Application Categories¶

accounting¶

GnuCash ¶

Free and open-source desktop application for personal and small-business accounting and financial management

Akaunting ¶

Self-hosted platform for online accounting, bookkeeping, and business finance management

acme¶

sys-front-tls-letsencrypt ¶

Let’s Encrypt provider for the front-facing TLS layer ensuring automated certificate issuance and presence

Certbot ¶

ACME client for automated Let’s Encrypt SSL/TLS certificate issuance and renewal via webroot or DNS-01 challenges

NGINX HTTPS Certificate Retrieval ¶

Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

activitypub¶

BookWyrm ¶

Self-hosted federated reading platform for book reviews and reading tracking across the Fediverse

Bridgy Fed ¶

Federation bridge connecting ActivityPub (Fediverse), the AT Protocol (Bluesky), and the IndieWeb

Chess ¶

Federated chess server for playing and following rule-validated games over ActivityPub across the Fediverse

adapter¶

MCP Adapter ¶

Reusable per-provider MCP adapter exposing a narrow allowlisted read surface

adblock¶

web-app-pihole ¶

Network-wide DNS sinkhole for blocking ads and trackers across all devices, with DHCP and a web admin dashboard

admin¶

LiteLLM Admin UI ¶

Browser-facing admin interface for the shared LLM gateway, published on its own domain behind the front proxy

administration¶

Elasticsearch ¶

Central search and analytics engine with per-consumer index namespaces isolating tenants in a shared Docker deployment

MariaDB ¶

Shared relational database server for applications needing central SQL storage, run in Docker

PostgreSQL ¶

Containerized relational database with automated database, user, and privilege provisioning

RabbitMQ ¶

Shared message broker for async messaging with per-consumer virtual host and user isolation

Typesense ¶

Central Dockerized search engine shared by multiple apps with per-consumer scoped API keys

System Maintenance Lock ¶

Locking mechanism for gating maintenance tasks until critical services stop, with configurable retry and timeout

Sudo ¶

Privilege-escalation package and hardened sudoers configuration with /etc/sudoers.d drop-in support

User ¶

Provisioning role for per-user environment setup, managing shell dotfiles and SSH authorized_keys

FusionDirectory ¶

Web-based LDAP administration interface for managing users, groups, and directory objects

administrator¶

Administrator User ¶

Dedicated administrator account with SSH key access and password-authenticated sudo for secure privilege escalation

Root User ¶

Host-level role provisioning a root RSA 4096-bit SSH key pair for secure automated administrative access

agent¶

SSH Agent ¶

Persistent systemd user-service SSH agent for Wayland desktops, with the .ssh config synced from Git

Robot Platform ¶

Embodied robot platform for Hermes on a dedicated, network-segmented single-tenant device

Hermes Agent ¶

Kernel-isolated agent runtime serving an OpenAI-compatible API, routed to models through the shared LLM gateway

OpenClaw ¶

Self-hosted personal AI agent gateway with a browser control UI, sandboxed in a Kata microVM or gVisor runtime

ai¶

LiteLLM Gateway ¶

OpenAI-compatible LLM gateway routing a single /v1 endpoint to local and hosted model backends with per-consumer keys

LM Studio ¶

Headless local model server for open LLMs with an OpenAI-compatible API on the container network

MCP Adapter ¶

Reusable per-provider MCP adapter exposing a narrow allowlisted read surface

Ollama ¶

Self-hosted model server for running open LLMs locally behind a simple HTTP API

sys-svc-mcp-reconcile ¶

End-of-play convergence of every deployed MCP client against the complete provider set

Flowise ¶

Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints

Hermes Agent ¶

Kernel-isolated agent runtime serving an OpenAI-compatible API, routed to models through the shared LLM gateway

LiteLLM Admin UI ¶

Browser-facing admin interface for the shared LLM gateway, published on its own domain behind the front proxy

OpenClaw ¶

Self-hosted personal AI agent gateway with a browser control UI, sandboxed in a Kata microVM or gVisor runtime

Open WebUI ¶

Self-hosted chat interface for interacting with local and private AI models via backends such as Ollama

akaunting¶

Akaunting ¶

Self-hosted platform for online accounting, bookkeeping, and business finance management

alerting¶

Prometheus ¶

Open-source monitoring and alerting toolkit for storing metrics as time-series data and querying them with PromQL

analytics¶

NGINX Matomo Tracking Role ¶

NGINX subfilter injector adding Matomo analytics script and noscript image tracker to served HTML pages

Matomo ¶

Self-hosted, privacy-first web analytics platform for real-time visitor tracking and site metrics

anonymity¶

Torbrowser ¶

Tor network client and browser launcher for anonymous, privacy-focused web browsing

Tor Onion Service ¶

Tor daemon publishing the node as a v3 onion service

ansible¶

sys-token-store ¶

Ansible helper role for idempotent persistence and lookup of per-user application tokens in a local YAML store

Semaphore UI ¶

Web UI and API for running Ansible, Terraform/OpenTofu, and shell automation on a schedule or on demand

Universal Logout ¶

Central logout proxy for single-action sign-out across all OIDC-connected apps, with Nginx snippets and a live status UI

apt¶

Package update ¶

System-maintenance role for refreshing the package index and upgrading installed packages via the OS package manager

archlinux¶

GNOME Desktop ¶

Aggregate desktop environment bundling caffeine, shell extensions, and terminal into a complete GNOME setup on Linux

GNOME Caffeine ¶

Desktop utility for inhibiting screen blanking and sleep, autostarted on the GNOME desktop

LibreOffice ¶

Desktop office suite for documents, spreadsheets, and presentations with Liberation fonts and language packs

Nextcloud Client ️¶

Desktop client setup linking home folders into the cloud-synced directory for integrated file synchronization

RetroArch ¶

Libretro-based frontend for emulators, game engines, and media players, with XMB and Ozone menu styles

Spotify ¶

Desktop client for streaming music, playlists, and podcasts

SSH Agent ¶

Persistent systemd user-service SSH agent for Wayland desktops, with the .ssh config synced from Git

Development Utilities ¶

Base development environment for software engineers on Linux, with core editors and language-agnostic tooling

GCC ¶

Optimizing compiler toolchain for building C, C++, and other native-language programs

Git ¶

Distributed version control system for tracking source code changes and coordinating development work

Make Installation ¶

Package installation for the GNU Make build automation tool on Arch Linux via Pacman

LID Switch Driver ¶

Power-aware systemd logind configuration for predictable laptop lid-close behavior across battery, AC, and docked states

Package Manager Installation ¶

Wrapper role for idempotent package installation and updates through the pkgmgr universal package manager

Backup to External Device ¶

Plug-triggered systemd backup for hard-link deduplicated snapshots of the local backup tree onto a swappable USB device

Docker Healer ¶

Automated recovery service restarting exited or unhealthy Docker Compose stacks and resolving port conflicts

NGINX Domain Setup ¶

Orchestration wrapper for per-domain NGINX provisioning with TLS certificates, vHost templates, and optional OAuth2

Docker Compose ¶

Infrastructure role for managing containerized-application project structures, .env files, and lifecycle handlers

sys-svc-mail ¶

Central mail orchestration role for Infinito.Nexus, integrating Email SaaS, msmtp, and an optional local SMTP relay

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

sys-svc-mail-smtp ¶

Loopback-only Postfix relay for lightweight outbound mail delivery via localhost when no central mail stack runs

NGINX Docker Reverse Proxy ¶

Reverse proxy front-end for Docker-hosted services with automatic TLS, WebSocket support, and per-app vHost templating

Taiga ¶

Open-source agile project management platform for Scrum, Kanban, and hybrid team workflows

arduino¶

Arduino Development Utilities ¶

Workstation toolchain and serial-port permissions for Arduino board development on Linux

asset-management¶

Snipe‑IT ¶

Open-source IT asset management system for tracking hardware and software inventory

assets¶

RetroArch ¶

Libretro-based frontend for emulators, game engines, and media players, with XMB and Ozone menu styles

Content Delivery Network ¶

Versioned asset-tree layout for CDN delivery with shared, vendor, and per-role release directories

Assets Server ¶

Nginx-based server for hosting static assets copied from a source directory to the web data path

Corporate Design ¶

Service-registry role owning the canonical `css` flag and redirecting the CSS hostname to the CDN upstream

assistant¶

OpenClaw ¶

Self-hosted personal AI agent gateway with a browser control UI, sandboxed in a Kata microVM or gVisor runtime

atproto¶

Bridgy Fed ¶

Federation bridge connecting ActivityPub (Fediverse), the AT Protocol (Bluesky), and the IndieWeb

aur¶

Spotify ¶

Desktop client for streaming music, playlists, and podcasts

automation¶

Chromium ¶

Hardened desktop web browser with enforced privacy and password-manager extensions via Enterprise Policies

Dotlinker ¶

Generic role installing the doli CLI and applying dotfile symlink mappings passed in by other roles

GNOME Desktop ¶

Aggregate desktop environment bundling caffeine, shell extensions, and terminal into a complete GNOME setup on Linux

GNOME Extensions Manager ¶

Desktop config role for activating GNOME Shell extensions and installing a CLI tool to manage them

GNOME Terminal ¶

Terminal emulator for the GNOME desktop, giving command-line access on Arch Linux workstations

LibreOffice ¶

Desktop office suite for documents, spreadsheets, and presentations with Liberation fonts and language packs

Nextcloud Client ️¶

Desktop client setup linking home folders into the cloud-synced directory for integrated file synchronization

Make Installation ¶

Package installation for the GNU Make build automation tool on Arch Linux via Pacman

dev-nix ¶

Cross-distribution installer for the Nix package manager with checksum-verified, reproducible multi-user setup

Node.js ¶

JavaScript runtime for building and running server-side applications and developer tooling

npm ¶

Node.js package-manager setup installing npm and optionally running ‘npm ci’ inside a project directory

Kevins Package Manager ¶

Python CLI package manager for cloning multiple code repositories and automating common Git operations

Backup to External Device ¶

Plug-triggered systemd backup for hard-link deduplicated snapshots of the local backup tree onto a swappable USB device

Backup NFS ¶

Scheduled backup job for hard-linked differential rsync snapshots of an NFS export into the local backup tree

Backup Remote Server ¶

Scheduled pull-style backup replicating remote hosts onto this host over SSH and rsync as hard-linked snapshots

Backup Host Secrets ¶

Scheduled deduplicating backup of host secrets, CA, ACME credentials, and node identity to the local backup directory

Backup Docker Volumes ¶

Scheduled deduplicating backup system for Docker container volumes to a local directory, with consistent SQL dumps

Self-Hosted Runner ¶

Self-hosted CI runner infrastructure for executing GitHub Actions workflow jobs in ephemeral Docker containers

sys-cleanup ¶

Cross-distribution maintenance routine for disk reclamation across CI, container, and build environments

Infinito.Nexus CLI ¶

System-wide command-line interface for managing and operating the entire self-hosted platform environment from the shell

Automated Email Alerts for Service Failures ¶

Systemd-triggered msmtp notifier for emailing operators when a monitored service unit fails

Automated Telegram Alerts for Service Failures ¶

Systemd-triggered notifier for delivering service-failure alerts to a Telegram chat

Cleanup Docker Anonymous Volumes ¶

Scheduled maintenance task for reclaiming disk space by removing unused anonymous Docker volumes and their symlinks

Cleanup Backups Service ¶

Scheduled systemd maintenance service for pruning outdated backup versions when disk usage exceeds a threshold

Certbot Reaper ¶

Scheduled cleanup tool for revoking and deleting unused Let’s Encrypt certificates

Cleanup Disc Space ¶

Cleanup routine for reclaiming disk space from temp files, package caches, optional Docker data and old backups

Cleanup Docker Resources ¶

Systemd-driven cleanup service pruning anonymous Docker volumes plus images, containers, networks, and build cache

Cleanup Failed Backups ¶

Scheduled maintenance service for detecting and removing failed Docker backups while keeping recent sets intact

NGINX Certbot Automation ¶

Scheduled systemd-timer job renewing Let’s Encrypt SSL/TLS certificates via Certbot and reloading NGINX afterward

System Btrfs Auto Balancer ¶

Scheduled systemd service and timer for rebalancing Btrfs file systems to keep storage allocation optimal

Docker Auto Restart ¶

Systemd-scheduled maintenance role for full Docker Compose stack restarts, with hard restarts for stacks like Mailu

Docker Healer ¶

Automated recovery service restarting exited or unhealthy Docker Compose stacks and resolving port conflicts

Cloudflare DNS Records ¶

Data-driven role for managing Cloudflare DNS records (A/AAAA, CNAME, MX, TXT, SRV) across apps and environments

sys-dns-wildcards ¶

Provisioning role for Cloudflare wildcard DNS records (*.parent) on parent hosts and the apex domain

Operating System Images ¶

Pins the upstream operating system images the development environment boots each distribution from

Python-Pip ¶

Package manager for installing and managing Python packages on the target host

sys-pip-install ¶

System-wide pip helper for installing or upgrading a Python package via the host’s system Python

sys-service ¶

Infrastructure role for managing systemd service units: cleanup, deployment, timers, and shared failure diagnostics

Front Base (HTTPS + Cloudflare + Handlers)¶

Front-layer base for web apps: HTTPS foundation, optional Cloudflare setup, and reverse-proxy handler wiring

NGINX Domain Setup ¶

Orchestration wrapper for per-domain NGINX provisioning with TLS certificates, vHost templates, and optional OAuth2

Certbot ¶

ACME client for automated Let’s Encrypt SSL/TLS certificate issuance and renewal via webroot or DNS-01 challenges

NGINX HTTPS Certificate Retrieval ¶

Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

Docker Compose ¶

Infrastructure role for managing containerized-application project structures, .env files, and lifecycle handlers

Docker Server ¶

Container engine runtime with Compose for building and running application containers on Linux hosts

sys-svc-dns ¶

Cloudflare DNS bootstrap role for apex and wildcard A/AAAA records (and optional CAA) across a web stack’s base domains

sys-svc-mail ¶

Central mail orchestration role for Infinito.Nexus, integrating Email SaaS, msmtp, and an optional local SMTP relay

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

sys-svc-mail-smtp ¶

Loopback-only Postfix relay for lightweight outbound mail delivery via localhost when no central mail stack runs

NGINX Docker Reverse Proxy ¶

Reverse proxy front-end for Docker-hosted services with automatic TLS, WebSocket support, and per-app vHost templating

Webserver HTTPS Provisioning ¶

NGINX layer for HTTPS with Let’s Encrypt ACME challenge handling, port 80 to 443 redirect, and stale vHost cleanup

Systemd Timer ¶

Systemd timer unit for starting a service on a recurring calendar schedule for automated task execution

System Utility: Git Pull (Shallow & Pinned)¶

Reusable Git pull primitive for shallow clones, detached-safe updates, tag pinning, and reliable change detection

System Version ️¶

Host-level provisioning for exposing the project’s pyproject.toml version system-wide via /etc/environment

Test E2E Cli ¶

Test-harness role running end-to-end CLI test scripts for roles that declare a test environment template

Test: E2E Playwright Runner ¶

Generic end-to-end test runner executing role-provided Playwright specs in Docker against deployed applications

User for Backup Provider ¶

Dedicated system account with SSH-restricted commands and passwordless rsync sudo for secure backup access

Hermes Agent ¶

Kernel-isolated agent runtime serving an OpenAI-compatible API, routed to models through the shared LLM gateway

Home Assistant ¶

Smart-home automation hub with device integrations, dashboards and a built-in MCP server for AI agent access

n8n ¶

Self-hosted low-code automation platform for connecting services and building workflow integrations visually

Presentation ¶

Containerized Reveal.js slide deck for presenting the platform to admins, developers, users, and investors

Nextcloud ¶

Self-hosted cloud platform for file sync, sharing, real-time collaboration, and team workspaces under your own domain

OpenClaw ¶

Self-hosted personal AI agent gateway with a browser control UI, sandboxed in a Kata microVM or gVisor runtime

OpenProject ¶

Self-hosted platform for project management, work-package tracking, Gantt planning, and team collaboration

Semaphore UI ¶

Web UI and API for running Ansible, Terraform/OpenTofu, and shell automation on a schedule or on demand

Sphinx ¶

Documentation generator that builds HTML from a source repository and serves it through a lightweight HTTP server

WordPress ¶

Content management system for building and managing websites, blogs, and multisite networks with themes and plugins

YOURLS ¶

Self-hosted URL shortener for creating, tracking, and managing short links with built-in click analytics

Content Delivery Network ¶

Nginx-based content delivery network for serving shared static assets to internal web applications

File Server ¶

Static file server over HTTPS with directory listing, .well-known handling, and automatic TLS certificates

HTML Server ¶

NGINX vhost for serving static HTML websites over HTTPS with automatic Let’s Encrypt certificates

Asset Mirror (Privacy Proxy)¶

Nginx-based privacy proxy that mirrors whitelisted third-party assets under a first-party domain

autostart¶

GNOME Caffeine ¶

Desktop utility for inhibiting screen blanking and sleep, autostarted on the GNOME desktop

backup¶

Backup to External Device ¶

Plug-triggered systemd backup for hard-link deduplicated snapshots of the local backup tree onto a swappable USB device

Backup NFS ¶

Scheduled backup job for hard-linked differential rsync snapshots of an NFS export into the local backup tree

Backup Remote Server ¶

Scheduled pull-style backup replicating remote hosts onto this host over SSH and rsync as hard-linked snapshots

Backup Host Secrets ¶

Scheduled deduplicating backup of host secrets, CA, ACME credentials, and node identity to the local backup directory

Backup Docker Volumes ¶

Scheduled deduplicating backup system for Docker container volumes to a local directory, with consistent SQL dumps

Cleanup Backups Service ¶

Scheduled systemd maintenance service for pruning outdated backup versions when disk usage exceeds a threshold

Cleanup Failed Backups ¶

Scheduled maintenance service for detecting and removing failed Docker backups while keeping recent sets intact

Database Docker Composition ¶

Docker Compose stack for containerized relational databases with backup, user, and permission management

User for Backup Provider ¶

Dedicated system account with SSH-restricted commands and passwordless rsync sudo for secure backup access

MinIO ¶

Self-hosted S3-compatible object storage for files, media, backups, and AI artifacts

balancing¶

System Btrfs Auto Balancer ¶

Scheduled systemd service and timer for rebalancing Btrfs file systems to keep storage allocation optimal

baserow¶

Baserow ¶

Self-hosted no-code database platform with a spreadsheet-like interface for building and collaborating on data

bash¶

Shell ¶

Host-level configuration linking Bash and Zsh login shells to a shared .profile for consistent environment loading

User ¶

Provisioning role for per-user environment setup, managing shell dotfiles and SSH authorized_keys

bigbluebutton¶

BigBlueButton ¶

Self-hosted web conferencing platform for virtual classrooms, online meetings, and real-time collaboration

blog¶

WordPress ¶

Content management system for building and managing websites, blogs, and multisite networks with themes and plugins

bluesky¶

Bluesky ¶

Self-hosted decentralized social network on the open AT Protocol, with its own Personal Data Server

Bridgy Fed ¶

Federation bridge connecting ActivityPub (Fediverse), the AT Protocol (Bluesky), and the IndieWeb

bluray¶

Blue-ray Disc ¶

Desktop media-player setup with VLC and AACS/BD+ libraries for Blu-ray disc decryption and playback on Arch Linux

books¶

BookWyrm ¶

Self-hosted federated reading platform for book reviews and reading tracking across the Fediverse

bookwyrm¶

BookWyrm ¶

Self-hosted federated reading platform for book reviews and reading tracking across the Fediverse

bootstrap¶

Global CSS Injection for NGINX ¶

Global stylesheet injection for NGINX-served apps, unifying light and dark theming from a dynamic colorscheme

branding¶

Simple Icons ¶

Containerized icon server for hosting the Simple Icons brand SVG and PNG collection for web and documentation use

bridge¶

Bridgy Fed ¶

Federation bridge connecting ActivityPub (Fediverse), the AT Protocol (Bluesky), and the IndieWeb

browser¶

Chromium ¶

Hardened desktop web browser with enforced privacy and password-manager extensions via Enterprise Policies

