Aboutยถ
๐ One login. โพ๏ธ Infinite applications

What is Infinito.Nexus? ๐ยถ
Infinito.Nexus is an automated, modular infrastructure framework built on Docker, Linux, and Ansible, equally suited for cloud services, local server management, and desktop workstations. At its core lies a web-based desktop with single sign-on, backed by an LDAP directory and OIDC, granting seamless access to an almost limitless portfolio of self-hosted applications. It fully supports ActivityPub applications and is Fediverse-compatible, while integrated monitoring, alerting, cleanup, self-healing, automated updates, and backup solutions provide everything an organization needs to run at scale.
๐ |
๐ |
|---|---|
๐ Try It Live |
|
๐ง Request Your Setup |
|
๐ About This Project |
|
โ๏ธ Support Us |
Key Features ๐ฏยถ
Automated Deployment ๐ฆ Turn up servers and workstations in minutes with ready-made Ansible roles.
Enterprise-Grade Security ๐ Centralized user management via LDAP & OIDC (Keycloak), plus optional 2FA and encrypted storage.
Modular Scalability ๐ Grow from small teams to global enterprises by composing only the services you need.
Fediverse & ActivityPub Support ๐ Seamlessly integrate Mastodon, Peertube, Matrix and other ActivityPub apps out of the box.
Self-Healing & Maintenance โ๏ธ Automated cleanup, container healing, and auto-updates keep infrastructure healthy without human intervention.
Monitoring, Alerting & Analytics ๐ Built-in system, application, and security monitoring with multi-channel notifications.
Backup & Disaster Recovery ๐พ Scheduled backups and scripted recovery processes to safeguard your data.
Continuous Updates ๐ Automatic patching and version upgrades across the stack.
Application Ecosystem ๐ A curated suite of self-hosted apps, from project management, version control, and CI/CD to chat, video conferencing, CMS, e-learning, social networking, and e-commerce, all seamlessly integrated.
Use it online ๐ยถ
Try Infinito.Nexus. Sign up in seconds, explore the platform, and discover what our solution can do for you!โจ
Roles Overview ๐งฉยถ
Every invokable role in the tested lifecycle envelope, with its upstream homepage, an introduction video, the roles it integrates with, and a one-command local install.
Name |
Status |
Description |
More |
Integrated with |
|---|---|---|---|---|
beta |
Per-user Hermes and OpenClaw agents started on demand behind an OpenAI-compatible endpoint |
Documentation, Hermes Agent, Keycloak, LiteLLM Gateway, OpenClaw |
||
alpha |
Public REST API serving role data, history and translations of Infinito.Nexus for every ref of core and its forks |
|||
alpha |
Nginx-based privacy proxy that mirrors whitelisted third-party assets under a first-party domain |
|||
beta |
Nginx-based server for hosting static assets copied from a source directory to the web data path |
Documentation, File Server, Matomo, Prometheus, Tor Onion Service |
||
beta |
Scheduled deduplicating backup system for Docker container volumes to a local directory, with consistent SQL dumps |
|||
beta |
Scheduled deduplicating backup of host secrets, CA, ACME credentials, and node identity to the local backup directory |
|||
beta |
Scheduled backup job for hard-linked differential rsync snapshots of an NFS export into the local backup tree |
|||
beta |
Scheduled pull-style backup replicating remote hosts onto this host over SSH and rsync as hard-linked snapshots |
|||
beta |
Plug-triggered systemd backup for hard-link deduplicated snapshots of the local backup tree onto a swappable USB device |
|||
beta |
Shared premise of every desktop role, the login account its files belong to |
|||
beta |
Self-hosted no-code database platform with a spreadsheet-like interface for building and collaborating on data |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Hermes Agent, Keycloak, Matomo, Open WebUI, OpenClaw, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted web conferencing platform for virtual classrooms, online meetings, and real-time collaboration |
Backup Docker Volumes, Collabora, Corporate Design, Coturn, Dashboard, Documentation, Keycloak, Matomo, Prometheus, Stalwart, Universal Logout |
||
alpha |
Blender workstation installation wired to the agents on the host through the Model Context Protocol |
|||
beta |
Self-hosted decentralized social network on the open AT Protocol, with its own Personal Data Server |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, Prometheus, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted federated reading platform for book reviews and reading tracking across the Fediverse |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Federation bridge connecting ActivityPub (Fediverse), the AT Protocol (Bluesky), and the IndieWeb |
Dashboard, Documentation, Matomo, Prometheus, Tor Onion Service |
||
beta |
Open-source IT and application monitoring server behind SSO with native LDAP user management |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Hermes Agent, Keycloak, Matomo, Open WebUI, OpenClaw, OpenLDAP, Prometheus, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Federated chess server for playing and following rule-validated games over ActivityPub across the Fediverse |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Matomo, PostgreSQL, Prometheus, Tor Onion Service |
||
alpha |
Terminal coding agent from Anthropic, pointed at the platformโs own model gateway instead of the vendor API |
|||
alpha |
Visual Studio Code workstation editor in a selectable flavor, carrying the extensions of the agents the host deploys |
|||
alpha |
Terminal coding agent from OpenAI, pointed at the platformโs own model gateway instead of the vendor API |
|||
beta |
Self-hosted online office backend for real-time in-browser editing of documents, spreadsheets, and presentations |
|||
beta |
Nginx-based content delivery network for serving shared static assets to internal web applications |
|||
beta |
Corporate design configuration owner and |
Content Delivery Network, Documentation, Prometheus, Tor Onion Service |
||
beta |
Free and open-source TURN/STUN relay server for NAT traversal in WebRTC and real-time communication |
|||
alpha |
AI-first code editor installed on the workstation, whose endpoint override stays an operator step |
