GREEN PACKAGE SKILL · Clojure · OpenTofu · Ansible

walter

Provision and operate one remote development machine, maintain its SSH alias, and power supported Oracle Cloud machines off and on.

Development machine
Five compute modes
Safe dry-run
MIT licensed

#Introduction

Walter turns a flat, reviewable colors.yml into one development machine. It provisions or adopts compute, writes a managed local SSH alias, installs Nix and terminal support, and optionally converges an editor, language runtimes, dotfiles, source checkouts, shell history, and agent credentials.

Safe first stepsbuild renders local files and create --dry-run prints the workflow without contacting providers. Review both before approving a real operation.

#Quick start

npx skills add getcolors/walter
cp .agents/skills/package-walter-green/green ./green
./green build
./green create --dry-run
# after explicit approval:
./green create
ssh <profile>

The installed root launcher is a copy of the skill payload. Re-copy it after every skill update.

#Workflow architecture

create/build   start ─ walter-compute ─┬─ walter-ansible-local
                                        └─ walter-ansible-remote ─ [walter-emacs-packages]

delete         start ─ walter-ansible-cleanup ─ walter-compute
stop/start      start ─ OCI power operation [─ local SSH refresh]

Every stage name is package-specific because it is also part of the remote-state key. The optional Emacs package stage starts a remote batch job and does not wait for it.

#Desired state

Area	Important keys
Identity	`profile`, `workdir`, `compute-prevent-destroy`
Providers	`provider-compute`: oci, hcloud, digitalocean, yandex, or no-infra; backend: local, s3, or r2
Workstation	`nix-packages`, `login-shell`, `asdf-tools`, `corepack-packages`
Personal setup	`emacs-config-repo`, `dotfiles-checkout`, `clone-orgs`, `atuin-username`
Agents	`seed-agent-credentials`: claude, codex, or pi

Optional keys should be omitted, not filled with placeholders. The complete contract is in the configuration reference.

#Compute and state providers

OCI authenticates through ~/.oci/config. Hetzner, DigitalOcean, and Yandex use COLORS_PAR_HCLOUD_TOKEN, COLORS_PAR_DO_TOKEN, and COLORS_PAR_YANDEX_TOKEN. no-infra configures an existing host.

Local state lives in generated output. S3 uses the ambient AWS chain; R2 uses COLORS_PAR_R2_ACCESS_KEY_ID and COLORS_PAR_R2_SECRET_ACCESS_KEY. Remote state is <profile>/walter-compute.tfstate.

#What the machine gets

Every machine receives Nix and a Ghostty terminfo entry. Optional blocks install one Nix profile, select a login shell, configure asdf and Corepack, clone the editor over the forwarded SSH agent, run a checked-out dotfiles Package Skill, clone public source repositories from named GitHub organisations, log into Atuin, and seed individual agent credential files.

Convergence protects working copiesRepository clones are created once and are not pulled or overwritten by later creates. Update them on the machine.

#Command reference

Command	Effect
`./green build`	Validate and render only
`./green create --dry-run`	Print the graph; no side effects
`./green create`	Provision and converge
`./green stop` / `start`	Power-cycle OCI only
`./green delete`	Guarded destruction

start reads the new address live and refreshes the SSH alias. Other compute providers report power verbs as unsupported no-ops.

#Generated files

.colors/<profile>/
├── walter-compute/
├── walter-ansible-local/
├── walter-ansible-remote/
└── walter-emacs-packages/   # only with Emacs configuration

This tree is regenerated. Never edit or commit it.

#Credentials and safety

Deletion removes the boot volumeKeep compute-prevent-destroy: true. Lift it only for one authorized command with COLORS_PAR_COMPUTE_PREVENT_DESTROY=false.

Never export COLORS_PAR_PROFILE.
Keep credentials in a private environment loader, never YAML.
Agent credential seeding copies one known file, uses no_log, and never copies session directories.
SSH agent forwarding avoids placing a private Git key on the machine.

#Troubleshooting

Stopped OCI machine stays stopped after create

Power state is not desired state. Run ./green start.

Emacs packages are missing

Inspect ~/.local/state/walter/emacs-packages.log; the package warm-up runs in the background.

A login shell cannot find Nix

Fish needs Walter’s generated nix.fish; one-shot SSH commands do not load login-shell profile scripts.