ChatGPT can write the config.
We already debugged it.
Docker Compose stacks, Cloudflare Workers, CloudFormation templates, and shell scripts — tested in real environments and ready to run. Less than a cup of coffee to skip the trial-and-error entirely.
AI can get you 80% of the way there. The other 20% is an hour of debugging a missing healthcheck, a wrong volume mount, or an env var that quietly references itself. Every file here you use saves you an hour.
Available Assets
Proxmox GPU Passthrough Script
Automated GPU passthrough setup for Proxmox — IOMMU detection, vfio binding, and hook scripts with validation.
Proxmox IaC Starter Kit
Terraform + cloud-init templates for provisioning Proxmox VMs and LXCs as code — stop clicking in the UI.
Cloudflare Tunnel and Zero Trust Config
Terraform: Cloudflare Tunnel exposing internal services with Zero Trust access policies and identity provider integration. No inbound firewall rules required on your servers.
Rails 8 Dev Stack
Rails + Postgres + Redis + Sidekiq + Mailpit + pgAdmin, hot reload wired, ready to clone and code.
Postgres Backup to S3
Docker Compose: pg_dump cron container that dumps, compresses, encrypts with GPG, and ships backups to S3 on a configurable schedule with retention management.
VMware to Proxmox Migration Pack
Scripts, templates, and runbook to migrate your VMware VMs to Proxmox VE.
Outline Team Wiki
Outline + Postgres + Redis + S3-compatible storage — team wiki with OIDC auth ready and file uploads configured.
Metabase Analytics Stack
Metabase + Postgres backend — production-configured analytics with persistent storage, ready for your data source.
Self-Hosted Cron Monitor
Node.js Docker Compose stack that monitors cron jobs via heartbeat URLs. Alerts via email if a job misses its schedule. Simple alternative to Dead Man's Snitch.
Serverless Contact Form Backend
CloudFormation: API Gateway + Lambda + SES contact form handler. CORS configured, honeypot spam field, rate limiting, and input sanitization included.
Ingress, cert-manager & ExternalDNS Stack
Helm values and installation order for correctly wiring Traefik v3 ingress, cert-manager with Let Encrypt, and ExternalDNS. Common misconfiguration pitfalls documented.
Grafana Dashboard Pack for Docker Hosts
6 Grafana dashboard JSON files for Docker host monitoring: running containers, volume usage, network I/O, CPU per container, memory per container, and system resources.
JWT Auth Middleware Worker
Validates JWTs at the Cloudflare edge before requests hit your origin. Returns proper 401 responses on failure. Zero origin load for auth rejections.
Proxmox Post-Install Hardening Kit
Production-ready Proxmox in 10 minutes — security hardening, monitoring, storage, and network config scripts.
AWS Account Security Bootstrap
CloudFormation template that enables GuardDuty, Security Hub, CloudTrail across all regions, AWS Config, and removes default VPCs. One-click security baseline.
Rust Development Environment
Rust toolchain with cargo-watch live reloading + Postgres + Redis. Volume-mounted source for fast recompile cycles.
Ollama + Open WebUI Stack
Private ChatGPT on your own hardware — Ollama with Open WebUI, GPU or CPU mode, HTTPS ready.
Nuxt 4 Dev Stack
Nuxt 4 + Postgres + Redis + Adminer. Nitro server config pre-set. Environment variable handling for dev and production documented.
FastAPI Async Dev Stack
FastAPI + Postgres + Redis + Celery + Flower dashboard + Adminer with Alembic migrations and async SQLAlchemy pre-wired.
Laravel 13 Dev Stack
Laravel + MySQL + Redis + Horizon + Mailpit + phpMyAdmin, queue workers pre-configured
Proxmox Backup Automation Bundle
Automated PBS jobs, offsite replication to S3-compatible storage, restore testing, and email alerts — all scripted.