|||
beta |
Self-hosted portal for unified access to all deployed applications via a customizable tile and menu interface |
Assets Server, Content Delivery Network, Corporate Design, Documentation, Keycloak, Matomo, Prometheus, Simple Icons, Tor Onion Service, Universal Logout |
||
beta |
Open-source participatory democracy platform for public consultations, civic processes, and community voting |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Open-source discussion and community forum platform with moderation, notifications, and plugin support |
Assets Server, Backup Docker Volumes, BigBlueButton, Corporate Design, Dashboard, Documentation, Jitsi Meet, Keycloak, LiteLLM Gateway, Mastodon, Matomo, Matrix, Mattermost, PostgreSQL, Prometheus, Redis, Stalwart, Tor Onion Service, Translation Gateway, Universal Logout |
||
beta |
Cluster-local container image registry for serving custom-built images to Docker Swarm worker nodes |
|||
beta |
Cluster-local pull-through cache for shared Docker Hub base-image pulls, cutting duplicate transfers and rate limits |
|||
beta |
Container orchestration cluster for scheduling services across pooled manager and worker nodes |
|||
beta |
Marker role tagging a host as the Docker Swarm manager node, with the init logic delegated to svc-swarm-node |
|||
beta |
Infinito.Nexus documentation for the latest commit and every release, built on demand with Sphinx |
Corporate Design, Dashboard, Matomo, Prometheus, Tor Onion Service |
||
beta |
Central search and analytics engine with per-consumer index namespaces isolating tenants in a shared Docker deployment |
|||
beta |
Self-hosted open-source ERP suite for finance, CRM, inventory, manufacturing, HR, sales, and projects |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, MariaDB, Matomo, OpenLDAP, Prometheus, Redis, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Open-source CRM platform for managing sales, customer interactions, and business processes across teams |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, MariaDB, Matomo, OpenLDAP, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted Fediverse wall for showing recent public posts by hashtag or account in a live masonry grid |
Corporate Design, Dashboard, Documentation, Friendica, Mastodon, Matomo, Prometheus, Tor Onion Service |
||
beta |
Open-source community feedback platform for collecting, voting on, and prioritizing feature requests and ideas |
Corporate Design, Dashboard, Documentation, Hermes Agent, Keycloak, Matomo, Open WebUI, OpenClaw, PostgreSQL, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Static file server over HTTPS with directory listing, .well-known handling, and automatic TLS certificates |
|||
beta |
nftables packet filter whose rules each role owns as its own table, replaced atomically and reloaded at boot |
|||
beta |
Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, LiteLLM Gateway, Matomo, Ollama, PostgreSQL, Prometheus, Qdrant, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Decentralized, federated social-networking platform for peer-to-peer communication and community building |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, MariaDB, Matomo, OpenLDAP, Prometheus, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted, federated platform for sharing, hosting, and streaming your own music and audio library |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, OpenLDAP, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Typesense, Universal Logout |
||
beta |
Lightweight self-hosted Git service for code collaboration, version control, and repository management |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Hermes Agent, Keycloak, MariaDB, Matomo, Open WebUI, OpenClaw, OpenLDAP, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted DevOps platform for Git source-code management, CI/CD pipelines, and issue tracking |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Hermes Agent, Jenkins, Keycloak, Matomo, Matrix, Mattermost, Open WebUI, OpenClaw, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Kernel-isolated agent runtime serving an OpenAI-compatible API, routed to models through the shared LLM gateway |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Kata & gVisor, Keycloak, LiteLLM Gateway, Matomo, Prometheus, Tor Onion Service |
||
beta |
Smart-home automation hub with device integrations, dashboards and a built-in MCP server for AI agent access |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Flowise, Hermes Agent, Open WebUI, OpenClaw, Prometheus, Tor Onion Service |
||
beta |
NGINX vhost for serving static HTML websites over HTTPS with automatic Letโs Encrypt certificates |
Corporate Design, Documentation, Matomo, Prometheus, Tor Onion Service |
||
beta |
Static site generator building HTML from an upstream Git repository at build time and serving it via nginx |
Corporate Design, Dashboard, Documentation, Matomo, Prometheus, Tor Onion Service |
||
beta |
NGINX-served static page rendering a legal imprint (Impressum) from a Jinja2 template |
|||
alpha |
Intel VA-API media driver for hardware-accelerated video decode and encode across Linux distributions |
|||
beta |
Self-hosted media server for streaming and organizing movies, TV, music, and photos, with OIDC and LDAP login |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Hermes Agent, Keycloak, Matomo, Open WebUI, OpenClaw, OpenLDAP, Prometheus, Tor Onion Service, Universal Logout |
||
beta |
Open-source automation server for CI/CD pipelines, builds, and plugin-driven deployment workflows |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Gitea, GitLab, Hermes Agent, Keycloak, Matomo, Mattermost, Open WebUI, OpenClaw, OpenLDAP, Prometheus, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted WebRTC platform for end-to-end-encryptable video conferencing with federated authentication |
Corporate Design, Dashboard, Documentation, Keycloak, Matomo, OpenLDAP, Prometheus, Stalwart, Universal Logout |
||
beta |
Open-source content management system for building websites, intranets, and online applications without writing code |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, MariaDB, Matomo, Prometheus, Stalwart, Tor Onion Service, Universal Logout |
