Community blueprints for real infrastructure
Reusable, reviewed stacks you can run from the OpenSible console in one click — Kubernetes, service meshes, databases, observability and more.
Logstash HA (Docker cluster)
Multi-node Logstash deployment running the official Logstash Docker image. Every node runs one container managed by a dedicated systemd unit, sharing the same pipeline configuration and writing to the same Elasticsearch backend. Ships with a default beats-in / elasticsearch-out pipeline and a per-node HTTP health dashboard exposing Logstash node + pipeline stats and upstream Elasticsearch reachability.
PostgreSQL HA (Patroni + etcd)
3-node PostgreSQL HA cluster managed by Patroni with an embedded etcd v3 DCS. Installs PostgreSQL from PGDG, runs Patroni from a pinned Python venv, and manages everything via systemd. First node is the initial leader; use 3+ nodes for real HA.
Redis + Sentinel
Redis primary/replica with Sentinel for automatic failover. Distro packages + systemd — no Docker, no Bitnami. First node is the initial primary; add 3+ nodes for real HA.
Kibana HA (Docker cluster)
Multi-node Kibana deployment (recommended 2 or 3 behind a load balancer) running the official Kibana Docker image. Every node runs one container managed by a dedicated systemd unit, all pointing at the same Elasticsearch backend via ELASTICSEARCH_HOSTS. Ships with a per-node HTTP health dashboard exposing Kibana + upstream Elasticsearch status.
Valkey + Sentinel
Valkey (open-source Redis fork) primary/replica with Sentinel for automatic failover. Distro packages + systemd — no Docker, no Bitnami. First node is the initial primary; add 3+ nodes for real HA.
Docker Compose Stack
Render a docker-compose.yml on target hosts and run `docker compose up -d`. Ships with the compose plugin, per-host env files and idempotent restart handling.
Docker Engine
Install and harden Docker Engine with buildx and compose plugin.
NGINX Reverse Proxy
Install NGINX from distro packages and render a hardened reverse-proxy vhost with optional TLS, HTTP→HTTPS redirect and upstream health checks.
Argo CD via Helm
Install Argo CD on any cluster using the official argo-helm chart.
Istio Service Mesh
Install Istio via the official istio-helm charts: base + istiod control plane in the istio-system namespace. Deploys sidecar-injection ready mesh; add gateways separately.
k3s HA (embedded etcd)
Lightweight k3s cluster with embedded etcd and Longhorn storage.
Kuma Service Mesh (kuma.io)
Envoy-based, universal service mesh from kuma.io. Deploys the kuma control plane via the official Helm chart into the kuma-system namespace in standalone mode.
Linux CIS Hardening
Apply CIS Level 1 benchmark to Ubuntu / RHEL hosts.
HAProxy Load Balancer
HAProxy L4/L7 load balancer on systemd (distro package). Renders a hardened haproxy.cfg with health checks, a protected stats page and optional TLS termination. Enable keepalived to publish a VRRP virtual IP across 2+ nodes for HA.
Traefik Reverse Proxy (Docker provider)
Traefik v3 on systemd with the Docker provider enabled — auto-discovers containers on the host's Docker socket via `traefik.enable=true` labels, exposes the protected dashboard, Prometheus metrics and optional Let's Encrypt ACME. Deploy as a single node or as an HA cluster with a keepalived VRRP virtual IP.
OpenBao Cluster (Raft HA)
HashiCorp Vault–compatible OpenBao on systemd (no Docker). Installs from pinned official release assets without GitHub API calls, renders /etc/openbao/openbao.hcl with integrated Raft storage, cross-node retry_join for HA, and can auto-init + unseal every node on the first run.
Kubernetes HA (kubeadm)
Multi control-plane kubeadm cluster with Calico CNI and metrics-server.
Linkerd Service Mesh
Ultralight service mesh (Rust data plane). Deploys the linkerd-control-plane Helm chart into the linkerd namespace. Requires linkerd-crds + trust anchor first — see the values.yaml comment for a one-liner.
RabbitMQ Cluster
RabbitMQ cluster with management UI, Prometheus metrics and quorum-queue defaults. Installs from distro packages and manages rabbitmq-server via systemd. First node is the seed; the rest join it. Use 3+ nodes for HA quorum queues.
Traefik Reverse Proxy / LB
Traefik v3 reverse proxy on systemd (official GitHub tarball). Hardened static config, file-provider directory for dynamic routes, protected dashboard, Prometheus metrics and optional Let's Encrypt ACME. Deploy as a single instance or as an HA cluster with a keepalived VRRP virtual IP.
HashiCorp Vault HA (Docker cluster)
Production HashiCorp Vault HA cluster across N nodes running the official hashicorp/vault Docker image with integrated Raft storage. Each node runs one container managed by a dedicated systemd unit (vault-docker.service); followers auto-join via retry_join, and optional first-run auto-init + persistent auto-unseal keep the cluster unsealed across reboots.
Uninstall — HAProxy Load Balancer
Stop haproxy + keepalived, kill leftover processes, purge packages and remove /etc/haproxy, /var/lib/haproxy, /run/haproxy, /var/log/haproxy* and /etc/keepalived.
Uninstall — HashiCorp Vault (Docker cluster)
Stop vault-docker.service and the vault-autounseal service/timer on every node, remove the Vault container and image, and purge /etc/vault, /opt/vault and the Raft data directory (/var/lib/vault-data).
Uninstall — PostgreSQL HA (Patroni + etcd)
Stop patroni + etcd, kill leftover postgres processes, purge PGDG packages, remove /opt/patroni venv, /etc/patroni, /var/lib/patroni, /var/lib/etcd and /var/lib/postgresql.
Elasticsearch HA (Docker cluster)
Production Elasticsearch cluster across N nodes running the official Elasticsearch Docker image. Each node runs one container managed by a dedicated systemd unit; cluster formation via discovery.seed_hosts and cluster.initial_master_nodes. Ships with a per-node HTTP health dashboard (green/yellow/red + shard summary).
CI/CD Pipeline (Git → Build → Push → Deploy)
Clone a Git repo (GitHub / GitLab / Gitea / Forgejo), build a container image with docker buildx, push to any OCI registry (Harbor, Sonatype Nexus, Zot, Docker Hub, GHCR, GitLab), and optionally deploy to a target host via docker or docker compose.