Complex deployments, declared in one file.
Colors packages OpenTofu and Ansible into Package Skills: reproducible multi-machine deployments a coding agent can operate and your team can read. Infrastructure stays in your cloud account, and credentials stay local.
npx skills add getcolors/langfuseprofile: langfuse-vultr
workdir: .colors
provider-compute: vultr
provider-dns: cloudflare
provider-backend: r2
compute-prevent-destroy: true
langfuse-host: langfuse.bigconfig.online
clickhouse-version: 26.3.29.7
clickhouse-nodes: 3
neon-pg-version: 17
vultr-region: ams
vultr-vpc-subnet: 10.50.0.0/24
vultr-plan-neon: vc2-4c-8gb
vultr-plan-redis: vc2-1c-2gb
vultr-plan-clickhouse: vc2-4c-8gb
vultr-plan-app: vc2-4c-8gb
vultr-http-sources: cloudflare
langfuse-postgres-backup-oncalendar: "*-*-* 00/6:00:00"
langfuse-backup-retention-days: 7The excerpt above is not a mock-up: it is the desired state of a real Langfuse deployment. From a Vultr account, a Cloudflare zone and two R2 buckets, the Langfuse Package Skill creates a VPC, a Neon storage tier for Postgres, a Redis host, three ClickHouse replicas with their own Keeper quorum, and the application host behind Cloudflare — and then proves the topology works before it reports success.
- Provisions the VPC, six instances and four role-scoped firewall groups with OpenTofu
- Converges the storage tier, the three replicas, Redis and the app host with Ansible, in dependency order
- Generates every internal secret on the machine that owns it; the operator holds three
- Reads a trace back from node 0 and the last replica, finds the raw event in R2, then rehearses a restore
There is no Colors control plane on any of the six machines. When the workflow finishes, the instances, the state and the backups are yours; describe and rehearse run against them from your laptop.
Every Package Skill is built on the same SDK and walks the same build, dry-run, create and guarded delete. The shape it converges is the package’s to decide.
Langfuse
LLM observability with a Neon storage tier, Redis, three ClickHouse replicas with Keeper, and the app host, plus a restore rehearsal.
Neon Multi-Node
Separate PostgreSQL compute and pageserver roles, a three-member WAL quorum, native PostgreSQL TLS and managed S3 storage.
ClickHouse
A replicated ClickHouse cluster with a three-member Keeper quorum and a separate Metabase and PostgreSQL server.
PostgreSQL HA
PostgreSQL 17 with etcd quorum consensus, Patroni leader election, HAProxy routing and continuous WAL backups to R2.
MySQL HA
MySQL 8.4 Group Replication with a floating-IP primary and one-minute binary-log archiving to R2.
AutoMQ
Kafka 3.9.1 protocol with both KRaft roles on every node and object storage in R2, S3 or GCS.
K8s
A kubeadm cluster in a deployment-owned VPC with pinned Flannel, cloud-controller and Flux releases reconciling a public repository.
Agent Network K8s
A keyless, policy-gated LLM endpoint behind a TCP load balancer and a network-isolated agent pod running headless Claude Code.
Agent Network DOKS
The same two-pod demo on DigitalOcean Kubernetes, with a kaniko build pushed to a created-or-adopted container registry.
Every deployment uses the same explicit lifecycle, whether it converges one host or six. The first two commands are safe on a fresh checkout with no provider credentials.
./green buildRender locally
Validate colors.yml and generate the OpenTofu, Ansible, and supporting files for every machine under .colors/.
./green create --dry-runWalk the complete plan
Traverse the deployment graph while skipping every provider call and remote side effect.
./green createProvision and verify
Converge the declared infrastructure, configure the hosts in dependency order, and run the package’s acceptance gates.
You can use any of them. Colors is useful when a team needs a whole topology stood up, proven and torn down on demand, not one layer of it.
The module stops at the instance
A Package Skill carries host configuration, secret generation on the machine that owns each secret, ordering across machines, and the acceptance gates that prove the topology works — behind one lifecycle.
The cluster has to exist first
Charts assume a cluster and Compose assumes one host. Colors provisions the machines, the network between them and a firewall per role, then converges each tier in dependency order.
