# Provisioning page — Infrastructure Orchestration Platform

# Hero
provisioning-badge = v3.0.11 | Production Ready
provisioning-tagline = Provision at Scale
provisioning-page-title = Infrastructure Orchestration With Configuration as Code
provisioning-page-subtitle = Declarative infrastructure management with Nickel schemas, Nushell orchestration, and Rust executables. Type-safe configuration, automated validation, and cloud-native deployment across Kubernetes, Docker, and custom platforms. 100% infrastructure as code.

# Core Capabilities
provisioning-capabilities-title = Core Capabilities
provisioning-cap-1-title = Type-Safe Configuration
provisioning-cap-1-desc = Nickel provides formal type checking, automated validation, and recursive merging for infrastructure definitions. Eliminate configuration drift and parsing errors.
provisioning-cap-2-title = Intelligent Orchestration
provisioning-cap-2-desc = Nushell scripts orchestrate complex deployment workflows with structured data pipelines, state management, and error recovery. Built-in type system prevents runtime failures.
provisioning-cap-3-title = Multi-Platform Support
provisioning-cap-3-desc = Deploy to Kubernetes, Docker Compose, local VMs, and custom infrastructure. Unified interface with platform-specific overrides and workspace isolation.
provisioning-cap-4-title = Version Control Ready
provisioning-cap-4-desc = All infrastructure lives in Git. Configuration schemas, Nickel modules, and Nushell scripts are versionable, reviewable, and rollbackable.

# How It Works
provisioning-how-title = How It Works
provisioning-how-nickel-title = Define with Nickel
provisioning-how-nickel-desc = Write declarative infrastructure schemas with full type safety. Nickel's lazy evaluation and recursive merging enable powerful abstractions and configuration composition.
provisioning-how-nushell-title = Orchestrate with Nushell
provisioning-how-nushell-desc = Structured data pipelines, type-safe operations, and stateful workflows. Nushell eliminates shell script fragility while maintaining scripting simplicity.
provisioning-how-rust-title = Execute with Rust
provisioning-how-rust-desc = Performance-critical operations backed by Rust. Zero-cost abstractions, memory safety, and fearless concurrency for infrastructure tooling.
provisioning-how-nats-title = Coordinate via NATS JetStream
provisioning-how-nats-desc = Persistent event bus for decoupled service coordination. Services exchange lease_id, task_id, and status events — credentials never traverse the bus. Auditable, replay-capable, at-least-once delivery.
provisioning-how-security-title = Secure end-to-end
provisioning-how-security-desc = Cedar policy-as-code for authorization, JWT sessions managed exclusively by ControlCenter, and post-quantum cryptography via SecretumVault. Credentials never leave the vault — services operate on lease references only.
provisioning-how-oci-title = Extend via OCI Registry
provisioning-how-oci-desc = Distribute custom providers, task services, and cluster definitions as OCI artifacts. The Extension Registry catalogs and versions capabilities independently — swap or compose providers without touching core platform code.
provisioning-how-cli-title = Platform CLI & External Services
provisioning-how-cli-desc = 8 platform subcommands (list, status, health, check, config, connections, init, start) with declarative external service management. Validates SurrealDB, OCI registries, Git sources, and cache before startup.
provisioning-how-versions-title = Centralized Version Management
provisioning-how-versions-desc = All tool and provider versions defined in Nickel schemas. Automatic provider discovery, shell script integration, and single source of truth for Nushell, Nickel, SOPS, Age, AWS CLI, and all providers.

# SOLID Architecture Boundaries
provisioning-solid-title = SOLID Architecture Boundaries
provisioning-solid-provider-title = Provider APIs — Orchestrator only
provisioning-solid-provider-desc = All hcloud, AWS, and provider SDK calls are isolated to the Orchestrator crate. Every other service routes through the Orchestrator HTTP API. SSH operations share this same boundary.
provisioning-solid-auth-title = Auth decisions — ControlCenter only
provisioning-solid-auth-desc = JWT validation and Cedar policy evaluation happen exclusively in ControlCenter. Other services receive a UserContext via middleware — no service re-validates tokens or evaluates policies directly.
provisioning-solid-secrets-title = Secrets — Vault Service API only
provisioning-solid-secrets-desc = Credentials are never stored in NATS messages or environment variables. Services hold a lease_id and retrieve actual secrets via HTTPS to the Vault Service. The bus carries references, not values.

# Architecture diagram
provisioning-architecture-title = System Architecture

# Tech stack
provisioning-tech-stack-title = Technology Stack

# Platform Services
provisioning-services-title = Platform Services (13)
provisioning-svc-orchestrator-role = Provider APIs + SSH boundary
provisioning-svc-controlcenter-role = Cedar auth boundary
provisioning-svc-controlcenter-ui-role = Leptos WASM dashboard
provisioning-svc-mcp-server-role = RAG + AI tools
provisioning-svc-ai-service-role = LLM inference layer
provisioning-svc-extension-registry-role = Extension catalog
provisioning-svc-secretumvault-role = PQC secrets API
provisioning-svc-detector-role = Event detection
provisioning-svc-daemon-cli-role = Service lifecycle
provisioning-svc-machines-role = Machine management
provisioning-svc-observability-role = Prometheus metrics
provisioning-svc-backup-role = State backup
provisioning-svc-encrypt-role = Key operations

# CTA
provisioning-cta-title = Ready for infrastructure automation?
provisioning-cta-subtitle = Built with Nickel & Nushell | Rust | Type-Safe | Open Source
provisioning-cta-explore = Explore Git Repo