Community blueprints for real infrastructure
Reusable, reviewed stacks you can run from the OpenSible console in one click — Kubernetes, service meshes, databases, observability and more.
Logstash HA (Docker cluster)
Multi-node Logstash deployment running the official Logstash Docker image. Every node runs one container managed by a dedicated systemd unit, sharing the same pipeline configuration and writing to the same Elasticsearch backend. Ships with a default beats-in / elasticsearch-out pipeline and a per-node HTTP health dashboard exposing Logstash node + pipeline stats and upstream Elasticsearch reachability.
PostgreSQL HA (Patroni + etcd)
3-node PostgreSQL HA cluster managed by Patroni with an embedded etcd v3 DCS. Installs PostgreSQL from PGDG, runs Patroni from a pinned Python venv, and manages everything via systemd. First node is the initial leader; use 3+ nodes for real HA.
Redis + Sentinel
Redis primary/replica with Sentinel for automatic failover. Distro packages + systemd — no Docker, no Bitnami. First node is the initial primary; add 3+ nodes for real HA.
Kibana HA (Docker cluster)
Multi-node Kibana deployment (recommended 2 or 3 behind a load balancer) running the official Kibana Docker image. Every node runs one container managed by a dedicated systemd unit, all pointing at the same Elasticsearch backend via ELASTICSEARCH_HOSTS. Ships with a per-node HTTP health dashboard exposing Kibana + upstream Elasticsearch status.
MySQL Group Replication
MySQL 8 group replication with ProxySQL routing.
Valkey + Sentinel
Valkey (open-source Redis fork) primary/replica with Sentinel for automatic failover. Distro packages + systemd — no Docker, no Bitnami. First node is the initial primary; add 3+ nodes for real HA.
Docker Compose Stack
Render a docker-compose.yml on target hosts and run `docker compose up -d`. Ships with the compose plugin, per-host env files and idempotent restart handling.
Docker Engine
Install and harden Docker Engine with buildx and compose plugin.
NGINX Reverse Proxy
Install NGINX from distro packages and render a hardened reverse-proxy vhost with optional TLS, HTTP→HTTPS redirect and upstream health checks.
Argo CD via Helm
Install Argo CD on any cluster using the official argo-helm chart.
Portainer CE
Deploy Portainer CE for container management across nodes.
MongoDB Replica Set
3-node MongoDB replica set with TLS and rolling backups.
Uninstall — Logstash (Docker cluster)
Stop logstash-docker.service on every node, remove the Logstash container and image, delete /etc/logstash, /var/lib/logstash and the per-node health dashboard unit.
Istio Service Mesh
Install Istio via the official istio-helm charts: base + istiod control plane in the istio-system namespace. Deploys sidecar-injection ready mesh; add gateways separately.
k3s HA (embedded etcd)
Lightweight k3s cluster with embedded etcd and Longhorn storage.
Kuma Service Mesh (kuma.io)
Envoy-based, universal service mesh from kuma.io. Deploys the kuma control plane via the official Helm chart into the kuma-system namespace in standalone mode.
Grafana OSS
Grafana OSS from the official apt/dnf repository on systemd. Admin creds and listen port injected via a systemd drop-in; can pre-provision a Prometheus / VictoriaMetrics datasource so dashboards work on first boot.
Prometheus / VictoriaMetrics
Single-node metrics backend on systemd (no Docker). Choose Prometheus (with a rendered scrape config for your node_exporter targets) or VictoriaMetrics (drop-in Prometheus API, lower RAM and better compression).
Prometheus node_exporter
Install prometheus-node-exporter on every selected host from distro packages (Debian/Ubuntu + RHEL/Rocky/Alma via EPEL). Exposes host metrics on :9100/metrics with the textfile collector enabled.
Linux CIS Hardening
Apply CIS Level 1 benchmark to Ubuntu / RHEL hosts.