||
alpha |
Kernel backend that runs the code a chat writes, in a container instead of in the browser sandbox |
|||
beta |
Kernel-isolating container runtimes that sandbox untrusted workloads in a microVM or a userspace kernel |
|||
beta |
Self-hosted identity and access management platform for single sign-on, multi-factor authentication, and user federation |
Content Delivery Network, Corporate Design, Dashboard, Documentation, Matomo, PostgreSQL, Prometheus, Stalwart, Tor Onion Service |
||
beta |
Open-source ITSM and helpdesk platform (OTRS fork) for ticketing, CMDB, knowledge base, and reporting |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, OpenLDAP, PostgreSQL, Prometheus, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Web interface for administering LDAP directories: managing users, groups, and other directory objects |
Corporate Design, Dashboard, Documentation, Keycloak, Matomo, OpenLDAP, Prometheus, Redis, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted open-source machine translation API for translating and detecting text across languages |
Corporate Design, Documentation, Hermes Agent, Keycloak, Matomo, Open WebUI, OpenClaw, Prometheus, Tor Onion Service |
||
beta |
Machine translation engine without a web surface, for pipelines that call it directly |
|||
alpha |
Power-aware systemd logind configuration for predictable laptop lid-close behavior across battery, AC, and docked states |
|||
beta |
Self-hosted platform for newsletters and mailing lists with subscriber segmentation and campaign analytics |
Assets Server, Corporate Design, Dashboard, Documentation, Hermes Agent, Keycloak, Matomo, Open WebUI, OpenClaw, PostgreSQL, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Browser-facing admin interface for the shared LLM gateway, published on its own domain behind the front proxy |
Corporate Design, Dashboard, Documentation, Keycloak, LiteLLM Gateway, Prometheus, Tor Onion Service |
||
beta |
OpenAI-compatible LLM gateway routing a single /v1 endpoint to local and hosted model backends with per-consumer keys |
|||
beta |
Headless local model server for open LLMs with an OpenAI-compatible API on the container network |
|||
alpha |
LLM-backed translation engine speaking the LibreTranslate API, for pipelines that call it directly |
|||
alpha |
Self-hosted e-commerce platform for catalog management, checkout, promotions, and multi-store online retail |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Shared relational database server for applications needing central SQL storage, run in Docker |
|||
beta |
Self-hosted federated social network for microblogging, real-time timelines, and community moderation |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted, privacy-first web analytics platform for real-time visitor tracking and site metrics |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, MariaDB, Prometheus, Tor Onion Service, Universal Logout |
||
beta |
Federated, end-to-end-encrypted messaging platform with a web client and protocol bridges to external chat networks |
Backup Docker Volumes, Corporate Design, Coturn, Dashboard, Documentation, GitLab, Jitsi Meet, Keycloak, LiteLLM Gateway, Matomo, n8n, OpenLDAP, PostgreSQL, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Open-source, self-hosted team messaging platform for real-time collaboration via channels, threads, and integrations |
Backup Docker Volumes, Content Delivery Network, Corporate Design, Dashboard, Documentation, GitLab, Hermes Agent, Jenkins, Jitsi Meet, Keycloak, LiteLLM Gateway, Matomo, Open WebUI, OpenClaw, PostgreSQL, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
alpha |
Reusable per-provider MCP adapter exposing a narrow allowlisted read surface |
|||
beta |
Collaborative wiki platform for user-driven documentation with an extensible extension ecosystem and content management |
Backup Docker Volumes, Corporate Design, Dashboard, Discourse, Documentation, Keycloak, LiteLLM Gateway, MariaDB, Matomo, PeerTube, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Translation Gateway, Universal Logout |
||
beta |
Central in-memory caching engine with per-consumer key-prefix isolation, usable centrally or as an embedded sidecar |
|||
alpha |
Interactive graph visualization of all Infinito.Nexus roles and their dependencies for architecture transparency |
API, Dashboard, Documentation, Matomo, Prometheus, Tor Onion Service |
||
beta |
Self-hosted browser tool for generating QR codes from text or URLs with privacy-friendly local rendering |
Corporate Design, Dashboard, Documentation, Matomo, Prometheus, Tor Onion Service |
||
beta |
Federated, self-hosted platform for organizing events and building communities and groups |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, PostgreSQL, Prometheus, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Open-source learning management system for creating, managing, and delivering online courses and e-learning |
Backup Docker Volumes, BigBlueButton, Corporate Design, Dashboard, Documentation, Hermes Agent, Jitsi Meet, Keycloak, LiteLLM Gateway, MariaDB, Matomo, Matrix, Nextcloud, Open WebUI, OpenClaw, OpenLDAP, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted low-code automation platform for connecting services and building workflow integrations visually |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Hermes Agent, Keycloak, LiteLLM Gateway, Matomo, Open WebUI, OpenClaw, PostgreSQL, Prometheus, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted cloud platform for file sync, sharing, real-time collaboration, and team workspaces under your own domain |
Backup Docker Volumes, BigBlueButton, Collabora, Corporate Design, Coturn, Dashboard, Discourse, Documentation, GitLab, Hermes Agent, Keycloak, LiteLLM Gateway, MariaDB, Mastodon, Matomo, Matrix, Mattermost, OnlyOffice, Open WebUI, OpenClaw, OpenLDAP, OpenProject, PeerTube, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout, XWiki, Zammad |
||
beta |
Client-side NFS setup for mounting a remote server export on every swarm node, with a deploy-time reachability probe |
|||
beta |
Kernel-level NFS server for exporting a shared directory tree with IP-restricted access for swarm-node hosts |
