aieng-platform-onboard

AI Engineering Platform

---

Infrastructure and tooling for AI Engineering bootcamps, providing secure, isolated development environments and automated participant onboarding.

Overview

This platform consists of the following components:

1. Coder Deployment - Containerized development environments supported by Coder
2. Participant Onboarding System - Secure, automated participant onboarding

---

1. Coder Deployment for GCP

The coder folder contains all resources needed to deploy a Coder instance on Google Cloud Platform (GCP), along with reusable workspace templates and Docker images for the workspace environment.

Structure

• deploy/ - Terraform scripts and startup automation for provisioning the Coder server on a GCP VM
• docker/ - Dockerfiles and guides for building custom images used by Coder workspace templates
• templates/ - Coder workspace templates for reproducible, containerized development environments on GCP

Usage

1. Provision Coder on GCP - Follow the steps in coder/deploy/README.md
2. Build and Push Docker Images - See coder/docker/README.md
3. Push Workspace Templates - See coder/templates/README.md

---

2. Participant Onboarding System

Automated API key distribution for bootcamp participants using GCP Secret Manager and workload identity.

• Secrets never written to disk — exported into the shell via eval "$(onboard ...)"
• Workspace VMs authenticate directly to Secret Manager via workload identity (no Firebase, no token service)
• Per-participant JSON secrets named {bootcamp-name}-env-{github-handle}
• Firestore tracks participant records and onboarded status

Architecture

Admin Phase
  1. Setup participants/teams in Firestore
  2. Generate API keys (Gemini, Langfuse, etc.)
  3. onboard admin setup-secrets  →  creates per-participant Secret Manager secrets
  4. Grant workspace SA roles/secretmanager.secretAccessor
  5. Add users to GitHub org

Participant Phase
  1. eval "$(onboard --bootcamp-name <name>)"  in Coder workspace
  2. Fetches env vars from Secret Manager via workload identity
  3. Runs integration tests (env vars injected, nothing written to disk)
  4. Marks participant as onboarded in Firestore

---