CloudWatch Dashboard Pack for EC2
CloudFormation with 5 pre-built CloudWatch dashboards covering EC2 CPU, memory, disk, network throughput, and instance status checks.
Next.js Full Stack
Next.js 16 + Postgres + Redis + Prisma + Adminer — a complete full-stack dev environment in one command.
Ollama + AnythingLLM RAG Stack
Chat with your own documents privately — Ollama and AnythingLLM pre-wired with vector storage and document ingestion.
Grafana, Prometheus, and Loki Stack
Full observability Docker Compose stack: Prometheus for metrics, Loki for logs, Grafana with pre-wired datasources and starter dashboards. Ready in one command.
Gitea Self-Hosted Git
Gitea + Postgres + Gitea Actions runner — self-hosted Git with SSH push, HTTP clone, and CI/CD wired up out of the box.
Hub and Spoke Transit Gateway Stack
CloudFormation: Transit Gateway with a shared services VPC, workload VPC attachments, and isolated route tables per environment.
Cloudflare WAF Baseline Ruleset
Terraform config applying OWASP Core Rule Set, bot management, rate limiting, and custom rules for SQLi, XSS, and path traversal. Ready to apply to any zone.
Horizontal Pod Autoscaler Pack
HPA manifests and KEDA ScaledObject configurations for CPU-based, memory-based, and SQS queue depth autoscaling. Includes load testing scripts to validate scaling behavior.
Zero-Downtime Migration Runbook
Documented runbook plus bash scripts for the expand/contract migration pattern — add, rename, and drop columns without downtime.
API Gateway Lambda and DynamoDB Starter
CloudFormation: REST API with Lambda proxy integration, DynamoDB table, IAM execution roles, CloudWatch logging, and X-Ray tracing enabled.
API Rate Limiter Worker
Per-IP rate limiting using Cloudflare KV. Configurable time window and request limit. Returns proper 429s with Retry-After headers.
AWS PrivateLink Service Stack
CloudFormation: expose an internal service via PrivateLink with Network Load Balancer, endpoint service configuration, and consumer endpoint in a separate VPC.
Prometheus Alerting Rules Pack
40+ production-tested alerting rules for Node Exporter, cAdvisor container metrics, and uptime. Covers CPU, memory, disk, load, and network. Drop into any Prometheus setup.
Scheduled Job Framework
CloudFormation: EventBridge cron rule triggering Lambda, SQS dead letter queue for failures, CloudWatch alarm on error rate, and SNS alert on DLQ depth.
Django + Celery Stack
Django + Postgres + Redis + Celery + Flower + Mailhog — async tasks and email dev wired from the start.
AWS Budget Alerts Stack
CloudFormation: account-level and per-service budgets with SNS alerts at 50%, 80%, and 100% of monthly threshold.
kube-prometheus-stack Starter Config
Pre-tuned Helm values for kube-prometheus-stack: storage class settings, retention periods, Alertmanager routing, and 8 Grafana dashboards pre-enabled.
Supabase Local Dev Stack
Full local Supabase via Docker Compose: Postgres + Auth + Storage + Realtime + Studio UI. No cloud account required.
n8n Production Stack
n8n + Postgres + Nginx — production-grade workflow automation with persistent storage, TLS-ready proxy, and daily backups.
S3 Intelligent Tiering and Lifecycle Pack
CloudFormation: S3 bucket with Intelligent Tiering enabled, lifecycle rules for Glacier archival, cross-region replication, and versioning with noncurrent version expiry.
Fluent Bit Log Aggregation Stack
Docker Compose: Fluent Bit collecting logs from all containers and shipping to S3 with daily date partitioning. Includes Athena table definition for querying.
Cookie Banner Injector Worker
Uses Cloudflare HTMLRewriter to inject a GDPR-compliant cookie consent banner into any HTML response. No origin code changes needed. Configurable styling.
