sns-network-solutions/infra/sns-digital/dev-environments.md

Development Environments — SNS Digital

Entity: SNS Digital · Status: Buildable now

What it is

Reproducible dev environments that can be spun up on Proxmox in minutes. No "works on my machine" — every project gets a defined environment.

Stack

Component	Software	FOSS	Role
Remote dev	SSH + VS Code Remote / Kiro CLI	Yes	Code on server, UI on laptop
Environment definition	Ansible roles	Yes	Reproducible provisioning
Ephemeral VMs	Proxmox cloud-init clone	Yes	Fresh VM per project/experiment
Containers (app deps)	Docker Compose	Yes	Databases, caches, queues for local dev
Language management	mise (formerly rtx)	Yes	Python, Node, Go version pinning per project

Patterns

Pattern 1: Remote VM (primary workflow)

Laptop (Kiro CLI / SSH)  ──────►  Dev VM on Proxmox
                                   ├── Project repo (git clone)
                                   ├── mise (.tool-versions)
                                   ├── Docker Compose (deps)
                                   └── Full Linux environment

When: Most development. Get a full Linux box with all tools, accessible from any device over Tailscale/WireGuard.

Build:

1. Clone Debian 12 template on Proxmox.
2. Run dev-workstation Ansible role:
   • Install: git, mise, docker, docker-compose, build-essential
   • Configure: user sam, SSH key, dotfiles
   • Set resource: 4 vCPU, 8GB RAM, 64GB disk (adjustable)
3. SSH in, mise install, docker compose up -d, start coding.

Pattern 2: Ephemeral project VM

When: Trying something risky, testing infrastructure changes, client-isolated work.

Build:

1. qm clone 9000 --name experiment-xyz --full
2. Work. Break things. Learn.
3. qm destroy <vmid> — gone, no cleanup.

Pattern 3: Local laptop (lightweight)

When: Quick edits, offline work, documentation.

Just Kiro CLI + SSH config. The heavy lifting happens on the remote VM.

mise Configuration (per-project)

# .mise.toml
[tools]
python = "3.12"
node = "20"
ansible = "latest"

[env]
VIRTUAL_ENV = ".venv"

Ensures every contributor (or future hire) gets the same versions without polluting the system.

Ansible Role: dev-workstation

# roles/dev-workstation/tasks/main.yml (key tasks)
- name: Install base packages
  apt:
    name: [git, curl, jq, tmux, htop, build-essential, unzip]

- name: Install Docker
  # Official Docker repo, not distro package

- name: Install mise
  shell: curl https://mise.run | sh

- name: Clone dotfiles
  git:
    repo: gitea:sam/dotfiles.git
    dest: /home/sam/.dotfiles

- name: Symlink dotfiles
  # .bashrc, .tmux.conf, .gitconfig

Security Posture

• Dev VMs are not production. They sit on the service VLAN but have no inbound ports open beyond SSH.
• No secrets in dev environments. Use .env.example + Vaultwarden lookups.
• Ephemeral VMs destroyed after use. No stale boxes accumulating.
• Docker socket access is the one elevated privilege — acceptable for dev, not prod.

Upgrade Path

• Devcontainers / Codespaces-like: If you hire devs who need browser-based IDEs, deploy code-server or Gitpod self-hosted on Proxmox.
• Nix flakes: For truly reproducible environments beyond what mise offers (full system-level deps). Higher learning curve.