|||
alpha |
NLLB-200 translation model served over HTTP, for pipelines that call it directly |
|||
beta |
Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, Nextcloud, OpenLDAP, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted model server for running open LLMs locally behind a simple HTTP API |
|||
beta |
Document server backend for real-time in-browser editing of documents, spreadsheets, and presentations |
Backup Docker Volumes, Documentation, Matomo, PostgreSQL, Prometheus, Redis, Tor Onion Service |
||
beta |
Self-hosted chat interface for interacting with local and private AI models via backends such as Ollama |
Agent Broker, Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, LiteLLM Gateway, Matomo, OpenLDAP, Prometheus, Qdrant, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Identity-based secrets, PKI and encryption manager with OIDC login, group-mapped policies and static-seal auto-unseal |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, OpenLDAP, Prometheus, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted personal AI agent gateway with a browser control UI, sandboxed in a Kata microVM or gVisor runtime |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Kata & gVisor, Keycloak, LiteLLM Gateway, Matomo, Prometheus, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted platform for file sync, sharing, and collaboration with Keycloak SSO and central LDAP directory |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, OpenLDAP, Prometheus, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted LDAP directory service for centralized user, group, and schema management with TLS-secured access |
|||
beta |
Self-hosted platform for project management, work-package tracking, Gantt planning, and team collaboration |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, GitLab, Keycloak, Matomo, Nextcloud, OpenLDAP, PostgreSQL, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
NGINX-based web platform and reverse proxy with validated config reloads and Letโs Encrypt integration |
|||
beta |
Sovereign open-source video conferencing platform for audio/video calls, screen sharing, breakout rooms, and SSO |
Backup Docker Volumes, Corporate Design, Coturn, Dashboard, Documentation, Keycloak, Matomo, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Universal Logout |
||
beta |
Cluster-local proxy cache for package upstreams, serving apt, pip, npm and raw artefacts every role declares |
|||
beta |
System-maintenance role for refreshing the package index and upgrading installed packages via the OS package manager |
|||
beta |
Decentralized, federated platform for peer-to-peer video hosting, streaming, and live broadcasting |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Universal Logout |
||
beta |
Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, OpenLDAP, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Web-based administration and development platform for managing multiple PostgreSQL servers, with optional OAuth2 login |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, PostgreSQL, Prometheus, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Web-based administration tool for MySQL and MariaDB with schema management, querying, and import/export |
Corporate Design, Dashboard, Documentation, Keycloak, MariaDB, Matomo, Prometheus, Redis, Tor Onion Service, Universal Logout |
||
alpha |
Minimal terminal coding agent with a lazy-loading skill system, wired to the platformโs own model gateway |
|||
beta |
Decentralized, federated platform for photo sharing and image feeds across the fediverse |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, MariaDB, Matomo, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Containerized relational database with automated database, user, and privilege provisioning |
|||
beta |
Single-user ActivityPub bookmarking site federating public bookmarks to Mastodon and the Fediverse |
Corporate Design, Dashboard, Documentation, Keycloak, Matomo, Prometheus, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted ticketing platform for events with online sales, registration management, and secure payments |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Hermes Agent, Keycloak, Matomo, Open WebUI, OpenClaw, PostgreSQL, Prometheus, Redis, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Open-source monitoring and alerting toolkit for storing metrics as time-series data and querying them with PromQL |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Flowise, Hermes Agent, Keycloak, Matomo, Open WebUI, OpenClaw, Stalwart, Tor Onion Service, Universal Logout |
||
alpha |
Proprietary GPU driver installer for Arch-based systems via mhwd nonfree hardware detection |
|||
beta |
Central vector database engine for storing and searching per-consumer embeddings shared across the stack |
Backup Docker Volumes, Documentation, Flowise, Hermes Agent, Open WebUI, OpenClaw, Tor Onion Service |
||
beta |
Shared message broker for async messaging with per-consumer virtual host and user isolation |
|||
beta |
NGINX glue role for 301 redirects from source to target domains with automatic SSL for the source hosts |
|||
beta |
In-memory key-value cache and store, shared centrally with per-consumer ACL isolation or embedded as a sidecar |
|||
alpha |
Metasearch engine the platform queries for web results without handing a userโs query to a tracking search provider |
|||
beta |
Distributed S3-compatible object store for shared, per-consumer bucket provisioning across web-app roles |
|||
beta |
Browser administration interface for the SeaweedFS object store, serving the filer and master consoles behind SSO |
Corporate Design, Dashboard, Documentation, Keycloak, Prometheus, SeaweedFS, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted CI runner infrastructure for executing GitHub Actions workflow jobs in ephemeral Docker containers |
|||
beta |