EC2 Rightsizing Report Script
Python script using Cost Explorer and CloudWatch metrics to identify over-provisioned EC2 instances with specific downsizing recommendations.
Webhook Signature Validator Worker
Validates Stripe, GitHub, Shopify, and Svix webhook signatures at the Cloudflare edge before forwarding to your origin. Rejects invalid payloads instantly.
Monthly Cost Digest Lambda
CloudFormation: Lambda running on the 1st of each month emailing a formatted cost breakdown by service, region, and cost allocation tag.
Default VPC Cleanup Script
Bash script removing default VPCs across all enabled regions. Dry-run mode shows exactly what will be deleted. Rollback documented.
Serverless Webhook Relay
CloudFormation: API Gateway + Lambda that receives webhooks, validates signatures, and fans out to multiple downstream services via SQS. Configurable routing rules.
Python Data Science Stack
Jupyter + Postgres + Redis + pgAdmin with NumPy, Pandas, scikit-learn, and SQLAlchemy pre-installed.
AWS Cost Anomaly Detection Stack
CloudFormation: Cost Anomaly Monitor with SNS topic and Lambda that formats anomaly alerts into readable email digests instead of raw JSON.
SOC2 Baseline CloudFormation Stack
Enables every AWS service auditors look for: Config rules, CloudTrail, VPC flow logs, Access Analyzer, and Security Hub with CIS standard enabled.
AWS Organizations SCP Pack
10 battle-tested Service Control Policies: deny non-approved regions, require encryption, prevent root usage, deny public RDS and S3.
Idle Resource Finder Script
Bash and AWS CLI script scanning all regions for unattached EBS volumes, unused Elastic IPs, stopped instances, and idle load balancers.
Production VPC 3-Tier
CloudFormation: public, private, and isolated subnets across 3 AZs with NAT Gateways, VPC endpoints, and flow logs.
Transit Gateway Hub Stack
CloudFormation: central Transit Gateway with spoke VPC attachment pattern and route table isolation between environments.
ECS Fargate Service Stack
CloudFormation: Fargate service with ALB, target tracking autoscaling, Secrets Manager integration, and structured CloudWatch logging.
AWS Landing Zone Bootstrap
CloudFormation StackSet: logging account, security account, baseline SCPs, and account vending structure for multi-account AWS.
Uptime Kuma with Push Notifications Stack
Docker Compose: Uptime Kuma paired with Ntfy for push notifications to mobile. Pre-configured notification templates for down and recovery alerts.
Terraform AWS Foundations Module
Opinionated Terraform root module: VPC, IAM roles, S3 remote state backend, and DynamoDB lock table with documented variable inputs.
ECS Fargate Spot Migration Template
CloudFormation showing the exact capacity provider strategy for mixing Fargate and Fargate Spot with graceful spot interruption handling.
GitHub Actions Security Scanning Pipeline
Combines Trivy (containers and Terraform IaC), Semgrep, and OWASP dependency check in one workflow. Results posted as PR annotations.
Proxmox Monitoring Stack
InfluxDB + Grafana pre-wired for Proxmox — dashboards for nodes, VMs, LXCs, and storage ready in one command.
Dependabot Auto-Merge Configuration Pack
Dependabot configs for Node.js, Python, Docker, Terraform, and GitHub Actions with auto-merge rules for patch updates and weekly schedules for major versions.
Packer Ubuntu 24.04 Hardened AMI
CIS Level 1 hardened Ubuntu 24.04 AMI with CloudWatch agent, SSM agent, fail2ban, and custom MOTD. Builds in under 10 minutes.
Multi-Origin Failover Router
Automatically routes traffic to a secondary origin if the primary returns 5xx errors. Configurable retry logic and failure thresholds.
EKS IRSA Role Factory
Terraform module creating IAM roles with OIDC trust for EKS service accounts. Pre-built policy attachments for S3, SQS, Secrets Manager, DynamoDB, and ECR.