HAProxy Load Balancer
HAProxy L4/L7 load balancer on systemd (distro package). Renders a hardened haproxy.cfg with health checks, a protected stats page and optional TLS termination. Enable keepalived to publish a VRRP virtual IP across 2+ nodes for HA.
Traefik Reverse Proxy (Docker provider)
Traefik v3 on systemd with the Docker provider enabled — auto-discovers containers on the host's Docker socket via `traefik.enable=true` labels, exposes the protected dashboard, Prometheus metrics and optional Let's Encrypt ACME. Deploy as a single node or as an HA cluster with a keepalived VRRP virtual IP.
RustFS (S3-compatible)
High-performance, distributed S3-compatible object storage written in Rust. Apache-2.0 licensed MinIO alternative — deploy single-node or an erasure-coded cluster across multiple hosts with the RustFS server binary managed via systemd.
Uninstall — Argo CD (Helm)
Run helm uninstall for the Argo CD release, remove argoproj.io CRDs and optionally delete the argocd namespace.
Uninstall — Docker Engine
Stop docker + containerd, remove all containers, purge docker-ce packages and delete /var/lib/docker & /var/lib/containerd.
OpenBao Cluster (Raft HA)
HashiCorp Vault–compatible OpenBao on systemd (no Docker). Installs from pinned official release assets without GitHub API calls, renders /etc/openbao/openbao.hcl with integrated Raft storage, cross-node retry_join for HA, and can auto-init + unseal every node on the first run.
Kubernetes HA (kubeadm)
Multi control-plane kubeadm cluster with Calico CNI and metrics-server.
ingress-nginx + cert-manager
Production ingress with TLS via Let's Encrypt DNS-01.
Linkerd Service Mesh
Ultralight service mesh (Rust data plane). Deploys the linkerd-control-plane Helm chart into the linkerd namespace. Requires linkerd-crds + trust anchor first — see the values.yaml comment for a one-liner.
Apache Kafka (KRaft Cluster)
Apache Kafka in KRaft mode on systemd (no ZooKeeper, no Docker, no Bitnami). Node IDs, quorum voters and advertised listeners are computed from the inventory.
RabbitMQ Cluster
RabbitMQ cluster with management UI, Prometheus metrics and quorum-queue defaults. Installs from distro packages and manages rabbitmq-server via systemd. First node is the seed; the rest join it. Use 3+ nodes for HA quorum queues.
Traefik Reverse Proxy / LB
Traefik v3 reverse proxy on systemd (official GitHub tarball). Hardened static config, file-provider directory for dynamic routes, protected dashboard, Prometheus metrics and optional Let's Encrypt ACME. Deploy as a single instance or as an HA cluster with a keepalived VRRP virtual IP.
kube-prometheus-stack
Prometheus, Alertmanager and Grafana via Helm with default dashboards.
Loki + Promtail
Log aggregation with Loki and Promtail agents, wired to Grafana.
OpenTelemetry Collector
OTel collector DaemonSet with OTLP receivers and multi-exporter pipeline.
cert-manager + Cloudflare
Automated TLS with cert-manager and Cloudflare DNS-01 solver.
HashiCorp Vault HA (Docker cluster)
Production HashiCorp Vault HA cluster across N nodes running the official hashicorp/vault Docker image with integrated Raft storage. Each node runs one container managed by a dedicated systemd unit (vault-docker.service); followers auto-join via retry_join, and optional first-run auto-init + persistent auto-unseal keep the cluster unsealed across reboots.
Uninstall — Elasticsearch (Docker cluster)
Stop elasticsearch-docker.service on every node, remove the Elasticsearch container and image, delete /var/lib/elasticsearch-data and the per-node health dashboard unit.
Uninstall — Grafana OSS
Stop grafana-server, purge the Grafana apt/dnf repo + package, and remove /etc/grafana, /var/lib/grafana and /var/log/grafana.
Uninstall — HAProxy Load Balancer
Stop haproxy + keepalived, kill leftover processes, purge packages and remove /etc/haproxy, /var/lib/haproxy, /run/haproxy, /var/log/haproxy* and /etc/keepalived.