Web UI and API for running Ansible, Terraform/OpenTofu, and shell automation on a schedule or on demand |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, OpenLDAP, PostgreSQL, Prometheus, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Open-source ecommerce platform built on Symfony and Vue.js for building and scaling online storefronts |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, MariaDB, Matomo, OpenLDAP, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Containerized icon server for hosting the Simple Icons brand SVG and PNG collection for web and documentation use |
|||
beta |
Open-source IT asset management system for tracking hardware and software inventory |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Hermes Agent, Keycloak, MariaDB, Matomo, Open WebUI, OpenClaw, OpenLDAP, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
alpha |
Privacy-first social platform for households, federating peer-to-peer over WebRTC on an embedded SQLite store |
Backup Docker Volumes, Corporate Design, Coturn, Dashboard, Documentation, Prometheus, Tor Onion Service, Universal Logout |
||
beta |
All-in-one Stalwart mail server with SMTP, IMAP, JMAP, POP3, ManageSieve, CalDAV, CardDAV and built-in spam filtering |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, PostgreSQL, Prometheus, Tor Onion Service, Tor SMTP Gateway (svc-net-tor-smtp), Universal Logout |
||
beta |
Tiering role placing Docker volumes on SSD or HDD by workload type, with symlinks keeping paths consistent |
|||
beta |
Open-source CRM platform for sales, service, cases, and campaign management with workflow automation |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, MariaDB, Matomo, OpenLDAP, Prometheus, Redis, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
On-target automation for creating and activating swap space via a cloned swapfile script |
|||
beta |
Self-hosted System One classifier that answers typed questions so the gateway can route without generating |
|||
alpha |
Public vhost that exposes the System One decision API of svc-ai-s1 |
|||
beta |
Open-source agile project management platform for Scrum, Kanban, and hybrid team workflows |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, OpenLDAP, PostgreSQL, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
alpha |
Central document extraction engine that turns uploaded files into text for retrieval-augmented chat |
|||
beta |
Tor daemon publishing the node as a v3 onion service |
|||
alpha |
SMTP gateway that relays .onion recipients through Torโs SOCKS listener |
|||
beta |
One translation endpoint that picks the engine itself and prefers a reviewed human string |
Documentation, Keycloak, LibreTranslate Engine, LiteLLM Gateway, LTEngine, NLLB-200, Ollama, PostgreSQL, Prometheus, System One, Tor Onion Service, Weblate |
||
beta |
Central Dockerized search engine shared by multiple apps with per-consumer scoped API keys |
|||
beta |
Central recursive/forwarding DNSSEC resolver on a static IP for consumer stacks to target as their DNS |
|||
beta |
Central logout proxy for single-action sign-out across all OIDC-connected apps, with Nginx snippets and a live status UI |
Corporate Design, Documentation, Matomo, Prometheus, Tor Onion Service |
||
beta |
Open-source SIEM and XDR platform for monitoring, log analysis, intrusion/vulnerability detection, and compliance |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, OpenLDAP, Prometheus, Tor Onion Service, Universal Logout |
||
beta |
Network-wide DNS sinkhole for blocking ads and trackers across all devices, with DHCP and a web admin dashboard |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, Prometheus, Tor Onion Service, Universal Logout |
||
beta |
Translation memory, glossaries and the human review workflow behind the translation gateway |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, Matomo, PostgreSQL, Prometheus, Redis, Stalwart, Tor Onion Service, Translation Gateway, Universal Logout |
||
beta |
Kernel WireGuard tunnels, hub-and-spoke meshes under a swarm manager and full meshes between Compose hosts |
|||
beta |
Content management system for building and managing websites, blogs, and multisite networks with themes and plugins |
Backup Docker Volumes, BigBlueButton, Corporate Design, Dashboard, Discourse, Documentation, Hermes Agent, Keycloak, Listmonk, LiteLLM Gateway, MariaDB, Matomo, OpenClaw, PeerTube, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Translation Gateway, Universal Logout |
||
beta |
NGINX server blocks that permanently redirect www subdomains to their non-www apex domains |
|||
beta |
Placeholder stub role for a future XMPP server/container deployment, implementation pending |
Backup Docker Volumes, Documentation, Keycloak, OpenLDAP, Prometheus, Tor Onion Service |
||
beta |
Self-hosted enterprise wiki and knowledge-management platform with collaboration and app-based extensibility |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Keycloak, LiteLLM Gateway, Matomo, PostgreSQL, Prometheus, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
||
beta |
Self-hosted URL shortener for creating, tracking, and managing short links with built-in click analytics |
Corporate Design, Dashboard, Documentation, Keycloak, MariaDB, Matomo, Prometheus, Tor Onion Service, Universal Logout |
||
beta |
Open-source helpdesk and ticketing system for handling customer requests via email, chat, phone, and web |
Backup Docker Volumes, Corporate Design, Dashboard, Documentation, Hermes Agent, Keycloak, LiteLLM Gateway, Matomo, Memcached, Open WebUI, OpenClaw, OpenLDAP, PostgreSQL, Prometheus, Redis, SeaweedFS, Stalwart, Tor Onion Service, Universal Logout |
Guides ๐ยถ
Installation Guide for local CLI installation, Docker execution, and source builds.
Deploy Guide for inventory creation, full deploys, and redeploy flows.
CI & Self-Hosted Runners for the test gate and adding your own hardware to the CI pool.
Contributing ๐จยถ
For the full development setup, contribution workflow, testing, and coding standards, see CONTRIBUTING.md.
Invest ๐นยถ
We are actively looking for investors to help scale Infinito.Nexus and bring open, self-hosted infrastructure to more organizations worldwide. If you are interested in investing or partnering with us, please reach out via our Investor Relations contact.
Code of Conduct ๐๏ธยถ
We are committed to fostering an open and welcoming environment. Please read our CODE_OF_CONDUCT.md to understand the standards we expect from all participants in our community.
