Open Source Infrastructure As Code

Terraform is a declarative infrastructure-as-code tool designed to manage the lifecycle of cloud and on-premises resources. It functions as a workflow engine that reconciles a defined desired state against real-world infrastructure, using a persistent state-tracking layer to maintain consistency and visibility across distributed environments. By mapping infrastructure components into a directed acyclic graph, the system calculates the optimal order for provisioning, updating, or destroying resources. The platform is distinguished by its extensible plugin-based architecture, which decouples core orchestration logic from vendor-specific service APIs. This allows users to manage diverse infrastructure across multiple providers through a unified workflow. The system enforces predictability by separating operations into a three-stage lifecycle—planning, applying, and state-updating—and supports policy-as-code evaluation to validate changes against security and compliance rules before any modifications are executed. Beyond core orchestration, the tool provides robust support for collaborative management, including workspace isolation for environment separation and module sharing for distributing standardized infrastructure patterns. It integrates into broader development ecosystems through support for programmatic definition in various languages, external system hooks, and comprehensive tooling for configuration debugging and editor assistance.

Awesome Compose is a collection of resources designed to demonstrate the orchestration of multi-container applications. It serves as a practical reference for using declarative configuration files to define, manage, and deploy complex software stacks, ensuring that services run consistently across development, testing, and production environments. The project highlights the capabilities of container lifecycle management by providing examples of how to bundle software with its dependencies into isolated, portable units. It emphasizes the use of multi-stage build pipelines to optimize image sizes and the integration of environment variables to decouple application logic from host-specific settings. By leveraging these patterns, users can standardize development workspaces and automate the maintenance of interconnected service architectures. Beyond basic orchestration, the repository covers the broader surface of container infrastructure, including the management of image registries, network configurations, and storage drivers. It also demonstrates how to execute build-time commands and embed complex scripts directly into configuration files to streamline the assembly of containerized environments.

This project is a comprehensive educational curriculum designed to build proficiency across modern infrastructure, cloud-native technologies, and systems administration. It functions as a reference library and interview preparation resource, offering a structured collection of conceptual questions, practical coding challenges, and hands-on scenarios that cover the full spectrum of software delivery and operational workflows. The repository distinguishes itself through a modular, domain-specific structure that links instructional problem statements with verified implementation examples. By employing a standardized documentation schema, it provides a predictable learning path for mastering complex technical concepts, ranging from infrastructure-as-code patterns and container orchestration to cloud platform administration and security best practices. The content spans a wide array of technical domains, including automated configuration management, distributed system monitoring, database operations, and version control. It provides deep dives into specific tooling for cloud provisioning, container networking, and service deployment, ensuring that learners can validate their technical skills through isolated, practical exercises. All instructional materials are organized into a unified taxonomy of markdown-based documents, allowing users to navigate and study specific technical topics at their own pace.

Tailscale is a zero-trust networking overlay that connects distributed devices and services into a private, encrypted mesh network. By utilizing a high-performance, user-space implementation of the WireGuard protocol, it establishes secure peer-to-peer tunnels across diverse network topologies without requiring complex firewall configuration. The platform operates on a centralized control plane that manages global network state, authentication, and policy distribution, ensuring that connectivity is governed by identity rather than traditional IP-based rules. What distinguishes Tailscale is its deep integration with existing identity providers, which allows organizations to bind network access to verified user accounts and device posture. It enforces granular security through declarative access control lists and microsegmentation, enabling administrators to define precise permissions for users and services. Beyond standard connectivity, the platform includes a secure AI gateway that proxies and audits language model requests, providing centralized control over API usage, spending limits, and security guardrails. The project offers a comprehensive suite of administrative and developer tools, including infrastructure-as-code support, automated node registration, and identity-based SSH access that eliminates the need for manual key management. It also provides flexible traffic management capabilities, such as exit nodes for egress control, subnet routers for bridging isolated network segments, and public-facing service exposure through encrypted tunnels. The software is distributed as an open-source command-line daemon, supporting a wide range of operating systems and containerized environments to facilitate automated infrastructure deployment.

OpenTofu is a declarative infrastructure orchestrator that automates the provisioning and management of cloud resources. It functions as a platform-agnostic interface, allowing users to define their desired environment state in configuration files, which the system then reconciles against live infrastructure to calculate and execute necessary updates. The project utilizes a graph-based execution engine to determine the optimal sequence for resource operations, enabling the parallel processing of independent components to reduce deployment times. To support complex, multi-platform environments, it employs a provider-based plugin architecture that translates generic configuration definitions into specific API calls for various cloud services and third-party providers. Beyond core provisioning, the system facilitates infrastructure lifecycle management through reusable configuration modules that standardize deployments and enforce consistent patterns. It also provides a synchronization layer for state metadata, enabling distributed teams to coordinate changes and maintain consistent environment status across collaborative workflows.

