Three libraries — red, green, and blue — give agents dry-run guarantees, secret indirection, and strict lifecycle control over real infrastructure, in the runtime your team already uses.
npx skills use getcolors/onceprofile: once-colors
workdir: .colors
once:
applications:
- host: www.getcolors.ai
image: ghcr.io/getcolors/colors-website:latest
github: getcolors/colors-website
provider-compute: oci
provider-smtp: resend
provider-dns: cloudflare
provider-backend: r2
compute-prevent-destroy: trueWeb automation and infrastructure automation demand different guarantees.
Navigates DOM elements, fills forms, scrapes content — bridges natural language intent with web interaction.
Provisions platforms, infrastructures, and containers — with dry-run boundaries and strict credential handling instead of raw shell access.
colors.yml declares hostnames, DNS zones, and mail domains directly — no separate settings to keep in sync.
Colors’ three pinned runtimes — Bun, Babashka, or uv — not ad-hoc shell scripts.
Secrets stay in COLORS_PAR_* env vars, referenced by name and never rendered into files.
Colors is an SDK made of three interchangeable libraries for building Package Skills. Pick the runtime your team already uses — the guarantees don't change: dry-run boundaries, secret indirection, identical desired-state semantics.
Create Package Skill gives a coding agent the workflow for building a new Colors Package Skill and a deployment that uses it — from requirements and credential boundaries through implementation, safe dry runs, and an authorized production deployment.
npx skills use getcolors/skills@create-package-skillAgree on names, behavior, acceptance criteria, deployment target, credentials, cost, and authorization before touching files.
Create only non-secret desired state and credential placeholders, then stop for review. Secrets never enter chat or tracked files.
Implement autonomously, test every layer, use real SHA pins, preserve safety guards, and deploy only within explicit authorization.
K8s is a Package Skill built with Colors. It provisions a two-node kubeadm cluster in a deployment-owned DigitalOcean VPC, installs pinned Flannel, DigitalOcean cloud-controller and Flux releases, and reconciles applications from a public Git repository.
npx skills use getcolors/k8sAgent reads colors.yml. It pins the control-plane and worker shapes, Kubernetes and component versions, network CIDRs, state backend, and GitOps repository.
DigitalOcean, Cloudflare, and remote-state credentials arrive through COLORS_PAR_*; tokens and kubeconfig never enter tracked or generated files.
Builds deterministic OpenTofu and Ansible files, then runs create --dry-run before any provider, node, DNS record, or load balancer is contacted.
OpenTofu creates the VPC, firewalls, control plane, and worker. Ansible installs containerd and kubeadm, joins the nodes, and keeps administrative access CIDR-restricted.
Flux deploys controllers and applications from Git; the workflow waits for both nodes, DNS, TLS, the DigitalOcean load balancer, and the HTTPS health endpoint.
Infrastructure is converged before kubeadm touches either node, and acceptance proves the GitOps application over valid HTTPS. Delete first reloads node addresses from remote state, asks Kubernetes to remove its DigitalOcean load balancer, drops the managed SSH alias, and only then reaches guarded infrastructure destruction.
K3s is a Package Skill built with Colors. It provisions one Hetzner Cloud VPS behind a default-deny firewall, installs pinned K3s and Flux releases, and continuously reconciles a public Git repository without exposing the Kubernetes API.
npx skills use getcolors/k3sAgent reads colors.yml. It pins the server shape, K3s and Flux versions, state backend, and public GitOps repository.
Hetzner, R2, and optional Cloudflare credentials arrive through COLORS_PAR_*; none are rendered under .colors/.
Builds OpenTofu and Ansible files, then runs create --dry-run before any provider or host is contacted.
OpenTofu creates the VPS and firewall; Ansible installs K3s and keeps API port 6443 private behind SSH.
Flux pulls applications and add-ons from Git. ExternalDNS and cert-manager can converge wildcard DNS and TLS without a kubeconfig in CI.
The remote branch installs K3s and Flux and waits for the GitOps repository; the local branch writes the SSH alias. `./green kubectl` then crosses an SSH tunnel instead of publishing port 6443. Delete removes the alias before destroying the firewall and server, and the committed guard refuses accidental destruction.
ClickHouse is a Package Skill built with Colors. It provisions a three-node replicated ClickHouse cluster with a three-member Keeper quorum, plus a separate Metabase and PostgreSQL server, on Hetzner Cloud.
npx skills use getcolors/clickhouseAgent reads colors.yml. It pins four server shapes, ClickHouse, Metabase, PostgreSQL and dbt versions, private networks, DNS, and the state backend.
Hetzner, Cloudflare, R2, ClickHouse, and Metabase credentials arrive through COLORS_PAR_*; deployment SSH and WireGuard private keys are generated and retained outside remote state.
Builds OpenTofu, Ansible, WireGuard, and dbt files, then runs create --dry-run before contacting any provider or server.
