# tentaflake documentation

> tentaflake is a generic NixOS flake template for running isolated Hermes and ZeroClaw agents with explicit security and operations boundaries.

Documentation version: 0.4.0
Pinned source: https://github.com/timfewi/tentaflake/tree/2081f31a099e7ec2741507c1411260fee2fbbc3c

## Start here

- [Documentation overview](https://docs.tentaflake.dev/)
- [Installation](https://docs.tentaflake.dev/getting-started/install/)
- [Quickstart](https://docs.tentaflake.dev/getting-started/quickstart/)
- [Threat model](https://docs.tentaflake.dev/security/threat-model/)

## Detailed guides

- [getting-started/install](https://docs.tentaflake.dev/getting-started/install/): Build the installer and provision a dedicated tentaflake host.
- [getting-started/quickstart](https://docs.tentaflake.dev/getting-started/quickstart/): Reach a secure first agent deployment on an installed host.
- [concepts/architecture](https://docs.tentaflake.dev/concepts/architecture/): Architecture, scope, modules, and consumption model for tentaflake.
- [configuration/agents](https://docs.tentaflake.dev/configuration/agents/): Define Hermes and ZeroClaw agents declaratively.
- [configuration/secrets](https://docs.tentaflake.dev/configuration/secrets/): Encrypt and deliver agent credentials with Agenix.
- [configuration/brokered-egress](https://docs.tentaflake.dev/configuration/brokered-egress/): Route provider traffic through an explicit broker boundary.
- [configuration/disposable-worker](https://docs.tentaflake.dev/configuration/disposable-worker/): Run host tool work in a disposable worker behind approval.
- [configuration/workspace-quota](https://docs.tentaflake.dev/configuration/workspace-quota/): Bound and migrate persistent agent workspaces.
- [operations/cli-shell](https://docs.tentaflake.dev/operations/cli-shell/): Use the operator shell and tentaflake CLI.
- [operations/agent-management](https://docs.tentaflake.dev/operations/agent-management/): Manage agent lifecycle and routine operator workflows.
- [operations/recovery](https://docs.tentaflake.dev/operations/recovery/): Operate, troubleshoot, and recover a tentaflake host.
- [operations/tailscale](https://docs.tentaflake.dev/operations/tailscale/): Apply a narrow Tailscale management-plane policy.
- [operations/observability](https://docs.tentaflake.dev/operations/observability/): Enable metrics, logs, dashboards, and runtime detection.
- [security/profiles](https://docs.tentaflake.dev/security/profiles/): Choose and migrate between tentaflake security profiles.
- [security/threat-model](https://docs.tentaflake.dev/security/threat-model/): Review assets, adversaries, trust assumptions, and mitigations.
- [security/reporting](https://docs.tentaflake.dev/security/reporting/): Report vulnerabilities and understand supported release policy.
- [reference/skills](https://docs.tentaflake.dev/reference/skills/): Find the bundled operational and Hermes skills.
- [reference/fork-checklist](https://docs.tentaflake.dev/reference/fork-checklist/): Adapt the generic template safely in a deployment fork.
- [reference/changelog](https://docs.tentaflake.dev/reference/changelog/): Review historical and current user-facing changes across tentaflake releases.