What should your agent operate?

Operate a minimal NetBird Agent Network demo — a keyless, policy-gated LLM endpoint and a network-isolated agent running headless Claude Code — on Vultr or DigitalOcean.

Operate a NetBird Agent Network demo on DigitalOcean Kubernetes — a keyless, policy-gated LLM endpoint and a two-pod application, the NetBird client in netstack/SOCKS5 mode plus a network-isolated agent running headless Claude Code.

Operate a NetBird Agent Network demo on Vultr Kubernetes Engine — a keyless, policy-gated LLM endpoint and a two-pod application, the NetBird client in netstack/SOCKS5 mode plus a network-isolated agent running headless Claude Code.

Operate a production Apache Airflow server with Postgres, backups, authenticated TLS, and GitHub-based DAG delivery.

Operate a three-node AutoMQ cluster on Vultr — Kafka-compatible brokers whose storage tier is Cloudflare R2, behind a public SASL_SSL endpoint with SCRAM authentication and ACL authorization.

Operate a private replicated ClickHouse cluster with Keeper, Metabase, PostgreSQL, WireGuard, and dbt.

Operate a single-server ClickStack observability stack — ClickHouse, MongoDB, the HyperDX OpenTelemetry collector and UI — on Vultr or DigitalOcean.

Operate a single-machine DBOS durable-workflow service with private PostgreSQL, Cloudflare HTTPS, and R2 backups on DigitalOcean.

Operate a single-host GitHub organization warehouse with ClickHouse, dbt, and Lightdash analytics.

Operate a secure single-node K3s server on Hetzner Cloud, continuously reconciled from Git with Flux.

Operate a two-node kubeadm Kubernetes cluster on DigitalOcean with Flux, DNS, TLS, and acceptance checks.

Operate self-hosted Langfuse v4 LLM observability on six Vultr machines in one VPC — a self-hosted Neon storage tier for Postgres, a Redis host, three ClickHouse replicas with Keeper, and the application host behind Caddy and Cloudflare — with Cloudflare R2 for raw events, media, Neon layers and WAL, and backups that are restored and booted in a rehearsal.

Operate a 3-node MySQL 8.4 Group Replication cluster with automated Floating VIP failover, Cloudflare DNS, and continuous binary log point-in-time recovery to Cloudflare R2 on DigitalOcean.

Operate a 3-node MySQL 8.0 Group Replication cluster with a reserved-IP endpoint claimed by the primary, Cloudflare DNS, and continuous binary log point-in-time recovery with a daily verified restore to Cloudflare R2 on DigitalOcean.

Operate self-hosted n8n workflow automation on one Vultr instance — the n8n server, an external task runner, and Caddy TLS — backed by a colocated self-hosted Neon whose Postgres layers and WAL live in Cloudflare R2.

Operate self-hosted Neon serverless Postgres — the storage broker, the pageserver, one safekeeper, and a Postgres 17 compute node, with layers and WAL in Cloudflare R2 — on a loopback-only Vultr instance reached over an SSH tunnel.

Operate a self-hosted NetBird control plane and its identity provider — Traefik, the combined netbird-server, the dashboard and Authentik — on Vultr.

Operate a personal PaaS on one VPS with Docker application hosting, DNS, outgoing mail, TLS, and GitHub deployments.

Operate a 3-node PostgreSQL 17 failover cluster with Patroni, colocated etcd v3, HAProxy client routing, Cloudflare DNS, and pgBackRest continuous WAL backups to Cloudflare R2 on DigitalOcean.

Operate a 3-node PostgreSQL 17 failover cluster with Patroni, colocated etcd, quorum synchronous commit, HAProxy client routing on every node, Cloudflare DNS, and pgBackRest continuous WAL backups with a daily verified restore to Cloudflare R2 on DigitalOcean.

Operate a single-node PostHog product analytics suite — Django, ClickHouse with embedded Keeper, Kafka, Temporal, and a Rust capture service — on one DigitalOcean droplet or Vultr instance.

