Authoritative On-Prem Foundation
NetBox-backed IPAM, Proxmox SDN, and foundation services brought up through one controlled path before higher-order services are layered on top.
Blueprints
Validated operating patterns with explicit environment posture, guardrails, and versioned implementation surfaces.
A blueprint is not a one-off environment file. It composes stable module contracts with policy profiles, environment state, and replaceable implementation packs so the same operating pattern can be reused cleanly across shared foundations, drills, staging, and production lanes.
Featured Blueprints
Complete, end-to-end blueprint paths with walkthroughs and run records.
Hybrid WAN Edge and Site Extension
Hetzner VyOS edge pair, on-prem site extension, and GCP hub routing combined into one reusable WAN control plane.
Self-Managed PostgreSQL DR
Backup-driven PostgreSQL HA failover to GCP and controlled failback on-prem with isolated drill lanes and checksum validation.
Managed PostgreSQL DR with Cloud SQL
Managed Cloud SQL standby, controlled promote, and isolated failback for teams that want a lower-operations cloud DR lane.
GitOps-Ready Kubernetes Foundation
On-prem RKE2 control plane and worker pool with clean kubeconfig handoff, ready for Argo CD and workload layering.
Reference Blueprints
29 reference blueprints organized by deployment scope.
On-Prem
8onprem/bootstrap-netbox@v1SDN + NetBox Bootstraponprem/authoritative-foundation@v1Authoritative Foundationonprem/postgresql-ha@v1PostgreSQL HA (Patroni + etcd)onprem/rke2@v1RKE2 Clusteronprem/rke2-workloads@v1RKE2 + ArgoCD Workloadsonprem/netbox-ha-cutover@v1NetBox DB HA Cutoveronprem/eve-ng@v1EVE-NG Training Platformonprem/gns3@v1GNS3 Training Platform
Networking & Cloud
15networking/wan-hub-edge@v1WAN Hub to Edge (GCP + Hetzner)networking/edge-control-plane@v1Edge Control Planenetworking/hetzner-vyos-edge@v1Hetzner VyOS Edgenetworking/onprem-vyos-edge@v1On-Prem VyOS Edgenetworking/onprem-site-extension@v1On-Prem Site Extensionnetworking/gcp-ops-runner@v1GCP Ops Runnernetworking/onprem-ops-runner@v1On-Prem Ops Runnernetworking/powerdns-shared-primary@v1PowerDNS Shared Primarynetworking/powerdns-onprem-secondary@v1PowerDNS On-Prem Secondarygcp/gke-burst@v1GKE Burst Clustergcp/linux-desktop@v1GCP Linux Desktopgcp/windows-desktop@v1GCP Windows Desktopgcp/containerlab@v1Containerlab Lifecyclegcp/eve-ng@v1EVE-NG on GCPgcp/gns3@v1GNS3 on GCP
DR
6dr/postgresql-ha-backup-gcp@v1PostgreSQL Backup to GCSdr/postgresql-ha-failover-gcp@v1PostgreSQL Failover to GCPdr/postgresql-ha-failback-onprem@v1PostgreSQL Failback to On-Premdr/postgresql-cloudsql-standby-gcp@v1Cloud SQL Standby in GCPdr/postgresql-cloudsql-promote-gcp@v1Cloud SQL Promote in GCPdr/postgresql-cloudsql-failback-onprem@v1Cloud SQL Failback to On-Prem
Full blueprint step sequences, module compositions, and runbook links are in the blueprint index.
Module Catalog
Core module families behind the current validated platform paths.
Infrastructure
SDN, virtual networks, WAN hubs, edge foundations, and image lifecycle across on-prem, GCP, Azure, AWS, and Hetzner.
core/onprem/network-sdncore/azure/vnetorg/gcp/wan-hub-networkorg/hetzner/vyos-edge-foundationorg/gcp/wan-vpn-to-edgecore/onprem/template-image
Platform
PostgreSQL HA, RKE2 Kubernetes, ArgoCD, NetBox IPAM, network-lab runtimes, edge observability, and DNS routing.
platform/onprem/postgresql-haplatform/onprem/rke2-clusterplatform/k8s/argocd-bootstrapplatform/onprem/netboxplatform/linux/containerlabplatform/network/edge-observabilityplatform/network/decision-service
DR & Storage
pgBackRest to GCS/S3, Cloud SQL replication, object storage repos, and DNS-based failover.
platform/onprem/postgresql-ha-backuporg/gcp/cloudsql-postgresqlorg/gcp/cloudsql-external-replicaorg/gcp/object-repoplatform/network/dns-routing
Full module contracts, lifecycle runbooks, and input/output references are in the module index. Implementation packages are published through the appropriate source repositories and registries.
Governed execution model
The same blueprint can operate across environments because policy, state, and execution are separated cleanly.
Full topology: on-prem primary runtime, always-on edge decisioning, event-driven cloud burst and DR. Hover any box for detail.
Prometheus scrapes on-prem cluster metrics and remote-writes them to the Thanos edge receiver for a global view.
The Decision service evaluates policy rules against aggregated Thanos metrics. If thresholds breach, it emits action signals.
DNS cutover module executes the traffic shift. Structured run records are written to external object storage.
Cloud target cluster activates (warm or cold), DR data promotes, and failover ingress begins receiving traffic.
For detailed signal and control mapping, see the ADR overview. The execution model page explains the contract chain in detail.
WAN topology
Hetzner edge pair, BGP peering to GCP hub, and HA VPN tunnels — as deployed by the networking blueprints.
Three-zone WAN topology connecting on-prem workloads through a Hetzner edge pair to the GCP cloud hub. BGP route exchange and HA VPN tunnels provide redundant, automatically-converging connectivity.
Workload hosts, management network, and VLAN segments on the on-prem site. Routes are advertised via eBGP to the Hetzner edge pair for onward transit.
Primary/secondary edge pair with floating IP for automatic failover. Terminates IPsec and WireGuard VPN tunnels to GCP. BGP sessions maintained across both tunnels.
Cloud Router peers with the edge pair via eBGP over HA VPN. Dynamic routes propagate on-prem prefixes into the VPC. Cloud DNS handles failover routing policy.