This repository implements a Terraform provider for managing Incus, a container and virtual machine orchestration platform. It provides full CRUD operations for Incus resources such as instances, networks, storage pools, profiles, projects, certificates, cluster groups, and server configuration, along with corresponding data sources for reading existing state. The provider is built using the Terraform Plugin Framework (v1.19.0) with some fallback to Plugin SDK v2, and communicates with Incus via its client library (github.com/lxc/incus/v7). Key entry points include the main.go provider server, internal/provider/provider.go for resource registration, and individual resource files under internal/{certificate,cluster,image,instance,network,profile,project,server,storage}. The provider supports multiple remotes, OIDC authentication, clustering, and PKI, and includes a code generation tool (cmd/generate-datasources) that produces consistent data source implementations and documentation from a YAML configuration and Go templates. Acceptance tests require a live Incus environment and cover complex scenarios like instance lifecycle, exec triggers, file uploads, and import. The codebase is well-structured with shared utilities in internal/common for config/device/file/import handling, and demonstrates a consistent pattern for state synchronization and error handling. However, it carries some technical debt from its fork of the LXD provider, including dual SDK usage and heavy boilerplate that could benefit from further abstraction.
Protoconf is a configuration-as-code framework that uses protobuf schemas and Starlark (a Python dialect) to define, compile, and deliver configuration to services. In production, it operates as a multi-component system: a compiler that transforms Starlark config files into protobuf messages, an agent that serves compiled configs to applications via gRPC streaming, a server that handles config mutations (with git-based workflows and staged rollouts), and an inserter that pushes configs to key-value stores (Consul, etcd, Zookeeper, Kubernetes ConfigMaps). The architecture is modular with clear separation between compilation, storage, and delivery layers, all communicating via gRPC and protobuf. External dependencies include protobuf tooling, Starlark runtime, gRPC, and multiple KV store backends. The project also includes a web IDE (compiled to WASM) for browser-based config authoring and a Python client library for config consumption.
This repository is the infrastructure-as-code backbone for Security Onion, a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It contains over 1,700 files of SaltStack states, Jinja templates, shell scripts, and Python modules that orchestrate the deployment, configuration, and lifecycle management of a distributed grid of security monitoring nodes. The code manages the entire Elastic Stack (Elasticsearch, Logstash, Kibana), network sensors (Zeek, Suricata), file analysis (Strelka), endpoint monitoring (Elastic Fleet/Agent), authentication (Kratos/Hydra), messaging (Kafka/Redis), metrics (Telegraf/InfluxDB), and the Security Onion Console (SOC) web UI. It is not a standalone application but a deployment and configuration system that transforms a bare OS into a fully operational security operations center. The repository is actively maintained with frequent commits, versioned releases, and a large community. Key architecture patterns include role-based state inclusion via `allowed_states`, consistent Docker container management, Jinja-based configuration merging, and event-driven reactors for rule pushes. Notable reusable components include a self-contained threat intelligence analyzer framework, a YAML manipulation CLI tool, and polling-based beacons that avoid inotify leaks.
This repository is a comprehensive, declarative NixOS homelab configuration managed with the Clan framework. It defines the entire infrastructure for a multi-machine homelab including servers, desktops, and network devices, all version-controlled and reproducible. The system provisions self-hosted services (Caddy, Grafana, VictoriaMetrics, Vector, Blocky, Miniflux, Linkding, etc.), identity management (Authentik, Zitadel), monitoring and alerting, backup (Borgbackup), and desktop environments (KDE, i3). The architecture is modular: reusable NixOS feature modules under `modules/nixos/features/` follow a consistent pattern using `mkFeatureOptions` for enabling services with standardized options (domain, firewall, monitoring integration). Secrets are managed via SOPS with age encryption, and disk partitioning is handled by Disko templates. The repository is not a software application but an infrastructure-as-code project that demonstrates high craftsmanship in Nix module design, with clear separation of concerns, helper functions, and integration patterns. It is actively maintained but shows some technical drift due to deprecated identity providers and hardcoded IPs.
Digger (now OpenTaco) is an infrastructure-as-code orchestration platform that automates Terraform, OpenTofu, Terragrunt, and Pulumi workflows within existing CI/CD pipelines. The system provides PR-level automation (plan/apply comments), drift detection, policy-as-code via OPA, and an optional Terraform Enterprise-compatible state management and remote execution layer. It integrates with GitHub, GitLab, Bitbucket, Azure DevOps, and Buildkite through webhooks and CI backends. The architecture is a multi-service monorepo: a Go backend (Gin/GORM) handles webhooks, job scheduling, and a web UI; a separate CLI tool (cobra) runs directly in CI; a drift detection service with cron scheduling; a sandbox sidecar (TypeScript/Node) for remote execution; and the Taco service (Echo) that reimplements TFE APIs for state management, RBAC, and run execution. The UI is a React/TanStack Router app with WorkOS authentication. The codebase is actively maintained with frequent releases, extensive SQL migrations, Helm charts for Kubernetes deployment, and dual open-core and enterprise (ee/) feature sets.
