# Fork checklist

> Adapt the generic template safely in a deployment fork.

Canonical page: https://docs.tentaflake.dev/reference/fork-checklist/

> Source: [`docs/05-fork-checklist.md`](https://github.com/timfewi/tentaflake/blob/e21be475a3afc6e95c5087003edd0b7f780e4df4/docs/05-fork-checklist.md) at `e21be475a3af` · docs version **0.4.37**

Change deployment-specific values in a fork, never in the generic template.

| What | Template location |
|---|---|
| Host and admin defaults | `lib/constants.nix` |
| Host modules | `flake.nix` |
| Agent definitions | `my-agents.nix` |
| Runtime secret paths | Host broker, backup and optional profile declarations; direct-agent paths are dev-only |
| SSH keys | `tentaflake.adminAuthorizedKeys` |
| Timezone and locale | `tentaflake.*` options |

The Rust package name and workspace live in `Cargo.toml` and
`crates/tentaflake-cli/Cargo.toml`. If a fork renames the project, update those
manifests, the Nix package wrapper, CLI paths, documentation, and tests together.

## Pinning

The repository tracks `nixos-unstable` at the exact revision in `flake.lock`.
Update deliberately, review the lock diff, and rerun the flake and VM checks.
Do not weaken package security policy merely to retain an old pin.

## Secrets

Create encrypted secret declarations in the fork. Keep the decryption identity
off-host in a protected recovery location. Literal secret values must not enter
Nix expressions, JSON, Git, logs, or build outputs.

## Backend choice

Docker is the default. Under `balanced`, the operator is deliberately not in
its root-equivalent group; narrow CLI actions use sudo. `dev` retains group
access for compatibility. Podman does not add that group, but root-managed
systemd containers and the operator's rootless store are separate. Verify CLI
behavior against the selected backend.

## Security profile

Keep the installed default `balanced` for an untrusted 24/7 workload. It is
fail-closed and has no external connectivity until an exact per-agent broker
policy is declared.
Select `dev` only when a trusted development workflow explicitly needs direct
env credentials, host networking, ports, or mutable local images. `strict`
currently fails evaluation and must not be advertised as deployed.

Enable and migrate to `tentaflake.workspaceQuota.agents.<container>` for every
persistent controller workspace that needs a hard ceiling. The generic module
uses an exact-size Btrfs backing image and refuses to hide existing non-empty
data; runtime-specific state outside the workspace still needs capacity
monitoring.

## Optional profiles

Import observability or Falco only when the deployment needs them. Keep editor,
Hive Research and speech integrations in the consumer flake. Web/research uses
the core [secure research transport](https://docs.tentaflake.dev/configuration/research/). Each optional integration
has a separate package,
credential, network, or privilege boundary; see
[observability and detection](https://docs.tentaflake.dev/operations/observability/).