Firefox ¶

Policy-managed web browser for Arch Linux desktops with auto-installed enterprise extensions

Torbrowser ¶

Tor network client and browser launcher for anonymous, privacy-focused web browsing

Health CSP Crawler ¶

Scheduled health check crawling configured domains for CSP-blocked resources via a Puppeteer-based Node.js checker

btrfs¶

sys-ctl-hlth-btrfs ¶

Scheduled health check for Btrfs filesystems that alerts on non-zero device error counters

System Btrfs Auto Balancer ¶

Scheduled systemd service and timer for rebalancing Btrfs file systems to keep storage allocation optimal

buckets¶

MinIO ¶

Self-hosted S3-compatible object storage for files, media, backups, and AI artifacts

build¶

Base Development Toolchain ¶

Distro-specific base build toolchain (compilers, linkers, make) for compiling software from source

GCC ¶

Optimizing compiler toolchain for building C, C++, and other native-language programs

Make Installation ¶

Package installation for the GNU Make build automation tool on Arch Linux via Pacman

dev-nix ¶

Cross-distribution installer for the Nix package manager with checksum-verified, reproducible multi-user setup

sys-cleanup ¶

Cross-distribution maintenance routine for disk reclamation across CI, container, and build environments

business¶

Odoo ERP ¶

Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management

ca¶

sys-ca-selfsigned ¶

Local self-signed Root CA for issuing trust so containers accept internal TLS endpoints

sys-svc-compose-ca ¶

Helper role installing CA-trust injection assets for Docker Compose stacks and validating the project CA certificate

cache¶

Memcached ¶

Central in-memory caching engine with per-consumer key-prefix isolation, usable centrally or as an embedded sidecar

Redis ¶

In-memory key-value cache and store, shared centrally with per-consumer ACL isolation or embedded as a sidecar

Docker Registry Cache ¶

Cluster-local pull-through cache for shared Docker Hub base-image pulls, cutting duplicate transfers and rate limits

sys-cleanup ¶

Cross-distribution maintenance routine for disk reclamation across CI, container, and build environments

Svc Engine ¶

Engine-agnostic wiring layer for shared cache, queue, search, and vector engines with per-consumer provisioning

Asset Mirror (Privacy Proxy)¶

Nginx-based privacy proxy that mirrors whitelisted third-party assets under a first-party domain

caching¶

Webserver ¶

Core NGINX webserver with HTTP and TCP/UDP stream support and performance-tuned defaults

caffeine¶

GNOME Caffeine ¶

Desktop utility for inhibiting screen blanking and sleep, autostarted on the GNOME desktop

cdn¶

Content Delivery Network ¶

Versioned asset-tree layout for CDN delivery with shared, vendor, and per-role release directories

centos¶

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

central-database¶

MariaDB ¶

Shared relational database server for applications needing central SQL storage, run in Docker

Memcached ¶

Central in-memory caching engine with per-consumer key-prefix isolation, usable centrally or as an embedded sidecar

PostgreSQL ¶

Containerized relational database with automated database, user, and privilege provisioning

Qdrant ¶

Central vector database engine for storing and searching per-consumer embeddings shared across the stack

RabbitMQ ¶

Shared message broker for async messaging with per-consumer virtual host and user isolation

Redis ¶

In-memory key-value cache and store, shared centrally with per-consumer ACL isolation or embedded as a sidecar

Typesense ¶

Central Dockerized search engine shared by multiple apps with per-consumer scoped API keys

Central Database ¶

Centralized MariaDB or PostgreSQL database service shared across applications via Docker Compose

central-engine¶

Elasticsearch ¶

Central search and analytics engine with per-consumer index namespaces isolating tenants in a shared Docker deployment

Unbound ¶

Central recursive/forwarding DNSSEC resolver on a static IP for consumer stacks to target as their DNS

certbot¶

Certbot Reaper ¶

Scheduled cleanup tool for revoking and deleting unused Let’s Encrypt certificates

NGINX Certbot Automation ¶

Scheduled systemd-timer job renewing Let’s Encrypt SSL/TLS certificates via Certbot and reloading NGINX afterward

Certbot ¶

ACME client for automated Let’s Encrypt SSL/TLS certificate issuance and renewal via webroot or DNS-01 challenges

NGINX HTTPS Certificate Retrieval ¶

Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

sys-svc-cln-domains ¶

Cleanup routine for deprecated domains, removing Nginx configs and revoking their Certbot certificates

certificates¶

sys-ca-selfsigned ¶

Local self-signed Root CA for issuing trust so containers accept internal TLS endpoints

sys-front-tls-letsencrypt ¶

Let’s Encrypt provider for the front-facing TLS layer ensuring automated certificate issuance and presence

sys-front-tls-selfsigned ¶

SAN-aware certificate provider generating and storing self-signed TLS certificates for the front-proxy TLS layer

sys-svc-compose-ca ¶

Helper role installing CA-trust injection assets for Docker Compose stacks and validating the project CA certificate

chat¶

Open WebUI ¶

Self-hosted chat interface for interacting with local and private AI models via backends such as Ollama

XMPP ¶

Placeholder stub role for a future XMPP server/container deployment, implementation pending

checkmk¶

Checkmk ¶

Open-source IT and application monitoring server behind SSO with native LDAP user management

chess¶

Chess ¶

Federated chess server for playing and following rule-validated games over ActivityPub across the Fediverse

chromium¶

Chromium ¶

Hardened desktop web browser with enforced privacy and password-manager extensions via Enterprise Policies

ci¶

Self-Hosted Runner ¶

Self-hosted CI runner infrastructure for executing GitHub Actions workflow jobs in ephemeral Docker containers

sys-cleanup ¶

Cross-distribution maintenance routine for disk reclamation across CI, container, and build environments

Jenkins ¶

Open-source automation server for CI/CD pipelines, builds, and plugin-driven deployment workflows

ci-cd¶

Semaphore UI ¶

Web UI and API for running Ansible, Terraform/OpenTofu, and shell automation on a schedule or on demand

ci/cd¶

GitLab ¶

Self-hosted DevOps platform for Git source-code management, CI/CD pipelines, and issue tracking

civic¶

Decidim ¶

Open-source participatory democracy platform for public consultations, civic processes, and community voting

cleanup¶

sys-cleanup ¶

Cross-distribution maintenance routine for disk reclamation across CI, container, and build environments

Cleanup Docker Anonymous Volumes ¶

Scheduled maintenance task for reclaiming disk space by removing unused anonymous Docker volumes and their symlinks

Cleanup Backups Service ¶

Scheduled systemd maintenance service for pruning outdated backup versions when disk usage exceeds a threshold

Certbot Reaper ¶

Scheduled cleanup tool for revoking and deleting unused Let’s Encrypt certificates

Cleanup Disc Space ¶

Cleanup routine for reclaiming disk space from temp files, package caches, optional Docker data and old backups

Cleanup Docker Resources ¶

Systemd-driven cleanup service pruning anonymous Docker volumes plus images, containers, networks, and build cache

Cleanup Failed Backups ¶

Scheduled maintenance service for detecting and removing failed Docker backups while keeping recent sets intact

sys-daemon ¶

Base role for systemd manager configuration via drop-ins, default settings, and unit validation

sys-svc-cln-domains ¶

Cleanup routine for deprecated domains, removing Nginx configs and revoking their Certbot certificates

Docker Server ¶

Container engine runtime with Compose for building and running application containers on Linux hosts

cli¶

CopyQ ¶

Clipboard manager with editable history, custom actions, and scripting support

Jrnl ¶

Command-line journal application for creating and managing personal diary entries from the terminal

micro ¶

Terminal-based text editor with modern keybindings and syntax highlighting for Pacman-based workstations

Neovim ¶

Extensible Vim-based command-line text editor for terminal-driven code and configuration editing

Infinito.Nexus CLI ¶

System-wide command-line interface for managing and operating the entire self-hosted platform environment from the shell

Test E2E Cli ¶

Test-harness role running end-to-end CLI test scripts for roles that declare a test environment template

client¶

Spotify ¶

Desktop client for streaming music, playlists, and podcasts

NFS Client ¶

Client-side NFS setup for mounting a remote server export on every swarm node, with a deploy-time reachability probe

SSH Service (Client)¶

OpenSSH client package for secure remote shell access and key-based authentication

clipboard¶

CopyQ ¶

Clipboard manager with editable history, custom actions, and scripting support

cloud¶

Dotlinker ¶

Generic role installing the doli CLI and applying dotfile symlink mappings passed in by other roles

Nextcloud Client ️¶

Desktop client setup linking home folders into the cloud-synced directory for integrated file synchronization

Nextcloud ¶

Self-hosted cloud platform for file sync, sharing, real-time collaboration, and team workspaces under your own domain

OpenCloud ¶

Self-hosted platform for file sync, sharing, and collaboration with Keycloak SSO and central LDAP directory

cloudflare¶

Cloudflare DNS Records ¶

Data-driven role for managing Cloudflare DNS records (A/AAAA, CNAME, MX, TXT, SRV) across apps and environments

sys-dns-wildcards ¶

Provisioning role for Cloudflare wildcard DNS records (*.parent) on parent hosts and the apex domain

Front Base (HTTPS + Cloudflare + Handlers)¶

Front-layer base for web apps: HTTPS foundation, optional Cloudflare setup, and reverse-proxy handler wiring

sys-svc-dns ¶

Cloudflare DNS bootstrap role for apex and wildcard A/AAAA records (and optional CAA) across a web stack’s base domains

World Wide Web ¶

NGINX server blocks that permanently redirect www subdomains to their non-www apex domains

cluster¶

Docker Swarm Manager ¶

Marker role tagging a host as the Docker Swarm manager node, with the init logic delegated to svc-swarm-node

Docker Swarm ¶

Container orchestration cluster for scheduling services across pooled manager and worker nodes

cms¶

Joomla ¶

Open-source content management system for building websites, intranets, and online applications without writing code

Moodle ¶

Open-source learning management system for creating, managing, and delivering online courses and e-learning

code¶

Collabora ¶

Self-hosted online office backend for real-time in-browser editing of documents, spreadsheets, and presentations

collabora¶

Collabora ¶

Self-hosted online office backend for real-time in-browser editing of documents, spreadsheets, and presentations

collaboration¶

Mattermost ¶

Open-source, self-hosted team messaging platform for real-time collaboration via channels, threads, and integrations

OpenCloud ¶

Self-hosted platform for file sync, sharing, and collaboration with Keycloak SSO and central LDAP directory

Penpot ¶

Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff

colors¶

Global CSS Injection for NGINX ¶

Global stylesheet injection for NGINX-served apps, unifying light and dark theming from a dynamic colorscheme

community¶

Decidim ¶

Open-source participatory democracy platform for public consultations, civic processes, and community voting

Fider ¶

Open-source community feedback platform for collecting, voting on, and prioritizing feature requests and ideas

compiler¶

Base Development Toolchain ¶

Distro-specific base build toolchain (compilers, linkers, make) for compiling software from source

GCC ¶

Optimizing compiler toolchain for building C, C++, and other native-language programs

compose¶

Docker Healer ¶

Automated recovery service restarting exited or unhealthy Docker Compose stacks and resolving port conflicts

Database Docker Composition ¶

Docker Compose stack for containerized relational databases with backup, user, and permission management

Database Docker with Web Proxy ¶

Composite stack role bundling a containerized database backend with an HTTP reverse-proxy frontend for web access

Docker Compose ¶

Infrastructure role for managing containerized-application project structures, .env files, and lifecycle handlers

sys-svc-compose-ca ¶

Helper role installing CA-trust injection assets for Docker Compose stacks and validating the project CA certificate

sys-svc-compose-php ¶

Shared PHP hardening ini and PHP-FPM pool drop-in that PHP services of compose and swarm stacks mount as configs

Checkmk ¶

Open-source IT and application monitoring server behind SSO with native LDAP user management

Jellyfin ¶

Self-hosted media server for streaming and organizing movies, TV, music, and photos, with OIDC and LDAP login

OpenBao ¶

Identity-based secrets, PKI and encryption manager with OIDC login, group-mapped policies and static-seal auto-unseal

OpenProject ¶

Self-hosted platform for project management, work-package tracking, Gantt planning, and team collaboration

PeerTube ¶

Decentralized, federated platform for peer-to-peer video hosting, streaming, and live broadcasting

Penpot ¶

Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff

Semaphore UI ¶

Web UI and API for running Ansible, Terraform/OpenTofu, and shell automation on a schedule or on demand

compression¶

Webserver ¶

Core NGINX webserver with HTTP and TCP/UDP stream support and performance-tuned defaults

conference¶

BigBlueButton ¶

Self-hosted web conferencing platform for virtual classrooms, online meetings, and real-time collaboration

conferencing¶

Zoom ¶

Desktop video conferencing client for online meetings, webinars, and screen sharing

BigBlueButton ¶

Self-hosted web conferencing platform for virtual classrooms, online meetings, and real-time collaboration

Jitsi Meet ¶

Self-hosted WebRTC platform for end-to-end-encryptable video conferencing with federated authentication

OpenTalk ¶

Sovereign open-source video conferencing platform for audio/video calls, screen sharing, breakout rooms, and SSO

configuration¶

Git ¶

Version-control client for personal workstations, preconfigured with identity, signing, and merge defaults

Sudo ¶

Privilege-escalation package and hardened sudoers configuration with /etc/sudoers.d drop-in support

sshd ¶

Hardened OpenSSH daemon configuration for key-based remote access with root login and password authentication disabled

Systemd Timer ¶

Systemd timer unit for starting a service on a recurring calendar schedule for automated task execution

User ¶

Provisioning role for per-user environment setup, managing shell dotfiles and SSH authorized_keys

Administrator User ¶

Dedicated administrator account with SSH key access and password-authenticated sudo for secure privilege escalation

Root User ¶

Host-level role provisioning a root RSA 4096-bit SSH key pair for secure automated administrative access

Workstation User ¶

Provisioning role for a workstation login account with its shell dotfiles, SSH authorized keys, and environment

confluence¶

Confluence ¶

Enterprise wiki and team collaboration platform for creating, organizing, and sharing content

container¶

Docker Compose ¶

Infrastructure role for managing containerized-application project structures, .env files, and lifecycle handlers

Docker Server ¶

Container engine runtime with Compose for building and running application containers on Linux hosts

containers¶

Docker Container Health Check ¶

Systemd-timed monitor for detecting unhealthy or non-zero-exited Docker containers and raising failure alerts

content management¶

Joomla ¶

Open-source content management system for building websites, intranets, and online applications without writing code

copyq¶

CopyQ ¶

Clipboard manager with editable history, custom actions, and scripting support

coturn¶

Coturn ¶

Free and open-source TURN/STUN relay server for NAT traversal in WebRTC and real-time communication

crm¶

ERPNext ¶

Self-hosted open-source ERP suite for finance, CRM, inventory, manufacturing, HR, sales, and projects

EspoCRM ¶

Open-source CRM platform for managing sales, customer interactions, and business processes across teams

Odoo ERP ¶

Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management

SuiteCRM ¶

Open-source CRM platform for sales, service, cases, and campaign management with workflow automation

crypto¶

sys-openssl ¶

Shared host dependency ensuring the OpenSSL CLI is installed once for roles that invoke openssl commands

csp¶

Health CSP Crawler ¶

Scheduled health check crawling configured domains for CSP-blocked resources via a Puppeteer-based Node.js checker

iFrame Notifier for NGINX ¶

Front-end JS injection notifying parent windows of iframe location changes and forcing external links into new tabs

Global JavaScript Injector for NGINX ¶

Global JavaScript injection layer for NGINX HTML responses via sub_filter, with CSP hashing

sys-front-inj-logout ¶

Nginx sub_filter JavaScript injection redirecting all logout actions to a centralized OIDC single sign-out endpoint

css¶

Global CSS Injection for NGINX ¶

Global stylesheet injection for NGINX-served apps, unifying light and dark theming from a dynamic colorscheme

Corporate Design ¶

Service-registry role owning the canonical `css` flag and redirecting the CSS hostname to the CDN upstream

curl¶

Automated Telegram Alerts for Service Failures ¶

Systemd-triggered notifier for delivering service-failure alerts to a Telegram chat

daemon¶

sys-daemon ¶

Base role for systemd manager configuration via drop-ins, default settings, and unit validation

dashboard¶

Fediwall ¶

Self-hosted Fediverse wall for showing recent public posts by hashtag or account in a live masonry grid

data management¶

Baserow ¶

Self-hosted no-code database platform with a spreadsheet-like interface for building and collaborating on data

database¶

MariaDB ¶

Shared relational database server for applications needing central SQL storage, run in Docker

PostgreSQL ¶

Containerized relational database with automated database, user, and privilege provisioning

Qdrant ¶

Central vector database engine for storing and searching per-consumer embeddings shared across the stack

Database Docker Composition ¶

Docker Compose stack for containerized relational databases with backup, user, and permission management

Database Docker with Web Proxy ¶

Composite stack role bundling a containerized database backend with an HTTP reverse-proxy frontend for web access

Central Database ¶

Centralized MariaDB or PostgreSQL database service shared across applications via Docker Compose

databases¶

Baserow ¶

Self-hosted no-code database platform with a spreadsheet-like interface for building and collaborating on data

debian¶

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

decentralization¶

Pixelfed ¶

Decentralized, federated platform for photo sharing and image feeds across the fediverse

decentralized¶

Bluesky ¶

Self-hosted decentralized social network on the open AT Protocol, with its own Personal Data Server

Friendica ¶

Decentralized, federated social-networking platform for peer-to-peer communication and community building

Mastodon ¶

Self-hosted federated social network for microblogging, real-time timelines, and community moderation

Matrix ¶

Federated, end-to-end-encrypted messaging platform with a web client and protocol bridges to external chat networks

PeerTube ¶

Decentralized, federated platform for peer-to-peer video hosting, streaming, and live broadcasting

decidim¶

Decidim ¶

Open-source participatory democracy platform for public consultations, civic processes, and community voting

democracy¶

Decidim ¶

Open-source participatory democracy platform for public consultations, civic processes, and community voting

dependencies¶

MIG ¶

Interactive graph visualization of all Infinito.Nexus roles and their dependencies for architecture transparency

deployment¶

System Utility: Git Pull (Shallow & Pinned)¶

Reusable Git pull primitive for shallow clones, detached-safe updates, tag pinning, and reliable change detection

Presentation ¶

Containerized Reveal.js slide deck for presenting the platform to admins, developers, users, and investors

Sphinx ¶

Documentation generator that builds HTML from a source repository and serves it through a lightweight HTTP server

design¶

Penpot ¶

Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff

desktop¶

Dotlinker ¶

Generic role installing the doli CLI and applying dotfile symlink mappings passed in by other roles

Git ¶

Version-control client for personal workstations, preconfigured with identity, signing, and merge defaults

GNOME Desktop ¶

Aggregate desktop environment bundling caffeine, shell extensions, and terminal into a complete GNOME setup on Linux

Nextcloud Client ️¶

Desktop client setup linking home folders into the cloud-synced directory for integrated file synchronization

development¶

Workstation Docker ¶

Workstation setup for Docker and Docker Compose with the local user in the docker group for rootless development use