Security ๐ก๏ธยถ
For security reporting and disclosure, see SECURITY.md.
Support and Contact ๐ผยถ
For expert installation, contact details, and project participation, see SUPPORT.md.
Support Us โค๏ธยถ
Infinito.Nexus is developed independently. Your support helps fund development, infrastructure, documentation, and the long-term growth of the project.
๐ GitHub Sponsors
โ Buy Us a Coffee
๐ณ PayPal
โฟ
bitcoin:bc1qn667c729cy64p5x58m3vg7zmudwqvf0fww7ph5
License โ๏ธยถ
Infinito.Nexus is distributed under the Infinito.Nexus Community License (Non-Commercial). Please see LICENSE.md for full terms.
Integrationsยถ
Which roles this repository wires into which, derived from the roles themselves.
Documentationยถ
The following pages cover contribution guidelines, development workflows, agent instructions, and security references.
- Documentation ๐
- Administration ๐ ๏ธ
- CI & Self-Hosted Runners ๐
- Configuration ๐ ๏ธ
- Email Configuration ๐ฌ
- RBAC ๐
- Deploy Guide ๐
- Installation Guide ๐
- Agent documentation ๐ค
- Agent action guides ๐งญ
- Lead a CI run with a priority line ๐
- Committing
- Debugging
- CI Debugging
- Local Deploy Debugging
- Log File Inspection
- Design Loop
- Development
- Agent iteration loops
- Compose Loop
- Playwright Spec Loop
- Roundtrip Loop
- Runner Iteration
- Swarm Loop
- Workflow Loop
- Pull Requests
- Push, Trigger, Pull
- Refactoring and Optimization
- Release Articles
- Requirements
- Testing
- Verify in two lanes at once ๐ค๏ธ
- Agent file rules ๐
- Agent group_vars rules
- applications lookup
- Agent role file rules ๐ญ
- javascript.js
- playwright.env.j2
- playwright.spec.js agent procedure
style.css- Agent meta guidance ๐ง
- About AGENTS.md
- Caveman: Token Compression
- Ethics and Morality
- Help
- Purpose
- Backup and Recover Schema (svc-bkp-* role family)
- Central Engine Services (swarm + compose)
- 0001: Distro and filesystem are deploy-matrix axes ๐งญ
- 0002: The CPU architecture is a deploy-matrix axis ๐๏ธ
- 0003: One MCP surface per provider, and a disposition for every role ๐
- Context ๐ฏ
- Decision โ
- Every role carries a disposition
- An enabled adapter declares everything it is allowed to do
- Identity is per provider, never the deployment administrator
- Discovery reconciles, and owns only what it named
- The two clients with version-specific behaviour
- Safety contract for every adapter
- Per-provider constraints
- Exhaustive Application-ID Audit
- Consequences โ๏ธ
- Adapter starter contracts
- Upstream sources
- Architecture Decisions ๐งญ
- Role Integrations
- Licence Context
- 0.1.0 (2025-12-09)
- 0.1.1 (2025-12-10)
- 0.2.0 (2025-12-10)
- 0.2.1 (2025-12-10)
- 0.3.0 (2025-12-17)
- 0.3.1 (2025-12-18)
- 0.3.2 (2025-12-19)
- 0.3.3 (2025-12-21)
- 0.3.4 (2025-12-21)
- 0.3.5 (2025-12-21)
- 0.4.0 (2025-12-29)
- 0.5.0 (2025-12-30)
- 0.6.0 (2025-12-31)
- 0.7.0 (2026-01-05)
- 0.7.1 (2026-01-06)
- 0.7.2 (2026-01-06)
- 0.8.0 (2026-01-06)
- 0.9.0 (2026-01-07)
- 0.10.0 (2026-01-08)
- 0.11.0 (2026-01-10)
- 0.12.0 (2026-01-25)
- 1.0.0 (2026-02-03)
- 2.0.0 (2026-02-08)
- 2.1.0 (2026-02-08)
- 2.1.1 (2026-02-08)
- 2.1.2 (2026-02-08)
- 2.1.3 (2026-02-08)
- 2.1.4 (2026-02-08)
- 2.1.5 (2026-02-09)
- 2.1.6 (2026-02-09)
- 2.1.7 (2026-02-09)
- 2.1.8 (2026-02-09)
- 2.1.9 (2026-02-10)
- 3.0.0 (2026-02-11)
- 4.0.0 (2026-02-13)
- 4.0.1 (2026-02-15)
- 4.0.2 (2026-02-15)
- 4.0.3 (2026-02-16)
- 4.1.0 (2026-02-17)
- 5.0.0 (2026-02-25)
- 5.1.0 (2026-02-28)
- 5.2.0 (2026-03-21)
- 6.0.0 (2026-04-25)
- 7.0.0 (2026-05-08)
- 8.0.0 (2026-05-27)
- 8.0.1 (2026-05-28)
- 8.0.2 (2026-05-28)
- 8.0.3 (2026-05-28)
- 8.0.4 (2026-05-28)
- Changelog Archive ๐
- Contribution documentation ๐ค
- Actions ๐
- Debugging guides ๐
- CI Failures and Debugging ๐
- Network ๐
- Local Deploy ๐
- Refactoring ๐ง
- Release ๐
- Review Requirements ๐
- Testing and Validation โ
- Test guidance ๐งช
- External Tests ๐
- Integration Tests ๐
- Lint ๐
- Playwright Tests ๐ญ
- Regression Guards ๐ก๏ธ
- Suppression Markers ๐ซ
- Unit Tests ๐งช
- Artefact documentation ๐งฑ
- File artefact rules ๐
- CLI README ๐
compose.yml๐ณ- Docs README rules ๐๏ธ
- Docs README ๐
- GitHub workflow files ๐