NetBird is a zero-trust networking platform that builds secure, encrypted peer-to-peer overlay networks using the WireGuard protocol. It functions as a software-defined perimeter, connecting distributed infrastructure across cloud environments and physical locations while hiding network resources from the public internet. By integrating with external identity providers, the platform enforces granular access control and identity-based segmentation for every user and device. The platform distinguishes itself through extensive automation and programmatic management capabilities. It provides a centralized control plane for orchestrating network resources, automating device enrollment, and managing peer lifecycles at scale. Administrators can define complex routing policies, manage internal DNS resolution, and expose services securely without manual firewall modifications. The system also supports advanced security postures, including post-quantum cryptography, compliance-based access enforcement, and integration with endpoint security platforms to isolate non-compliant devices. Beyond core connectivity, the project offers a comprehensive suite of tools for infrastructure management, including support for hybrid cloud bridging, Kubernetes cluster integration, and multi-tenant administrative scoping. It provides deep observability through traffic event streaming, network topology visualization, and diagnostic utilities. The software is designed for flexible deployment, offering headless agents for servers, containerized sidecars for orchestration environments, and support for mobile and desktop operating systems.

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networking is handled through OVN-based virtual networks with built-in ACLs and BGP route advertisement, while storage uses a driver abstraction layer that supports Btrfs, ZFS, LVM, Ceph, LINSTOR, and directory backends. Clustering is built on Raft consensus for high availability, and containers use user-namespace isolation with non-overlapping UID/GID maps to prevent privilege escalation. Authentication supports TLS client certificates, OpenID Connect, PKI, and ACME certificate issuance, with fine-grained authorization via role-based access control and OpenFGA integration. The platform also provides comprehensive image management, backup and recovery workflows, real-time monitoring and metrics export to Prometheus and Grafana, and integration with infrastructure-as-code tools such as Terraform and Ansible. Cluster operations include automatic rebalancing, live migration, and rolling upgrades.

Dokku is a self-hosted platform as a service that automates the deployment and management of web applications on your own infrastructure. It functions as an infrastructure automation tool, providing a git-driven engine that triggers container builds, service orchestration, and release workflows directly from source code repositories. The platform distinguishes itself by using buildpack-based image construction to detect project structures and automate container creation without manual configuration. It manages the full application lifecycle through a simplified interface that abstracts low-level container runtime commands, while dynamically handling reverse-proxy routing and environment-variable-driven configuration to map traffic and decouple settings from the underlying host. Beyond core deployment, the system provides comprehensive infrastructure lifecycle management, including the automated setup of system dependencies and the configuration of administrative access controls. The platform is designed for modular expansion, allowing users to extend core functionality through a plugin system that hooks into lifecycle events. It is installed on Linux distributions using automated scripts to ensure consistent environment preparation.

Appwrite is a backend-as-a-service platform that provides a unified development environment for building full-stack applications. It integrates essential infrastructure components—including authentication, databases, storage, and serverless functions—into a single, centralized interface to simplify application development and resource management. The platform distinguishes itself through a container-based microservices architecture that ensures consistent execution across diverse infrastructure. It features a versatile connectivity layer that links frontend applications with third-party services, databases, and external APIs through standardized interfaces. Developers can manage and automate the configuration of these backend resources using infrastructure-as-code tools, while granular role-based access control enforces security policies across all platform resources and API endpoints. Beyond its core services, the platform offers a broad capability surface that includes cross-platform data synchronization, event-driven webhooks, and comprehensive billing and usage monitoring. It supports extensive integrations for AI utilities, payment processing, messaging, and logging, allowing developers to extend application functionality through modular, event-driven workflows. The platform is designed for both managed and self-hosted deployments, providing tools for production environment optimization, data migration, and custom domain configuration.

Ansible is an agentless infrastructure automation engine designed to manage remote servers and network devices. It functions as a cross-platform orchestration tool that coordinates system updates, software installations, and service configurations from a centralized management workstation. By utilizing a declarative approach, it allows users to define desired system states through human-readable configuration files, ensuring consistency across distributed environments. The platform operates by establishing secure shell connections to target nodes, eliminating the need for persistent agent software or complex bootstrapping processes on managed hosts. It employs an inventory-driven model to organize infrastructure into logical groups, while its module-based execution system dispatches idempotent scripts to verify and maintain state. This architecture is supported by a plugin-based framework that enables custom interfaces for connection methods, inventory sources, and task processing logic. Beyond core orchestration, the project provides capabilities for automated application deployment and infrastructure as code, allowing for version-controlled management of data center environments. It also includes template rendering functionality to dynamically inject variables and logic into configuration files before deployment. The software is distributed as a comprehensive package with extensive documentation available for installation and configuration.

