Skip to content
dabba

Quickstart

A few minutes from clone to a working platform on a local kind cluster — no cloud account, no secret manager, nothing to sign up for.

Requirements

Section titled “Requirements”

dabba drives Docker, OpenTofu, and kubectl, so they need to be on your PATH — dabba doctor checks for them.

Install the CLI

Section titled “Install the CLI”
Terminal window
curl -fsSL https://raw.githubusercontent.com/spice-labs-inc/dabba/main/install.sh | bash

On Windows, use irm https://raw.githubusercontent.com/spice-labs-inc/dabba/main/install.ps1 | iex. To build from source instead: cargo install --git https://github.com/spice-labs-inc/dabba.

The installer also sets up shell completions. (dabba completions <bash|zsh|fish|powershell> prints a completion script if you’d rather wire it up yourself.)

Bring it up

Section titled “Bring it up”
Terminal window
git clone https://github.com/spice-labs-inc/dabba.git
cd dabba
dabba up -c examples/local.yaml

dabba up doesn’t report success until the platform has reconciled. If a layer fails, it tells you which one and why.

What you get

Section titled “What you get”
  • https://podinfo.localtest.me:31443 — the demo app. Its banner was written into OpenBao and delivered to the app by External Secrets, so seeing it confirms the chain (gateway → TLS → External Secrets → OpenBao → gitops) works end to end.
  • https://bao.localtest.me:31443 — the OpenBao UI.

*.localtest.me resolves to 127.0.0.1, so there’s nothing to add to /etc/hosts. TLS uses a self-signed CA, so your browser will warn — that’s expected locally.

Credentials

Section titled “Credentials”

dabba ships no default credentials — everything is generated per-environment. Most secrets live in OpenBao and are addressed by their path; retrieve them with the CLI:

Terminal window
dabba secret ls                  # list what's in OpenBao
dabba secret get dabba/forgejo   # the Forgejo admin login (vault path secret/dabba/forgejo)
dabba secret get demo/podinfo    # the demo app's banner secret

The one exception is the OpenBao root token — the key to the vault, so it can’t live inside it. dabba keeps it in a local per-env stash; fetch it with the keyword form:

Terminal window
dabba secret get local/openbao-root    # from .dabba/<env>/, not from OpenBao

Look at it

Section titled “Look at it”
Terminal window
dabba status        # health, declared-vs-live, component versions, endpoints
dabba diagram       # the live topology as an ASCII diagram (--mermaid to embed)

Tear down

Section titled “Tear down”
Terminal window
dabba down -c examples/local.yaml

The default config also ships k3d and minikube environments — dabba ls lists them, and dabba env k3d up brings up a different one.