---
layout: two-cols
class: 'restaurant bg-photo'
---
# The Restaurant
Every restaurant has at least three actors.
| Restaurant | Infrastructure |
|---|---|
| Guest declares
1. **Hardcoded** โ everything inside the binary. Full control. Zero flexibility.
2. **External config (JSON)** โ works between machines. Unreadable for humans at scale.
3. **YAML / TOML** โ more readable. Fragile syntax. Implicit types. Silent errors.
4. **YAML + Serde** โ Serde validates the *structure*:
- Does the field exist? Is it the right type?
- Do we accept `"elephant"` as a pet? If the type is `String`... yes.
- **Serde validates shape. Not meaning.**
5. **Helm / Jinja templates** โ YAML generated from variables (in YAML).
- Does it validate the content of the generated YAML? **No. Not at all.**
- Like using an LLM with a markdown reference: the format is there,
but is the content correct?
Nobody guarantees that.
---
layout: cover
background: ./3XXSKa4jKaM.webp
---
Nobody guarantees that.
๐ก โโโโโ ๐ด โโโโโ ๐ฅ โโโโโ
---
class: items-list
---
# Three Questions Without Answers
Question 1 โ
โ Why do we wait for things to break?
- "Works on my machine" โ in production, I don't know
- Fail late = maximum cost. We want: fail fast, fail cheap
Question 2 โ
โ Do we actually know what we want?
- Is the declaration sufficient and consistent with what's *possible*?
- What are the boundaries? Static or dynamic? What is the source of truth โ and when does it mutate?
Question 3 โ
Can we guarantee determinism ?
- CI/CD without semantic validation = continuous hope
- We want certainty, not randomness
- "Works on my machine" cannot be the production standard
> *We're not inventing anything new. Everything already exists.
> The question is whether we're managing it correctly.*
---
layout: cover
background: /jr-korpa-vg0Mph2RmI4-unsplash.jpg
---
---
layout: cover
background: andrew-neel-jtsW--Z6bFw-unsplash.jpg
---
๐ก โโโโโ ๐ด โโโโโ ๐ฅ โโโโโ
---
layout: section
---
Rust
The answer to all three questions
---
# The Bridge: From Serde to Types
Serde loads structurally valid config.But `"elephant"` as `pet: String` compiles. **Rust's answer: don't use `String`. Use a type.** ```rust // Before: String โ anything goes pet: String // "elephant" compiles. "unicorn" compiles. ๐คท // After: closed domain โ impossible values don't exist enum Pet { Dog, Cat, Rabbit } // "elephant" doesn't compile ``` **This is the shift.**:
Not the config format. The model of what it can contain.
Serde validates shape | Types validate meaningThe compiler validates *before the binary exists*.
--- # What Rust Gives Us
Answer to Question 1: fail early, fail cheap
```rust
// Immutability by default โ invariants are invariants
let config = load_config()?; // cannot change silently
// OptionAnswer to Question 2: explicit contracts
```rust
// Traits define what every actor in the chain must fulfill
#[async_trait]
pub trait TaskStorage: Send + Sync {
async fn create_task(&self, task: WorkflowTask) -> StorageResultAnswer to Question 3:
guaranteed determinism
```rust
// Closed domain โ you can't forget a case
enum RollbackStrategy {
ConfigDriven,
Conservative, // preserve unless marked deletion
Aggressive, // revert all changes
Custom { operations: Vecmemory, resources, workflows
The compiler is the waiter who validates the order.
Before it reaches the kitchen.
Before the guest waits.
Before any ingredient is missing.
---
layout: cover
background: clouds_lpa.jpg
---
Before it reaches the kitchen.
Before the guest waits.
Before any ingredient is missing.
--- layout: cover background: /jude-infantini-mI-QcAP95Ok-unsplash.jpg ---
๐ก โโโโโ ๐ด โโโโโ ๐ฅ โโโโโ
---
layout: section
---
In Production
This is not theory
---
layout: center
name: provisioning
---
๐
---
layout: two-cols
---
# Nickel
**YAML rejected. TOML rejected.Reason: no type safety.** YAML wrote what we wanted.
It couldn't say what was *possible*.
Nickel closes that gap
โ at config time, not at 3 AM. ```haskell # Infrastructure schema # โ validated at config compile time { compute | { region | String, count | Number & (fun n => n > 0), scaling | { min | Number & (fun n => n > 0), max | Number & (fun n => n >= min), # -- compiler verifies this relationship } } } ``` ::right:: # Typed Source of Truth Result (ADR-003):
**zero configuration type errors in production.** Config hierarchy:
defaults โ workspace โ profile โ
environment โ runtime
Each layer merges.
Type system catches conflicts.
At config time โ not deployment time. The guest wrote an impossible order.