This project is a self-hosted platform-as-a-service that provides a centralized management interface for deploying, configuring, and monitoring containerized applications and databases on private infrastructure. It functions as a visual control plane, automating the end-to-end lifecycle of services from source code to production. By managing container orchestration, networking, and resource allocation, it allows users to maintain full control over their own hardware while streamlining the delivery of software. The platform distinguishes itself through its agentless architecture, which uses secure shell connections to execute administrative tasks and manage remote servers without requiring persistent local software. It integrates directly with version control systems to trigger automated build and deployment pipelines, including the creation of temporary, isolated preview environments for every pull request. This workflow is supported by a declarative engine that uses templates to standardize the deployment of complex multi-container architectures and persistent database engines. Beyond core orchestration, the system handles the operational requirements of hosted services by managing dynamic reverse-proxy routing and automated SSL certificate lifecycles. It provides a comprehensive suite of infrastructure management tools, including browser-based terminal access for debugging, automated system dependency installation, and persistent state management via a central database. These capabilities ensure that infrastructure remains synchronized and consistent across multiple remote environments.

This project is an automated deployment tool designed to streamline the installation, configuration, and maintenance of network proxy software on Linux servers. It functions as a command-line utility that manages the lifecycle of network tunneling services, enabling users to establish and control private traffic routing through repeatable, automated workflows. The tool distinguishes itself through an interactive, menu-driven interface that abstracts complex configuration parameters into selectable options, making it accessible for operators regardless of their technical background. It performs environment-aware path resolution to detect host architecture and distribution specifics, ensuring that binary packages and directory structures are correctly aligned during deployment. Furthermore, it integrates proxy processes directly into the host operating system as managed background daemons, ensuring automatic restarts and consistent boot-time initialization. Beyond initial setup, the project provides comprehensive infrastructure management capabilities, including automated service updates and configuration changes. It utilizes template-driven generation to create service files, ensuring that network traffic routing and security settings are applied consistently across remote server environments.

Prefect is a workflow orchestration platform designed to define, schedule, and monitor complex data pipelines as Python code. It functions as a container-native engine that wraps individual tasks in isolated environments, ensuring consistent dependencies and resource allocation across diverse infrastructure. By utilizing a state-machine-based orchestration model, the system tracks execution progress through discrete transitions and persistent event logs to maintain reliable and observable task processing. The platform distinguishes itself through a decoupled worker-API architecture, which separates task scheduling from execution by allowing remote workers to poll a central API for pending work units. This design enables distributed task concurrency, allowing parallel workloads to scale horizontally across clusters or remote nodes. Furthermore, the system supports event-driven workflow triggering, enabling pipelines to initiate or resume automatically in response to system state changes or external signals. The project provides a comprehensive capability surface for managing the entire lifecycle of data operations. This includes modular block-based configuration for injecting credentials and infrastructure settings, result persistence caching for optimizing redundant computations, and extensive integration support for cloud services, databases, and version control systems. Users can also leverage built-in tools for infrastructure automation, data lineage tracking, and automated notification management. The software is distributed as a Python-based framework, with documentation and installation guides available to assist in configuring self-hosted deployments or connecting to managed orchestration services.

Ory Keto is an open-source authorization server that implements Google Zanzibar’s relationship-based access control model. It stores every access relationship as a tuple in a SQL database and exposes a declarative TypeScript-like namespace language for defining object types, relations, and permissions. The service provides bidirectional permission resolution, configurable consistency levels for checks, and dual gRPC and REST APIs for broad integration. Keto extends the Zanzibar model with edge enforcement of access policies, structured compliance auditing of permission decisions, and infrastructure-as-code management through Terraform, Pulumi, and Helm. It includes agent-level security controls with identity authentication, action authorization against the permission model, and graduated policy enforcement from observation to strict blocking. Observability is supported via OpenTelemetry, Prometheus metrics, and SIEM event streaming. The system also covers identity verification workflows, consent synchronization, automated data subject request fulfillment, and billing integrations. Deployment options include managed SaaS, on-premises, and private cloud, with containerized execution and Kubernetes Helm charts for orchestration. The project, written in Go, provides full documentation and a command-line interface for configuration and management.