This repository is the deployment system for Internet-in-a-Box (IIAB): an offline-first learning server for schools and communities without reliable Internet. It is an Ansible configuration-management application that installs and configures a complete local network stack — nginx reverse proxy, PHP-FPM, MySQL/PostgreSQL, hostapd WiFi access point, dnsmasq DNS/DHCP, Squid proxy, captive portal, Samba, CUPS — alongside a catalog of educational services such as Kiwix (offline Wikipedia/ZIM), Kolibri, WordPress, MediaWiki, Nextcloud, Gitea, JupyterHub, Moodle, Calibre-Web, and an offline OpenStreetMap/vector-tile mapping system with geocoding. Python, PHP, and Jinja2 templates generate systemd units, nginx virtual hosts, and app configs for every deployed service. Architecture is a staged Ansible pipeline: eleven role groups (0-init through 9-local-addons, then network) are driven from top-level playbooks (iiab-stages.yml, iiab-from-cmdline.yml) invoked by shell entry points (iiab-install, iiab-configure, iiab-network). Every role follows consistent conventions: defaults in defaults/main.yml, an install.yml and enable-or-disable.yml, boolean *_install/*_enabled flags validated up front with Ansible assert tasks, install state recorded in /etc/iiab/iiab_state.yml, and disk usage audited into iiab.ini. A custom Ansible module (get_curl) performs resumable/atomic downloads used across roles. Content provisioning is data-driven: maps and ZIM catalogs are generated (roles/maps/generate-catalog.py) and fetched at install time; offline search and geometry utilities (FQR, static_search.js) are bundled into the served front end. The project is actively developed (Ubuntu 24.04 and Raspberry Pi OS CI matrices, expected-state integration tests) but carries heavy legacy baggage: a large 0-DEPRECATED-ROLES tree, numerous .unused files, Python 2 support scripts, hardcoded versions/vendor URLs, plaintext default secrets, and fragile per-distro workarounds. The reusable gems — the custom download module, the tested geographic FQR geometry utility, the client-side static geocoder, the Ansible facts script, and the pdsm proot service manager — are isolated enough to extract into new projects. Overall it is a solid, professional infrastructure-as-code project with a few genuinely reusable components, tempered by significant accumulated technical debt.
This repository is a comprehensive guide and automation suite for setting up a production-like Kubernetes cluster on local machines (macOS/ARM64 and Linux/AMD64). It combines educational documentation with working bash scripts that automate the entire deployment process from VM provisioning to Kubernetes component installation. The codebase consists primarily of shell scripts for infrastructure automation (VM setup, network configuration, certificate generation, Kubernetes component deployment) and JSON/YAML configuration files for Kubernetes and TLS certificates. The architecture follows a multi-stage deployment pattern: host preparation → VM provisioning → security bootstrapping → control plane setup → worker node setup → cluster services installation. Key entry points include setupall.sh (master orchestration script), auth/genauth.sh (certificate generation), and various setup scripts for individual components (setupcontrol.sh, setupnode.sh, setupcluster.sh). The repository demonstrates solid DevOps engineering practices with idempotent scripts, proper error handling, and clear separation of concerns across different deployment stages.
This repository provides Terraform modules for managing Google Cloud SQL instances (MySQL, PostgreSQL, SQL Server) with features including backups, high availability, private networking, IAM authentication, and encryption. It follows a modular architecture where each database type and supporting feature (backup, restore, private service access) is implemented as a separate, reusable Terraform module. The root module is deprecated in favor of direct use of the submodules. Key entry points are the module directories (modules/mysql, modules/postgresql, etc.) and the examples directory which contains ready-to-run configurations for common deployment patterns. The system automates database lifecycle management through infrastructure-as-code, integrating with Google Cloud services like Cloud Workflows for backup scheduling, KMS for encryption, and Service Networking for private access. While the modules are well-maintained with frequent updates and comprehensive documentation, they exhibit tight coupling to Google Cloud-specific services and Terraform provider versions, limiting portability outside the GCP ecosystem.
