A cookie-cutter, open-source-only minimal viable IT infrastructure stack for day 1 of a new organization.
Status: v1.0 Specification — PoC in progress (Oracle Cloud Free Tier)
IT-101 is an opinionated, fully open-source IT infrastructure stack that gives a new organization everything it needs to be operational on day one. It covers the core IT layer only — identity, email, file storage, observability, security, VPN, ticketing, and documentation — deployable to any cloud or on-premises environment.
No proprietary software. No lock-in. No "we'll add security later."
| Tier | Users | Nodes | Cost | Spec |
|---|---|---|---|---|
| PoC | 1–25 | 5 | $0 (Oracle Free Tier) | SPEC.md |
| Small (S) | 25–100 | 9–11 | ~$500–1,500/mo | SPEC-S.md |
| Medium (M) | 100–500 | 20–27 | ~$2,500–7,000/mo | SPEC-M.md |
| Large (L) | 500–2,000+ | 100–200+ | ~$12,000–40,000+/mo | SPEC-L.md |
See SPECS.md for the full comparison — what stays the same, what changes, and how to migrate between tiers.
| Document | Description |
|---|---|
| SPECS.md | Tier comparison index — start here |
| CHANGELOG.md | Version history |
| docs/architecture/ | Architecture diagrams and decisions |
| docs/operations/runbooks/ | Day-1 mandatory runbooks |
| infra/tofu/ | OpenTofu infrastructure provisioning |
| infra/ansible/ | Ansible configuration management |
| kubernetes/ | Helm values and ArgoCD app definitions |
| Layer | Tool | Purpose |
|---|---|---|
| Identity / SSO | Keycloak | All authentication, OIDC/SAML2, MFA |
| Secrets | OpenBao | Credentials, dynamic secrets, PKI |
| Stalwart | SMTP + IMAP4 + JMAP in one binary | |
| File Storage | Nextcloud | File sync, sharing, collaboration |
| DNS | CoreDNS | Internal name resolution |
| VPN | WireGuard + Headscale | Mesh VPN with self-hosted control plane |
| Monitoring | VictoriaMetrics + Grafana + Loki | Metrics, logs, dashboards |
| Ticketing | Zammad | IT helpdesk and service management |
| Documentation | BookStack | Internal wiki and runbooks |
| Container Platform | K3s | Single-binary CNCF-certified Kubernetes |
| Git / CI/CD | Forgejo + Woodpecker + ArgoCD | IaC source control, pipelines, GitOps |
| Security | Wazuh + Trivy + Gitleaks | SIEM, scanning, secret detection |
| Backup | Restic + Velero | Application and cluster backups |
| IaC | OpenTofu + Ansible | Cloud provisioning and OS config |
The first proof-of-concept runs on Oracle Cloud's always-free resources:
- 2× AMD Micro VMs (1 OCPU / 1 GB RAM) — edge/ingress nodes
- 3× ARM Ampere VMs (4 OCPU / 24 GB RAM total) — K3s cluster
- 200 GB block storage + 20 GB object storage
Total cost: $0/month at this scale.
- Immutable Infrastructure — Everything is code; replace, never patch in-place
- Least Privilege by Default — Minimum permissions, time-limited, audited
- Single Pane of Glass Observability — Unified metrics, logs, traces
- Zero-Trust Networking — No implicit trust; VPN grants adjacency, not authorization
- Secrets Never in Code — All credentials injected at runtime from vault
- Vendor-Agnostic — Kubernetes is the portability layer; no managed-service lock-in
- Minimal Footprint — Fits Free Tier today; scales to hundreds of users without architectural rewrites
Prerequisites: Oracle Cloud account, domain name, FIDO2 hardware tokens for admins
# 1. Clone the repo
git clone https://github.com/Ravenmoray/IT-101.git
cd IT-101
# 2. Review the spec
open SPEC.md
# 3. Configure your environment
cp infra/tofu/environments/poc/terraform.tfvars.example \
infra/tofu/environments/poc/terraform.tfvars
# Edit with your OCI credentials and region
# 4. Provision infrastructure
make poc-plan
make poc-apply
# 5. Bootstrap K3s and base services
make ansible-bootstrap
# 6. Deploy services via ArgoCD
make argocd-bootstrapFull step-by-step in SPEC.md → Bootstrap Order.
- v1.0 PoC specification (SPEC.md)
- v1.0 Small tier specification (SPEC-S.md)
- v1.0 Medium tier specification (SPEC-M.md)
- v1.0 Large tier specification (SPEC-L.md)
- Tier comparison index (SPECS.md)
- OpenTofu OCI modules (PoC)
- Ansible hardening playbooks
- Helm values for all services
- ArgoCD app-of-apps manifest
- Day-1 runbooks (RB-001 to RB-010)
- PoC deployment validation on Oracle Cloud Free Tier
This project is in active development. See SPEC.md for the full design. Open an issue or PR for feedback.
MIT — See LICENSE for details.