How-to — yoink

Task-oriented walkthroughs — pick the one that matches what you are trying to accomplish.

Task-oriented walkthroughs. Each how-to takes you from "I want X" to "X is running in production." Pick the one that matches what you're trying to accomplish; for the deeper "how does this work" content, see the Guide.

Hetzner cx23 quickstart with HTTPS

Empty Hetzner project → live HTTPS endpoint in ~90 seconds. €3.99/mo cx23, AGE-sealed deploy key, real Let's Encrypt cert via `<ip>.nip.io`.

TanStack Start + postgres from scratch

End-to-end: scaffold the app, add postgres via `yoink add`, deploy, verify with `yoink pf`.

Volume backups + postgres PITR

Nightly restic snapshots to any S3 (or self-hosted RustFS over Tailscale) plus postgres WAL archiving for point-in-time recovery.

Cloudflare Origin Certificates

Skip Let's Encrypt — 15-year cert + origin-pull mTLS that locks your origin to Cloudflare's edge.

Defense-in-depth web serving

No-license-fee hardened stack — Cloudflare Free + CrowdSec + Coraza + Origin Certs. The architecture, the gotchas, and the honest cost.

Caddy plugins (xcaddy, no registry)

`proxy.xcaddy.plugins:` builds a custom caddy on each host with rate-limit, l4, redis-storage, third-party DNS providers — no registry required.

Hosting gRPC backends

`upstream_h2c: true` for native gRPC (Tonic, grpc-go, grpc-java) — covers REST too.

Sealed secrets workflow

Generate the AGE keypair, seal values, consume them, multi-env, backup, and rotation — the operator-side commands.

Standalone (no-registry) deploys

`yoink up --build` ships images straight to each host over SSH. Layer-level dedup via the bundled unregistry transport; tarball fallback for air-gapped.

Adding a service via `yoink add`

Pick a vetted template (postgres, redis, meilisearch, …), answer prompts, get a sealed-secret-having service fragment in your repo.

Caddy snippets cookbook

Forward auth, basic auth, IP allowlist, custom headers, body-size limit, redirects, maintenance page — both Caddyfile and JSON forms.

AGE secrets in GitHub Actions

Generate a CI-only identity, paste into a GitHub secret, deploy. One env var.

Multi-host Let's Encrypt with Redis

Share ACME state across hosts to avoid Let's Encrypt rate limits.

Run staging alongside prod

Same hosts, two configs, namespaced services + networks.

Self-hosted registry on a yoink host

Run registry:2 as a yoink service, expose via tailnet, push to it.

Pre-merge dry-run on every PR

Sticky GitHub PR comment showing what `yoink up` would change before the merge.

Edit-save-deploy with --watch

`yoink up --watch --build` polls the config and redeploys on save. Hot-reload for prod-like dev without CI.

Edit container files with `yoink vscode`

VS Code in your browser, rooted in a running container's live filesystem. No operator install — just SSH and a browser.