Operate a private Rama distributed computing cluster with ZooKeeper, WireGuard, optional DNS, and mail.

Operate one Redis 7.2 server on one Vultr instance or DigitalOcean droplet — published on loopback only, reached over an SSH tunnel, with an append-only file for persistence and RDB backup sets in Cloudflare R2 that a rehearsal verb restores and reads back.

Operate a production-oriented single-node Restate durable execution platform on DigitalOcean.

Operate a single-node Rybbit analytics service pairing PostgreSQL for metadata with ClickHouse for columnar events, behind Caddy TLS.

Operate a single-node SigNoz observability stack — ClickHouse, ClickHouse Keeper, a Postgres metastore, the SigNoz application, the signoz-otel-collector ingester and Caddy — on Vultr or DigitalOcean.

Operate a production-oriented Temporal server with PostgreSQL, durable workflow verification, TLS, backups, and restart recovery.

Operate a single-node Umami web analytics service with PostgreSQL, Caddy TLS, and restore-verified backups to R2.

Operate Vaultwarden on a personal PaaS with email, off-server SQLite replication, and recovery checks.

Operate a remote development machine that configures SSH access and powers off while you sleep.

Operate a public WaveHouse analytics demo with ClickHouse and a live GitHub stats dashboard on Vultr.

Verified traps, API contract, and acceptance doctrine for single-node NetBird Agent Network deployments, distilled from a live adversarially reviewed build.

Verified traps and acceptance doctrine for NetBird Agent Network on DigitalOcean Kubernetes, distilled from a live DOKS build - platform-allocated subnets that are not the documented 10.244.0.0/16 default, DOCR's account-scoped adopt-or-create registries with registry-wide credentials, and the Ready-versus-gateway-reachable timing traps.

Verified traps and acceptance doctrine for NetBird Agent Network on Kubernetes, distilled from a live VKE build - the unprivileged netstack/SOCKS5 client the flags will not configure, the embedded proxy peer whose overlay address churns, and isolation probed from both sides of the listener.

Verified traps, listener and SCRAM contract, storage-ownership rules, and acceptance doctrine for a multi-node AutoMQ cluster whose storage tier is object storage — including the two firewalls in front of every Vultr node and the genesis mistake that leaves a cluster unable to authenticate anyone.

Verified topology, config.d traps, the s3_plain backup disk verified against system.backups, a collision-free restore beside the live database, application versus operator grants, the two firewalls on a Vultr VPC, and the replica-loss drill for three replicated ClickHouse nodes with embedded Keeper.

Verified topology, the Langfuse v4 events_only write-mode contract (OTLP in, Observations API v2 out, events_full in ClickHouse), the Prisma P3005 trap a Neon-provisioned database springs, ClickHouse cluster and s3_plain backup traps, the restore-time pairing rule, and a rehearsed restore-and-boot for self-hosted Langfuse on six machines.

The n8n 2.x keys and defaults every guide still gets wrong, the encryption key n8n persists on first boot, the API that redacts credential values so decryption can only be proven by using them, and an acceptance doctrine written after a converge reported success with zero gates executed.

Verified topology, compute-spec auth contract, Cloudflare R2 remote-storage traps, honestly measured single-node RPO, and rehearsed recovery doctrine for self-hosted Neon serverless Postgres on one machine.

Verified ten-container topology, ClickHouse Keeper and named-collections configuration, converge ordering, and a ~30-entry failure catalogue for self-hosted single-node PostHog.

Verified exposure doctrine, redis-cli gate contract, RDB backup-set protocol, and the AOF-off restore rehearsal for a single-node Redis 7 on Docker Compose with backups in Cloudflare R2.

Verified six-container topology, provider-independent converge seam, restore-proven ClickHouse backups, and a 30-entry failure catalogue for self-hosted single-node Rybbit analytics.