StackMaster is a mature Ruby CLI gem for managing AWS CloudFormation stacks. It provides a rich command set (apply, diff, drift, delete, events, outputs, resources, status, validate, lint, nag, compile, tidy, init) and supports multiple template formats (JSON, YAML, ERB, SparkleFormation DSL, CfnDsl) through a pluggable compiler registry. A standout feature is the parameter resolution pipeline: 13+ pluggable resolvers (SSM Parameter Store, ACM certificates, AMI finders, stack outputs, 1Password, EJSON, environment variables, security groups, SSO group IDs) that fetch values at apply/compile time, making cross-account and cross-region stack composition practical. The architecture is cleanly modular — commands are standalone classes sharing a base module, template compilers and parameter resolvers are registered via simple registry interfaces, and the stack event streamer provides live sync feedback during updates. The codebase demonstrates solid engineering craftsmanship: a custom Erubis subclass generates CloudFormation Fn::Join arrays from ERB templates, a role assumer caches STS credentials per (account, role) and temporarily swaps Aws.config to support cross-account operations, and a generic PagedResponseAccumulator cleanly handles AWS SDK pagination. Test coverage is extensive — RSpec unit specs plus Cucumber/Aruba feature tests exercise every command and resolver against stubbed AWS responses, and a dedicated in-memory test driver (TestDriver::CloudFormation/S3) enables isolated testing without network calls. The changelog is meticulously maintained with per-release notes, and the gem supports a wide Ruby range (2.4–4.0). However, there are signs of accumulated technical debt: a large .rubocop_todo.yml exclusions list indicates code quality lapses, the codebase relies on autoload (deprecated in Ruby 3.2+), and heavy stubbing in tests may mask real AWS API integration regressions. Dependency pins on SparkleFormation (~> 3) and CfnDsl (~> 1) could become brittler as those upstream libraries evolve. This is a maintainer-mode tool — stable, well-documented, and battle-tested, but not rapidly evolving.
This repository provides the official Helm charts for deploying Mattermost, an open-source messaging platform, and its associated services (Focalboard, RTCD, Push Proxy, Calls Offloader) onto Kubernetes. The primary deployment method is the `mattermost-operator` chart, which uses Kubernetes Custom Resource Definitions (CRDs) to declaratively manage the full lifecycle of Mattermost installations, including databases, file stores, ingresses, and scaling. Legacy charts (`mattermost-enterprise-edition`, `mattermost-team-edition`) are included but deprecated in favor of the operator. The architecture is a collection of Helm charts, with the operator chart acting as the core. It relies on external dependencies like PostgreSQL, S3-compatible storage, and optionally Elasticsearch and Grafana. The repository demonstrates strong DevOps practices, including automated CI/CD for chart releases, end-to-end testing with kind, and embedded monitoring configuration. Key reusable patterns include a Helm-embedded Grafana dashboard template for application KPIs, an ExternalSecrets integration for secure credential management, a deprecation handling template for managing breaking changes, and advanced Kubernetes storage patterns (EFS, NFS). The codebase is actively maintained but carries some technical drift from legacy components and outdated Kubernetes API versions.
This repository is the Azure Enterprise-Scale (ALZ) reference implementation, providing infrastructure-as-code artifacts to deploy and govern multi-subscription Azure environments. It is not a runtime application but a deployment toolkit consisting of ARM templates, Bicep files, custom Azure Policy definitions/initiatives, custom role definitions, and PowerShell automation. The architecture follows the Cloud Adoption Framework's landing zone design, with a management group hierarchy, policy-driven governance, and modular networking topologies (hub-spoke, Virtual WAN). Key entry points include the main ARM deployment template (`eslzArm/eslzArm.json`), the portal accelerator (`eslzArm/eslz-portal.json`), and the Bicep-based policy compilation (`src/templates/policies.bicep`). Data flows are primarily declarative: policy definitions and assignments are deployed to management groups, which then enforce compliance on subscriptions and resources. External dependencies are entirely Azure-native: Azure Resource Manager, Azure Policy, Azure RBAC, and Azure networking services. The repository also includes a PowerShell module (`Alz.Tools`) for subscription alias creation, orphaned RBAC cleanup, and artifact conversion, plus a Pester-based test framework for policy validation.
Troposphere is a mature, well-established Python library for programmatically generating AWS CloudFormation templates. It provides a rich set of Python classes that map to AWS resource types, allowing developers to define infrastructure as code using familiar Python constructs. The library covers hundreds of AWS services through auto-generated modules derived from the official CloudFormation resource specification, with per-service validators and patches to correct naming conflicts and maintain backward compatibility. Its architecture centers on base classes (AWSObject, AWSProperty, Template) that handle serialization, validation, and CloudFormation intrinsic functions. The project also includes a template generator for converting existing JSON/YAML templates back into Python objects, utility helpers for user data scripts, and optional integration with the awacs library for IAM policy documents. While the core is manually maintained, the vast majority of service modules are auto-generated, necessitating regular regeneration to keep pace with AWS changes. The library is extensively tested with example-based regression tests and unit tests for critical services and validators.