Proxmox VE Helper Scripts is a collection of shell-based automation utilities designed to simplify the installation and configuration of software services within virtualization environments. The repository functions as an infrastructure management tool, providing standardized procedures for deploying and maintaining virtual machines and containers directly on the host operating system. The project distinguishes itself through idempotent configuration management, which ensures system state consistency by verifying existing resources before applying changes. By utilizing direct host interaction, the scripts invoke native system binaries to modify the environment without requiring intermediate abstraction layers, while environment-aware execution allows the logic to adapt dynamically to different host parameters and versioning. These scripts cover a broad range of administrative operations, including homelab resource orchestration, server cluster maintenance, and general infrastructure automation. The modular design allows users to execute isolated tasks independently or chain them together to support complex deployment workflows.

Atlas is a SQL database schema management tool and database infrastructure as code framework. It provides a declarative database migration engine that computes the difference between a desired schema state and the current database state to automatically generate the necessary SQL for transitions. The project distinguishes itself through a comprehensive suite of analysis and visualization tools, including a database schema linter that detects destructive changes and data loss risks. It also features a SQL schema visualization tool capable of generating entity-relationship diagrams from extracted database structures. The platform covers a broad surface of database operations, including versioned migration management, schema drift detection, and declarative seed data synchronization. It extends into security and governance by treating database access control, roles, and permissions as version-controlled code. The tool integrates with CI/CD pipelines, GitOps workflows, and infrastructure orchestration tools to automate the linting, testing, and deployment of database changes.

Helm is a package manager for Kubernetes that simplifies the deployment and management of multi-component applications. It functions as a template rendering engine and release coordinator, allowing users to bundle, version, and deploy software as standardized packages. By maintaining a persistent metadata layer within the cluster, it tracks release history and manages the full lifecycle of applications, including installations, upgrades, and rollbacks. What distinguishes Helm is its ability to handle complex application hierarchies through automated dependency resolution and the composition of umbrella charts. It provides robust security through cryptographic provenance verification, ensuring package integrity via digital signatures and hashes. Furthermore, it leverages standard container image registries for artifact distribution and utilizes server-side logic to resolve configuration conflicts during concurrent infrastructure updates. The project offers a comprehensive suite of tools for infrastructure management, including lifecycle hooks for custom automation, readiness testing, and advanced deployment strategies. It supports a highly extensible plugin architecture and provides developer utilities such as package inspection and repository management. Users can define reusable configuration logic through a sophisticated templating framework that supports dynamic data injection, flow control, and global value management. Helm is distributed as a command-line interface tool, providing a unified experience for managing containerized environments across development and production workflows.

Chef is a configuration management platform and infrastructure as code framework used to automate the deployment and maintenance of infrastructure state across a fleet of servers. It operates as an idempotent automation engine, ensuring systems converge to a desired state by applying only the necessary changes to resolve differences. The system functions as a multi-platform server orchestrator capable of managing infrastructure across different operating systems, cloud providers, and hardware architectures. It includes a dedicated infrastructure testing framework to verify configuration code by deploying it to temporary virtual instances and running automated validation checks. The platform covers broad capability areas including cloud environment provisioning, enterprise server automation, and the management of Windows infrastructure. It provides tools for detecting system runtimes, virtualization states, and node architectures to apply conditional configuration logic.

Portainer is a unified infrastructure management platform that provides a centralized control plane for deploying, monitoring, and managing containerized applications. It functions as an orchestration-abstraction layer, translating user actions into platform-specific API calls to maintain consistency across diverse container runtimes and cluster technologies. By organizing users, teams, and resources into a single interface, it enables granular role-based access control and lifecycle management for containerized services and stacks. The platform distinguishes itself through its support for distributed edge infrastructure and secure remote connectivity. It utilizes encrypted tunnels and outbound-only agent communication to manage geographically dispersed environments without requiring inbound port exposure. Furthermore, it integrates a GitOps-driven reconciliation engine that automatically synchronizes service configurations from version-controlled repositories, facilitating continuous delivery workflows and automated stack redeployments. Beyond its core orchestration capabilities, the platform offers extensive tools for cluster administration, including web-based terminal access, namespace management, and resource monitoring. It supports standardized deployment through a template-based engine that allows for reusable configuration schemas and dynamic variable injection. Users can also manage multiple orchestration instances and remote environments through automated update scheduling, rollback mechanisms, and custom metadata tagging. The software is designed for flexible deployment, supporting air-gapped environments and providing programmatic access via secure API tokens.