EXTENSIONS

Install and operate a SHA-pinned k0s Kubernetes cluster on a Linux host over SSH, with a rendered k0s.yaml, readiness waits, kubeconfig capture, manifest stacks and Helm reconciliation. One model type serves any host: the SSH target and cluster inputs arrive per call, and state is keyed by the target host.

Serve a directory of pinned artifacts over HTTP(S) from one host, fetched by content hash, and manage that directory over SSH: nginx site config, upload, host-side fetch, bundles, refs, listing, verification and prune. One generic model type with no host, path or credential baked in; every method takes its target and root as arguments and strict host-key pins are required.

Render, validate and publish an Ubuntu Server autoinstall NoCloud seed from typed inputs, over SSH to an artifact-server root or for a CIDATA image. The password is a crypt hash from vault and no output carries a plaintext.

Order, inspect, wait for and delete Cherry Servers bare-metal and VPS servers, with their projects, SSH keys and live plan stock. One model type per API resource; a server is ready only when the API reports it deployed and it answers SSH with the expected host keys.

Drive an existing Ansible playbook from swamp. `check` runs --check --diff and never mutates, so changed=0 across every host is a machine-readable 'already matches its declaration' gate; `apply` runs for real. Parses the PLAY RECAP into typed per-host tallies for CEL, accepts inventory as content so a workflow can build it from model data instead of a render script, and keeps vault and sudo passwords in 0600 temp files rather than argv.

Administer an Apple Developer Program team over the App Store Connect API. Team-key auth with an ES256 JWT signed in WebCrypto (no JWT library, no native dependencies), cached in-process and re-signed near its 20-minute limit, with 429 and 5xx retry honouring Retry-After and a re-sign on a mid-flight 401. Roll the whole team up in one call: members by role, pending invitations, devices by class and status, and every certificate or provisioning profile that has expired or expires within a window, which catches the lapsed development profile that makes a tvOS or iOS app silently refuse to launch. Invite people with roles and the Certificates, Identifiers & Profiles permission, cancel invitations, change a member's roles, and register development devices by UDID. List users, invitations, devices, certificates, profiles, and bundle IDs, fully paged and filterable with a CEL selector, with daysToExpiry computed on anything that expires. Reach any unwrapped endpoint through an authenticated passthrough.

Administration of a Forgejo (or Gitea) server over its /api/v1 REST API, authenticated with a scoped access token. Find or create organizations and repositories and update their settings; run GitHub pull-mirrors (create via /repos/migrate, reconcile interval, visibility and description, queue immediate syncs); audit every mirror's sync health; manage pull requests (open, inspect mergeability and head CI state, merge); and audit or repoint repository webhooks so a hook pointing at an old CI target is reported. Changes are find-or-create or reversible (archive/unarchive), except the guarded pr_merge. There are no delete methods: an empty repository left by a failed migration is reported, not deleted. Secrets are never output: mirror source credentials are write-only, and webhook operations neither read nor write the hook secret.

Install and operate k3s on a local or SSH-reachable host using the official

Provision and operate Linode (Akamai) infrastructure from swamp — compute instances with boot/shutdown/reboot/wait, Cloud Firewalls with rule and device management, Block Storage volumes with attach/detach/resize, profile SSH keys, and a regions/types/images catalog with pricing. Label-addressed state, idempotent create and delete, confirmation-gated instance and volume deletes. Pure HTTPS, token from your vault.

Provision a Craft-ready Hetzner server — nginx, PHP-FPM, MySQL, vhost, database, optional TLS and Tailscale — with a protected teardown. Deployment is intentionally out of scope.

Laravel Forge (API v2, org-scoped) — list servers, audit and idempotently provision sites (git-backed or repo-less, e.g. a reverse proxy to a Node app), set a site's .env from a vault reference, read and replace a site's nginx config, run root-level Bash on a server via Forge recipes, install LetsEncrypt SSL, and manage deployments (set deploy script, deploy with polling, read the deploy log).

Generic cloud-init NoCloud seed ISO generator for Swamp. Renders user-data, meta-data, and optional network-config into an ISO 9660 image with CIDATA volume label, optionally writing the ISO to a host filesystem path.