Lambda Layer Pack for Node.js
Pre-built Lambda layers for Node.js 22: sharp for image processing, Puppeteer for headless Chrome, and a common AWS SDK utility helpers layer. Deploy-ready ZIPs included.
Security Headers Injector Worker
Adds HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy to every response without touching your origin code.
EKS Cluster Baseline
Terraform: production-ready EKS cluster with managed node groups, IRSA, VPC CNI, cluster autoscaler, and EBS CSI driver.
GitHub Actions Multi-Environment Promotion
Dev to staging to production promotion with manual approval gates, environment protection rules, and deployment history via GitHub releases.
GitHub Actions Terraform Pipeline
Terraform plan posted as PR comment, apply on merge, state locking enforced, manual approval gate for production. Supports multiple workspaces.
VPC Peering Automation Script
Bash and AWS CLI script that creates bidirectional VPC peering including route table entries and security group rules in both VPCs. Idempotent and safe to re-run.
ElastiCache Redis Cluster Stack
CloudFormation: Redis cluster with automatic failover, a parameter group tuned for caching workloads, CloudWatch alarms on evictions and connections, VPC-only access.
S3 Static Site with CloudFront and WAF
CloudFormation: S3 origin with OAC, CloudFront distribution, ACM certificate automation, and WAF with AWS managed rules.
Aurora Serverless v2 Stack
CloudFormation: Aurora Serverless v2 Postgres cluster with auto-scaling, Data API enabled, Secrets Manager integration, and a Bastion for initial access.
SvelteKit Full Stack Environment
SvelteKit + Postgres + Prisma + Redis + Adminer. adapter-node configured for production builds.
AWS Access Analyzer Weekly Digest
Deploys Access Analyzer with an EventBridge rule triggering a Lambda that emails a formatted weekly digest of all external access findings.
ELK Logging Stack
Elasticsearch + Logstash + Kibana — pre-wired with sane memory limits, ILM index lifecycle policy, and a Filebeat shipper config.
Namespace Hardening Pack
Helm chart applying resource quotas, LimitRanges, default NetworkPolicies, and baseline RBAC roles to any namespace.
Elixir Phoenix Dev Stack
Elixir + Phoenix + Postgres + Redis. LiveView ready, mix tasks via docker exec, iex remote shell documented.
Multi-Region Active-Passive DR Stack
CloudFormation replicating core infrastructure to a second region with Route53 health check failover. RTO and RPO documented.
Geo-Block Worker
Block or redirect requests by country code at the edge. Configurable allow/deny lists stored in KV. Includes bypass header for internal use.
AWS Client VPN Stack
CloudFormation: Client VPN endpoint with mutual certificate authentication, split-tunnel configured to only route AWS traffic, CloudWatch connection logging.
WordPress Local Dev Environment
WordPress + MySQL + phpMyAdmin + Mailpit + WP-CLI with theme and plugin directories mapped to host.
EC2 Bastion with SSM Fallback
CloudFormation: bastion host with SSM Session Manager fallback. Session logging to CloudWatch, IAM-controlled access, no port 22 required.
AWS CodePipeline and CodeBuild Stack
CloudFormation full CI/CD pipeline from GitHub via CodeStar connection, CodeBuild Docker build, ECS deployment. Build spec and IAM roles included.
A/B Test Traffic Splitter
Routes a configurable percentage of traffic to alternate origins. Logs split results to KV for analysis. No app changes required.
Prometheus + Grafana Stack
Prometheus + Grafana + Alertmanager + Node Exporter — full observability stack with starter dashboards pre-loaded.
Cost Allocation Tagging Enforcer
CloudFormation: AWS Config rule with Lambda auto-remediation that tags untagged resources and sends a weekly digest of still-untagged resources.
VPC Flow Logs and Athena Query Pack
Enables VPC flow logs to S3 and creates an Athena table for querying them. Includes 10 security queries: port scanners, unusual protocols, rejected traffic analysis.