This is the umbrella repository for the cdk8s project, an open-source software development framework for defining Kubernetes applications using familiar programming languages (TypeScript, Python, Java, Go). The repository itself does not contain the core cdk8s library code—those live in separate packages (cdk8s-core, cdk8s-cli, cdk8s-plus). Instead, this repo coordinates documentation (MkDocs site for API reference, Hugo website for marketing), RFCs for feature proposals, research on high-level abstractions, Kubernetes schema definitions (version 1.14.0 through 1.37.0), and CI/CD infrastructure. It also includes scripts for schema import, version rotation, and build automation. The repository is a CNCF Sandbox project developed primarily at AWS and follows the constructs programming model (App → Chart → resources). While the repo serves as the project's documentation and coordination hub, it demonstrates strong engineering practices: a well-defined RFC process, projen-based project configuration, versioned documentation targeting multiple Kubernetes versions, and automated upgrade workflows. The actual application logic for defining and synthesizing Kubernetes manifests resides in the companion packages. Researchers and engineers looking for reusable Kubernetes abstractions should refer to the separate cdk8s-plus libraries, which provide hand-crafted high-level constructs for resources like Pods, Deployments, and Services. This umbrella repo is best suited for understanding the project's architecture, contributing via RFCs, or consuming the documentation and schema definitions.
This repository, microsoft/WhatTheHack, is a comprehensive collection of hackathon challenge content focused on Microsoft Azure technologies. It contains over 70 individual 'hacks' covering topics such as Kubernetes, AI, DevOps, serverless, infrastructure-as-code, and more. Each hack includes student challenge instructions, coach solutions, and often starter code and infrastructure templates. The repository serves as a reusable library for running hands-on workshops and self-paced learning. While not a single application, it provides a structured framework for creating and delivering technical training events. The code quality varies across challenges, but the overall organization and documentation are strong, with reusable patterns like GitHub Actions workflows and hack authoring templates.
This repository is a community-maintained toolkit for Microsoft Defender for Cloud (MDC), providing automation, configuration, and operational assets to extend and manage MDC capabilities. It contains hundreds of Azure Policy definitions, Logic App playbooks, PowerShell scripts, Azure Workbooks, and infrastructure-as-code templates (ARM, Bicep, Terraform) for enabling security controls, remediating recommendations, exporting security data, and integrating with external systems like Azure DevOps, ServiceNow, and Microsoft Sentinel. The repository also includes a production-grade connector (MDC Recommendations to Azure DevOps) built with Python Durable Functions, managed identity authentication, and modular Bicep infrastructure. Architecturally, the repo is a collection of loosely coupled, deployable artifacts rather than a single application. The most sophisticated component is the MDC-to-ADO connector, which uses an HTTP-triggered Durable Function to orchestrate enrichment (via Azure Resource Graph, Microsoft Graph, and MDC APIs), deduplication, and work item creation/update in Azure DevOps. It employs a consistent client pattern with tenacity retry, token caching, and OpenTelemetry tracing. Other notable patterns include DeployIfNotExists Azure Policies that create security automations, Logic Apps with managed identity for alert response, and PowerShell scripts for bulk operations and cost estimation. While the repository is actively maintained and contains several high-quality, reusable components, it also exhibits technical drift: many artifacts reference the deprecated 'Azure Security Center' name, use preview API versions, or contain hardcoded placeholder values. The overall quality is functional but uneven, with some components being production-ready and others requiring manual configuration or updates. The repository is best suited for security engineers and cloud architects looking for battle-tested automation patterns and reference implementations for Microsoft Defender for Cloud.
