EXTENSIONS

Drive an existing Ansible playbook from swamp. `check` runs --check --diff and never mutates, so changed=0 across every host is a machine-readable 'already matches its declaration' gate; `apply` runs for real. Parses the PLAY RECAP into typed per-host tallies for CEL, accepts inventory as content so a workflow can build it from model data instead of a render script, and keeps vault and sudo passwords in 0600 temp files rather than argv.

Laravel Forge (API v2, org-scoped) — list servers, audit and idempotently provision sites (git-backed or repo-less, e.g. a reverse proxy to a Node app), set a site's .env from a vault reference, read and replace a site's nginx config, run root-level Bash on a server via Forge recipes, install LetsEncrypt SSL, and manage deployments (set deploy script, deploy with polling, read the deploy log).

Generic cloud-init NoCloud seed ISO generator for Swamp. Renders user-data, meta-data, and optional network-config into an ISO 9660 image with CIDATA volume label, optionally writing the ISO to a host filesystem path.

Careful administration of a Forgejo (or Gitea) server over its /api/v1 REST API, authenticated with a scoped access token. Find-or-create organizations and repositories and converge their settings, run GitHub pull-mirrors (create via /repos/migrate, reconcile interval/visibility, queue immediate syncs), and audit every mirror's sync health. Mutations are find-or-create or reversible (archive/unarchive); there are no delete methods — a failed migration's empty shell repo is detected and reported, never auto-deleted. Mirror source credentials are write-only: supplied via a vault reference, sent once, never read back or emitted.