GitOps Baseline with Flux v2
Terraform and Flux bootstrap config: installs Flux on EKS, connects to GitHub repo, sets up image update automation and Slack notifications for deployment events.
Staging Environment Auth Wall
Basic auth Worker that gates any subdomain behind a username/password. Perfect for locking down staging and preview deployments.
Lambda Warmer Stack
CloudFormation: EventBridge rules pinging configured Lambda functions every 5 minutes to eliminate cold starts. Configurable function list via parameter.
S3 Cost Analysis Script
Python script breaking down S3 costs per bucket: storage class distribution, request costs, data transfer, and lifecycle rule recommendations.
Cloudflare Bot Filter Worker
Scores requests and blocks known bad actors at the edge. Allows legitimate crawlers, blocks malicious bots. Fully configurable thresholds via KV store.
Java Spring Boot Dev Stack
Spring Boot + Postgres + Redis + Adminer. Maven dependency cache volume for fast rebuilds. Spring DevTools hot reload configured.
ECS Container Insights Stack
CloudFormation enabling Container Insights on ECS clusters with pre-built CloudWatch dashboards for task CPU, memory, network, and service-level metrics.
Pod Security Standards Baseline
Kubernetes manifests enforcing Pod Security Standards at namespace level with audit logging for violations and a migration guide from deprecated PodSecurityPolicy.
CloudWatch Dashboard Pack for RDS
Pre-built CloudWatch dashboards for RDS connections, query latency, free storage, replication lag, and IOPS. Works for MySQL and Postgres.
RDS Postgres with Read Replica
CloudFormation: Multi-AZ RDS Postgres with read replica, automated backups, enhanced monitoring, Parameter Store, and Secrets Manager rotation.
CloudTrail Security Alerting Stack
CloudWatch metric filters and alarms on CloudTrail for root login, console login without MFA, IAM policy changes, and security group modifications. SNS notifications included.
Multi-Tenant EKS RBAC Pack
ClusterRoles, Roles, and RoleBindings for four personas: read-only viewer, developer scoped to own namespace, platform engineer, and emergency break-glass role.
Bash Deployment Toolkit
8 production-tested bash scripts: zero-downtime deploy, health check waiter, rollback trigger, blue/green switch, log tailer, and environment diff checker.
DynamoDB Single-Table Design Template
CloudFormation table definition plus a documentation pack covering single-table design access patterns with working query examples in Node.js and Python.
Automated RDS Snapshot Export to S3
CloudFormation: EventBridge + Lambda that exports RDS snapshots to S3 in Parquet format nightly, making them queryable via Athena without restoring the database.
Dev Environment Auto-Scheduler
CloudFormation: Lambda and EventBridge rules that stop tagged EC2 and RDS resources outside business hours. Typically saves 65% on dev costs.
Reserved Instance Planner
Python script analyzing 90 days of EC2 On-Demand usage to recommend 1-year vs 3-year RI purchases with break-even calculations.
VPC Endpoints Pack
CloudFormation: deploys Interface and Gateway VPC Endpoints for S3, DynamoDB, SSM, Secrets Manager, ECR API, ECR DKR, and CloudWatch Logs in a single stack.
GitHub Actions Node.js Full Pipeline
Lint, test, build, Docker push, and deploy workflow with matrix testing across Node versions, layer caching, and environment-specific deployment steps.
ALB with WAF and ACM Stack
CloudFormation: Application Load Balancer with WAF attached, automated ACM certificate, HTTP to HTTPS redirect rule, and S3 access logging pre-configured.
SQS Lambda Worker Pattern
CloudFormation: SQS queue with Lambda consumer, configurable batch size, DLQ for failures, and CloudWatch alarms on queue depth and DLQ message count.
Route53 Private Hosted Zone Stack
CloudFormation: private hosted zone associated across multiple VPCs, Route53 Resolver rules for on-premises DNS forwarding, and Resolver endpoint configuration.