Arduino Development Utilities ¶

Workstation toolchain and serial-port permissions for Arduino board development on Linux

Base Development Toolchain ¶

Distro-specific base build toolchain (compilers, linkers, make) for compiling software from source

Development Utilities ¶

Base development environment for software engineers on Linux, with core editors and language-agnostic tooling

Fakeroot ¶

Build-time tool for simulating root-owned file operations without elevated privileges during package builds

GCC ¶

Optimizing compiler toolchain for building C, C++, and other native-language programs

dev-nix ¶

Cross-distribution installer for the Nix package manager with checksum-verified, reproducible multi-user setup

Python Development Utilities ¶

Toolchain for Python scripting, application development, and data science on Linux

Kevins Package Manager ¶

Python CLI package manager for cloning multiple code repositories and automating common Git operations

devops¶

Docker Compose ¶

Infrastructure role for managing containerized-application project structures, .env files, and lifecycle handlers

MinIO ¶

Self-hosted S3-compatible object storage for files, media, backups, and AI artifacts

devtools¶

dev-nix ¶

Cross-distribution installer for the Nix package manager with checksum-verified, reproducible multi-user setup

directory¶

OpenLDAP ¶

Self-hosted LDAP directory service for centralized user, group, and schema management with TLS-secured access

LAM ¶

Web interface for administering LDAP directories: managing users, groups, and other directory objects

discourse¶

Discourse ¶

Open-source discussion and community forum platform with moderation, notifications, and plugin support

discussion¶

Discourse ¶

Open-source discussion and community forum platform with moderation, notifications, and plugin support

disk¶

Cleanup Backups Service ¶

Scheduled systemd maintenance service for pruning outdated backup versions when disk usage exceeds a threshold

Cleanup Disc Space ¶

Cleanup routine for reclaiming disk space from temp files, package caches, optional Docker data and old backups

sys-ctl-hlth-disc-space ¶

Scheduled health check for filesystem disk usage, alerting when any mount exceeds its warning threshold

distribution¶

Operating System Images ¶

Pins the upstream operating system images the development environment boots each distribution from

dnf¶

Package update ¶

System-maintenance role for refreshing the package index and upgrading installed packages via the OS package manager

dns¶

Unbound ¶

Central recursive/forwarding DNSSEC resolver on a static IP for consumer stacks to target as their DNS

Cloudflare DNS Records ¶

Data-driven role for managing Cloudflare DNS records (A/AAAA, CNAME, MX, TXT, SRV) across apps and environments

Hetzner Reverse DNS ¶

Automation role for reverse DNS (PTR) records on Hetzner Cloud servers, primary IPs, floating IPs, and load balancers

sys-dns-wildcards ¶

Provisioning role for Cloudflare wildcard DNS records (*.parent) on parent hosts and the apex domain

sys-svc-dns ¶

Cloudflare DNS bootstrap role for apex and wildcard A/AAAA records (and optional CAA) across a web stack’s base domains

NSS ¶

Local name resolution for the domains the target serves, via the myhostname NSS module

web-app-pihole ¶

Network-wide DNS sinkhole for blocking ads and trackers across all devices, with DHCP and a web admin dashboard

docker¶

Workstation Docker ¶

Workstation setup for Docker and Docker Compose with the local user in the docker group for rootless development use

Backup Remote Server ¶

Scheduled pull-style backup replicating remote hosts onto this host over SSH and rsync as hard-linked snapshots

Backup Docker Volumes ¶

Scheduled deduplicating backup system for Docker container volumes to a local directory, with consistent SQL dumps

Elasticsearch ¶

Central search and analytics engine with per-consumer index namespaces isolating tenants in a shared Docker deployment

MariaDB ¶

Shared relational database server for applications needing central SQL storage, run in Docker

Memcached ¶

Central in-memory caching engine with per-consumer key-prefix isolation, usable centrally or as an embedded sidecar

OpenLDAP ¶

Self-hosted LDAP directory service for centralized user, group, and schema management with TLS-secured access

PostgreSQL ¶

Containerized relational database with automated database, user, and privilege provisioning

Qdrant ¶

Central vector database engine for storing and searching per-consumer embeddings shared across the stack

RabbitMQ ¶

Shared message broker for async messaging with per-consumer virtual host and user isolation

Redis ¶

In-memory key-value cache and store, shared centrally with per-consumer ACL isolation or embedded as a sidecar

Typesense ¶

Central Dockerized search engine shared by multiple apps with per-consumer scoped API keys

Unbound ¶

Central recursive/forwarding DNSSEC resolver on a static IP for consumer stacks to target as their DNS

Storage Optimizer ¶

Tiering role placing Docker volumes on SSD or HDD by workload type, with symlinks keeping paths consistent

OpenResty ¶

NGINX-based web platform and reverse proxy with validated config reloads and Let’s Encrypt integration

Docker Registry Cache ¶

Cluster-local pull-through cache for shared Docker Hub base-image pulls, cutting duplicate transfers and rate limits

Docker Registry ¶

Cluster-local container image registry for serving custom-built images to Docker Swarm worker nodes

Self-Hosted Runner ¶

Self-hosted CI runner infrastructure for executing GitHub Actions workflow jobs in ephemeral Docker containers

Docker Swarm Manager ¶

Marker role tagging a host as the Docker Swarm manager node, with the init logic delegated to svc-swarm-node

Docker Swarm ¶

Container orchestration cluster for scheduling services across pooled manager and worker nodes

Cleanup Docker Anonymous Volumes ¶

Scheduled maintenance task for reclaiming disk space by removing unused anonymous Docker volumes and their symlinks

Cleanup Docker Resources ¶

Systemd-driven cleanup service pruning anonymous Docker volumes plus images, containers, networks, and build cache

Cleanup Failed Backups ¶

Scheduled maintenance service for detecting and removing failed Docker backups while keeping recent sets intact

Docker Container Health Check ¶

Systemd-timed monitor for detecting unhealthy or non-zero-exited Docker containers and raising failure alerts

Container Runtime Health Check ¶

Systemd-timed monitor for containers running PHP below its security floor or without the shared PHP hardening

Docker Volumes Health Check ¶

Health check for orphaned anonymous Docker volumes unbound to containers, with whitelist and alerting

Docker Compose Certificate Sync Service ¶

Systemd service and timer for syncing Let’s Encrypt certificates into Docker Compose NGINX stacks with hot-reload

Docker Auto Restart ¶

Systemd-scheduled maintenance role for full Docker Compose stack restarts, with hard restarts for stacks like Mailu

Docker Healer ¶

Automated recovery service restarting exited or unhealthy Docker Compose stacks and resolving port conflicts

Database Docker Composition ¶

Docker Compose stack for containerized relational databases with backup, user, and permission management

Database Docker with Web Proxy ¶

Composite stack role bundling a containerized database backend with an HTTP reverse-proxy frontend for web access

Docker Compose ¶

Infrastructure role for managing containerized-application project structures, .env files, and lifecycle handlers

sys-svc-compose-ca ¶

Helper role installing CA-trust injection assets for Docker Compose stacks and validating the project CA certificate

sys-svc-compose-php ¶

Shared PHP hardening ini and PHP-FPM pool drop-in that PHP services of compose and swarm stacks mount as configs

Docker Server ¶

Container engine runtime with Compose for building and running application containers on Linux hosts

Svc Engine ¶

Engine-agnostic wiring layer for shared cache, queue, search, and vector engines with per-consumer provisioning

Svc Objstore ¶

Object-storage layer for SeaweedFS/MinIO backend resolution and per-consumer bucket and credential provisioning

NGINX Docker Reverse Proxy ¶

Reverse proxy front-end for Docker-hosted services with automatic TLS, WebSocket support, and per-app vHost templating

Central Database ¶

Centralized MariaDB or PostgreSQL database service shared across applications via Docker Compose

Test: E2E Playwright Runner ¶

Generic end-to-end test runner executing role-provided Playwright specs in Docker against deployed applications

Baserow ¶

Self-hosted no-code database platform with a spreadsheet-like interface for building and collaborating on data

BigBlueButton ¶

Self-hosted web conferencing platform for virtual classrooms, online meetings, and real-time collaboration

Bluesky ¶

Self-hosted decentralized social network on the open AT Protocol, with its own Personal Data Server

Checkmk ¶

Open-source IT and application monitoring server behind SSO with native LDAP user management

Decidim ¶

Open-source participatory democracy platform for public consultations, civic processes, and community voting

Discourse ¶

Open-source discussion and community forum platform with moderation, notifications, and plugin support

ERPNext ¶

Self-hosted open-source ERP suite for finance, CRM, inventory, manufacturing, HR, sales, and projects

Fider ¶

Open-source community feedback platform for collecting, voting on, and prioritizing feature requests and ideas

Friendica ¶

Decentralized, federated social-networking platform for peer-to-peer communication and community building

Funkwhale ¶

Self-hosted, federated platform for sharing, hosting, and streaming your own music and audio library

FusionDirectory ¶

Web-based LDAP administration interface for managing users, groups, and directory objects

Gitea ¶

Lightweight self-hosted Git service for code collaboration, version control, and repository management

GitLab ¶

Self-hosted DevOps platform for Git source-code management, CI/CD pipelines, and issue tracking

Hugo ¶

Static site generator building HTML from an upstream Git repository at build time and serving it via nginx

Jellyfin ¶

Self-hosted media server for streaming and organizing movies, TV, music, and photos, with OIDC and LDAP login

Jitsi Meet ¶

Self-hosted WebRTC platform for end-to-end-encryptable video conferencing with federated authentication

Joomla ¶

Open-source content management system for building websites, intranets, and online applications without writing code

Keycloak ¶

Self-hosted identity and access management platform for single sign-on, multi-factor authentication, and user federation

KIX ¶

Open-source ITSM and helpdesk platform (OTRS fork) for ticketing, CMDB, knowledge base, and reporting

LAM ¶

Web interface for administering LDAP directories: managing users, groups, and other directory objects

Listmonk ¶

Self-hosted platform for newsletters and mailing lists with subscriber segmentation and campaign analytics

LittleJS ¶

Self-hosted HTML5 game sandbox for browsing and running lightweight engine demos and games in the browser

Magento ¶

Self-hosted e-commerce platform for catalog management, checkout, promotions, and multi-store online retail

Mailu ¶

Self-hosted mail server suite with SMTP/IMAP/POP3, webmail, spam filtering, antivirus, DKIM signing, and TLS

Mastodon ¶

Self-hosted federated social network for microblogging, real-time timelines, and community moderation

Matomo ¶

Self-hosted, privacy-first web analytics platform for real-time visitor tracking and site metrics

Matrix ¶

Federated, end-to-end-encrypted messaging platform with a web client and protocol bridges to external chat networks

Mattermost ¶

Open-source, self-hosted team messaging platform for real-time collaboration via channels, threads, and integrations

Mobilizon ¶

Federated, self-hosted platform for organizing events and building communities and groups

Moodle ¶

Open-source learning management system for creating, managing, and delivering online courses and e-learning

n8n ¶

Self-hosted low-code automation platform for connecting services and building workflow integrations visually

Presentation ¶

Containerized Reveal.js slide deck for presenting the platform to admins, developers, users, and investors

Nextcloud ¶

Self-hosted cloud platform for file sync, sharing, real-time collaboration, and team workspaces under your own domain

OpenBao ¶

Identity-based secrets, PKI and encryption manager with OIDC login, group-mapped policies and static-seal auto-unseal

OpenCloud ¶

Self-hosted platform for file sync, sharing, and collaboration with Keycloak SSO and central LDAP directory

OpenProject ¶

Self-hosted platform for project management, work-package tracking, Gantt planning, and team collaboration

OpenTalk ¶

Sovereign open-source video conferencing platform for audio/video calls, screen sharing, breakout rooms, and SSO

PeerTube ¶

Decentralized, federated platform for peer-to-peer video hosting, streaming, and live broadcasting

Penpot ¶

Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff

pgAdmin ¶

Web-based administration and development platform for managing multiple PostgreSQL servers, with optional OAuth2 login

phpldapadmin ¶

Web-based LDAP client for browsing, searching, and administering directory entries in LDAP servers

PhpMyAdmin ¶

Web-based administration tool for MySQL and MariaDB with schema management, querying, and import/export

Pixelfed ¶

Decentralized, federated platform for photo sharing and image feeds across the fediverse

Prometheus ¶

Open-source monitoring and alerting toolkit for storing metrics as time-series data and querying them with PromQL

Roulette Wheel ¶

Browser-based spinning wheel app for decision making, random selection, and gamification

SeaweedFS ¶

Distributed S3-compatible object store for shared, per-consumer bucket provisioning across web-app roles

Semaphore UI ¶

Web UI and API for running Ansible, Terraform/OpenTofu, and shell automation on a schedule or on demand

Sphinx ¶

Documentation generator that builds HTML from a source repository and serves it through a lightweight HTTP server

Stalwart Mail Server ¶

All-in-one Stalwart mail server with SMTP, IMAP, JMAP, POP3, ManageSieve, CalDAV, CardDAV and built-in spam filtering

Taiga ¶

Open-source agile project management platform for Scrum, Kanban, and hybrid team workflows

Wazuh ¶

Open-source SIEM and XDR platform for monitoring, log analysis, intrusion/vulnerability detection, and compliance

WordPress ¶

Content management system for building and managing websites, blogs, and multisite networks with themes and plugins

YOURLS ¶

Self-hosted URL shortener for creating, tracking, and managing short links with built-in click analytics

Zammad ¶

Open-source helpdesk and ticketing system for handling customer requests via email, chat, phone, and web

Collabora ¶

Self-hosted online office backend for real-time in-browser editing of documents, spreadsheets, and presentations

Coturn ¶

Free and open-source TURN/STUN relay server for NAT traversal in WebRTC and real-time communication

Universal Logout ¶

Central logout proxy for single-action sign-out across all OIDC-connected apps, with Nginx snippets and a live status UI

OnlyOffice ¶

Document server backend for real-time in-browser editing of documents, spreadsheets, and presentations

Simple Icons ¶

Containerized icon server for hosting the Simple Icons brand SVG and PNG collection for web and documentation use

documentation¶

Confluence ¶

Enterprise wiki and team collaboration platform for creating, organizing, and sharing content

MediaWiki ¶

Collaborative wiki platform for user-driven documentation with an extensible extension ecosystem and content management

Sphinx ¶

Documentation generator that builds HTML from a source repository and serves it through a lightweight HTTP server

XWiki ¶

Self-hosted enterprise wiki and knowledge-management platform with collaboration and app-based extensibility

documentserver¶

OnlyOffice ¶

Document server backend for real-time in-browser editing of documents, spreadsheets, and presentations

domains¶

sys-svc-cln-domains ¶

Cleanup routine for deprecated domains, removing Nginx configs and revoking their Certbot certificates

Redirector ¶

NGINX glue role for 301 redirects from source to target domains with automatic SSL for the source hosts

dotfiles¶

Dotlinker ¶

Generic role installing the doli CLI and applying dotfile symlink mappings passed in by other roles

Shell ¶

Host-level configuration linking Bash and Zsh login shells to a shared .profile for consistent environment loading

driver¶

Intel Driver ¶

Intel VA-API media driver for hardware-accelerated video decode and encode across Linux distributions

drivers¶

Proprietary Drivers ¶

Proprietary GPU driver installer for Arch-based systems via mhwd nonfree hardware detection

dynamic¶

Global CSS Injection for NGINX ¶

Global stylesheet injection for NGINX-served apps, unifying light and dark theming from a dynamic colorscheme

e-learning¶

Moodle ¶

Open-source learning management system for creating, managing, and delivering online courses and e-learning

e2e¶

Test E2E Cli ¶

Test-harness role running end-to-end CLI test scripts for roles that declare a test environment template

Test: E2E Playwright Runner ¶

Generic end-to-end test runner executing role-provided Playwright specs in Docker against deployed applications

ecommerce¶

Magento ¶

Self-hosted e-commerce platform for catalog management, checkout, promotions, and multi-store online retail

Shopware ¶

Open-source ecommerce platform built on Symfony and Vue.js for building and scaling online storefronts

editor¶

micro ¶

Terminal-based text editor with modern keybindings and syntax highlighting for Pacman-based workstations

Neovim ¶

Extensible Vim-based command-line text editor for terminal-driven code and configuration editing

education¶

Moodle ¶

Open-source learning management system for creating, managing, and delivering online courses and e-learning

elasticsearch¶

Elasticsearch ¶

Central search and analytics engine with per-consumer index namespaces isolating tenants in a shared Docker deployment

Svc Engine ¶

Engine-agnostic wiring layer for shared cache, queue, search, and vector engines with per-consumer provisioning

email¶

Unified Service Failure Notifier ¶

Unified systemd notification service dispatching service-failure alerts through both Telegram and email channels

Automated Email Alerts for Service Failures ¶

Systemd-triggered msmtp notifier for emailing operators when a monitored service unit fails

sys-ctl-hlth-msmtp ¶

Periodic health check for outbound mail delivery, sending a test message via msmtp and alerting on failure

sys-svc-mail ¶

Central mail orchestration role for Infinito.Nexus, integrating Email SaaS, msmtp, and an optional local SMTP relay

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

sys-svc-mail-smtp ¶

Loopback-only Postfix relay for lightweight outbound mail delivery via localhost when no central mail stack runs

Mailu ¶

Self-hosted mail server suite with SMTP/IMAP/POP3, webmail, spam filtering, antivirus, DKIM signing, and TLS

Stalwart Mail Server ¶

All-in-one Stalwart mail server with SMTP, IMAP, JMAP, POP3, ManageSieve, CalDAV, CardDAV and built-in spam filtering

email marketing¶

Listmonk ¶

Self-hosted platform for newsletters and mailing lists with subscriber segmentation and campaign analytics

embedded¶

Arduino Development Utilities ¶

Workstation toolchain and serial-port permissions for Arduino board development on Linux

embodied¶

Robot Platform ¶

Embodied robot platform for Hermes on a dedicated, network-segmented single-tenant device

emulator¶

RetroArch ¶

Libretro-based frontend for emulators, game engines, and media players, with XMB and Ozone menu styles

encrypted¶

Matrix ¶

Federated, end-to-end-encrypted messaging platform with a web client and protocol bridges to external chat networks

encryption¶

Certbot ¶

ACME client for automated Let’s Encrypt SSL/TLS certificate issuance and renewal via webroot or DNS-01 challenges

engine¶

Memcached ¶

Central in-memory caching engine with per-consumer key-prefix isolation, usable centrally or as an embedded sidecar

Redis ¶

In-memory key-value cache and store, shared centrally with per-consumer ACL isolation or embedded as a sidecar

engineering¶

Arduino Development Utilities ¶

Workstation toolchain and serial-port permissions for Arduino board development on Linux

Development Utilities ¶

Base development environment for software engineers on Linux, with core editors and language-agnostic tooling

Python Development Utilities ¶

Toolchain for Python scripting, application development, and data science on Linux

enterprise-policy¶

Chromium ¶

Hardened desktop web browser with enforced privacy and password-manager extensions via Enterprise Policies

Firefox ¶

Policy-managed web browser for Arch Linux desktops with auto-installed enterprise extensions

environment¶

Shell ¶

Host-level configuration linking Bash and Zsh login shells to a shared .profile for consistent environment loading

System Version ️¶

Host-level provisioning for exposing the project’s pyproject.toml version system-wide via /etc/environment

epson¶

Epson Multiprinter Driver ¶

Arch Linux driver bundle for Epson multifunction printing and scanning via escpr and imagescan

erp¶

ERPNext ¶

Self-hosted open-source ERP suite for finance, CRM, inventory, manufacturing, HR, sales, and projects