No control plane, no seat bill
Colors provisions in your cloud account and exits. The machines, the state and the backups stay yours, and delete is guarded by a committed flag.
OpenTofu and Ansible stay inspectable
build renders the files for every machine locally before create is allowed to contact a provider or a host.
Secrets never belong in `colors.yml`
Credentials arrive through local COLORS_PAR_* environment variables and are not rendered into generated files.
No model provisions your infrastructure
A coding agent can install and operate a Package Skill, but the launcher itself is ordinary deterministic code and makes no LLM calls. Three implementations render byte-identical output, checked on every commit.
Not for every team
If your platform team already maintains the IaC for every tier, or one host with a dashboard is all you need, Colors may add no value.
Colors is an SDK made of three interchangeable libraries for building Package Skills. Pick the runtime your team already uses — the guarantees don't change: dry-run boundaries, secret indirection, identical desired-state semantics.
A Package Skill provisions infrastructure; a Context Skill remembers what a verified build learned. Each kind can be created with your agent, and each can be submitted to the Skills Catalog — four workflows that pair up into a matrix.
Create Package Skill
Build a new Package Skill and a deployment that uses it.
Create Context Skill
Distill a completed, verified build into routed knowledge.
Submit Package Skill
Validate an existing Package Skill and add its recipe to the Catalog.
Submit Context Skill
Validate against the Context Skill Standard and add its recipe.
Create Package Skill gives a coding agent the workflow for building a new Colors Package Skill and a deployment that uses it — from requirements and credential boundaries through implementation, safe dry runs, and an authorized production deployment.
npx skills add "https://github.com/getcolors/skills" --skill "create-package-skill"Define
Agree on names, behavior, acceptance criteria, deployment target, credentials, cost, and authorization before touching files.
Scaffold safely
Create only non-secret desired state and credential placeholders, then stop for review. Secrets never enter chat or tracked files.
Build and deploy
Implement autonomously, test every layer, use real SHA pins, preserve safety guards, and deploy only within explicit authorization.
Submit Package Skill gives a coding agent the workflow for validating an existing Colors Package Skill, adding its catalog recipe, and opening an authorized pull request for curated discovery on getcolors.ai.
npx skills add "https://github.com/getcolors/skills" --skill "submit-package-skill"Validate
Inspect every SKILL.md and verify the Colors runtime, desired state, dry-run boundary, credential indirection, and lifecycle DAGs.
Add the recipe
Create one validated recipe for the product, grouping interchangeable runtime variants and infrastructure-oriented search keywords.
Open the PR
Run catalog validation and the site build, then create a branch, commit, push, fork, or pull request only with explicit authorization.
Create Context Skill gives a coding agent the workflow for distilling a completed, verified build into a Context Skill conforming to the Context Skill Standard — symptom-first routing, provenance-labelled claims, pinned versions, a failure catalogue, and evals, with no copies of the companion package's files.
npx skills add "https://github.com/getcolors/skills" --skill "create-context-skill"Harvest
Collect verbatim failures, review dispositions, deviations from documentation, and the exact pinned versions while the build's session still holds them.
Structure and route
Write the why into the body and the reference material into references, keep every claim provenance-labelled, and copy no file the companion package owns.
Prove and hand off
Write user-in-trouble evals, pass skills-ref validate, and stop: committing, pushing, and the catalog pull request each need explicit authorization.
Submit Context Skill gives a coding agent the workflow for validating a Context Skill — knowledge distilled from a verified build — against the Context Skill Standard, adding its catalog recipe, and opening an authorized pull request for curated discovery on getcolors.ai.
npx skills add "https://github.com/getcolors/skills" --skill "submit-context-skill"Validate
Read the skill and its references, run skills-ref validate, and verify symptom routing, provenance, pins, the failure catalogue, and evals.
Add the recipe
Create one type: context recipe naming the skill's repository, symptom-oriented search keywords, and the companion Package Skill it documents.
Open the PR
Run catalog validation and the site build, then create a branch, commit, push, fork, or pull request only with explicit authorization.
Browse the PR-curated Skills Catalog by platform, provider, or runtime.
View the Catalog