Step Functions Order Workflow
CloudFormation: Step Functions state machine for multi-step order processing with parallel branches, error catching, retry logic, and CloudWatch execution logging.
Data Transfer Cost Analyzer
Python script using Cost and Usage Report data to identify top data transfer costs: inter-AZ, NAT Gateway, and CloudFront origin pull charges.
S3 Object Expiry Notification Stack
CloudFormation: S3 lifecycle expiry rules with EventBridge notifications when objects expire, Lambda logging all deletions to DynamoDB for a full audit trail.
S3 Security Guardrails Stack
AWS Config rules plus Lambda auto-remediation that automatically blocks any S3 bucket that becomes public. Includes SNS alert on remediation.
Lambda@Edge SEO Redirect Handler
CloudFormation: Lambda@Edge function handling trailing slash normalization, www to non-www redirects, and legacy URL pattern redirects at the CloudFront layer.
S3 Event Processing Pipeline
CloudFormation: S3 upload event triggers Lambda processor, result written to DynamoDB, failures routed to SQS DLQ with CloudWatch alarm.
AWS Network Firewall Baseline Stack
CloudFormation: Network Firewall in a dedicated inspection VPC with stateful rules for common threat categories and CloudWatch logging for all rule matches.
n8n Self-Hosted Automation Stack
Escape Zapier pricing — self-host n8n with Postgres, Caddy, and automatic SSL in one compose file.
Go Web Development Stack
Go with Air live reload + Postgres + Redis + Adminer. Makefile for common tasks. Structured for a typical Go web service.
CIS Level 1 EC2 Hardening Script
Bash script applying CIS Amazon Linux 2023 Level 1 benchmark. Every change documented with the corresponding CIS control reference. Safe to run on existing instances.
Velero Backup Configuration
Helm values and BackupSchedule manifests for Velero backing up to S3 with encryption. Includes a tested restore runbook and backup verification cron job.
Secrets Manager Rotation Template
CloudFormation for automated RDS credential rotation. Includes the Lambda rotator function, IAM roles, and rotation schedule. Works for MySQL and Postgres.
MinIO Production Stack
Docker Compose: MinIO with Nginx load balancer sidecar, mc client container for administration, and lifecycle policy automation scripts for object expiry.
IAM Password Policy and MFA Enforcer
CloudFormation that sets a strong account password policy plus an SCP that denies all API calls from IAM users without MFA enabled.
Route53 DNS Failover Stack
CloudFormation: Route53 health checks with primary and secondary failover records, SNS alert when failover activates, and automatic recovery detection.
Packer Amazon Linux 2023 Base AMI
Amazon Linux 2023 with CloudWatch agent, SSM agent, Docker, Docker Compose, and standard tooling pre-installed and smoke tested.
GitHub Actions ECS Deployment Pipeline
Build, push to ECR, deploy to ECS Fargate with rolling update, auto-rollback on health check failure, and Slack notification.
Zero Trust SSH with Short-Lived Certificates
SSH to servers without exposing port 22. Cloudflare Tunnel + Zero Trust Access with ephemeral certificates, no long-lived keys.
Cloudflare Tunnel + Traefik Stack
Cloudflare Tunnel + Traefik routing. Zero ports, one tunnel, one config. Add services with Docker labels.
cloudflared Systemd Service Pack
Hardened systemd units & idempotent installer for cloudflared tunnels on Ubuntu/Debian/Raspberry Pi. Zero-config setup, auto-updates, security hardening.
Homelab Cloudflare Tunnel Stack
Expose your homelab remotely without opening ports. Docker Compose + cloudflared tunnel with ingress rules for 6 services.
Cloudflare Access Policy Pack
Pre-built Terraform configs for Cloudflare Zero Trust Access—protect Grafana, Gitea, pgAdmin with email OTP, GitHub SSO, and service token policies.