Nickel makes impossible orders unwritable. > *Serde validates shape.* > > *Nickel validates meaning.* > > *The compiler validates before deployment.* --- layout: two-cols --- # Traits as Provider **The kitchen can change.
AWS โ UpCloud โ bare metal. Same menu.** ```rust // Every provider implements the same contract enum DependencyType { Hard, Soft, Optional } enum TaskStatus { Pending, Running, Completed, Failed, Cancelled } // Dependency resolution // โ the orchestrator knows the order // Installing Kubernetes: // containerd (Hard) โ etcd (Hard) โ kubernetes // โ cilium (requires kubernetes) // โ rook-ceph (requires cilium) ``` **Explicit state โ no drift:** ```rust pub struct WorkflowExecutionState { pub task_states: HashMap
- Checkpoint every 5 minutes - No implicit state. > No *"the waiter remembers the customer doesn't want salt."* - It's in the order. Always. Explicit. --- layout: two-cols class: -mt-7 --- # Dependency Graph **Fail_fast: bool is not a config option.
It's a principle encoded as a type.** Typed DAG โ dependency resolution enforced
at workflow compile time: The kitchen doesn't serve the main course
before the starter is done.
`DependencyType::Hard` is that rule.
In the type system, not in a runbook. ```rust pub struct WorkflowConfig { pub max_parallel_tasks: usize, pub task_timeout_seconds: u64, // halt on first failure pub fail_fast: bool, // recovery point granularity pub checkpoint_interval_seconds: u64, } containerd (Hard) โ etcd (Hard) โ kubernetes โ cilium (requires: kubernetes) โ rook-ceph (requires: kubernetes + cilium) ``` ::right:: # Fail Fast, Fail Cheap
- `DependencyType::Hard`
- failure stops the chain. Always. - `DependencyType::Soft`
- continues, explicitly degraded. - `DependencyType::Optional`
- missing is expected and fine.
> *The compiler catches the install order.*
> *Not the on-call engineer at 2 AM.* --- layout: two-cols --- # Real Applications ### Kubernetes The orchestrator provisions cluster
components as a typed workflow: ``` containerd โ etcd โ kubernetes control plane โ CoreDNS โ Cilium (CNI) โ Rook-Ceph (storage) ``` Each dependency is a `DependencyType`.
The compiler catches:
installing Cilium without Kubernetes.
Not the on-call engineer at 2 AM.
>*"In my machine it works" has a price here.* > > *This is the highest-stakes infrastructure in the deck.* ::right:: ### Blockchain Validators Validators require brutal uptime.
A validator that fails loses funds โ not your infrastructure's money.
**Your customer's.** - **Post-quantum cryptography**: CRYSTALS-Kyber + Falcon + AES-256-GCM hybrid. Validator keys protected against quantum computers. - **SLOs with real error budgets**: 99.99% = 52.6 min downtime/year. Prometheus blocks deploys when burn rate exceeds budget. - **Deterministic config**: validator parameters are types. A `bond_amount` that isn't a valid `u128` doesn't compile. --- layout: two-cols --- # Disaster Recovery **Rollback as a type, not a procedure** 3 AM. Something broke. You need to rollback.
Without types: you improvise.
With types: you choose a strategy
โ or it doesn't compile. ```rust // Checkpoint = complete system snapshot pub struct Checkpoint { pub workflow_state: Option
**Multi-backend backup:** restic, borg, tar, rsync
โ all as enum variants.
Production backup and DR restore use the same type, the same schema. > *The runbook exists.* > > *Nobody reads it clearly at 3 AM under pressure.* > > *The type forces the decision before the crisis.* > > *The state is the same in prod and in DR. Always.* --- layout: two-cols --- # Self-Healing
> **When something breaks at 3 AM**
> โ **the system responds, not you.**
```rust enum RemediationAction { ScaleService { service: String, replicas: u32 }, FailoverService { service: String, region: Region }, RestartService { service: String }, ClearCache { service: String, scope: CacheScope }, } // Typed playbooks. Not shell scripts. Not hope. // Fails 3 times โ escalates to human. // Never loops indefinitely. ``` ::right:: # โ Typed Remediation
**What happens at 3 AM:** - Alert fires
โ `RemediationEngine` matches condition
โ runs `RestartService`
- Works: silent. Nobody woken up.
- Fails 3ร: page sent
โ with full state, checkpoint,
and execution history.
> *You wake up to information. Not to chaos.* --- layout: cover background: /jude-infantini-mI-QcAP95Ok-unsplash.jpg class: photo-bg ---
๐ก โโโโโ ๐ด โโโโโ ๐ฅ โโโโโ
---
layout: two-cols
---
Why This Matters
For everyone in this room
---
layout: two-cols
---
# For You