Makefile๐ ๏ธ- Plugin file rules ๐
- Lookup plugin rules ๐
applicationslookup ๐ฆuserslookup ๐ฅ- Role file rules ๐ ๏ธ
Dockerfile๐ณjavascript.js๐playwright.spec.js๐ญ- Role README ๐
style.css๐จmeta/variants.yml๐งฌ- Git artefacts ๐๏ธ
- Branch ๐ฟ
- Commit ๐
- Continuous Integration ๐
- Overview ๐บ๏ธ
- Entry Points ๐ช
- PR Scope Detection ๐
- Pipeline Stages ๐๏ธ
- Concurrency ๐
- Fork PRs ๐ด
- Pull Request ๐
- Remotes ๐
- Image artefact guidance ๐ผ๏ธ
- Image Mirroring ๐ช
- Role Image Configuration ๐ณ
- Scripts ๐งฐ
- Utilities ๐
- Customize ๐งฉ
- Design ๐จ
- Repository Architecture ๐๏ธ
- Deployment Modes ๐ข
- Deployment Exceptions โ ๏ธ
- Identity and Access Management ๐
- Common ๐งญ
- LDAP ๐
- OIDC ๐ชช
- RBAC ๐
- Inventory ๐๏ธ
- Language-specific code rules ๐ฃ๏ธ
- Shell ๐
- Network Modes ๐
- Code Principles ๐
- Role Mapping ๐งฉ
- Services ๐งฑ
- Service Management ๐งฑ
- Email Lookup Plugin ๐ฌ
- Per-Role Meta Layout ๐๏ธ
- File Layout ๐
- File-Root Convention ๐งท
- Materialised Paths ๐
- Services Inlining Rule ๐ฅ
- Schema Format:
meta/secrets.yml๐๏ธ - Per-Role Networks:
meta/server.yml.networks๐ - Per-Entity Ports:
meta/services.yml.<entity>.ports๐ช run_afterandlifecycle๐ฑ- Descriptive Role-Level Metadata:
meta/info.yml๐ - Unified Addons:
meta/addons/๐งฉ - Related Pages ๐
- Role lifecycle ๐ฑ
- MCP Service Block ๐
- MCP User Delegation ๐ชช
- Variants ๐งฌ
- Documentation ๐
- Environment guide ๐ฅ๏ธ
- Local Caches ๐ฆ
- Manage Low-Hardware Resources
- Supported Operation Systems
- Platform setup guides ๐
- Linux
- macOS
- Windows (WSL2)
- Development Environment Setup ๐ ๏ธ
- Environment Variables
- Contribution Guide
- Organisation ๐๏ธ
- Communication ๐ฌ
- Organisational Principles ๐
- Requirements ๐
- Tooling guides ๐งฐ
- Act Workflow Checks ๐ญ
- Agent Tooling ๐ค
- Cheatsheet ๐
- Claude Code ๐ค
- Claude Code Sandbox ๐๏ธ
- Claude Code Security Assumptions ๐ก๏ธ
- Two-Layer Containment ๐๏ธ
- Assumption 1: The sandbox backend is installed and functional โ๏ธ
- Assumption 2:
sandbox.filesystem.allowWriteis the authoritative write boundary โ๏ธ - Assumption 3: The host runs only test workloads ๐งช
- Assumption 4: Operators review
askprompts before approval ๐ - Assumption 5: DinD ask-gates are comfort thresholds, not hard barriers ๐ณ
- Assumption 6: Access to
/var/run/docker.sockequals host root ๐ - Assumption 7: The
Makefileis peer-reviewed and trusted ๐ง - Assumption 8: Shell control-flow loops are never necessary ๐
- Assumption 9:
denyReadlists every credential directory ๐ - Assumption 10:
~/.sshstays readable except for the default private keys ๐ - Updating Assumptions ๐งน
- Claude Code Settings ๐ค
- Agent Guidelines for humans
- Ansible ๐ญ
- Docker and Runtime Commands ๐ณ
- GHCR guides ๐ฆ
- GHCR Authentication ๐
- Mirror Cleanup: Deleting Private GHCR Packages ๐๏ธ
- GitHub governance guides ๐ก๏ธ
- GitHub Actions guides ๐ฌ
- CI Configuration โ๏ธ
- Instructions replay ๐
- CI Secrets ๐
- GitHub Actions ๐ฌ
- Branch Governance ๐ฟ
- Branch Protection ๐
- Repository Settings ๐ง
- Makefile Commands ๐ ๏ธ
cli contributing network address suggest๐cli contributing network ports suggest๐ช- Terminal Aliases ๐
- Contribution Flow ๐
- 000 - Template
- 014 - Dedicated CI Runner via
svc-runnerRole - 017 - Playwright
bibernon-admin RBAC coverage - 018 - Playwright LDAP authentication coverage
- 023 - Docker Swarm Deployment with NFS-backed Shared Volumes
- User Story
- Context
- Acceptance Criteria
- Mode selection (group-membership trigger)
- Role:
svc-swarm-node - Reverse proxy under Swarm:
svc-prx-openrestystays the edge - Role:
svc-storage-nfs-server - Role:
svc-storage-nfs-client - Docker volume integration
- Docker network integration
- Configuration surface
- Cluster validation
- Pilot role:
web-app-mediawiki - CI: pilot validation workflow
- Tests & Documentation
- Future Extensions
- Procedure
- See Also
- 023 - Setup Penpot
- 024 - ERPNext Role with OIDC SSO
- User Story
- Background
- Confirmed Decisions
- Target Schema
- Acceptance Criteria
- Routing & TLS
- Role layout & image
- Central-service reuse (Decision #7)
- SSO / OIDC (Decisions #4, #5)
- LDAP (V3 variant + V1 dual)
- Email (Decision #8 โ outbound only in v1)
