EXTENSIONS

Write a secret file onto one host over SSH from vault values delivered over stdin, atomically and idempotently by content hash, with settable owner and group and a remove action. One generic model type; state holds file metadata and at most a keyed HMAC of the content, never the value.

Manage authoritative Knot DNS zones and a Knot Resolver 6 recursive resolver over SSH. Every candidate zone file, Knot config fragment and resolver config is rendered deterministically and validated by the vendor tools before it reaches the live service; secrets stay in the vault and reach the host over stdin.

Harden a freshly provisioned Linux host over SSH in three phases: base packages and users, an nftables firewall rendered from inputs, and an SSH lockdown. The target and every phase input are method arguments, and the firewall and lockdown phases arm a host-side revert timer before they change anything unless commit cancels it.

Plan and operate a multi-node k0s cluster over SSH in the k0sctl style: short-lived join tokens, ordered controller and worker joins, drain and detach before reset, and safe rolling upgrades. Per-node work is delegated to @randybias/k0s-cluster, and this model needs no kubeconfig.

Render one WireGuard node's config from mesh data (peers, allowlist, relay exclusion) and apply it to that node over SSH. One generic model for any node of any mesh; the private key is delivered over stdin and never appears in the config text.

Write a secret file onto one host over SSH from vault values delivered over stdin, atomically and idempotently by content hash, with settable owner and group and a remove action. One generic model type; state holds file metadata and at most a keyed HMAC of the content, never the value.

Ensure a peer device and a shared folder on one Syncthing node through its REST API, reached locally or over SSH, and inspect or remove them. The API key travels only in the X-API-Key header, plain HTTP is loopback-only, and state is keyed by a SHA-256 of the node label and endpoint.

Provision and tear down a hardened single-node k0s host on a WireGuard mesh, running NATS and published in Cloudflare DNS, by composing the server, SSH, mesh, hardening, cluster and secret model types. Workflows only: the package ships no models of its own, and every instance value arrives as a workflow input.

Install and operate a SHA-pinned k0s Kubernetes cluster on a Linux host over SSH, with a rendered k0s.yaml, readiness waits, kubeconfig capture, manifest stacks and Helm reconciliation. One model type serves any host: the SSH target and cluster inputs arrive per call, and state is keyed by the target host.

Install and operate a standalone Ceph cluster managed by cephadm on Debian-family Linux hosts reached over SSH. One model type drives host preparation, disk wiping, bootstrap, daemon placement, pools, CephFS, RGW users and buckets, maintenance and teardown.

Serve a directory of pinned artifacts over HTTP(S) from one host, fetched by content hash, and manage that directory over SSH: nginx site config, upload, host-side fetch, bundles, refs, listing, verification and prune. One generic model type with no host, path or credential baked in; every method takes its target and root as arguments and strict host-key pins are required.

Render, validate and publish an Ubuntu Server autoinstall NoCloud seed from typed inputs, over SSH to an artifact-server root or for a CIDATA image. The password is a crypt hash from vault and no output carries a plaintext.

Run one argv vector, push bytes atomically, and wait for SSH host keys on any host, under an explicit strict or trust-on-first-use host-key policy. One generic model with no host in its definition; every method takes its target as arguments and stores data keyed by host.

Install and upgrade KubeVirt on an existing Kubernetes cluster from a SHA-256-pinned operator manifest, and manage one VirtualMachine from a digest-pinned containerDisk image or a CDI DataVolume. Two model types over kubectl, with the kubeconfig supplied as a vault reference and never placed on a command line.

Install and operate Apt-Cacher NG on a Linux host over SSH and point apt clients at it: one managed server fragment plus per-distribution mirror backends, client proxy configuration with conflict detection and rollback, hit/miss and byte statistics, and removal. One model type serves any host: the SSH target and inputs arrive per call, and state is keyed by the target.

Install and configure an ISC Kea DHCPv4 server on one Linux host over SSH, with subnets, pools, host reservations and typed DHCP options. Every change is validated by Kea itself, written atomically and applied with config-set under an armed host-side revert that restores the previous configuration unless it is committed.

Manage a ZFS pool, datasets, sparse zvols, snapshots, clones and rollback on a Linux host over SSH. One model type serves any host; state is keyed by the SSH identity plus the pool or dataset name, and create_pool refuses any device that carries the running system.

Manage libvirt/KVM over SSH: define and undefine virtual networks including the default, clone a golden volume or zvol per node, define domains from a clone, control power, and capture the serial console. The SSH target, libvirt URI and every operand are method arguments, so one definition manages any hypervisor.

Configure Linux host networking over SSH — a bridge (Linux or OVS), a VLAN-tagged storage plane and jumbo MTU — under an automatic revert armed before anything is changed. Every interface, MAC, VLAN id, MTU and address is an input, and the host-key policy is required; one definition serves any host.

Read and control a server's power and boot settings over the DMTF Redfish API. One model serves any BMC: the endpoint, system and vault-wired credentials are method arguments, the TLS policy is explicit, and no credential is ever placed in a URL, log or stored state.

Create, read, sync and delete a Kubernetes Secret from vault values. Values reach kubectl only on stdin and are never returned: output and stored state carry metadata and key names only.

Inspect and delete an Azure network security group and converge its security rules through the Azure Resource Manager REST API with a service principal from a vault. One generic model type, keyed by subscription, resource group and NSG name, with rule convergence that plans before it applies.

Create, adopt, start, deallocate, stop, inspect and delete an Azure virtual machine through the Azure Resource Manager REST API with a service principal from a vault. One generic model type, keyed by subscription, resource group and VM name, with no credential on a command line.

Order, inspect, wait for and delete Cherry Servers bare-metal and VPS servers, with their projects, SSH keys and live plan stock. One model type per API resource; a server is ready only when the API reports it deployed and it answers SSH with the expected host keys.