A moon monorepo.
Private source lives in private/ directories and is encrypted in place with
git-crypt, so the repository stays public
without exposing it.
Runtime secrets are a separate concern and never enter the repository at all:
.env and env.sh are ignored, and CI reads credentials from GitHub Actions
secrets.
| Path | Holds |
|---|---|
apps/ |
Deployable frontends (Astro, game clients) |
services/ |
Deployable backends (Rust crates, workers) |
packages/ |
Shared TypeScript libraries |
crates/ |
Shared Rust libraries |
tools/ |
Internal CLIs and scripts |
infra/ |
Deploy manifests, Docker, CI helpers |
docs/ |
Documentation |
packages/protobuf/ |
Protobuf schemas — source of truth for every wire type |
The repository is public. Anything under a private/ directory at any depth is
encrypted in place by git-crypt, so a Godot project keeps its game logic, core
systems and shaders in godot/private/ while vendored addons stay outside it —
they are third-party OSS and encrypting them would hide upstream diffs.
Encryption is not retroactive. A file committed before it matched a rule
keeps its plaintext in history forever, and git-crypt status reports on the
working tree rather than on history, so it will call that file encrypted. A
pre-commit hook checks the staged blob instead and refuses the commit; it is
generated by moon sync vcs-hooks into .moon/hooks.
That hook directory is pointed at by core.hooksPath, which replaces
.git/hooks rather than adding to it, so the Git LFS hooks are declared in
.moon/workspace.yml alongside it. Removing them there stops pre-push from
uploading LFS objects: pointers push, blobs do not.
proto use # installs node, pnpm, rust, moon from .prototools
git-crypt unlock <your git-crypt key>
pnpm install
moon run protobuf:build # generates ts/rust/csharp/python from the schemas
The generate step is not optional. packages/protobuf/gen is not committed,
and @kbve/protobuf points at it, so until it exists the editor reports
Cannot find module '@kbve/protobuf/...' and every type from it degrades to
any. moon run <project>:check does the same thing as part of the graph.
moon check --all # build + test + lint every affected project
moon run :build # run the `build` task in every project
moon run <project>:<task> # run one task
moon query projects # list the project graph
Create the directory under the right root, add a moon.yml declaring its
type/language, and it is picked up by the globs in .moon/workspace.yml.
Node projects inherit tasks from .moon/tasks/node.yml, Rust from
.moon/tasks/rust.yml.