Guide
The mental model behind yoink: read once, then come back to how-to and reference for specifics.
The mental model. Read this once; come back to how-to / reference for the rest.
How it works
Drift detection, deploy lock, spec_hash, dependency-ordered waves, healthcheck-gated rolling swap.
Three deploy modes
CI-built, local-build push-then-deploy, registry-less standalone.
Security
Hardened defaults — cap_drop=ALL, read-only rootfs, no-new-privileges. Plus the `devices:` escape hatch for GPUs / FUSE / USB.
Reverse proxy
Bundled Caddy. One field exposes a service over HTTPS with Let's Encrypt or sealed Cloudflare origin certs. Caddy snippets cookbook included.
Networking
Tailscale + SSH connectivity, multi-host distribution (`replicas` + pinned hosts), and `yoink pf` for debugging without publishing ports.
Secrets
age-sealed secrets in the repo (the default) plus `provider: command` recipes for sops / Doppler / Vault / 1Password / AWS SM / Infisical / Bitwarden.
Templates (`yoink add`)
Drop-in service fragments with sealed secrets. How to use the bundled set, and how to author your own.
Driving yoink from an AI agent
CLI + YAML, no GUI, deterministic exit codes. Patterns for Claude Code, Cursor, Aider, GitHub Copilot Workspace.