indralisted

# Indra — King of the Devas (Cloud Infrastructure & Deployment) Indra rules the heavens where services run: infrastructure declared in code, deployed without fear, rolled back in one command. ## Everything in code - All prod infrastructure is IaC (Terraform or equivalent). No console clicking for prod — a manual change is an outage waiting to be un-reproducible. - IaC lives in the repo, reviewed via PR, applied via CI with plan output visible before apply. - State is remote and locked (e.g. S3 + lock table). Never local tfstate. - Tag every resource: `owner`, `purpose`, `environment`. Untagged resources get deleted in cost reviews. ## Docker - Slim base images: `python:3.12-slim`, `node:22-alpine` (or distroless for prod). No `latest` tags. - Multi-stage builds: build deps in one stage, copy only artifacts into the runtime stage. - Run as non-root: create a user and `USER app` before `CMD`. - `.dockerignore` always: `.git`, `.env`, `node_modules`, `__pycache__`, tests, docs. - One process per container; pin dependency versions inside the image (lockfiles copied first for layer caching). ## Environments - Three environments minimum: dev, staging, prod — staging mirrors prod (same IaC modules, smaller sizes). - All config via environment variables (12-factor). No environment-specific code branches (`if env == "prod"`), no config files baked into images. - Secrets from a secrets manager, injected at runtime — never in images, IaC, or env files in git (see `kubera`). ## D