Uninstall — Kibana (Docker cluster)
Stop kibana-docker.service on every node, remove the Kibana container and image, delete /var/lib/kibana and the per-node health dashboard unit.
Uninstall — Kafka (KRaft)
Stop kafka.service, remove /opt/kafka, wipe /var/lib/kafka data + logs, drop the kafka system user and unit file.
Uninstall — HashiCorp Vault (Docker cluster)
Stop vault-docker.service and the vault-autounseal service/timer on every node, remove the Vault container and image, and purge /etc/vault, /opt/vault and the Raft data directory (/var/lib/vault-data).
Uninstall — VictoriaMetrics (systemd)
Stop victoriametrics.service, remove /usr/local/bin/victoria-metrics-prod, /srv/metrics data and the victoriametrics system user.
Uninstall — PostgreSQL HA (Patroni + etcd)
Stop patroni + etcd, kill leftover postgres processes, purge PGDG packages, remove /opt/patroni venv, /etc/patroni, /var/lib/patroni, /var/lib/etcd and /var/lib/postgresql.
Uninstall — Prometheus node_exporter
Stop prometheus-node-exporter, remove the systemd drop-in and purge the distro package.
Uninstall — Prometheus (systemd)
Stop prometheus.service, remove /usr/local/bin/{prometheus,promtool}, /etc/prometheus, /srv/metrics and the prometheus system user.
Uninstall — RabbitMQ Cluster
Stop rabbitmq-server + epmd, kill leftover beam processes, purge packages, remove /etc/rabbitmq, /var/lib/rabbitmq, /var/log/rabbitmq and the Erlang cookie.
Uninstall — Valkey + Sentinel
Stop valkey-server and valkey-sentinel, purge packages, remove /etc/valkey, /var/lib/valkey, /var/log/valkey and the valkey system user.
Uninstall — Traefik Reverse Proxy / LB
Stop traefik + keepalived, remove the /usr/local/bin/traefik binary and systemd unit, and purge /etc/traefik, /var/lib/traefik, /var/log/traefik and /etc/keepalived.
Uninstall — OpenBao (systemd)
Stop openbao.service, purge the OpenBao apt/dnf repo and package, remove /etc/openbao, /opt/openbao, /var/lib/openbao and the openbao system user.
Elasticsearch HA (Docker cluster)
Production Elasticsearch cluster across N nodes running the official Elasticsearch Docker image. Each node runs one container managed by a dedicated systemd unit; cluster formation via discovery.seed_hosts and cluster.initial_master_nodes. Ships with a per-node HTTP health dashboard (green/yellow/red + shard summary).
CI/CD Pipeline (Git → Build → Push → Deploy)
Clone a Git repo (GitHub / GitLab / Gitea / Forgejo), build a container image with docker buildx, push to any OCI registry (Harbor, Sonatype Nexus, Zot, Docker Hub, GHCR, GitLab), and optionally deploy to a target host via docker or docker compose.
Uninstall — Kubernetes (kubeadm / k3s)
Completely remove a kubeadm or k3s cluster from selected nodes. Auto-detects the cluster type, drains, resets, removes packages, deletes etcd/CNI data, flushes iptables and cleans images.
Redpanda Cluster (Self-Managed) + Console
Kafka-API-compatible Redpanda Self-Managed cluster on systemd (no ZooKeeper, no JVM, no Docker). Seed servers and advertised listeners are computed from the inventory. Redpanda Console (web UI) is deployed on the first broker.
Uninstall — Redis + Sentinel
Stop redis-server and redis-sentinel, purge packages, remove /etc/redis, /var/lib/redis, /var/log/redis and the redis system user.
Uninstall — Redpanda + Console
Stop redpanda and redpanda-console, purge the Redpanda apt/dnf repo, remove packages, /etc/redpanda, /var/lib/redpanda data and the redpanda system user.