Featured
Production examples that show what deterministic, agent-operated infrastructure looks like—from Kubernetes and data platforms to application hosting and remote development.
K8s is a Package Skill built with Colors. It provisions a two-node kubeadm cluster in a deployment-owned DigitalOcean VPC, installs pinned Flannel, DigitalOcean cloud-controller and Flux releases, and reconciles applications from a public Git repository.
npx skills add getcolors/k8sRead desired state
Agent reads colors.yml. It pins the control-plane and worker shapes, Kubernetes and component versions, network CIDRs, state backend, and GitOps repository.
Resolve secrets
DigitalOcean, Cloudflare, and remote-state credentials arrive through COLORS_PAR_*; tokens and kubeconfig never enter tracked or generated files.
Dry-run boundary
Builds deterministic OpenTofu and Ansible files, then runs create --dry-run before any provider, node, DNS record, or load balancer is contacted.
Bootstrap kubeadm
OpenTofu creates the VPC, firewalls, control plane, and worker. Ansible installs containerd and kubeadm, joins the nodes, and keeps administrative access CIDR-restricted.
Reconcile and verify
Flux deploys controllers and applications from Git; the workflow waits for both nodes, DNS, TLS, the DigitalOcean load balancer, and the HTTPS health endpoint.
Infrastructure is converged before kubeadm touches either node, and acceptance proves the GitOps application over valid HTTPS. Delete first reloads node addresses from remote state, asks Kubernetes to remove its DigitalOcean load balancer, drops the managed SSH alias, and only then reaches guarded infrastructure destruction.
K3s is a Package Skill built with Colors. It provisions one Hetzner Cloud VPS behind a default-deny firewall, installs pinned K3s and Flux releases, and continuously reconciles a public Git repository without exposing the Kubernetes API.
npx skills add getcolors/k3sRead desired state
Agent reads colors.yml. It pins the server shape, K3s and Flux versions, state backend, and public GitOps repository.
Resolve secrets
Hetzner, R2, and optional Cloudflare credentials arrive through COLORS_PAR_*; none are rendered under .colors/.
Dry-run boundary
Builds OpenTofu and Ansible files, then runs create --dry-run before any provider or host is contacted.
Provision securely
OpenTofu creates the VPS and firewall; Ansible installs K3s and keeps API port 6443 private behind SSH.
Reconcile GitOps
Flux pulls applications and add-ons from Git. ExternalDNS and cert-manager can converge wildcard DNS and TLS without a kubeconfig in CI.
The remote branch installs K3s and Flux and waits for the GitOps repository; the local branch writes the SSH alias. `./green kubectl` then crosses an SSH tunnel instead of publishing port 6443. Delete removes the alias before destroying the firewall and server, and the committed guard refuses accidental destruction.
ClickHouse is a Package Skill built with Colors. It provisions a three-node replicated ClickHouse cluster with a three-member Keeper quorum, plus a separate Metabase and PostgreSQL server, on Hetzner Cloud.
npx skills add getcolors/clickhouseRead desired state
Agent reads colors.yml. It pins four server shapes, ClickHouse, Metabase, PostgreSQL and dbt versions, private networks, DNS, and the state backend.
Resolve secrets
Hetzner, Cloudflare, R2, ClickHouse, and Metabase credentials arrive through COLORS_PAR_*; deployment SSH and WireGuard private keys are generated and retained outside remote state.
Dry-run boundary
Builds OpenTofu, Ansible, WireGuard, and dbt files, then runs create --dry-run before contacting any provider or server.
Provision privately
OpenTofu creates all four servers in parallel behind a default-deny firewall; split Ansible stages then configure ClickHouse and Metabase concurrently after WireGuard is ready.
Prove the data path
Local dbt tests replicated tables, acceptance queries them through Metabase and checks public-port isolation, then zero-change OpenTofu plans prove convergence.
The shared firewall exposes only SSH, ICMP, and WireGuard UDP. Acceptance verifies Keeper, replicas, dbt, Metabase, DNS, VPN reachability, and public-port isolation; the drift stage requires every OpenTofu plan to be empty. Delete reverses the graph with parallel DNS/firewall and server teardown, while destroy protection refuses accidents.
Airflow is a Package Skill built with Colors. It provisions one VPS running Apache Airflow with LocalExecutor, host Postgres, continuous WAL-G backups, Caddy authentication and TLS, and a private GitHub repository that deploys DAGs over a confined rsync key.
npx skills add getcolors/airflowRead desired state
Agent reads colors.yml. It pins the server, Airflow and Postgres versions, hostname, DAG repository, and backup policy.