Odoo ERP ¶

Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management

erpnext¶

ERPNext ¶

Self-hosted open-source ERP suite for finance, CRM, inventory, manufacturing, HR, sales, and projects

espocrm¶

EspoCRM ¶

Open-source CRM platform for managing sales, customer interactions, and business processes across teams

event-management¶

Mobilizon ¶

Federated, self-hosted platform for organizing events and building communities and groups

extensions¶

GNOME Extensions Manager ¶

Desktop config role for activating GNOME Shell extensions and installing a CLI tool to manage them

fakeroot¶

Fakeroot ¶

Build-time tool for simulating root-owned file operations without elevated privileges during package builds

federated¶

Mastodon ¶

Self-hosted federated social network for microblogging, real-time timelines, and community moderation

Matrix ¶

Federated, end-to-end-encrypted messaging platform with a web client and protocol bridges to external chat networks

federation¶

Chess ¶

Federated chess server for playing and following rule-validated games over ActivityPub across the Fediverse

Pixelfed ¶

Decentralized, federated platform for photo sharing and image feeds across the fediverse

fediverse¶

BookWyrm ¶

Self-hosted federated reading platform for book reviews and reading tracking across the Fediverse

Bridgy Fed ¶

Federation bridge connecting ActivityPub (Fediverse), the AT Protocol (Bluesky), and the IndieWeb

Fediwall ¶

Self-hosted Fediverse wall for showing recent public posts by hashtag or account in a live masonry grid

fedora¶

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

feedback¶

Fider ¶

Open-source community feedback platform for collecting, voting on, and prioritizing feature requests and ideas

fider¶

Fider ¶

Open-source community feedback platform for collecting, voting on, and prioritizing feature requests and ideas

figma-alternative¶

Penpot ¶

Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff

file¶

Content Delivery Network ¶

Nginx-based content delivery network for serving shared static assets to internal web applications

File Server ¶

Static file server over HTTPS with directory listing, .well-known handling, and automatic TLS certificates

files¶

OpenCloud ¶

Self-hosted platform for file sync, sharing, and collaboration with Keycloak SSO and central LDAP directory

filesystem¶

sys-ctl-hlth-btrfs ¶

Scheduled health check for Btrfs filesystems that alerts on non-zero device error counters

System Btrfs Auto Balancer ¶

Scheduled systemd service and timer for rebalancing Btrfs file systems to keep storage allocation optimal

finance¶

GnuCash ¶

Free and open-source desktop application for personal and small-business accounting and financial management

Akaunting ¶

Self-hosted platform for online accounting, bookkeeping, and business finance management

ERPNext ¶

Self-hosted open-source ERP suite for finance, CRM, inventory, manufacturing, HR, sales, and projects

Odoo ERP ¶

Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management

firecracker¶

Kata & gVisor ¶

Kernel-isolating container runtimes that sandbox untrusted workloads in a microVM or a userspace kernel

firefox¶

Firefox ¶

Policy-managed web browser for Arch Linux desktops with auto-installed enterprise extensions

firewall¶

Firewall ruleset ¶

nftables packet filter whose rules each role owns as its own table, replaced atomically and reloaded at boot

flask¶

Universal Logout ¶

Central logout proxy for single-action sign-out across all OIDC-connected apps, with Nginx snippets and a live status UI

flowise¶

Flowise ¶

Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints

forum¶

Discourse ¶

Open-source discussion and community forum platform with moderation, notifications, and plugin support

frappe¶

ERPNext ¶

Self-hosted open-source ERP suite for finance, CRM, inventory, manufacturing, HR, sales, and projects

friendica¶

Friendica ¶

Decentralized, federated social-networking platform for peer-to-peer communication and community building

frontend¶

Global CSS Injection for NGINX ¶

Global stylesheet injection for NGINX-served apps, unifying light and dark theming from a dynamic colorscheme

funkwhale¶

Funkwhale ¶

Self-hosted, federated platform for sharing, hosting, and streaming your own music and audio library

fusiondirectory¶

FusionDirectory ¶

Web-based LDAP administration interface for managing users, groups, and directory objects

game¶

LittleJS ¶

Self-hosted HTML5 game sandbox for browsing and running lightweight engine demos and games in the browser

Roulette Wheel ¶

Browser-based spinning wheel app for decision making, random selection, and gamification

gaming¶

RetroArch ¶

Libretro-based frontend for emulators, game engines, and media players, with XMB and Ozone menu styles

gateway¶

LiteLLM Gateway ¶

OpenAI-compatible LLM gateway routing a single /v1 endpoint to local and hosted model backends with per-consumer keys

LiteLLM Admin UI ¶

Browser-facing admin interface for the shared LLM gateway, published on its own domain behind the front proxy

gcc¶

GCC ¶

Optimizing compiler toolchain for building C, C++, and other native-language programs

git¶

Git ¶

Version-control client for personal workstations, preconfigured with identity, signing, and merge defaults

Git ¶

Distributed version control system for tracking source code changes and coordinating development work

Kevins Package Manager ¶

Python CLI package manager for cloning multiple code repositories and automating common Git operations

System Utility: Git Pull (Shallow & Pinned)¶

Reusable Git pull primitive for shallow clones, detached-safe updates, tag pinning, and reliable change detection

Gitea ¶

Lightweight self-hosted Git service for code collaboration, version control, and repository management

gitea¶

Gitea ¶

Lightweight self-hosted Git service for code collaboration, version control, and repository management

github¶

Self-Hosted Runner ¶

Self-hosted CI runner infrastructure for executing GitHub Actions workflow jobs in ephemeral Docker containers

gitlab¶

GitLab ¶

Self-hosted DevOps platform for Git source-code management, CI/CD pipelines, and issue tracking

global¶

Global CSS Injection for NGINX ¶

Global stylesheet injection for NGINX-served apps, unifying light and dark theming from a dynamic colorscheme

Global JavaScript Injector for NGINX ¶

Global JavaScript injection layer for NGINX HTML responses via sub_filter, with CSP hashing

gnome¶

GNOME Desktop ¶

Aggregate desktop environment bundling caffeine, shell extensions, and terminal into a complete GNOME setup on Linux

GNOME Extensions Manager ¶

Desktop config role for activating GNOME Shell extensions and installing a CLI tool to manage them

GNOME Terminal ¶

Terminal emulator for the GNOME desktop, giving command-line access on Arch Linux workstations

SSH Agent ¶

Persistent systemd user-service SSH agent for Wayland desktops, with the .ssh config synced from Git

gnucash¶

GnuCash ¶

Free and open-source desktop application for personal and small-business accounting and financial management

gpio¶

Robot Platform ¶

Embodied robot platform for Hermes on a dedicated, network-segmented single-tenant device

gpu¶

Proprietary Drivers ¶

Proprietary GPU driver installer for Arch-based systems via mhwd nonfree hardware detection

graph¶

MIG ¶

Interactive graph visualization of all Infinito.Nexus roles and their dependencies for architecture transparency

greenlight¶

BigBlueButton ¶

Self-hosted web conferencing platform for virtual classrooms, online meetings, and real-time collaboration

gui¶

CopyQ ¶

Clipboard manager with editable history, custom actions, and scripting support

gvisor¶

Kata & gVisor ¶

Kernel-isolating container runtimes that sandbox untrusted workloads in a microVM or a userspace kernel

hardening¶

sys-svc-compose-php ¶

Shared PHP hardening ini and PHP-FPM pool drop-in that PHP services of compose and swarm stacks mount as configs

health¶

sys-ctl-hlth-btrfs ¶

Scheduled health check for Btrfs filesystems that alerts on non-zero device error counters

Docker Container Health Check ¶

Systemd-timed monitor for detecting unhealthy or non-zero-exited Docker containers and raising failure alerts

Health CSP Crawler ¶

Scheduled health check crawling configured domains for CSP-blocked resources via a Puppeteer-based Node.js checker

sys-ctl-hlth-disc-space ¶

Scheduled health check for filesystem disk usage, alerting when any mount exceeds its warning threshold

sys-ctl-hlth-journalctl ¶

Scheduled health check scanning the systemd journal for daily errors and alerting on matches

sys-ctl-hlth-msmtp ¶

Periodic health check for outbound mail delivery, sending a test message via msmtp and alerting on failure

Docker Volumes Health Check ¶

Health check for orphaned anonymous Docker volumes unbound to containers, with whitelist and alerting

Webserver Health Check ¶

Scheduled health check verifying each NGINX domain returns its expected HTTP status and alerting on deviations

helpdesk¶

KIX ¶

Open-source ITSM and helpdesk platform (OTRS fork) for ticketing, CMDB, knowledge base, and reporting

Zammad ¶

Open-source helpdesk and ticketing system for handling customer requests via email, chat, phone, and web

hermes¶

Robot Platform ¶

Embodied robot platform for Hermes on a dedicated, network-segmented single-tenant device

Hermes Agent ¶

Kernel-isolated agent runtime serving an OpenAI-compatible API, routed to models through the shared LLM gateway

hetzner¶

Hetzner Reverse DNS ¶

Automation role for reverse DNS (PTR) records on Hetzner Cloud servers, primary IPs, floating IPs, and load balancers

hibernate¶

LID Switch Driver ¶

Power-aware systemd logind configuration for predictable laptop lid-close behavior across battery, AC, and docked states

homeassistant¶

Home Assistant ¶

Smart-home automation hub with device integrations, dashboards and a built-in MCP server for AI agent access

homepage¶

Dashboard ¶

Self-hosted portal for unified access to all deployed applications via a customizable tile and menu interface

HTML Server ¶

NGINX vhost for serving static HTML websites over HTTPS with automatic Let’s Encrypt certificates

hostname¶

Hostname ¶

System hostname configuration derived from the inventory host entry

hr¶

ERPNext ¶

Self-hosted open-source ERP suite for finance, CRM, inventory, manufacturing, HR, sales, and projects

Odoo ERP ¶

Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management

html¶

HTML Server ¶

NGINX vhost for serving static HTML websites over HTTPS with automatic Let’s Encrypt certificates

html5¶

LittleJS ¶

Self-hosted HTML5 game sandbox for browsing and running lightweight engine demos and games in the browser

http¶

Webserver Health Check ¶

Scheduled health check verifying each NGINX domain returns its expected HTTP status and alerting on deviations

Webserver ¶

Core NGINX webserver with HTTP and TCP/UDP stream support and performance-tuned defaults

https¶

NGINX Certbot Automation ¶

Scheduled systemd-timer job renewing Let’s Encrypt SSL/TLS certificates via Certbot and reloading NGINX afterward

Front Base (HTTPS + Cloudflare + Handlers)¶

Front-layer base for web apps: HTTPS foundation, optional Cloudflare setup, and reverse-proxy handler wiring

Certbot ¶

ACME client for automated Let’s Encrypt SSL/TLS certificate issuance and renewal via webroot or DNS-01 challenges

NGINX HTTPS Certificate Retrieval ¶

Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

Webserver HTTPS Provisioning ¶

NGINX layer for HTTPS with Let’s Encrypt ACME challenge handling, port 80 to 443 redirect, and stale vHost cleanup

Content Delivery Network ¶

Nginx-based content delivery network for serving shared static assets to internal web applications

File Server ¶

Static file server over HTTPS with directory listing, .well-known handling, and automatic TLS certificates

HTML Server ¶

NGINX vhost for serving static HTML websites over HTTPS with automatic Let’s Encrypt certificates

hugo¶

Hugo ¶

Static site generator building HTML from an upstream Git repository at build time and serving it via nginx

hunspell¶

Hunspell ¶

Multi-language spell checker with configurable dictionary packs for desktop and office text editing

i18n¶

Locales ¶

System configuration role for setting up and generating localesvia locale.gen and locale.conf templates

icons¶

Simple Icons ¶

Containerized icon server for hosting the Simple Icons brand SVG and PNG collection for web and documentation use

identity management¶

OpenLDAP ¶

Self-hosted LDAP directory service for centralized user, group, and schema management with TLS-secured access

Keycloak ¶

Self-hosted identity and access management platform for single sign-on, multi-factor authentication, and user federation

iframe¶

iFrame Notifier for NGINX ¶

Front-end JS injection notifying parent windows of iframe location changes and forcing external links into new tabs

image¶

Operating System Images ¶

Pins the upstream operating system images the development environment boots each distribution from

imprint¶

Imprint ¶

NGINX-served static page rendering a legal imprint (Impressum) from a Jinja2 template

inference¶

LM Studio ¶

Headless local model server for open LLMs with an OpenAI-compatible API on the container network

Ollama ¶

Self-hosted model server for running open LLMs locally behind a simple HTTP API

infinito¶

Package Manager Installation ¶

Wrapper role for idempotent package installation and updates through the pkgmgr universal package manager

sys-ca-selfsigned ¶

Local self-signed Root CA for issuing trust so containers accept internal TLS endpoints

sys-cleanup ¶

Cross-distribution maintenance routine for disk reclamation across CI, container, and build environments

Infinito.Nexus CLI ¶

System-wide command-line interface for managing and operating the entire self-hosted platform environment from the shell

sys-daemon ¶

Base role for systemd manager configuration via drop-ins, default settings, and unit validation

Operating System Images ¶

Pins the upstream operating system images the development environment boots each distribution from

sys-service ¶

Infrastructure role for managing systemd service units: cleanup, deployment, timers, and shared failure diagnostics

sys-service-loader ¶

Central loader role for ordered shared-service preloading and queued post-load role inclusions across the deployment

sys-service-terminator ¶

Deferred-start orchestrator for enabling and starting collected systemd services once a play completes

sys-svc-mcp-reconcile ¶

End-of-play convergence of every deployed MCP client against the complete provider set

System Utility: Git Pull (Shallow & Pinned)¶

Reusable Git pull primitive for shallow clones, detached-safe updates, tag pinning, and reliable change detection

System Version ️¶

Host-level provisioning for exposing the project’s pyproject.toml version system-wide via /etc/environment

Test E2E Cli ¶

Test-harness role running end-to-end CLI test scripts for roles that declare a test environment template

Test: E2E Playwright Runner ¶

Generic end-to-end test runner executing role-provided Playwright specs in Docker against deployed applications

Fediwall ¶

Self-hosted Fediverse wall for showing recent public posts by hashtag or account in a live masonry grid

Hugo ¶

Static site generator building HTML from an upstream Git repository at build time and serving it via nginx

LittleJS ¶

Self-hosted HTML5 game sandbox for browsing and running lightweight engine demos and games in the browser

MIG ¶

Interactive graph visualization of all Infinito.Nexus roles and their dependencies for architecture transparency

Mini-QR ¶

Self-hosted browser tool for generating QR codes from text or URLs with privacy-friendly local rendering

Taiga ¶

Open-source agile project management platform for Scrum, Kanban, and hybrid team workflows

Universal Logout ¶

Central logout proxy for single-action sign-out across all OIDC-connected apps, with Nginx snippets and a live status UI

infinito-nexus¶

dev-nix ¶

Cross-distribution installer for the Nix package manager with checksum-verified, reproducible multi-user setup

infrastructure¶

Docker Compose ¶

Infrastructure role for managing containerized-application project structures, .env files, and lifecycle handlers

Docker Server ¶

Container engine runtime with Compose for building and running application containers on Linux hosts

SSH Service (Client)¶

OpenSSH client package for secure remote shell access and key-based authentication

injection¶

Global JavaScript Injector for NGINX ¶

Global JavaScript injection layer for NGINX HTML responses via sub_filter, with CSP hashing

injector¶

NGINX Global Matomo & Theming Modifier Role ¶

Aggregate NGINX sub-filter injector adding Matomo tracking, global theming, iFrame and JS snippets by feature flag

installation¶

Git ¶

Distributed version control system for tracking source code changes and coordinating development work

Python-Pip ¶

Package manager for installing and managing Python packages on the target host

sys-pip-install ¶

System-wide pip helper for installing or upgrading a Python package via the host’s system Python

integration¶

n8n ¶

Self-hosted low-code automation platform for connecting services and building workflow integrations visually

intel¶

Intel Driver ¶

Intel VA-API media driver for hardware-accelerated video decode and encode across Linux distributions

inventory¶

ERPNext ¶

Self-hosted open-source ERP suite for finance, CRM, inventory, manufacturing, HR, sales, and projects

Odoo ERP ¶

Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management

iot¶

Home Assistant ¶

Smart-home automation hub with device integrations, dashboards and a built-in MCP server for AI agent access

isolation¶

Kata & gVisor ¶

Kernel-isolating container runtimes that sandbox untrusted workloads in a microVM or a userspace kernel

itsm¶

KIX ¶

Open-source ITSM and helpdesk platform (OTRS fork) for ticketing, CMDB, knowledge base, and reporting

Zammad ¶

Open-source helpdesk and ticketing system for handling customer requests via email, chat, phone, and web

java¶

Java ¶

OpenJDK 11 runtime and development kit for Java applications on Pacman-based systems

javascript¶

Node.js ¶

JavaScript runtime for building and running server-side applications and developer tooling

npm ¶

Node.js package-manager setup installing npm and optionally running ‘npm ci’ inside a project directory

iFrame Notifier for NGINX ¶

Front-end JS injection notifying parent windows of iframe location changes and forcing external links into new tabs

Global JavaScript Injector for NGINX ¶

Global JavaScript injection layer for NGINX HTML responses via sub_filter, with CSP hashing

sys-front-inj-logout ¶

Nginx sub_filter JavaScript injection redirecting all logout actions to a centralized OIDC single sign-out endpoint

jdk11¶

Java ¶

OpenJDK 11 runtime and development kit for Java applications on Pacman-based systems

jellyfin¶

Jellyfin ¶

Self-hosted media server for streaming and organizing movies, TV, music, and photos, with OIDC and LDAP login

jenkins¶

Jenkins ¶

Open-source automation server for CI/CD pipelines, builds, and plugin-driven deployment workflows

jira¶

Jira ¶

Issue and project tracking platform for software teams, with agile boards, workflows, and optional OIDC SSO

jitsi¶

Jitsi Meet ¶

Self-hosted WebRTC platform for end-to-end-encryptable video conferencing with federated authentication

joomla¶

Joomla ¶

Open-source content management system for building websites, intranets, and online applications without writing code

journal¶

Jrnl ¶

Command-line journal application for creating and managing personal diary entries from the terminal

journalctl¶

sys-ctl-hlth-journalctl ¶

Scheduled health check scanning the systemd journal for daily errors and alerting on matches

journald¶

Journalctl ¶

Host-level configuration for the systemd-journald logging daemon with retention limits and live log streaming

jrnl¶

Jrnl ¶

Command-line journal application for creating and managing personal diary entries from the terminal

kata¶

Kata & gVisor ¶

Kernel-isolating container runtimes that sandbox untrusted workloads in a microVM or a userspace kernel

keepassxc¶

KeePassXC ¶

Local-first cross-platform desktop password manager storing credentials in an encrypted KeePass-format database

SSH Agent ¶

Persistent systemd user-service SSH agent for Wayland desktops, with the .ssh config synced from Git

kernel-modules¶

Virtual Box ¶

Type-2 hypervisor for virtual machines on Pacman workstations, with kernel modules and extension pack

keycloak¶

Keycloak ¶

Self-hosted identity and access management platform for single sign-on, multi-factor authentication, and user federation

kix¶

KIX ¶

Open-source ITSM and helpdesk platform (OTRS fork) for ticketing, CMDB, knowledge base, and reporting

lam¶

LAM ¶

Web interface for administering LDAP directories: managing users, groups, and other directory objects

landingpage¶

Dashboard ¶

Self-hosted portal for unified access to all deployed applications via a customizable tile and menu interface

language¶

Hunspell ¶

Multi-language spell checker with configurable dictionary packs for desktop and office text editing

laptop¶

LID Switch Driver ¶

Power-aware systemd logind configuration for predictable laptop lid-close behavior across battery, AC, and docked states

ldap¶

OpenLDAP ¶

Self-hosted LDAP directory service for centralized user, group, and schema management with TLS-secured access