- First-admin bootstrap (Decision #9)
- Variants (Decision #11)
- Backup (Decision #13 โ documented operator command in v1)
- Playwright (Decision #10, per 019)
- Health & quality
- Documentation
- Validation Apps
- Prerequisites
- Implementation Strategy
- Commit Policy
- Context
- 025 - MCP Role Integration
- 025 - Matrix Role Ansible Flavor (matrix-docker-ansible-deploy)
- 026 - Unified Addon Syntax
- User Story
- Background
- Confirmed Decisions
- Current State Audit
- Cross-Role Integration Matrix
- Target Schema
- Acceptance Criteria
- Validation Apps
- Prerequisites
- Implementation Strategy
- Commit Policy
- 027 - Integration Matrix
- 028 - atmo.rsvp (AT Protocol Events) Role + Mobilizon/ActivityPub Bridge
- 028 - Semaphore UI Role with OIDC SSO + LDAP
- 029 - Checkmk Role with oauth2-proxy SSO + LDAP
- 030 - Jellyfin Role with LDAP / OIDC SSO
- 031 - LLM Gateway and Model Backends (LiteLLM)
- 031 - svc-net-tor: Full Tor Onion Node
- User Story
- Model
- Codebase facts (verified; build on these)
- Tor facts (verified upstream)
- Decisions (operator-confirmed; do not re-litigate)
- Target Schema
- Acceptance Criteria
- Onion service extensions (phase 2, layered on a green onion core)
- Out of scope
- Validation
- Prerequisites
- Implementation order
- Commit Policy
- Context
- 032 - Kernel-Isolated AI Agent Employees with Flowise Supervisor
- User Story
- Background
- Confirmed Decisions
- Architecture
- Flowise Supervisor (cross-agent pipelines) โ Phase 2
- Example Scenario (orientation): corporate-design CSS sweep agent
- Example Scenario (orientation): Hermes as an isolated home assistant on a Raspberry Pi
- Example Scenario (orientation): Hermes as an embodied robot platform (full-access, dedicated device)
- Use Cases
- Multi-Node Deployment (Raspberry Pi cluster)
- Where each guarantee is enforced
- Agent identity
- Blocked on hardware and on Phase 2
- Acceptance Criteria
- Cross-linking
- See Also
- 032 - OpenBao Secrets Manager with Keycloak OIDC, RBAC Policies and Static-Seal Auto-Unseal
- User Story
- Background
- Confirmed Decisions
- Target Schema
- Acceptance Criteria
- Role layout & image
- Routing & TLS (Decision #9)
- Deployment modes (Decisions #11, #12, #13)
- Storage & persistence (Decision #3)
- Seal, init & bootstrap (Decisions #1, #2)
- OIDC / Keycloak
- LDAP (Decision #5)
- RBAC / policies (Decision #6)
- Secrets engine & machine identity
- PKI (Decision #4)
- Monitoring (Decision #8)
- Logging
- Backup & restore
- Variants
- Playwright
- Quality & documentation
- Validation Apps
- Prerequisites
- Implementation Strategy
- Commit Policy
- Context
- 033 - Home Assistant Role with MCP Server Surface
- 034 - Embodied Robot Platform for Hermes (svc-ai-robot)
- 035 - MCP Proxy Expansion and Application Interconnection
- 036 - Native AI Gateway Integration
- 037 - Corporate Design Overhaul
- 037 - Gettext Catalogs with LibreTranslate Autotranslation
- 037 - Multi-Network Serving
- 037 - Per-User Agents on Demand from Open WebUI
- 037 - World Monitor Role behind the oauth2-proxy SSO Gate
- 038 - System One Model Router
- 039 - Core i18n Consumers
- 039 - svc-net-wireguard: Test Full Meshes on the Roleโs Own CI Row
- 040 - Translation Gateway
- 042 - Automatic Major Upgrades
- 043 - WireGuard Hub for Compose Deployments
- 044 - Stalwart Imports Every Mailu Mailbox
- 045 - Stack Service: One Shared Service Replaces the Stack Role Includes
- User Story
- Decisions (operator-confirmed 2026-10-24; do not re-litigate)
- Codebase facts (verified on
origin/main6997dd3dbb, 2026-10-24; build on these) - Target Design (binding where it restates a decision; the rest is the starting proposal)
- Acceptance Criteria
- Out of scope
- Validation
- Implementation order
- Commit Policy
- 046 - Custom Roles from Inventory-Declared Sources
- 047 - OpenBao Audit Device
- 061 - Nextcloud Talk high-performance backend from pinned upstream components
- 065 - Shared stack caches and release after rescue
- 066 - Logout everywhere per network and device
- Requirements ๐
- Security guidance ๐
- Security Guidelines ๐ก๏ธ
- Security Guidelines ๐ก๏ธ