OpenTofu creates all four servers in parallel behind a default-deny firewall; split Ansible stages then configure ClickHouse and Metabase concurrently after WireGuard is ready.
Local dbt tests replicated tables, acceptance queries them through Metabase and checks public-port isolation, then zero-change OpenTofu plans prove convergence.
The shared firewall exposes only SSH, ICMP, and WireGuard UDP. Acceptance verifies Keeper, replicas, dbt, Metabase, DNS, VPN reachability, and public-port isolation; the drift stage requires every OpenTofu plan to be empty. Delete reverses the graph with parallel DNS/firewall and server teardown, while destroy protection refuses accidents.
Airflow is a Package Skill built with Colors. It provisions one VPS running Apache Airflow with LocalExecutor, host Postgres, continuous WAL-G backups, Caddy authentication and TLS, and a private GitHub repository that deploys DAGs over a confined rsync key.
npx skills use getcolors/airflowAgent reads colors.yml. It pins the server, Airflow and Postgres versions, hostname, DAG repository, and backup policy.
Provider, database, Airflow, backup, and GitHub credentials arrive through COLORS_PAR_*; none are rendered under .colors/.
Builds OpenTofu, Ansible, and repository seed files, then runs create --dry-run before contacting a provider or host.
OpenTofu creates compute, SMTP, and DNS; Ansible installs Docker, Postgres, WAL-G, Airflow, Caddy, and the deploy account.
A private repository pushes DAGs over rrsync; its write-only key is confined to one directory and has no shell or sudo access.
GitHub follows the remote stage because seeding the repository immediately triggers its deploy workflow, so the matching public key must already be installed. Delete revokes the credential first, removes the local SSH alias, then tears down SMTP, DNS, and compute; it deliberately keeps the DAG repository and the WAL-G archive.
Rama is a Package Skill built with Colors. It provisions a private single-node Rama cluster on DigitalOcean with ZooKeeper, a Conductor and Supervisor, WireGuard access, and optional Cloudflare DNS and Resend mail.
npx skills use getcolors/ramaAgent reads colors.yml. It pins the Droplet shape, Rama, ZooKeeper and Java versions, VPN network, optional hostname and mail domain, and state backend.
DigitalOcean, R2, optional Cloudflare and Resend credentials arrive through COLORS_PAR_*; the Rama license and generated WireGuard client remain outside tracked files and remote state.
Builds deterministic OpenTofu and Ansible files, then runs create --dry-run before any provider, server, DNS record, or mail domain is contacted.
OpenTofu creates the Droplet and default-deny firewall; Ansible installs WireGuard, ZooKeeper, Rama Conductor and Supervisor, exposing only SSH and the VPN publicly.
Acceptance checks every service, runs conductorReady and numSupervisors through the local Rama CLI, and proves Rama ports are unreachable from the public internet.
DNS and mail stages become no-ops when their providers are disabled. Delete reverses the graph, removing local and remote WireGuard configuration before infrastructure; the committed destroy guard refuses accidental deletion.
Once is a Package Skill built with Colors. It provisions a VPS, configures DNS and outgoing mail, installs Docker, and reconciles declared applications — a self-hosted alternative to Netlify or Vercel that an agent runs end to end.
npx skills use getcolors/onceAgent reads colors.yml. Hostnames determine DNS zones and mail domains.
Env map points to COLORS_PAR_* variables, deferred until runtime.
Builds files under .colors/ and runs create --dry-run, touching nothing live.
OpenTofu provisions compute/SMTP/DNS; Ansible configures local and remote hosts.
Publishing follows the remote stage, not the local one: the deploy keys describe a configured host, so a workstation-side failure does not gate them. Delete reverses the graph — it withdraws the published credentials first, then cleanup, SMTP post and DNS, then SMTP and compute in parallel. Step failures travel as namespaced exit codes, never uncaught exceptions.
Walter is another Package Skill built with Colors. It provisions one development machine, records it in ~/.ssh/config so ssh <profile> reaches it, and powers it off and on — so the machine you code on costs nothing while you sleep.
npx skills use getcolors/walterAgent reads colors.yml. profile names the work directory, the state keys, and the ~/.ssh/config alias.
State-backend keys come from COLORS_PAR_*. OCI authenticates from ~/.oci/config, so no token is written anywhere.
Builds files under .colors/ and runs create --dry-run, touching nothing live.
OpenTofu provisions the machine; Ansible writes the ssh alias and confirms it answers.
The same colors.yml names nix packages, a login shell and asdf runtimes. stop and start take it from there.
Stop and start never reach OpenTofu. No template declares a power state, so powering the machine down out of band causes no drift — there is nothing to reconcile, because power was never managed. Starting reads the address back from the provider rather than from stored state, which a power cycle does not refresh. Delete reverses the create graph, dropping the managed ssh alias before anything is destroyed.
Dry-run first. Approve. Then provision — with Once, built with Colors. Paste this into your coding agent.
npx skills use getcolors/once