BigBlueButton ¶

Self-hosted web conferencing platform for virtual classrooms, online meetings, and real-time collaboration

Checkmk ¶

Open-source IT and application monitoring server behind SSO with native LDAP user management

FusionDirectory ¶

Web-based LDAP administration interface for managing users, groups, and directory objects

Jellyfin ¶

Self-hosted media server for streaming and organizing movies, TV, music, and photos, with OIDC and LDAP login

LAM ¶

Web interface for administering LDAP directories: managing users, groups, and other directory objects

Nextcloud ¶

Self-hosted cloud platform for file sync, sharing, real-time collaboration, and team workspaces under your own domain

OpenBao ¶

Identity-based secrets, PKI and encryption manager with OIDC login, group-mapped policies and static-seal auto-unseal

OpenCloud ¶

Self-hosted platform for file sync, sharing, and collaboration with Keycloak SSO and central LDAP directory

OpenProject ¶

Self-hosted platform for project management, work-package tracking, Gantt planning, and team collaboration

OpenTalk ¶

Sovereign open-source video conferencing platform for audio/video calls, screen sharing, breakout rooms, and SSO

Penpot ¶

Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff

phpldapadmin ¶

Web-based LDAP client for browsing, searching, and administering directory entries in LDAP servers

Semaphore UI ¶

Web UI and API for running Ansible, Terraform/OpenTofu, and shell automation on a schedule or on demand

legal¶

Imprint ¶

NGINX-served static page rendering a legal imprint (Impressum) from a Jinja2 template

letsencrypt¶

Docker Compose Certificate Sync Service ¶

Systemd service and timer for syncing Let’s Encrypt certificates into Docker Compose NGINX stacks with hot-reload

NGINX Certbot Automation ¶

Scheduled systemd-timer job renewing Let’s Encrypt SSL/TLS certificates via Certbot and reloading NGINX afterward

sys-front-tls ¶

Reverse-proxy TLS orchestration layer selecting Let’s Encrypt, self-signed, or disabled certificate providers for Nginx

sys-front-tls-letsencrypt ¶

Let’s Encrypt provider for the front-facing TLS layer ensuring automated certificate issuance and presence

NGINX Domain Setup ¶

Orchestration wrapper for per-domain NGINX provisioning with TLS certificates, vHost templates, and optional OAuth2

Certbot ¶

ACME client for automated Let’s Encrypt SSL/TLS certificate issuance and renewal via webroot or DNS-01 challenges

NGINX HTTPS Certificate Retrieval ¶

Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

sys-svc-dns ¶

Cloudflare DNS bootstrap role for apex and wildcard A/AAAA records (and optional CAA) across a web stack’s base domains

Webserver HTTPS Provisioning ¶

NGINX layer for HTTPS with Let’s Encrypt ACME challenge handling, port 80 to 443 redirect, and stale vHost cleanup

Content Delivery Network ¶

Nginx-based content delivery network for serving shared static assets to internal web applications

File Server ¶

Static file server over HTTPS with directory listing, .well-known handling, and automatic TLS certificates

HTML Server ¶

NGINX vhost for serving static HTML websites over HTTPS with automatic Let’s Encrypt certificates

libreoffice¶

LibreOffice ¶

Desktop office suite for documents, spreadsheets, and presentations with Liberation fonts and language packs

lid¶

LID Switch Driver ¶

Power-aware systemd logind configuration for predictable laptop lid-close behavior across battery, AC, and docked states

lightweight¶

Mini-QR ¶

Self-hosted browser tool for generating QR codes from text or URLs with privacy-friendly local rendering

lint¶

Lint ¶

Release pins for the GitHub-release lint tools the toolchain installs

linux¶

Base Development Toolchain ¶

Distro-specific base build toolchain (compilers, linkers, make) for compiling software from source

Intel Driver ¶

Intel VA-API media driver for hardware-accelerated video decode and encode across Linux distributions

Docker Server ¶

Container engine runtime with Compose for building and running application containers on Linux hosts

listmonk¶

Listmonk ¶

Self-hosted platform for newsletters and mailing lists with subscriber segmentation and campaign analytics

litellm¶

LiteLLM Gateway ¶

OpenAI-compatible LLM gateway routing a single /v1 endpoint to local and hosted model backends with per-consumer keys

Flowise ¶

Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints

LiteLLM Admin UI ¶

Browser-facing admin interface for the shared LLM gateway, published on its own domain behind the front proxy

littlejs¶

LittleJS ¶

Self-hosted HTML5 game sandbox for browsing and running lightweight engine demos and games in the browser

livekit¶

OpenTalk ¶

Sovereign open-source video conferencing platform for audio/video calls, screen sharing, breakout rooms, and SSO

llm¶

LiteLLM Gateway ¶

OpenAI-compatible LLM gateway routing a single /v1 endpoint to local and hosted model backends with per-consumer keys

LM Studio ¶

Headless local model server for open LLMs with an OpenAI-compatible API on the container network

Ollama ¶

Self-hosted model server for running open LLMs locally behind a simple HTTP API

Flowise ¶

Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints

Hermes Agent ¶

Kernel-isolated agent runtime serving an OpenAI-compatible API, routed to models through the shared LLM gateway

LiteLLM Admin UI ¶

Browser-facing admin interface for the shared LLM gateway, published on its own domain behind the front proxy

OpenClaw ¶

Self-hosted personal AI agent gateway with a browser control UI, sandboxed in a Kata microVM or gVisor runtime

Open WebUI ¶

Self-hosted chat interface for interacting with local and private AI models via backends such as Ollama

lmstudio¶

LM Studio ¶

Headless local model server for open LLMs with an OpenAI-compatible API on the container network

local¶

Backup NFS ¶

Scheduled backup job for hard-linked differential rsync snapshots of an NFS export into the local backup tree

Backup Remote Server ¶

Scheduled pull-style backup replicating remote hosts onto this host over SSH and rsync as hard-linked snapshots

Backup Host Secrets ¶

Scheduled deduplicating backup of host secrets, CA, ACME credentials, and node identity to the local backup directory

Backup Docker Volumes ¶

Scheduled deduplicating backup system for Docker container volumes to a local directory, with consistent SQL dumps

locales¶

Locales ¶

System configuration role for setting up and generating localesvia locale.gen and locale.conf templates

lock¶

System Maintenance Lock ¶

Locking mechanism for gating maintenance tasks until critical services stop, with configurable retry and timeout

logging¶

Journalctl ¶

Host-level configuration for the systemd-journald logging daemon with retention limits and live log streaming

logout¶

sys-front-inj-logout ¶

Nginx sub_filter JavaScript injection redirecting all logout actions to a centralized OIDC single sign-out endpoint

Universal Logout ¶

Central logout proxy for single-action sign-out across all OIDC-connected apps, with Nginx snippets and a live status UI

logs¶

sys-ctl-hlth-journalctl ¶

Scheduled health check scanning the systemd journal for daily errors and alerting on matches

low-code¶

n8n ¶

Self-hosted low-code automation platform for connecting services and building workflow integrations visually

magento¶

Magento ¶

Self-hosted e-commerce platform for catalog management, checkout, promotions, and multi-store online retail

mail¶

Tor SMTP Gateway (svc-net-tor-smtp)¶

SMTP gateway that relays .onion recipients through Tor’s SOCKS listener

Cloudflare DNS Records ¶

Data-driven role for managing Cloudflare DNS records (A/AAAA, CNAME, MX, TXT, SRV) across apps and environments

Hetzner Reverse DNS ¶

Automation role for reverse DNS (PTR) records on Hetzner Cloud servers, primary IPs, floating IPs, and load balancers

Postmarks ¶

Single-user ActivityPub bookmarking site federating public bookmarks to Mastodon and the Fediverse

mail server¶

Mailu ¶

Self-hosted mail server suite with SMTP/IMAP/POP3, webmail, spam filtering, antivirus, DKIM signing, and TLS

Stalwart Mail Server ¶

All-in-one Stalwart mail server with SMTP, IMAP, JMAP, POP3, ManageSieve, CalDAV, CardDAV and built-in spam filtering

mailu¶

Mailu ¶

Self-hosted mail server suite with SMTP/IMAP/POP3, webmail, spam filtering, antivirus, DKIM signing, and TLS

maintenance¶

Cleanup Docker Anonymous Volumes ¶

Scheduled maintenance task for reclaiming disk space by removing unused anonymous Docker volumes and their symlinks

Cleanup Docker Resources ¶

Systemd-driven cleanup service pruning anonymous Docker volumes plus images, containers, networks, and build cache

System Maintenance Lock ¶

Locking mechanism for gating maintenance tasks until critical services stop, with configurable retry and timeout

Package update ¶

System-maintenance role for refreshing the package index and upgrading installed packages via the OS package manager

make¶

Make Installation ¶

Package installation for the GNU Make build automation tool on Arch Linux via Pacman

management¶

Infinito.Nexus CLI ¶

System-wide command-line interface for managing and operating the entire self-hosted platform environment from the shell

LAM ¶

Web interface for administering LDAP directories: managing users, groups, and other directory objects

manager¶

CopyQ ¶

Clipboard manager with editable history, custom actions, and scripting support

mariadb¶

MariaDB ¶

Shared relational database server for applications needing central SQL storage, run in Docker

Central Database ¶

Centralized MariaDB or PostgreSQL database service shared across applications via Docker Compose

Magento ¶

Self-hosted e-commerce platform for catalog management, checkout, promotions, and multi-store online retail

PhpMyAdmin ¶

Web-based administration tool for MySQL and MariaDB with schema management, querying, and import/export

marketing¶

Odoo ERP ¶

Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management

mastodon¶

Fediwall ¶

Self-hosted Fediverse wall for showing recent public posts by hashtag or account in a live masonry grid

Mastodon ¶

Self-hosted federated social network for microblogging, real-time timelines, and community moderation

matomo¶

NGINX Global Matomo & Theming Modifier Role ¶

Aggregate NGINX sub-filter injector adding Matomo tracking, global theming, iFrame and JS snippets by feature flag

NGINX Matomo Tracking Role ¶

NGINX subfilter injector adding Matomo analytics script and noscript image tracker to served HTML pages

Matomo ¶

Self-hosted, privacy-first web analytics platform for real-time visitor tracking and site metrics

matrix¶

Matrix ¶

Federated, end-to-end-encrypted messaging platform with a web client and protocol bridges to external chat networks

mattermost¶

Mattermost ¶

Open-source, self-hosted team messaging platform for real-time collaboration via channels, threads, and integrations

mcp¶

MCP Adapter ¶

Reusable per-provider MCP adapter exposing a narrow allowlisted read surface

sys-svc-mcp-reconcile ¶

End-of-play convergence of every deployed MCP client against the complete provider set

Home Assistant ¶

Smart-home automation hub with device integrations, dashboards and a built-in MCP server for AI agent access

media¶

Blue-ray Disc ¶

Desktop media-player setup with VLC and AACS/BD+ libraries for Blu-ray disc decryption and playback on Arch Linux

Intel Driver ¶

Intel VA-API media driver for hardware-accelerated video decode and encode across Linux distributions

Jellyfin ¶

Self-hosted media server for streaming and organizing movies, TV, music, and photos, with OIDC and LDAP login

mediawiki¶

MediaWiki ¶

Collaborative wiki platform for user-driven documentation with an extensible extension ecosystem and content management

meet¶

Jitsi Meet ¶

Self-hosted WebRTC platform for end-to-end-encryptable video conferencing with federated authentication

memcached¶

Memcached ¶

Central in-memory caching engine with per-consumer key-prefix isolation, usable centrally or as an embedded sidecar

messaging¶

Mattermost ¶

Open-source, self-hosted team messaging platform for real-time collaboration via channels, threads, and integrations

meta¶

MIG ¶

Interactive graph visualization of all Infinito.Nexus roles and their dependencies for architecture transparency

metrics¶

Prometheus ¶

Open-source monitoring and alerting toolkit for storing metrics as time-series data and querying them with PromQL

micro¶

micro ¶

Terminal-based text editor with modern keybindings and syntax highlighting for Pacman-based workstations

microblog¶

Mastodon ¶

Self-hosted federated social network for microblogging, real-time timelines, and community moderation

microcontroller¶

Arduino Development Utilities ¶

Workstation toolchain and serial-port permissions for Arduino board development on Linux

microvm¶

Kata & gVisor ¶

Kernel-isolating container runtimes that sandbox untrusted workloads in a microVM or a userspace kernel

mig¶

MIG ¶

Interactive graph visualization of all Infinito.Nexus roles and their dependencies for architecture transparency

minio¶

Svc Objstore ¶

Object-storage layer for SeaweedFS/MinIO backend resolution and per-consumer bucket and credential provisioning

MinIO ¶

Self-hosted S3-compatible object storage for files, media, backups, and AI artifacts

mobilizon¶

Mobilizon ¶

Federated, self-hosted platform for organizing events and building communities and groups

monitor¶

sys-ctl-hlth-btrfs ¶

Scheduled health check for Btrfs filesystems that alerts on non-zero device error counters

Docker Container Health Check ¶

Systemd-timed monitor for detecting unhealthy or non-zero-exited Docker containers and raising failure alerts

sys-ctl-hlth-disc-space ¶

Scheduled health check for filesystem disk usage, alerting when any mount exceeds its warning threshold

sys-ctl-hlth-journalctl ¶

Scheduled health check scanning the systemd journal for daily errors and alerting on matches

sys-ctl-hlth-msmtp ¶

Periodic health check for outbound mail delivery, sending a test message via msmtp and alerting on failure

Container Runtime Health Check ¶

Systemd-timed monitor for containers running PHP below its security floor or without the shared PHP hardening

Docker Volumes Health Check ¶

Health check for orphaned anonymous Docker volumes unbound to containers, with whitelist and alerting

Webserver Health Check ¶

Scheduled health check verifying each NGINX domain returns its expected HTTP status and alerting on deviations

monitoring¶

Health CSP Crawler ¶

Scheduled health check crawling configured domains for CSP-blocked resources via a Puppeteer-based Node.js checker

sys-svc-mail ¶

Central mail orchestration role for Infinito.Nexus, integrating Email SaaS, msmtp, and an optional local SMTP relay

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

sys-svc-mail-smtp ¶

Loopback-only Postfix relay for lightweight outbound mail delivery via localhost when no central mail stack runs

Checkmk ¶

Open-source IT and application monitoring server behind SSO with native LDAP user management

Prometheus ¶

Open-source monitoring and alerting toolkit for storing metrics as time-series data and querying them with PromQL

Wazuh ¶

Open-source SIEM and XDR platform for monitoring, log analysis, intrusion/vulnerability detection, and compliance

moodle¶

Moodle ¶

Open-source learning management system for creating, managing, and delivering online courses and e-learning

msmtp¶

Automated Email Alerts for Service Failures ¶

Systemd-triggered msmtp notifier for emailing operators when a monitored service unit fails

sys-ctl-hlth-msmtp ¶

Periodic health check for outbound mail delivery, sending a test message via msmtp and alerting on failure

sys-svc-mail ¶

Central mail orchestration role for Infinito.Nexus, integrating Email SaaS, msmtp, and an optional local SMTP relay

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

multisite¶

WordPress ¶

Content management system for building and managing websites, blogs, and multisite networks with themes and plugins

music¶

Spotify ¶

Desktop client for streaming music, playlists, and podcasts

Funkwhale ¶

Self-hosted, federated platform for sharing, hosting, and streaming your own music and audio library

n8n¶

n8n ¶

Self-hosted low-code automation platform for connecting services and building workflow integrations visually

neovim¶

Neovim ¶

Extensible Vim-based command-line text editor for terminal-driven code and configuration editing

netfilter¶

Firewall ruleset ¶

nftables packet filter whose rules each role owns as its own table, replaced atomically and reloaded at boot

network¶

WireGuard ¶

Kernel WireGuard tunnels, hub-and-spoke meshes under a swarm manager and full meshes between Compose hosts

web-app-pihole ¶

Network-wide DNS sinkhole for blocking ads and trackers across all devices, with DHCP and a web admin dashboard

networking¶

Tor Onion Service ¶

Tor daemon publishing the node as a v3 onion service

Tor SMTP Gateway (svc-net-tor-smtp)¶

SMTP gateway that relays .onion recipients through Tor’s SOCKS listener

SSH Service (Client)¶

OpenSSH client package for secure remote shell access and key-based authentication

nextcloud¶

Nextcloud Client ️¶

Desktop client setup linking home folders into the cloud-synced directory for integrated file synchronization

Nextcloud ¶

Self-hosted cloud platform for file sync, sharing, real-time collaboration, and team workspaces under your own domain

OnlyOffice ¶

Document server backend for real-time in-browser editing of documents, spreadsheets, and presentations

nfs¶

Backup NFS ¶

Scheduled backup job for hard-linked differential rsync snapshots of an NFS export into the local backup tree

NFS Client ¶

Client-side NFS setup for mounting a remote server export on every swarm node, with a deploy-time reachability probe

NFS Server ¶

Kernel-level NFS server for exporting a shared directory tree with IP-restricted access for swarm-node hosts

nftables¶

Firewall ruleset ¶

nftables packet filter whose rules each role owns as its own table, replaced atomically and reloaded at boot

nginx¶

OpenResty ¶

NGINX-based web platform and reverse proxy with validated config reloads and Let’s Encrypt integration

Webserver Health Check ¶

Scheduled health check verifying each NGINX domain returns its expected HTTP status and alerting on deviations

Docker Compose Certificate Sync Service ¶

Systemd service and timer for syncing Let’s Encrypt certificates into Docker Compose NGINX stacks with hot-reload

NGINX Certbot Automation ¶

Scheduled systemd-timer job renewing Let’s Encrypt SSL/TLS certificates via Certbot and reloading NGINX afterward

NGINX Global Matomo & Theming Modifier Role ¶

Aggregate NGINX sub-filter injector adding Matomo tracking, global theming, iFrame and JS snippets by feature flag

Global CSS Injection for NGINX ¶

Global stylesheet injection for NGINX-served apps, unifying light and dark theming from a dynamic colorscheme

iFrame Notifier for NGINX ¶

Front-end JS injection notifying parent windows of iframe location changes and forcing external links into new tabs

Global JavaScript Injector for NGINX ¶

Global JavaScript injection layer for NGINX HTML responses via sub_filter, with CSP hashing

sys-front-inj-logout ¶

Nginx sub_filter JavaScript injection redirecting all logout actions to a centralized OIDC single sign-out endpoint

NGINX Matomo Tracking Role ¶

NGINX subfilter injector adding Matomo analytics script and noscript image tracker to served HTML pages

sys-front-tls ¶

Reverse-proxy TLS orchestration layer selecting Let’s Encrypt, self-signed, or disabled certificate providers for Nginx

sys-front-tls-letsencrypt ¶

Let’s Encrypt provider for the front-facing TLS layer ensuring automated certificate issuance and presence

sys-front-tls-selfsigned ¶

SAN-aware certificate provider generating and storing self-signed TLS certificates for the front-proxy TLS layer

Front Base (HTTPS + Cloudflare + Handlers)¶

Front-layer base for web apps: HTTPS foundation, optional Cloudflare setup, and reverse-proxy handler wiring

NGINX Domain Setup ¶

Orchestration wrapper for per-domain NGINX provisioning with TLS certificates, vHost templates, and optional OAuth2

Content Delivery Network ¶

Versioned asset-tree layout for CDN delivery with shared, vendor, and per-role release directories