This repository is a comprehensive collection of infrastructure-as-code configurations for self-hosting a wide variety of services, primarily aimed at homelab enthusiasts and followers of the Jim's Garage YouTube channel. It contains Docker Compose files, Kubernetes manifests, Ansible playbooks, and shell scripts that deploy services such as Traefik, PiHole, Plex, Jellyfin, Immich, Vaultwarden, Gitea, and many more. The central architectural pattern is a reverse proxy (Traefik or Caddy) with Cloudflare DNS-01 certificate challenges, with all services attached to a shared Docker network. The repository is not a single application but a set of modular, copy-paste-friendly deployment blueprints that can be adapted to different environments by changing IP addresses, domain names, and secrets. The codebase demonstrates strong organizational patterns—consistent Traefik labels, Kubernetes IngressRoutes with security middleware, and Ansible roles for cluster provisioning. However, the repository displays technical drift: some scripts pin outdated versions (e.g., kube-vip v0.6.3, MetalLB v0.12.1), and many files use `:latest` image tags, reducing reproducibility. Hardcoded IPs and dummy secrets (annotated with `# gitleaks:allow`) are present throughout, which is acceptable for a tutorial but requires careful sanitization before production use. The inclusion of multiple orchestration options (Docker Compose, Swarm, K3S, RKE2, Ansible) provides flexibility but can confuse users about which path to follow. As a learning resource, the repository is well-structured and actively maintained, with pre-commit hooks, GitHub Actions linting, and gitleaks integration. It is not a reusable library or service but a collection of reference configurations that can be extracted and adapted. The most reusable components are the Ansible roles for RKE2 deployment, the Traefik reverse proxy configuration, and the Kubernetes defaults-headers middleware pattern. Overall, the repository serves its educational purpose effectively while offering practical templates for homelab automation.
SST is a full-stack deployment framework and CLI tool for building and deploying serverless applications on AWS and Cloudflare. It uses Pulumi for infrastructure as code, provides a rich set of high-level components (Functions, Buckets, Queues, Databases, Auth, etc.), and supports multiple runtimes (Node.js, Python, Go, Rust) and frontend frameworks (Next.js, Remix, Astro, SvelteKit, SolidStart, etc.). The CLI offers live development mode with hot-reload, a terminal multiplexer, and SSH tunneling for VPC resources. The codebase is a monorepo with a Go CLI, TypeScript platform components, and SDKs in JavaScript, Python, Rust, and Go. While it demonstrates solid engineering patterns like a typed event bus, component transform system, and resource linking, it suffers from some deprecated components, code duplication across framework-specific SSR site components, and a high maintenance surface due to the sheer number of providers and examples.
This repository provides documentation and automation scripts for setting up a Kubernetes cluster from scratch using VirtualBox. It includes shell scripts for creating and configuring VM images with cloud-init, configuration files for various Kubernetes components (etcd, control plane, worker nodes, HAProxy load balancers), and detailed documentation explaining the setup process. The repository serves as an educational guide for understanding Kubernetes infrastructure components and how they interact, rather than a deployable application itself. The main value lies in the well-structured automation scripts and comprehensive documentation that walk users through building a complete Kubernetes cluster with high availability features.
This is a Terraform module for deploying a production-grade HashiCorp Vault cluster on Google Compute Engine (GCE). It provisions all necessary networking (VPC, subnets, NAT, firewalls), a GCS bucket for Vault's storage backend, a KMS key for auto-unseal and TLS encryption, and manages the full lifecycle of Vault nodes via a managed instance group with autoscaling and autohealing. The module supports both internal and external load balancers, and includes an optional submodule (`modules/cluster`) for organizations that need to separate concerns (e.g., shared VPC setups). The core logic resides in the `modules/cluster` submodule, which contains instance templates, load balancer configuration, health checks, IAM bindings, and self-signed TLS certificate generation. A startup script template handles Vault installation, configuration, mTLS setup, logging agents, and security hardening (core dumps disabled, swap disabled, unprivileged user). The module is highly parameterized with ~60 input variables, allowing customization of machine types, Vault versions, networking, and TLS management. It is designed for high availability (HA) with GCS backend and auto-unseal via Cloud KMS. The repository includes examples, integration tests using Kitchen/Terraform and Inspec, and CI/CD pipelines, indicating a mature, community-maintained module. The code is clean and follows Google's Cloud Foundation Toolkit conventions, but it is relatively conventional Terraform infrastructure code, not particularly novel or reusable beyond its intended purpose.
This repository is a large collection of tutorial lessons (numbered 006 to 281) focused on DevOps, cloud infrastructure, and backend development. It contains example applications in multiple languages (Go, Rust, Python, Node.js, Java, etc.) demonstrating common patterns like CRUD APIs, database integration, caching, and monitoring. The infrastructure-as-code examples cover Kubernetes (deployments, RBAC, ingress, service meshes), Terraform (AWS, GCP, Azure), Ansible, Helm, and CI/CD with ArgoCD. A significant portion is dedicated to observability with Prometheus, Grafana, and custom exporters. The repository serves as a companion to video tutorials and is not a single production application but a learning resource. It exhibits high duplication across lessons and some pseudo-code, but contains several reusable components for monitoring, infrastructure provisioning, and performance benchmarking.