EXTENSIONS

Vercel networking infrastructure models

Tailscale tailnet management models

OpenStack for swamp, through the official `openstack` CLI.

Declare a Pi-hole v6 exact-deny list in swamp and converge an appliance to it: plan by default, apply on request, prune only when asked

Unified drift detection surface that composes observations from existing

AWS cost audit workflow — identifies infrastructure waste by combining

Inspect VPC networking resources that commonly generate hidden costs:

Observe Route53 hosted zones, record sets, and detect orphaned DNS records

Cloudflare management - zones, DNS records, WAF/firewall rules, Workers, and cache/CDN

Cloudflare security and configuration audit workflow.

DNS and network probing model that generates diverse diagnostic events.

Porkbun DNS record management with full CRUD for all common record types

Pi-hole custom DNS record management for swamp — list, add, delete, and

Operational control of a Kemp LoadMaster appliance over its `/access` management API: discover every Virtual Service and its Real Servers, add or remove a Virtual Service, and add/remove/enable/disable a Real Server — the standard maintenance action for draining traffic before patching a backend.

Azure infrastructure management via az CLI — 43 model types covering compute, networking, data, security, RBAC, Azure Policy, Defender for Cloud, Entra directory, monitoring, DNS, DevOps, Azure AI Foundry (accounts, model deployments, projects, quota), AI Search, Cosmos DB, PostgreSQL Flexible Server, Static Web Apps, Service Bus, Event Grid, Recovery Services, Log Analytics, subscription-wide topology with Mermaid diagrams and cost estimation, actual-spend cost analysis and waste auditing via Cost Management/Resource Graph/Advisor, and the Azure AI Vision Face REST API for identity-aware room services.

Authenticated observation and explicit session management for Arcadyan Speedport Plus 2 routers.

Kubernetes operational toolkit — 16 model types covering pods, deployments, statefulsets, services, RBAC, storage, networking, autoscaling, batch jobs, and more. Includes 14 ready-to-run workflows for namespace debugging, security audits, RBAC analysis, cluster health, and operational diagnostics.

Roaming diagnostics for @mgreten/unifi: per-client AP/signal state (syncRadio), AP radio config incl. tx power and min-RSSI (syncDevices), and historical roam/connect/disconnect events via the UniFi v2 activity log (syncEvents).

Region-wide AWS topology discovery and an animated D3 architecture diagram. Adds a fan-out `discover` method to the official @swamp/aws EC2, ECS and ELBv2 model types, then renders every compute object and every inbound and outbound network route into a single self-contained HTML file.

Declarative DHCP fixed-IP reservations on a local UniFi controller (UDM / UDM Pro / UDM SE). `sync` reads every reservation the controller holds; `drift` compares a desired set against it without writing, reporting missing, mismatched, unmanaged, duplicate and DHCP-pool-overlapping entries; `apply` reconciles the controller to the desired set and supports `dryRun`. `device_drift` does the same read-only comparison for adopted hardware, which cannot hold reservations at all and is addressed through device config instead — the one surface `drift` is blind to. Reservations live on the legacy Network API as `user` objects carrying `use_fixedip`/`fixed_ip`. Adds TOTP/MFA login support, which the upstream @mgreten/unifi auth flow lacks — UniFi SSO accounts with MFA reject password-only logins with MFA_AUTH_REQUIRED. Catches the failure mode where a reservation silently never takes effect because its address is already claimed by a statically-configured host. `forget_client` prunes stale client records the controller still remembers, refusing any MAC that holds a reservation or a live lease unless forced.

Structural health monitoring for a UniFi fabric. The `@sntxrr/unifi-fabric/topology` model's `check` method compares a declared topology against live `/stat/device` rows and reports the failures that outcome-based monitoring cannot see: a device expected on the wire that has silently fallen back to a wireless mesh uplink, attachment to the wrong upstream device, links negotiated below their expected speed, ports carrying error counters, and — the one with no equivalent elsewhere — ports that are down but have carried real traffic before, which identifies a run that used to work. An access point that loses its wired uplink does not fail; it meshes, keeps serving clients, and every uptime check stays green while latency quietly goes from sub-millisecond to tens of milliseconds and jittery. `uplink.type` flipping from `wire` to `wireless` is a boolean, so it is asserted exactly rather than thresholded. Read-only: never writes to the controller. Emits a flat Prometheus-ready metric series alongside the verdict, including for healthy devices, so alerts can fire on a series dropping to zero rather than on a document changing shape. Authenticates with an API key over `X-API-KEY`, which sidesteps the HTTP 499 that MFA-enabled SSO accounts return for password logins.

WinBox-style MikroTik Neighbor Discovery Protocol discovery for Swamp

Observability and safe operational control for a TP-Link Omada controller. One fan-out sync reads every site, device, client, switch port, gateway WAN and SSID into addressable resources, and writes a drift record comparing configuration — not telemetry — against the previous sync, so an idle network reports nothing and a firmware bump, a re-addressed WAN, a disabled PoE port or a device that stopped answering each report themselves. Talks the supported Open API in client-credentials mode, with the controller's own web API as an optional fallback for reads the Open API does not expose. Writes are limited to reversible operational actions — reboot, PoE, client block, reconnect, LED, locate, firmware — each fanning out over a list in one controller session.

Full lifecycle management of an Nginx Proxy Manager instance. `sync` fans out one resource per proxy host, redirection host, dead host, stream, access list and certificate, plus an instance rollup that flags expiring certificates, plain-HTTP hosts and domains claimed by more than one host. The `apply*` methods are idempotent — they match an existing object by its natural key (domain set, listening port, access list name) and update it in place, so re-running a workflow converges instead of accumulating duplicates. `setEnabled` and `delete` dispatch on an object kind and take a list of ids, so a batch is one fan-out call rather than a run per id. Let's Encrypt certificates can be requested over HTTP-01 or DNS-01 (wildcards included), renewed, or replaced with uploaded PEM files.