NGINX HTTPS Certificate Retrieval ¶

Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

sys-svc-cln-domains ¶

Cleanup routine for deprecated domains, removing Nginx configs and revoking their Certbot certificates

sys-svc-dns ¶

Cloudflare DNS bootstrap role for apex and wildcard A/AAAA records (and optional CAA) across a web stack’s base domains

NGINX Docker Reverse Proxy ¶

Reverse proxy front-end for Docker-hosted services with automatic TLS, WebSocket support, and per-app vHost templating

Webserver ¶

Core NGINX webserver with HTTP and TCP/UDP stream support and performance-tuned defaults

Webserver HTTPS Provisioning ¶

NGINX layer for HTTPS with Let’s Encrypt ACME challenge handling, port 80 to 443 redirect, and stale vHost cleanup

Hugo ¶

Static site generator building HTML from an upstream Git repository at build time and serving it via nginx

Nextcloud ¶

Self-hosted cloud platform for file sync, sharing, real-time collaboration, and team workspaces under your own domain

Redirector ¶

NGINX glue role for 301 redirects from source to target domains with automatic SSL for the source hosts

World Wide Web ¶

NGINX server blocks that permanently redirect www subdomains to their non-www apex domains

Assets Server ¶

Nginx-based server for hosting static assets copied from a source directory to the web data path

Content Delivery Network ¶

Nginx-based content delivery network for serving shared static assets to internal web applications

Collabora ¶

Self-hosted online office backend for real-time in-browser editing of documents, spreadsheets, and presentations

Corporate Design ¶

Service-registry role owning the canonical `css` flag and redirecting the CSS hostname to the CDN upstream

File Server ¶

Static file server over HTTPS with directory listing, .well-known handling, and automatic TLS certificates

HTML Server ¶

NGINX vhost for serving static HTML websites over HTTPS with automatic Let’s Encrypt certificates

Imprint ¶

NGINX-served static page rendering a legal imprint (Impressum) from a Jinja2 template

Universal Logout ¶

Central logout proxy for single-action sign-out across all OIDC-connected apps, with Nginx snippets and a live status UI

Asset Mirror (Privacy Proxy)¶

Nginx-based privacy proxy that mirrors whitelisted third-party assets under a first-party domain

OnlyOffice ¶

Document server backend for real-time in-browser editing of documents, spreadsheets, and presentations

nix¶

dev-nix ¶

Cross-distribution installer for the Nix package manager with checksum-verified, reproducible multi-user setup

nodejs¶

Node.js ¶

JavaScript runtime for building and running server-side applications and developer tooling

npm ¶

Node.js package-manager setup installing npm and optionally running ‘npm ci’ inside a project directory

Health CSP Crawler ¶

Scheduled health check crawling configured domains for CSP-blocked resources via a Puppeteer-based Node.js checker

Roulette Wheel ¶

Browser-based spinning wheel app for decision making, random selection, and gamification

nonfree¶

Proprietary Drivers ¶

Proprietary GPU driver installer for Arch-based systems via mhwd nonfree hardware detection

notifications¶

Unified Service Failure Notifier ¶

Unified systemd notification service dispatching service-failure alerts through both Telegram and email channels

Automated Email Alerts for Service Failures ¶

Systemd-triggered msmtp notifier for emailing operators when a monitored service unit fails

Automated Telegram Alerts for Service Failures ¶

Systemd-triggered notifier for delivering service-failure alerts to a Telegram chat

notifier¶

Unified Service Failure Notifier ¶

Unified systemd notification service dispatching service-failure alerts through both Telegram and email channels

npm¶

npm ¶

Node.js package-manager setup installing npm and optionally running ‘npm ci’ inside a project directory

nss¶

NSS ¶

Local name resolution for the domains the target serves, via the myhostname NSS module

oauth2¶

NGINX Domain Setup ¶

Orchestration wrapper for per-domain NGINX provisioning with TLS certificates, vHost templates, and optional OAuth2

pgAdmin ¶

Web-based administration and development platform for managing multiple PostgreSQL servers, with optional OAuth2 login

PhpMyAdmin ¶

Web-based administration tool for MySQL and MariaDB with schema management, querying, and import/export

web-app-pihole ¶

Network-wide DNS sinkhole for blocking ads and trackers across all devices, with DHCP and a web admin dashboard

object-storage¶

MinIO ¶

Self-hosted S3-compatible object storage for files, media, backups, and AI artifacts

objectstore¶

Svc Objstore ¶

Object-storage layer for SeaweedFS/MinIO backend resolution and per-consumer bucket and credential provisioning

SeaweedFS ¶

Distributed S3-compatible object store for shared, per-consumer bucket provisioning across web-app roles

obs¶

OBS Studio ¶

Free and open-source desktop application for live video streaming and screen recording

observability¶

Checkmk ¶

Open-source IT and application monitoring server behind SSO with native LDAP user management

odoo¶

Odoo ERP ¶

Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management

office¶

Collabora ¶

Self-hosted online office backend for real-time in-browser editing of documents, spreadsheets, and presentations

OnlyOffice ¶

Document server backend for real-time in-browser editing of documents, spreadsheets, and presentations

office-suite¶

LibreOffice ¶

Desktop office suite for documents, spreadsheets, and presentations with Liberation fonts and language packs

offline¶

LM Studio ¶

Headless local model server for open LLMs with an OpenAI-compatible API on the container network

Ollama ¶

Self-hosted model server for running open LLMs locally behind a simple HTTP API

Open WebUI ¶

Self-hosted chat interface for interacting with local and private AI models via backends such as Ollama

oidc¶

sys-front-inj-logout ¶

Nginx sub_filter JavaScript injection redirecting all logout actions to a centralized OIDC single sign-out endpoint

BigBlueButton ¶

Self-hosted web conferencing platform for virtual classrooms, online meetings, and real-time collaboration

Nextcloud ¶

Self-hosted cloud platform for file sync, sharing, real-time collaboration, and team workspaces under your own domain

OpenBao ¶

Identity-based secrets, PKI and encryption manager with OIDC login, group-mapped policies and static-seal auto-unseal

OpenCloud ¶

Self-hosted platform for file sync, sharing, and collaboration with Keycloak SSO and central LDAP directory

OpenTalk ¶

Sovereign open-source video conferencing platform for audio/video calls, screen sharing, breakout rooms, and SSO

Taiga ¶

Open-source agile project management platform for Scrum, Kanban, and hybrid team workflows

ollama¶

Ollama ¶

Self-hosted model server for running open LLMs locally behind a simple HTTP API

Flowise ¶

Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints

Open WebUI ¶

Self-hosted chat interface for interacting with local and private AI models via backends such as Ollama

onion¶

Tor Onion Service ¶

Tor daemon publishing the node as a v3 onion service

Tor SMTP Gateway (svc-net-tor-smtp)¶

SMTP gateway that relays .onion recipients through Tor’s SOCKS listener

onlyoffice¶

OnlyOffice ¶

Document server backend for real-time in-browser editing of documents, spreadsheets, and presentations

open-source¶

Discourse ¶

Open-source discussion and community forum platform with moderation, notifications, and plugin support

Matomo ¶

Self-hosted, privacy-first web analytics platform for real-time visitor tracking and site metrics

Mobilizon ¶

Federated, self-hosted platform for organizing events and building communities and groups

PeerTube ¶

Decentralized, federated platform for peer-to-peer video hosting, streaming, and live broadcasting

openbao¶

OpenBao ¶

Identity-based secrets, PKI and encryption manager with OIDC login, group-mapped policies and static-seal auto-unseal

openclaw¶

OpenClaw ¶

Self-hosted personal AI agent gateway with a browser control UI, sandboxed in a Kata microVM or gVisor runtime

opencloud¶

OpenCloud ¶

Self-hosted platform for file sync, sharing, and collaboration with Keycloak SSO and central LDAP directory

openid¶

Taiga ¶

Open-source agile project management platform for Scrum, Kanban, and hybrid team workflows

openjdk¶

Java ¶

OpenJDK 11 runtime and development kit for Java applications on Pacman-based systems

openldap¶

OpenLDAP ¶

Self-hosted LDAP directory service for centralized user, group, and schema management with TLS-secured access

openproject¶

OpenProject ¶

Self-hosted platform for project management, work-package tracking, Gantt planning, and team collaboration

openresty¶

OpenResty ¶

NGINX-based web platform and reverse proxy with validated config reloads and Let’s Encrypt integration

opensearch¶

Magento ¶

Self-hosted e-commerce platform for catalog management, checkout, promotions, and multi-store online retail

Wazuh ¶

Open-source SIEM and XDR platform for monitoring, log analysis, intrusion/vulnerability detection, and compliance

openssh¶

SSH Service (Client)¶

OpenSSH client package for secure remote shell access and key-based authentication

openssl¶

sys-ca-selfsigned ¶

Local self-signed Root CA for issuing trust so containers accept internal TLS endpoints

sys-front-tls-selfsigned ¶

SAN-aware certificate provider generating and storing self-signed TLS certificates for the front-proxy TLS layer

sys-openssl ¶

Shared host dependency ensuring the OpenSSL CLI is installed once for roles that invoke openssl commands

opentalk¶

OpenTalk ¶

Sovereign open-source video conferencing platform for audio/video calls, screen sharing, breakout rooms, and SSO

openwebui¶

Open WebUI ¶

Self-hosted chat interface for interacting with local and private AI models via backends such as Ollama

optimization¶

Storage Optimizer ¶

Tiering role placing Docker volumes on SSD or HDD by workload type, with symlinks keeping paths consistent

orchestration¶

Docker Swarm ¶

Container orchestration cluster for scheduling services across pooled manager and worker nodes

Flowise ¶

Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints

os¶

Operating System Images ¶

Pins the upstream operating system images the development environment boots each distribution from

package¶

Package Manager Installation ¶

Wrapper role for idempotent package installation and updates through the pkgmgr universal package manager

sys-openssl ¶

Shared host dependency ensuring the OpenSSL CLI is installed once for roles that invoke openssl commands

Python-Pip ¶

Package manager for installing and managing Python packages on the target host

sys-pip-install ¶

System-wide pip helper for installing or upgrading a Python package via the host’s system Python

package-management¶

Base Development Toolchain ¶

Distro-specific base build toolchain (compilers, linkers, make) for compiling software from source

pacman¶

Git ¶

Version-control client for personal workstations, preconfigured with identity, signing, and merge defaults

Git ¶

Distributed version control system for tracking source code changes and coordinating development work

Package update ¶

System-maintenance role for refreshing the package index and upgrading installed packages via the OS package manager

participation¶

Decidim ¶

Open-source participatory democracy platform for public consultations, civic processes, and community voting

passwords¶

KeePassXC ¶

Local-first cross-platform desktop password manager storing credentials in an encrypted KeePass-format database

peertube¶

PeerTube ¶

Decentralized, federated platform for peer-to-peer video hosting, streaming, and live broadcasting

penpot¶

Penpot ¶

Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff

performance¶

Storage Optimizer ¶

Tiering role placing Docker volumes on SSD or HDD by workload type, with symlinks keeping paths consistent

Swapfile ¶

On-target automation for creating and activating swap space via a cloned swapfile script

Webserver ¶

Core NGINX webserver with HTTP and TCP/UDP stream support and performance-tuned defaults

persona¶

Arduino Development Utilities ¶

Workstation toolchain and serial-port permissions for Arduino board development on Linux

Development Utilities ¶

Base development environment for software engineers on Linux, with core editors and language-agnostic tooling

Python Development Utilities ¶

Toolchain for Python scripting, application development, and data science on Linux

pgadmin¶

pgAdmin ¶

Web-based administration and development platform for managing multiple PostgreSQL servers, with optional OAuth2 login

php¶

Container Runtime Health Check ¶

Systemd-timed monitor for containers running PHP below its security floor or without the shared PHP hardening

sys-svc-compose-php ¶

Shared PHP hardening ini and PHP-FPM pool drop-in that PHP services of compose and swarm stacks mount as configs

Magento ¶

Self-hosted e-commerce platform for catalog management, checkout, promotions, and multi-store online retail

Nextcloud ¶

Self-hosted cloud platform for file sync, sharing, real-time collaboration, and team workspaces under your own domain

phpldapadmin¶

phpldapadmin ¶

Web-based LDAP client for browsing, searching, and administering directory entries in LDAP servers

phpmyadmin¶

PhpMyAdmin ¶

Web-based administration tool for MySQL and MariaDB with schema management, querying, and import/export

pihole¶

web-app-pihole ¶

Network-wide DNS sinkhole for blocking ads and trackers across all devices, with DHCP and a web admin dashboard

pip¶

Python Development Utilities ¶

Toolchain for Python scripting, application development, and data science on Linux

Python-Pip ¶

Package manager for installing and managing Python packages on the target host

sys-pip-install ¶

System-wide pip helper for installing or upgrading a Python package via the host’s system Python

pixelfed¶

Pixelfed ¶

Decentralized, federated platform for photo sharing and image feeds across the fediverse

pkgmgr¶

Kevins Package Manager ¶

Python CLI package manager for cloning multiple code repositories and automating common Git operations

Cleanup Docker Anonymous Volumes ¶

Scheduled maintenance task for reclaiming disk space by removing unused anonymous Docker volumes and their symlinks

pki¶

OpenBao ¶

Identity-based secrets, PKI and encryption manager with OIDC login, group-mapped policies and static-seal auto-unseal

playwright¶

Test: E2E Playwright Runner ¶

Generic end-to-end test runner executing role-provided Playwright specs in Docker against deployed applications

png¶

Simple Icons ¶

Containerized icon server for hosting the Simple Icons brand SVG and PNG collection for web and documentation use

portfolio¶

Dashboard ¶

Self-hosted portal for unified access to all deployed applications via a customizable tile and menu interface

postfix¶

sys-svc-mail ¶

Central mail orchestration role for Infinito.Nexus, integrating Email SaaS, msmtp, and an optional local SMTP relay

sys-svc-mail-smtp ¶

Loopback-only Postfix relay for lightweight outbound mail delivery via localhost when no central mail stack runs

postgresql¶

PostgreSQL ¶

Containerized relational database with automated database, user, and privilege provisioning

Central Database ¶

Centralized MariaDB or PostgreSQL database service shared across applications via Docker Compose

pgAdmin ¶

Web-based administration and development platform for managing multiple PostgreSQL servers, with optional OAuth2 login

PhpMyAdmin ¶

Web-based administration tool for MySQL and MariaDB with schema management, querying, and import/export

postmarks¶

Postmarks ¶

Single-user ActivityPub bookmarking site federating public bookmarks to Mastodon and the Fediverse

postMessage¶

iFrame Notifier for NGINX ¶

Front-end JS injection notifying parent windows of iframe location changes and forcing external links into new tabs

power¶

LID Switch Driver ¶

Power-aware systemd logind configuration for predictable laptop lid-close behavior across battery, AC, and docked states

presentation¶

Presentation ¶

Containerized Reveal.js slide deck for presenting the platform to admins, developers, users, and investors

pretix¶

Pretix ¶

Self-hosted ticketing platform for events with online sales, registration management, and secure payments

printer¶

Epson Multiprinter Driver ¶

Arch Linux driver bundle for Epson multifunction printing and scanning via escpr and imagescan

privacy¶

Torbrowser ¶

Tor network client and browser launcher for anonymous, privacy-focused web browsing

Ollama ¶

Self-hosted model server for running open LLMs locally behind a simple HTTP API

Tor Onion Service ¶

Tor daemon publishing the node as a v3 onion service

Mini-QR ¶

Self-hosted browser tool for generating QR codes from text or URLs with privacy-friendly local rendering

MinIO ¶

Self-hosted S3-compatible object storage for files, media, backups, and AI artifacts

Open WebUI ¶

Self-hosted chat interface for interacting with local and private AI models via backends such as Ollama

web-app-pihole ¶

Network-wide DNS sinkhole for blocking ads and trackers across all devices, with DHCP and a web admin dashboard

Asset Mirror (Privacy Proxy)¶

Nginx-based privacy proxy that mirrors whitelisted third-party assets under a first-party domain

profile¶

Shell ¶

Host-level configuration linking Bash and Zsh login shells to a shared .profile for consistent environment loading

project management¶

Jira ¶

Issue and project tracking platform for software teams, with agile boards, workflows, and optional OIDC SSO

project-management¶

OpenProject ¶

Self-hosted platform for project management, work-package tracking, Gantt planning, and team collaboration

Taiga ¶

Open-source agile project management platform for Scrum, Kanban, and hybrid team workflows

prometheus¶

Prometheus ¶

Open-source monitoring and alerting toolkit for storing metrics as time-series data and querying them with PromQL

prototyping¶

Penpot ¶

Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff

proxy¶

LiteLLM Gateway ¶

OpenAI-compatible LLM gateway routing a single /v1 endpoint to local and hosted model backends with per-consumer keys

MCP Adapter ¶

Reusable per-provider MCP adapter exposing a narrow allowlisted read surface

Database Docker with Web Proxy ¶

Composite stack role bundling a containerized database backend with an HTTP reverse-proxy frontend for web access

Asset Mirror (Privacy Proxy)¶

Nginx-based privacy proxy that mirrors whitelisted third-party assets under a first-party domain

prune¶

Cleanup Docker Resources ¶

Systemd-driven cleanup service pruning anonymous Docker volumes plus images, containers, networks, and build cache

ptr¶

Hetzner Reverse DNS ¶

Automation role for reverse DNS (PTR) records on Hetzner Cloud servers, primary IPs, floating IPs, and load balancers

puppeteer¶

Health CSP Crawler ¶

Scheduled health check crawling configured domains for CSP-blocked resources via a Puppeteer-based Node.js checker

python¶

Python Development Utilities ¶

Toolchain for Python scripting, application development, and data science on Linux

Python-Pip ¶

Package manager for installing and managing Python packages on the target host

sys-pip-install ¶

System-wide pip helper for installing or upgrading a Python package via the host’s system Python

qbittorrent¶

QBittorrent ¶

Open-source desktop BitTorrent client for downloading and sharing files over the BitTorrent protocol

qdrant¶

Qdrant ¶

Central vector database engine for storing and searching per-consumer embeddings shared across the stack

Flowise ¶

Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints

qr¶

Mini-QR ¶

Self-hosted browser tool for generating QR codes from text or URLs with privacy-friendly local rendering

queue¶

RabbitMQ ¶

Shared message broker for async messaging with per-consumer virtual host and user isolation

rabbitmq¶

RabbitMQ ¶

Shared message broker for async messaging with per-consumer virtual host and user isolation

Svc Engine ¶

Engine-agnostic wiring layer for shared cache, queue, search, and vector engines with per-consumer provisioning

rag¶

Flowise ¶

Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints

rdbms¶

Database Docker Composition ¶

Docker Compose stack for containerized relational databases with backup, user, and permission management

rdns¶

Hetzner Reverse DNS ¶

Automation role for reverse DNS (PTR) records on Hetzner Cloud servers, primary IPs, floating IPs, and load balancers

reading¶

BookWyrm ¶

Self-hosted federated reading platform for book reviews and reading tracking across the Fediverse

real-time¶

Matrix ¶

Federated, end-to-end-encrypted messaging platform with a web client and protocol bridges to external chat networks

realtime¶

Coturn ¶

Free and open-source TURN/STUN relay server for NAT traversal in WebRTC and real-time communication

recording¶

OBS Studio ¶

Free and open-source desktop application for live video streaming and screen recording

records¶

Cloudflare DNS Records ¶

Data-driven role for managing Cloudflare DNS records (A/AAAA, CNAME, MX, TXT, SRV) across apps and environments

redirect¶

Redirector ¶

NGINX glue role for 301 redirects from source to target domains with automatic SSL for the source hosts