Resolve secrets
Provider, database, Airflow, backup, and GitHub credentials arrive through COLORS_PAR_*; none are rendered under .colors/.
Dry-run boundary
Builds OpenTofu, Ansible, and repository seed files, then runs create --dry-run before contacting a provider or host.
Provision safely
OpenTofu creates compute, SMTP, and DNS; Ansible installs Docker, Postgres, WAL-G, Airflow, Caddy, and the deploy account.
Deploy DAGs
A private repository pushes DAGs over rrsync; its write-only key is confined to one directory and has no shell or sudo access.
GitHub follows the remote stage because seeding the repository immediately triggers its deploy workflow, so the matching public key must already be installed. Delete revokes the credential first, removes the local SSH alias, then tears down SMTP, DNS, and compute; it deliberately keeps the DAG repository and the WAL-G archive.
Rama is a Package Skill built with Colors. It provisions a private single-node Rama cluster on DigitalOcean with ZooKeeper, a Conductor and Supervisor, WireGuard access, and optional Cloudflare DNS and Resend mail.
npx skills add getcolors/ramaRead desired state
Agent reads colors.yml. It pins the Droplet shape, Rama, ZooKeeper and Java versions, VPN network, optional hostname and mail domain, and state backend.
Resolve secrets
DigitalOcean, R2, optional Cloudflare and Resend credentials arrive through COLORS_PAR_*; the Rama license and generated WireGuard client remain outside tracked files and remote state.
Dry-run boundary
Builds deterministic OpenTofu and Ansible files, then runs create --dry-run before any provider, server, DNS record, or mail domain is contacted.
Provision privately
OpenTofu creates the Droplet and default-deny firewall; Ansible installs WireGuard, ZooKeeper, Rama Conductor and Supervisor, exposing only SSH and the VPN publicly.
Verify the cluster
Acceptance checks every service, runs conductorReady and numSupervisors through the local Rama CLI, and proves Rama ports are unreachable from the public internet.
DNS and mail stages become no-ops when their providers are disabled. Delete reverses the graph, removing local and remote WireGuard configuration before infrastructure; the committed destroy guard refuses accidental deletion.
Once is a Package Skill built with Colors. It provisions a VPS, configures DNS and outgoing mail, installs Docker, and reconciles declared applications — a self-hosted alternative to Netlify or Vercel that an agent runs end to end.
npx skills add getcolors/onceRead desired state
Agent reads colors.yml. Hostnames determine DNS zones and mail domains.
Resolve secrets
Env map points to COLORS_PAR_* variables, deferred until runtime.
Dry-run boundary
Builds files under .colors/ and runs create --dry-run, touching nothing live.
Provision & reconcile
OpenTofu provisions compute/SMTP/DNS; Ansible configures local and remote hosts.
Publishing follows the remote stage, not the local one: the deploy keys describe a configured host, so a workstation-side failure does not gate them. Delete reverses the graph — it withdraws the published credentials first, then cleanup, SMTP post and DNS, then SMTP and compute in parallel. Step failures travel as namespaced exit codes, never uncaught exceptions.
Walter is another Package Skill built with Colors. It provisions one development machine, records it in ~/.ssh/config so ssh <profile> reaches it, and powers it off and on — so the machine you code on costs nothing while you sleep.
npx skills add getcolors/walterRead desired state
Agent reads colors.yml. profile names the work directory, the state keys, and the ~/.ssh/config alias.
Resolve secrets
State-backend keys come from COLORS_PAR_*. OCI authenticates from ~/.oci/config, so no token is written anywhere.
Dry-run boundary
Builds files under .colors/ and runs create --dry-run, touching nothing live.
Provision
OpenTofu provisions the machine; Ansible writes the ssh alias and confirms it answers.
Install, then power
The same colors.yml names nix packages, a login shell and asdf runtimes. stop and start take it from there.
Stop and start never reach OpenTofu. No template declares a power state, so powering the machine down out of band causes no drift — there is nothing to reconcile, because power was never managed. Starting reads the address back from the provider rather than from stored state, which a power cycle does not refresh. Delete reverses the create graph, dropping the managed ssh alias before anything is destroyed.
Find infrastructure your agent can operate.
Browse the PR-curated Package Skills Catalog by platform, provider, or runtime.
View the Catalog