Cloud · Security · AutomationRead the quickstart
Security-first infrastructure templates for containerized AI agents.
ainfra turns explicit, versioned contracts into reviewable OpenTofu
plans, hardened hosts, and sanitized outputs. The tools remain visible.
The safety boundaries remain enforceable.
Infrastructure automation should make every important boundary easier to see.
`ainfra` validates inputs before mutation, binds apply to an exact reviewed
plan, keeps secrets out of ordinary outputs, and makes teardown a first-class
operation.
A reviewable path to production
From contract to teardown
Every consequential step stays explicit, inspectable, and repeatable. No hidden control plane stands between you and the underlying tools.
- Validate Reject unknown inputs before infrastructure can change.
- Plan Review the exact OpenTofu plan and its security boundaries.
- Apply Bind mutation to the reviewed plan, then configure with Ansible.
- Destroy Keep teardown tested and available from the first deployment.
Contract driven
Strict contracts reject unknown fields and unsupported versions.
Security first
Private networking and verified trust are secure defaults.
Direct tools stay visible
OpenTofu and Ansible remain visible, inspectable, direct tools.
Start disposable. Keep teardown ready.
The first reference template provisions a Kubernetes-ready Debian baseline on Hetzner Cloud. Plan, verify, apply, configure, and destroy it through explicit local commands.