World Wide Web ¶

NGINX server blocks that permanently redirect www subdomains to their non-www apex domains

redis¶

Redis ¶

In-memory key-value cache and store, shared centrally with per-consumer ACL isolation or embedded as a sidecar

Svc Engine ¶

Engine-agnostic wiring layer for shared cache, queue, search, and vector engines with per-consumer provisioning

registry¶

Docker Registry Cache ¶

Cluster-local pull-through cache for shared Docker Hub base-image pulls, cutting duplicate transfers and rate limits

Docker Registry ¶

Cluster-local container image registry for serving custom-built images to Docker Swarm worker nodes

relay¶

sys-svc-mail-smtp ¶

Loopback-only Postfix relay for lightweight outbound mail delivery via localhost when no central mail stack runs

remote¶

Backup Remote Server ¶

Scheduled pull-style backup replicating remote hosts onto this host over SSH and rsync as hard-linked snapshots

repositories¶

Kevins Package Manager ¶

Python CLI package manager for cloning multiple code repositories and automating common Git operations

resolver¶

Unbound ¶

Central recursive/forwarding DNSSEC resolver on a static IP for consumer stacks to target as their DNS

restart¶

Docker Auto Restart ¶

Systemd-scheduled maintenance role for full Docker Compose stack restarts, with hard restarts for stacks like Mailu

retroarch¶

RetroArch ¶

Libretro-based frontend for emulators, game engines, and media players, with XMB and Ozone menu styles

revealjs¶

Presentation ¶

Containerized Reveal.js slide deck for presenting the platform to admins, developers, users, and investors

reverse_proxy¶

OpenResty ¶

NGINX-based web platform and reverse proxy with validated config reloads and Let’s Encrypt integration

sys-front-tls ¶

Reverse-proxy TLS orchestration layer selecting Let’s Encrypt, self-signed, or disabled certificate providers for Nginx

NGINX Docker Reverse Proxy ¶

Reverse proxy front-end for Docker-hosted services with automatic TLS, WebSocket support, and per-app vHost templating

robotics¶

Robot Platform ¶

Embodied robot platform for Hermes on a dedicated, network-segmented single-tenant device

roles¶

Content Delivery Network ¶

Versioned asset-tree layout for CDN delivery with shared, vendor, and per-role release directories

root¶

Root User ¶

Host-level role provisioning a root RSA 4096-bit SSH key pair for secure automated administrative access

roulette¶

Roulette Wheel ¶

Browser-based spinning wheel app for decision making, random selection, and gamification

runner¶

Self-Hosted Runner ¶

Self-hosted CI runner infrastructure for executing GitHub Actions workflow jobs in ephemeral Docker containers

runtime¶

Node.js ¶

JavaScript runtime for building and running server-side applications and developer tooling

s3¶

Svc Objstore ¶

Object-storage layer for SeaweedFS/MinIO backend resolution and per-consumer bucket and credential provisioning

MinIO ¶

Self-hosted S3-compatible object storage for files, media, backups, and AI artifacts

SeaweedFS ¶

Distributed S3-compatible object store for shared, per-consumer bucket provisioning across web-app roles

sales¶

ERPNext ¶

Self-hosted open-source ERP suite for finance, CRM, inventory, manufacturing, HR, sales, and projects

EspoCRM ¶

Open-source CRM platform for managing sales, customer interactions, and business processes across teams

Odoo ERP ¶

Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management

Pretix ¶

Self-hosted ticketing platform for events with online sales, registration management, and secure payments

SuiteCRM ¶

Open-source CRM platform for sales, service, cases, and campaign management with workflow automation

sandbox¶

Kata & gVisor ¶

Kernel-isolating container runtimes that sandbox untrusted workloads in a microVM or a userspace kernel

scanner¶

Epson Multiprinter Driver ¶

Arch Linux driver bundle for Epson multifunction printing and scanning via escpr and imagescan

scheduling¶

Systemd Timer ¶

Systemd timer unit for starting a service on a recurring calendar schedule for automated task execution

search¶

Elasticsearch ¶

Central search and analytics engine with per-consumer index namespaces isolating tenants in a shared Docker deployment

Typesense ¶

Central Dockerized search engine shared by multiple apps with per-consumer scoped API keys

seaweedfs¶

SeaweedFS ¶

Distributed S3-compatible object store for shared, per-consumer bucket provisioning across web-app roles

secrets¶

Backup Host Secrets ¶

Scheduled deduplicating backup of host secrets, CA, ACME credentials, and node identity to the local backup directory

sys-token-store ¶

Ansible helper role for idempotent persistence and lookup of per-user application tokens in a local YAML store

OpenBao ¶

Identity-based secrets, PKI and encryption manager with OIDC login, group-mapped policies and static-seal auto-unseal

security¶

Chromium ¶

Hardened desktop web browser with enforced privacy and password-manager extensions via Enterprise Policies

KeePassXC ¶

Local-first cross-platform desktop password manager storing credentials in an encrypted KeePass-format database

MCP Adapter ¶

Reusable per-provider MCP adapter exposing a narrow allowlisted read surface

Firewall ruleset ¶

nftables packet filter whose rules each role owns as its own table, replaced atomically and reloaded at boot

Container Runtime Health Check ¶

Systemd-timed monitor for containers running PHP below its security floor or without the shared PHP hardening

iFrame Notifier for NGINX ¶

Front-end JS injection notifying parent windows of iframe location changes and forcing external links into new tabs

Sudo ¶

Privilege-escalation package and hardened sudoers configuration with /etc/sudoers.d drop-in support

sys-svc-compose-php ¶

Shared PHP hardening ini and PHP-FPM pool drop-in that PHP services of compose and swarm stacks mount as configs

SSH Service (Client)¶

OpenSSH client package for secure remote shell access and key-based authentication

sshd ¶

Hardened OpenSSH daemon configuration for key-based remote access with root login and password authentication disabled

Webserver ¶

Core NGINX webserver with HTTP and TCP/UDP stream support and performance-tuned defaults

Webserver HTTPS Provisioning ¶

NGINX layer for HTTPS with Let’s Encrypt ACME challenge handling, port 80 to 443 redirect, and stale vHost cleanup

sys-token-store ¶

Ansible helper role for idempotent persistence and lookup of per-user application tokens in a local YAML store

Administrator User ¶

Dedicated administrator account with SSH key access and password-authenticated sudo for secure privilege escalation

User for Backup Provider ¶

Dedicated system account with SSH-restricted commands and passwordless rsync sudo for secure backup access

Root User ¶

Host-level role provisioning a root RSA 4096-bit SSH key pair for secure automated administrative access

Wazuh ¶

Open-source SIEM and XDR platform for monitoring, log analysis, intrusion/vulnerability detection, and compliance

self-hosted¶

LiteLLM Gateway ¶

OpenAI-compatible LLM gateway routing a single /v1 endpoint to local and hosted model backends with per-consumer keys

LM Studio ¶

Headless local model server for open LLMs with an OpenAI-compatible API on the container network

MCP Adapter ¶

Reusable per-provider MCP adapter exposing a narrow allowlisted read surface

Ollama ¶

Self-hosted model server for running open LLMs locally behind a simple HTTP API

Robot Platform ¶

Embodied robot platform for Hermes on a dedicated, network-segmented single-tenant device

Tor Onion Service ¶

Tor daemon publishing the node as a v3 onion service

Tor SMTP Gateway (svc-net-tor-smtp)¶

SMTP gateway that relays .onion recipients through Tor’s SOCKS listener

Decidim ¶

Open-source participatory democracy platform for public consultations, civic processes, and community voting

Fider ¶

Open-source community feedback platform for collecting, voting on, and prioritizing feature requests and ideas

Flowise ¶

Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints

Funkwhale ¶

Self-hosted, federated platform for sharing, hosting, and streaming your own music and audio library

Gitea ¶

Lightweight self-hosted Git service for code collaboration, version control, and repository management

GitLab ¶

Self-hosted DevOps platform for Git source-code management, CI/CD pipelines, and issue tracking

Hermes Agent ¶

Kernel-isolated agent runtime serving an OpenAI-compatible API, routed to models through the shared LLM gateway

Home Assistant ¶

Smart-home automation hub with device integrations, dashboards and a built-in MCP server for AI agent access

Joomla ¶

Open-source content management system for building websites, intranets, and online applications without writing code

Keycloak ¶

Self-hosted identity and access management platform for single sign-on, multi-factor authentication, and user federation

Listmonk ¶

Self-hosted platform for newsletters and mailing lists with subscriber segmentation and campaign analytics

LiteLLM Admin UI ¶

Browser-facing admin interface for the shared LLM gateway, published on its own domain behind the front proxy

Mailu ¶

Self-hosted mail server suite with SMTP/IMAP/POP3, webmail, spam filtering, antivirus, DKIM signing, and TLS

Mattermost ¶

Open-source, self-hosted team messaging platform for real-time collaboration via channels, threads, and integrations

MinIO ¶

Self-hosted S3-compatible object storage for files, media, backups, and AI artifacts

n8n ¶

Self-hosted low-code automation platform for connecting services and building workflow integrations visually

OpenClaw ¶

Self-hosted personal AI agent gateway with a browser control UI, sandboxed in a Kata microVM or gVisor runtime

Open WebUI ¶

Self-hosted chat interface for interacting with local and private AI models via backends such as Ollama

web-app-pihole ¶

Network-wide DNS sinkhole for blocking ads and trackers across all devices, with DHCP and a web admin dashboard

Prometheus ¶

Open-source monitoring and alerting toolkit for storing metrics as time-series data and querying them with PromQL

Stalwart Mail Server ¶

All-in-one Stalwart mail server with SMTP, IMAP, JMAP, POP3, ManageSieve, CalDAV, CardDAV and built-in spam filtering

Wazuh ¶

Open-source SIEM and XDR platform for monitoring, log analysis, intrusion/vulnerability detection, and compliance

self_signed¶

sys-front-tls ¶

Reverse-proxy TLS orchestration layer selecting Let’s Encrypt, self-signed, or disabled certificate providers for Nginx

sys-front-tls-selfsigned ¶

SAN-aware certificate provider generating and storing self-signed TLS certificates for the front-proxy TLS layer

semaphore¶

Semaphore UI ¶

Web UI and API for running Ansible, Terraform/OpenTofu, and shell automation on a schedule or on demand

sendmail¶

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

seo¶

World Wide Web ¶

NGINX server blocks that permanently redirect www subdomains to their non-www apex domains

services¶

sys-service ¶

Infrastructure role for managing systemd service units: cleanup, deployment, timers, and shared failure diagnostics

sys-service-loader ¶

Central loader role for ordered shared-service preloading and queued post-load role inclusions across the deployment

sys-service-terminator ¶

Deferred-start orchestrator for enabling and starting collected systemd services once a play completes

shallow¶

System Utility: Git Pull (Shallow & Pinned)¶

Reusable Git pull primitive for shallow clones, detached-safe updates, tag pinning, and reliable change detection

shell¶

Shell ¶

Host-level configuration linking Bash and Zsh login shells to a shared .profile for consistent environment loading

shop¶

Pretix ¶

Self-hosted ticketing platform for events with online sales, registration management, and secure payments

shopware¶

Shopware ¶

Open-source ecommerce platform built on Symfony and Vue.js for building and scaling online storefronts

siem¶

Wazuh ¶

Open-source SIEM and XDR platform for monitoring, log analysis, intrusion/vulnerability detection, and compliance

sinkhole¶

web-app-pihole ¶

Network-wide DNS sinkhole for blocking ads and trackers across all devices, with DHCP and a web admin dashboard

smarthome¶

Home Assistant ¶

Smart-home automation hub with device integrations, dashboards and a built-in MCP server for AI agent access

smtp¶

Tor SMTP Gateway (svc-net-tor-smtp)¶

SMTP gateway that relays .onion recipients through Tor’s SOCKS listener

sys-svc-mail ¶

Central mail orchestration role for Infinito.Nexus, integrating Email SaaS, msmtp, and an optional local SMTP relay

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

sys-svc-mail-smtp ¶

Loopback-only Postfix relay for lightweight outbound mail delivery via localhost when no central mail stack runs

Postmarks ¶

Single-user ActivityPub bookmarking site federating public bookmarks to Mastodon and the Fediverse

snipe-it¶

Snipe‑IT ¶

Open-source IT asset management system for tracking hardware and software inventory

socialhome¶

socialmedia¶

Pixelfed ¶

Decentralized, federated platform for photo sharing and image feeds across the fediverse

software¶

Development Utilities ¶

Base development environment for software engineers on Linux, with core editors and language-agnostic tooling

Python Development Utilities ¶

Toolchain for Python scripting, application development, and data science on Linux

space¶

sys-ctl-hlth-disc-space ¶

Scheduled health check for filesystem disk usage, alerting when any mount exceeds its warning threshold

spellcheck¶

Hunspell ¶

Multi-language spell checker with configurable dictionary packs for desktop and office text editing

sphinx¶

Sphinx ¶

Documentation generator that builds HTML from a source repository and serves it through a lightweight HTTP server

spotify¶

Spotify ¶

Desktop client for streaming music, playlists, and podcasts

sqlite¶

ssh¶

SSH Agent ¶

Persistent systemd user-service SSH agent for Wayland desktops, with the .ssh config synced from Git

SSH Service (Client)¶

OpenSSH client package for secure remote shell access and key-based authentication

sshd ¶

Hardened OpenSSH daemon configuration for key-based remote access with root login and password authentication disabled

User ¶

Provisioning role for per-user environment setup, managing shell dotfiles and SSH authorized_keys

Administrator User ¶

Dedicated administrator account with SSH key access and password-authenticated sudo for secure privilege escalation

User for Backup Provider ¶

Dedicated system account with SSH-restricted commands and passwordless rsync sudo for secure backup access

Root User ¶

Host-level role provisioning a root RSA 4096-bit SSH key pair for secure automated administrative access

Workstation User ¶

Provisioning role for a workstation login account with its shell dotfiles, SSH authorized keys, and environment

sshd¶

sshd ¶

Hardened OpenSSH daemon configuration for key-based remote access with root login and password authentication disabled

ssl¶

sys-ca-selfsigned ¶

Local self-signed Root CA for issuing trust so containers accept internal TLS endpoints

Certbot Reaper ¶

Scheduled cleanup tool for revoking and deleting unused Let’s Encrypt certificates

NGINX Certbot Automation ¶

Scheduled systemd-timer job renewing Let’s Encrypt SSL/TLS certificates via Certbot and reloading NGINX afterward

sys-front-tls ¶

Reverse-proxy TLS orchestration layer selecting Let’s Encrypt, self-signed, or disabled certificate providers for Nginx

sys-front-tls-letsencrypt ¶

Let’s Encrypt provider for the front-facing TLS layer ensuring automated certificate issuance and presence

sys-front-tls-selfsigned ¶

SAN-aware certificate provider generating and storing self-signed TLS certificates for the front-proxy TLS layer

Certbot ¶

ACME client for automated Let’s Encrypt SSL/TLS certificate issuance and renewal via webroot or DNS-01 challenges

NGINX HTTPS Certificate Retrieval ¶

Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

Content Delivery Network ¶

Nginx-based content delivery network for serving shared static assets to internal web applications

File Server ¶

Static file server over HTTPS with directory listing, .well-known handling, and automatic TLS certificates

HTML Server ¶

NGINX vhost for serving static HTML websites over HTTPS with automatic Let’s Encrypt certificates

sso¶

BigBlueButton ¶

Self-hosted web conferencing platform for virtual classrooms, online meetings, and real-time collaboration

Checkmk ¶

Open-source IT and application monitoring server behind SSO with native LDAP user management

Jellyfin ¶

Self-hosted media server for streaming and organizing movies, TV, music, and photos, with OIDC and LDAP login

Keycloak ¶

Self-hosted identity and access management platform for single sign-on, multi-factor authentication, and user federation

OpenBao ¶

Identity-based secrets, PKI and encryption manager with OIDC login, group-mapped policies and static-seal auto-unseal

OpenProject ¶

Self-hosted platform for project management, work-package tracking, Gantt planning, and team collaboration

Penpot ¶

Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff

Semaphore UI ¶

Web UI and API for running Ansible, Terraform/OpenTofu, and shell automation on a schedule or on demand

stalwart¶

Stalwart Mail Server ¶

All-in-one Stalwart mail server with SMTP, IMAP, JMAP, POP3, ManageSieve, CalDAV, CardDAV and built-in spam filtering

stateless¶

Coturn ¶

Free and open-source TURN/STUN relay server for NAT traversal in WebRTC and real-time communication

static¶

Assets Server ¶

Nginx-based server for hosting static assets copied from a source directory to the web data path

Corporate Design ¶

Service-registry role owning the canonical `css` flag and redirecting the CSS hostname to the CDN upstream

HTML Server ¶

NGINX vhost for serving static HTML websites over HTTPS with automatic Let’s Encrypt certificates

static-files¶

Content Delivery Network ¶

Nginx-based content delivery network for serving shared static assets to internal web applications

File Server ¶

Static file server over HTTPS with directory listing, .well-known handling, and automatic TLS certificates

static-site¶

Hugo ¶

Static site generator building HTML from an upstream Git repository at build time and serving it via nginx

storage¶

Storage Optimizer ¶

Tiering role placing Docker volumes on SSD or HDD by workload type, with symlinks keeping paths consistent

NFS Client ¶

Client-side NFS setup for mounting a remote server export on every swarm node, with a deploy-time reachability probe

NFS Server ¶

Kernel-level NFS server for exporting a shared directory tree with IP-restricted access for swarm-node hosts

Cleanup Disc Space ¶

Cleanup routine for reclaiming disk space from temp files, package caches, optional Docker data and old backups

MinIO ¶

Self-hosted S3-compatible object storage for files, media, backups, and AI artifacts

SeaweedFS ¶

Distributed S3-compatible object store for shared, per-consumer bucket provisioning across web-app roles

stream¶

Webserver ¶

Core NGINX webserver with HTTP and TCP/UDP stream support and performance-tuned defaults

streaming¶

OBS Studio ¶

Free and open-source desktop application for live video streaming and screen recording

Spotify ¶

Desktop client for streaming music, playlists, and podcasts

Jellyfin ¶

Self-hosted media server for streaming and organizing movies, TV, music, and photos, with OIDC and LDAP login

stub¶

Jenkins ¶

Open-source automation server for CI/CD pipelines, builds, and plugin-driven deployment workflows

XMPP ¶

Placeholder stub role for a future XMPP server/container deployment, implementation pending

stun¶

Coturn ¶

Free and open-source TURN/STUN relay server for NAT traversal in WebRTC and real-time communication

sub_filter¶

Global JavaScript Injector for NGINX ¶

Global JavaScript injection layer for NGINX HTML responses via sub_filter, with CSP hashing

sys-front-inj-logout ¶

Nginx sub_filter JavaScript injection redirecting all logout actions to a centralized OIDC single sign-out endpoint

sudo¶

Sudo ¶

Privilege-escalation package and hardened sudoers configuration with /etc/sudoers.d drop-in support

Administrator User ¶

Dedicated administrator account with SSH key access and password-authenticated sudo for secure privilege escalation

Workstation User ¶

Provisioning role for a workstation login account with its shell dotfiles, SSH authorized keys, and environment

suitecrm¶

SuiteCRM ¶

Open-source CRM platform for sales, service, cases, and campaign management with workflow automation

svg¶

Simple Icons ¶

Containerized icon server for hosting the Simple Icons brand SVG and PNG collection for web and documentation use

swapfile¶

Swapfile ¶

On-target automation for creating and activating swap space via a cloned swapfile script

swarm¶

WireGuard ¶

Kernel WireGuard tunnels, hub-and-spoke meshes under a swarm manager and full meshes between Compose hosts

