Reference on ZTD — Zero Trust Dev

Commands

Mon, 01 Jan 0001 00:00:00 +0000

Commands

Everything is driven through ztd <verb>. ztd is a Go (Cobra) binary with its runtime assets embedded, so an installed copy needs no source checkout — see Install. The tables below spell it ./ztd, which is the shim in a source checkout: it builds the binary and execs it, pointing it at the live tree so script edits take effect without a rebuild. If you installed ztd, drop the ./ — nothing else differs.

Configuration

Mon, 01 Jan 0001 00:00:00 +0000

Configuration

.ztd/ztd.toml is the ONE file you edit. Every dependency’s config — Terraform variables, the lima instance YAML, cloud-init, the compose env — is generated inside the ztd binary from ztd.toml + built-in defaults. There is no terraform.tfvars, no lima/cloud-init/compose file you ever touch directly. Secrets live separately in .ztd/secrets/*.env (gitignored) — never in ztd.toml, which is meant to be committed.

Scaffold it with:

ztd init

This writes .ztd/ztd.toml with every key commented out — an all-defaults project boots as-is; uncomment only what you want to change.

Backends

Mon, 01 Jan 0001 00:00:00 +0000

Backends

A backend is a stable contract — inputs (name, size, image, cloud-init, repo-sync mode, ports) and outputs (a reachable SSH endpoint, instance id). Most backends implement it as a Terraform module; the macOS vz backend implements it host-side with lima instead (no usable Terraform provider, and it drives Virtualization.framework on the host). The same interface drives every backend; only TARGET changes.

Backend	Status	Notes
`kvm` (libvirt)	available	Local Linux host. `dmacvicar/libvirt` 0.9.x; repo live-mounted over virtiofs.
`proxmox` (bpg)	validated	Remote node; cloud-init uploaded as a snippet.
`ec2` (aws)	validated	AWS instance; Debian AMI auto-looked-up; public IP is a real Terraform output. See the EC2 how-to.
`vz` (Apple Virtualization)	available	macOS local via `lima` — host-side (not Terraform); reached over lima’s forwarded SSH port. See the vz how-to.
`hetzner` / `digitalocean` / `vultr`	planned	Same contract.
`verda`	planned	GPU cloud, for GPU agent workloads.

libvirt version pin

The kvm backend pins dmacvicar/libvirt to ~> 0.9.8 — the raw-XML schema (devices, os, memory_backing as attributes), which the module needs for native virtiofs. Note 0.9.x exposes no computed guest IP, so ztd reads it from the libvirt DHCP lease via virsh rather than a Terraform output.

Host prerequisites

Mon, 01 Jan 0001 00:00:00 +0000

Host prerequisites

ZTD keeps the host footprint minimal: all orchestration tooling (Terraform, providers, Task) runs in the toolbox container. The only thing that can’t be containerized is a hypervisor for a local VM — and that is “the VM” itself.

Backend	Host needs
`kvm` (local Linux)	Docker + libvirt/qemu + `virtiofsd`
`vz` (local macOS)	Docker + Virtualization.framework (via `lima`)
`proxmox` / `ec2` (remote)	Docker only

virtiofsd relays the repo live-share into the guest (it runs as root and reflects the guest uid to the host owner, so files created in the VM are owned by you on the host).