Validated operating patterns with explicit environment posture, guardrails, and versioned implementation surfaces.
A blueprint composes stable module contracts with policy profiles, environment state, and replaceable implementation packs. The same operating pattern can move across shared foundations, drills, staging, and production lanes while the operator-facing contract remains stable.
The featured blueprints are reference implementations. Their named technologies identify the concrete path exercised; the contract and execution model extend across alternative authorities, drivers, packs, and targets.
Complete, end-to-end blueprint paths with walkthroughs and run records.
Establish authoritative infrastructure data, segmented network state, and foundation services through one controlled path before higher-order services are layered on top.
Reference implementation: NetBox IPAM and Proxmox SDN.
Establish a resilient public edge, extend on-premises routes, and exchange prefixes with a cloud hub through one governed WAN control plane.
Reference implementation: A VyOS edge pair on Hetzner with GCP hub routing and BGP.
Exercise backup-driven cloud failover and controlled on-premises return through isolated drill lanes with checksum validation.
Reference implementation: PostgreSQL HA with pgBackRest across on-premises and GCP.
Establish a managed standby, promote it under control, and return through an isolated lane for a lower-operations cloud recovery path.
Reference implementation: PostgreSQL with Cloud SQL across on-premises and GCP.
Bring up an on-premises control plane and worker pool with a clean operator handoff, ready for governed workload layering.
Reference implementation: RKE2 with a GitOps-ready Argo CD workload path.
30 reference blueprints organized by deployment scope.
onprem/bootstrap-netbox@v1SDN + NetBox Bootstraponprem/authoritative-foundation@v1Authoritative Foundationonprem/postgresql-ha@v1PostgreSQL HA (Patroni + etcd)onprem/rke2@v1RKE2 Clusteronprem/rke2-workloads@v1RKE2 + ArgoCD Workloadsonprem/netbox-ha-cutover@v1NetBox DB HA Cutoveronprem/eve-ng@v1EVE-NG Training Platformonprem/gns3@v1GNS3 Training Platformnetworking/wan-hub-edge@v1WAN Hub to Edge (GCP + Hetzner)networking/edge-control-plane@v1Edge Control Planenetworking/hetzner-vyos-edge@v1Hetzner VyOS Edgenetworking/onprem-vyos-edge@v1On-Prem VyOS Edgenetworking/onprem-site-extension@v1On-Prem Site Extensionnetworking/gcp-ops-runner@v1GCP Ops Runnernetworking/onprem-ops-runner@v1On-Prem Ops Runnernetworking/powerdns-shared-primary@v1PowerDNS Shared Primarynetworking/powerdns-onprem-secondary@v1PowerDNS On-Prem Secondarygcp/gke-burst@v1GKE Burst Clustergcp/linux-desktop@v1GCP Linux Desktopgcp/windows-desktop@v1GCP Windows Desktopgcp/containerlab@v1Containerlab Lifecyclelinux/containerlab@v1Local Containerlabgcp/eve-ng@v1EVE-NG on GCPgcp/gns3@v1GNS3 on GCPdr/postgresql-ha-backup-gcp@v1PostgreSQL Backup to GCSdr/postgresql-ha-failover-gcp@v1PostgreSQL Failover to GCPdr/postgresql-ha-failback-onprem@v1PostgreSQL Failback to On-Premdr/postgresql-cloudsql-standby-gcp@v1Cloud SQL Standby in GCPdr/postgresql-cloudsql-promote-gcp@v1Cloud SQL Promote in GCPdr/postgresql-cloudsql-failback-onprem@v1Cloud SQL Failback to On-PremFull blueprint step sequences, module compositions, and runbook links are in the blueprint index.
Core module families behind the current validated platform paths.
Segmented networks, WAN hubs, edge foundations, virtual networks, and image lifecycle across on-premises and public-cloud targets.
core/onprem/network-sdncore/azure/vnetorg/gcp/wan-hub-networkorg/hetzner/vyos-edge-foundationorg/gcp/wan-vpn-to-edgecore/onprem/template-imageHighly available data services, container platforms, authoritative infrastructure data, network-lab runtimes, edge observability, and DNS routing.
platform/onprem/postgresql-haplatform/onprem/rke2-clusterplatform/k8s/argocd-bootstrapplatform/onprem/netboxplatform/linux/containerlabplatform/network/edge-observabilityplatform/network/decision-serviceBackup repositories, managed standby replication, object storage, controlled promotion, and DNS-based failover.
platform/onprem/postgresql-ha-backuporg/gcp/cloudsql-postgresqlorg/gcp/cloudsql-external-replicaorg/gcp/object-repoplatform/network/dns-routingFull module contracts, lifecycle runbooks, and input/output references are in the module index. Implementation packages are published through the appropriate source repositories and registries.
The same blueprint can operate across environments because policy, state, and execution are separated cleanly.
Full topology: on-prem primary runtime, always-on edge decisioning, event-driven cloud burst and DR. Hover any box for detail.
Prometheus scrapes on-prem cluster metrics and remote-writes them to the Thanos edge receiver for a global view.
The Decision service evaluates policy rules against aggregated Thanos metrics. If thresholds breach, it emits action signals.
DNS cutover module executes the traffic shift. Structured run records are written to external object storage.
Cloud target cluster activates (warm or cold), DR data promotes, and failover ingress begins receiving traffic.
For detailed signal and control mapping, see the ADR overview. The execution model page explains the contract chain in detail.
Redundant edge connectivity, dynamic route exchange, and site-extension tunnels as deployed by the networking blueprints.
Three-zone WAN topology connecting on-prem workloads through a Hetzner edge pair to the GCP cloud hub. BGP route exchange and HA VPN tunnels provide redundant, automatically-converging connectivity.
Workload hosts, management network, and VLAN segments on the on-prem site. Routes are advertised via eBGP to the Hetzner edge pair for onward transit.
Primary/secondary edge pair with floating IP for automatic failover. Terminates IPsec and WireGuard VPN tunnels to GCP. BGP sessions maintained across both tunnels.
Cloud Router peers with the edge pair via eBGP over HA VPN. Dynamic routes propagate on-prem prefixes into the VPC. Cloud DNS handles failover routing policy.