Docker Registry Cache ¶

Cluster-local pull-through cache for shared Docker Hub base-image pulls, cutting duplicate transfers and rate limits

Docker Registry ¶

Cluster-local container image registry for serving custom-built images to Docker Swarm worker nodes

NFS Client ¶

Client-side NFS setup for mounting a remote server export on every swarm node, with a deploy-time reachability probe

NFS Server ¶

Kernel-level NFS server for exporting a shared directory tree with IP-restricted access for swarm-node hosts

Docker Swarm Manager ¶

Marker role tagging a host as the Docker Swarm manager node, with the init logic delegated to svc-swarm-node

Docker Swarm ¶

Container orchestration cluster for scheduling services across pooled manager and worker nodes

system¶

Locales ¶

System configuration role for setting up and generating localesvia locale.gen and locale.conf templates

Cleanup Docker Resources ¶

Systemd-driven cleanup service pruning anonymous Docker volumes plus images, containers, networks, and build cache

Hostname ¶

System hostname configuration derived from the inventory host entry

System Maintenance Lock ¶

Locking mechanism for gating maintenance tasks until critical services stop, with configurable retry and timeout

sys-openssl ¶

Shared host dependency ensuring the OpenSSL CLI is installed once for roles that invoke openssl commands

Docker Server ¶

Container engine runtime with Compose for building and running application containers on Linux hosts

Journalctl ¶

Host-level configuration for the systemd-journald logging daemon with retention limits and live log streaming

NSS ¶

Local name resolution for the domains the target serves, via the myhostname NSS module

SSH Service (Client)¶

OpenSSH client package for secure remote shell access and key-based authentication

System Utility: Git Pull (Shallow & Pinned)¶

Reusable Git pull primitive for shallow clones, detached-safe updates, tag pinning, and reliable change detection

System Version ️¶

Host-level provisioning for exposing the project’s pyproject.toml version system-wide via /etc/environment

Package update ¶

System-maintenance role for refreshing the package index and upgrading installed packages via the OS package manager

systemd¶

SSH Agent ¶

Persistent systemd user-service SSH agent for Wayland desktops, with the .ssh config synced from Git

LID Switch Driver ¶

Power-aware systemd logind configuration for predictable laptop lid-close behavior across battery, AC, and docked states

Backup to External Device ¶

Plug-triggered systemd backup for hard-link deduplicated snapshots of the local backup tree onto a swappable USB device

Backup NFS ¶

Scheduled backup job for hard-linked differential rsync snapshots of an NFS export into the local backup tree

Backup Remote Server ¶

Scheduled pull-style backup replicating remote hosts onto this host over SSH and rsync as hard-linked snapshots

Backup Host Secrets ¶

Scheduled deduplicating backup of host secrets, CA, ACME credentials, and node identity to the local backup directory

Backup Docker Volumes ¶

Scheduled deduplicating backup system for Docker container volumes to a local directory, with consistent SQL dumps

Unified Service Failure Notifier ¶

Unified systemd notification service dispatching service-failure alerts through both Telegram and email channels

Automated Email Alerts for Service Failures ¶

Systemd-triggered msmtp notifier for emailing operators when a monitored service unit fails

Automated Telegram Alerts for Service Failures ¶

Systemd-triggered notifier for delivering service-failure alerts to a Telegram chat

Certbot Reaper ¶

Scheduled cleanup tool for revoking and deleting unused Let’s Encrypt certificates

sys-ctl-hlth-btrfs ¶

Scheduled health check for Btrfs filesystems that alerts on non-zero device error counters

Docker Container Health Check ¶

Systemd-timed monitor for detecting unhealthy or non-zero-exited Docker containers and raising failure alerts

Health CSP Crawler ¶

Scheduled health check crawling configured domains for CSP-blocked resources via a Puppeteer-based Node.js checker

sys-ctl-hlth-disc-space ¶

Scheduled health check for filesystem disk usage, alerting when any mount exceeds its warning threshold

sys-ctl-hlth-journalctl ¶

Scheduled health check scanning the systemd journal for daily errors and alerting on matches

sys-ctl-hlth-msmtp ¶

Periodic health check for outbound mail delivery, sending a test message via msmtp and alerting on failure

Container Runtime Health Check ¶

Systemd-timed monitor for containers running PHP below its security floor or without the shared PHP hardening

Docker Volumes Health Check ¶

Health check for orphaned anonymous Docker volumes unbound to containers, with whitelist and alerting

Webserver Health Check ¶

Scheduled health check verifying each NGINX domain returns its expected HTTP status and alerting on deviations

Docker Compose Certificate Sync Service ¶

Systemd service and timer for syncing Let’s Encrypt certificates into Docker Compose NGINX stacks with hot-reload

NGINX Certbot Automation ¶

Scheduled systemd-timer job renewing Let’s Encrypt SSL/TLS certificates via Certbot and reloading NGINX afterward

Docker Auto Restart ¶

Systemd-scheduled maintenance role for full Docker Compose stack restarts, with hard restarts for stacks like Mailu

Docker Healer ¶

Automated recovery service restarting exited or unhealthy Docker Compose stacks and resolving port conflicts

sys-daemon ¶

Base role for systemd manager configuration via drop-ins, default settings, and unit validation

sys-service ¶

Infrastructure role for managing systemd service units: cleanup, deployment, timers, and shared failure diagnostics

sys-service-terminator ¶

Deferred-start orchestrator for enabling and starting collected systemd services once a play completes

Systemd Timer ¶

Systemd timer unit for starting a service on a recurring calendar schedule for automated task execution

taiga¶

Taiga ¶

Open-source agile project management platform for Scrum, Kanban, and hybrid team workflows

team-chat¶

Mattermost ¶

Open-source, self-hosted team messaging platform for real-time collaboration via channels, threads, and integrations

telegram¶

Unified Service Failure Notifier ¶

Unified systemd notification service dispatching service-failure alerts through both Telegram and email channels

Automated Telegram Alerts for Service Failures ¶

Systemd-triggered notifier for delivering service-failure alerts to a Telegram chat

terminal¶

GNOME Terminal ¶

Terminal emulator for the GNOME desktop, giving command-line access on Arch Linux workstations

testing¶

Test E2E Cli ¶

Test-harness role running end-to-end CLI test scripts for roles that declare a test environment template

Test: E2E Playwright Runner ¶

Generic end-to-end test runner executing role-provided Playwright specs in Docker against deployed applications

theming¶

NGINX Global Matomo & Theming Modifier Role ¶

Aggregate NGINX sub-filter injector adding Matomo tracking, global theming, iFrame and JS snippets by feature flag

Global CSS Injection for NGINX ¶

Global stylesheet injection for NGINX-served apps, unifying light and dark theming from a dynamic colorscheme

ticketing¶

KIX ¶

Open-source ITSM and helpdesk platform (OTRS fork) for ticketing, CMDB, knowledge base, and reporting

Zammad ¶

Open-source helpdesk and ticketing system for handling customer requests via email, chat, phone, and web

tickets¶

Pretix ¶

Self-hosted ticketing platform for events with online sales, registration management, and secure payments

timer¶

Systemd Timer ¶

Systemd timer unit for starting a service on a recurring calendar schedule for automated task execution

tls¶

OpenLDAP ¶

Self-hosted LDAP directory service for centralized user, group, and schema management with TLS-secured access

sys-ca-selfsigned ¶

Local self-signed Root CA for issuing trust so containers accept internal TLS endpoints

NGINX Certbot Automation ¶

Scheduled systemd-timer job renewing Let’s Encrypt SSL/TLS certificates via Certbot and reloading NGINX afterward

sys-front-tls ¶

Reverse-proxy TLS orchestration layer selecting Let’s Encrypt, self-signed, or disabled certificate providers for Nginx

sys-front-tls-letsencrypt ¶

Let’s Encrypt provider for the front-facing TLS layer ensuring automated certificate issuance and presence

sys-front-tls-selfsigned ¶

SAN-aware certificate provider generating and storing self-signed TLS certificates for the front-proxy TLS layer

sys-openssl ¶

Shared host dependency ensuring the OpenSSL CLI is installed once for roles that invoke openssl commands

NGINX Domain Setup ¶

Orchestration wrapper for per-domain NGINX provisioning with TLS certificates, vHost templates, and optional OAuth2

Certbot ¶

ACME client for automated Let’s Encrypt SSL/TLS certificate issuance and renewal via webroot or DNS-01 challenges

NGINX HTTPS Certificate Retrieval ¶

Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

sys-svc-compose-ca ¶

Helper role installing CA-trust injection assets for Docker Compose stacks and validating the project CA certificate

Webserver HTTPS Provisioning ¶

NGINX layer for HTTPS with Let’s Encrypt ACME challenge handling, port 80 to 443 redirect, and stale vHost cleanup

tokens¶

sys-token-store ¶

Ansible helper role for idempotent persistence and lookup of per-user application tokens in a local YAML store

tooling¶

Lint ¶

Release pins for the GitHub-release lint tools the toolchain installs

tools¶

Base Development Toolchain ¶

Distro-specific base build toolchain (compilers, linkers, make) for compiling software from source

Development Utilities ¶

Base development environment for software engineers on Linux, with core editors and language-agnostic tooling

tor¶

Torbrowser ¶

Tor network client and browser launcher for anonymous, privacy-focused web browsing

Tor Onion Service ¶

Tor daemon publishing the node as a v3 onion service

Tor SMTP Gateway (svc-net-tor-smtp)¶

SMTP gateway that relays .onion recipients through Tor’s SOCKS listener

Asset Mirror (Privacy Proxy)¶

Nginx-based privacy proxy that mirrors whitelisted third-party assets under a first-party domain

torrent¶

QBittorrent ¶

Open-source desktop BitTorrent client for downloading and sharing files over the BitTorrent protocol

turn¶

Coturn ¶

Free and open-source TURN/STUN relay server for NAT traversal in WebRTC and real-time communication

typesense¶

Typesense ¶

Central Dockerized search engine shared by multiple apps with per-consumer scoped API keys

ubuntu¶

msmtp ¶

Lightweight SMTP client and sendmail replacement for delivering mail through an external SMTP server

ui-ux¶

Penpot ¶

Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff

unbound¶

Unbound ¶

Central recursive/forwarding DNSSEC resolver on a static IP for consumer stacks to target as their DNS

uncategorized¶

MSI Keyboard Driver ¶

Driver integration for dynamic keyboard color and RGB lighting control on MSI laptops

LibreTranslate ¶

Self-hosted open-source machine translation API for translating and detecting text across languages

update¶

Package Manager Installation ¶

Wrapper role for idempotent package installation and updates through the pkgmgr universal package manager

Docker Auto Restart ¶

Systemd-scheduled maintenance role for full Docker Compose stack restarts, with hard restarts for stacks like Mailu

Package update ¶

System-maintenance role for refreshing the package index and upgrading installed packages via the OS package manager

url-shortener¶

YOURLS ¶

Self-hosted URL shortener for creating, tracking, and managing short links with built-in click analytics

usb¶

Backup to External Device ¶

Plug-triggered systemd backup for hard-link deduplicated snapshots of the local backup tree onto a swappable USB device

user¶

Nextcloud Client ️¶

Desktop client setup linking home folders into the cloud-synced directory for integrated file synchronization

User ¶

Provisioning role for per-user environment setup, managing shell dotfiles and SSH authorized_keys

Administrator User ¶

Dedicated administrator account with SSH key access and password-authenticated sudo for secure privilege escalation

User for Backup Provider ¶

Dedicated system account with SSH-restricted commands and passwordless rsync sudo for secure backup access

Root User ¶

Host-level role provisioning a root RSA 4096-bit SSH key pair for secure automated administrative access

Workstation User ¶

Provisioning role for a workstation login account with its shell dotfiles, SSH authorized keys, and environment

utility¶

System Utility: Git Pull (Shallow & Pinned)¶

Reusable Git pull primitive for shallow clones, detached-safe updates, tag pinning, and reliable change detection

Mini-QR ¶

Self-hosted browser tool for generating QR codes from text or URLs with privacy-friendly local rendering

utils¶

sys-service-loader ¶

Central loader role for ordered shared-service preloading and queued post-load role inclusions across the deployment

vault¶

sys-token-store ¶

Ansible helper role for idempotent persistence and lookup of per-user application tokens in a local YAML store

OpenBao ¶

Identity-based secrets, PKI and encryption manager with OIDC login, group-mapped policies and static-seal auto-unseal

vector¶

Qdrant ¶

Central vector database engine for storing and searching per-consumer embeddings shared across the stack

version¶

System Version ️¶

Host-level provisioning for exposing the project’s pyproject.toml version system-wide via /etc/environment

version control¶

Gitea ¶

Lightweight self-hosted Git service for code collaboration, version control, and repository management

GitLab ¶

Self-hosted DevOps platform for Git source-code management, CI/CD pipelines, and issue tracking

versioning¶

Content Delivery Network ¶

Versioned asset-tree layout for CDN delivery with shared, vendor, and per-role release directories

versions¶

Lint ¶

Release pins for the GitHub-release lint tools the toolchain installs

video¶

Zoom ¶

Desktop video conferencing client for online meetings, webinars, and screen sharing

BigBlueButton ¶

Self-hosted web conferencing platform for virtual classrooms, online meetings, and real-time collaboration

Jitsi Meet ¶

Self-hosted WebRTC platform for end-to-end-encryptable video conferencing with federated authentication

OpenTalk ¶

Sovereign open-source video conferencing platform for audio/video calls, screen sharing, breakout rooms, and SSO

video platform¶

PeerTube ¶

Decentralized, federated platform for peer-to-peer video hosting, streaming, and live broadcasting

video-hosting¶

PeerTube ¶

Decentralized, federated platform for peer-to-peer video hosting, streaming, and live broadcasting

virtualbox¶

Virtual Box ¶

Type-2 hypervisor for virtual machines on Pacman workstations, with kernel modules and extension pack

virtualization¶

Virtual Box ¶

Type-2 hypervisor for virtual machines on Pacman workstations, with kernel modules and extension pack

visualization¶

MIG ¶

Interactive graph visualization of all Infinito.Nexus roles and their dependencies for architecture transparency

vlc¶

Blue-ray Disc ¶

Desktop media-player setup with VLC and AACS/BD+ libraries for Blu-ray disc decryption and playback on Arch Linux

volumes¶

Cleanup Docker Anonymous Volumes ¶

Scheduled maintenance task for reclaiming disk space by removing unused anonymous Docker volumes and their symlinks

Docker Volumes Health Check ¶

Health check for orphaned anonymous Docker volumes unbound to containers, with whitelist and alerting

voting¶

Fider ¶

Open-source community feedback platform for collecting, voting on, and prioritizing feature requests and ideas

vpn¶

WireGuard ¶

Kernel WireGuard tunnels, hub-and-spoke meshes under a swarm manager and full meshes between Compose hosts

wall¶

Fediwall ¶

Self-hosted Fediverse wall for showing recent public posts by hashtag or account in a live masonry grid

wayland¶

SSH Agent ¶

Persistent systemd user-service SSH agent for Wayland desktops, with the .ssh config synced from Git

wazuh¶

Wazuh ¶

Open-source SIEM and XDR platform for monitoring, log analysis, intrusion/vulnerability detection, and compliance

web¶

Front Base (HTTPS + Cloudflare + Handlers)¶

Front-layer base for web apps: HTTPS foundation, optional Cloudflare setup, and reverse-proxy handler wiring

NGINX Docker Reverse Proxy ¶

Reverse proxy front-end for Docker-hosted services with automatic TLS, WebSocket support, and per-app vHost templating

Nextcloud ¶

Self-hosted cloud platform for file sync, sharing, real-time collaboration, and team workspaces under your own domain

OpenCloud ¶

Self-hosted platform for file sync, sharing, and collaboration with Keycloak SSO and central LDAP directory

OpenTalk ¶

Sovereign open-source video conferencing platform for audio/video calls, screen sharing, breakout rooms, and SSO

webapp¶

Fediwall ¶

Self-hosted Fediverse wall for showing recent public posts by hashtag or account in a live masonry grid

Hugo ¶

Static site generator building HTML from an upstream Git repository at build time and serving it via nginx

LittleJS ¶

Self-hosted HTML5 game sandbox for browsing and running lightweight engine demos and games in the browser

Mini-QR ¶

Self-hosted browser tool for generating QR codes from text or URLs with privacy-friendly local rendering

Roulette Wheel ¶

Browser-based spinning wheel app for decision making, random selection, and gamification

webrtc¶

Jitsi Meet ¶

Self-hosted WebRTC platform for end-to-end-encryptable video conferencing with federated authentication

OpenTalk ¶

Sovereign open-source video conferencing platform for audio/video calls, screen sharing, breakout rooms, and SSO

Coturn ¶

Free and open-source TURN/STUN relay server for NAT traversal in WebRTC and real-time communication

webserver¶

Webserver Health Check ¶

Scheduled health check verifying each NGINX domain returns its expected HTTP status and alerting on deviations

website¶

Odoo ERP ¶

Open-source ERP suite for CRM, sales, accounting, inventory, HR, and website management

webui¶

pgAdmin ¶

Web-based administration and development platform for managing multiple PostgreSQL servers, with optional OAuth2 login

phpldapadmin ¶

Web-based LDAP client for browsing, searching, and administering directory entries in LDAP servers

PhpMyAdmin ¶

Web-based administration tool for MySQL and MariaDB with schema management, querying, and import/export

wiki¶

Confluence ¶

Enterprise wiki and team collaboration platform for creating, organizing, and sharing content

MediaWiki ¶

Collaborative wiki platform for user-driven documentation with an extensible extension ecosystem and content management

XWiki ¶

Self-hosted enterprise wiki and knowledge-management platform with collaboration and app-based extensibility

wildcard¶

NGINX HTTPS Certificate Retrieval ¶

Certbot-driven ACME service for Let’s Encrypt single-domain and wildcard TLS certificates on NGINX domains

wireguard¶

WireGuard ¶

Kernel WireGuard tunnels, hub-and-spoke meshes under a swarm manager and full meshes between Compose hosts

wopi¶

Collabora ¶

Self-hosted online office backend for real-time in-browser editing of documents, spreadsheets, and presentations

OnlyOffice ¶

Document server backend for real-time in-browser editing of documents, spreadsheets, and presentations

wordpress¶

WordPress ¶

Content management system for building and managing websites, blogs, and multisite networks with themes and plugins

workflow¶

Flowise ¶

Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints

n8n ¶

Self-hosted low-code automation platform for connecting services and building workflow integrations visually

workstation¶

Workstation User ¶

Provisioning role for a workstation login account with its shell dotfiles, SSH authorized keys, and environment

www¶

World Wide Web ¶

NGINX server blocks that permanently redirect www subdomains to their non-www apex domains

xdr¶

Wazuh ¶

Open-source SIEM and XDR platform for monitoring, log analysis, intrusion/vulnerability detection, and compliance

xmpp¶

XMPP ¶

Placeholder stub role for a future XMPP server/container deployment, implementation pending

xwiki¶

XWiki ¶

Self-hosted enterprise wiki and knowledge-management platform with collaboration and app-based extensibility

yourls¶

YOURLS ¶

Self-hosted URL shortener for creating, tracking, and managing short links with built-in click analytics

zammad¶

Zammad ¶

Open-source helpdesk and ticketing system for handling customer requests via email, chat, phone, and web

zoom¶

Zoom ¶

Desktop video conferencing client for online meetings, webinars, and screen sharing

zsh¶

Shell ¶

Host-level configuration linking Bash and Zsh login shells to a shared .profile for consistent environment loading