OPEN SOURCE · SELF-HOSTED · INSPECTABLE
Infrastructure tools should tell you what exists, what changed, what is failing, and what gets fixed first—without turning your evidence into somebody else’s subscription.
ONE SYSTEM · FIVE QUESTIONS
Start with the operational question, not a shopping list of containers.
Every component, config, dashboard, and trade-off stays visible.
Your telemetry, findings, identities, and asset data remain under your control.
START HERE · ASSETS IN A BOX
Your infrastructure is already documented—just not in one place. AIB turns Terraform, Kubernetes, Ansible, Docker Compose, CloudFormation, and Pulumi into a living dependency graph.
Ask what depends on a database, which workloads share a certificate, what changed between scans, or what a Terraform plan will disturb before the change becomes an incident.
aib / decision contextConfiguration describes the pieces. AIB shows you the system.
RUNNING SOFTWARE · VISIBLE OUTPUT
These are real outputs from the projects—not product mockups. The public repositories expose the dashboards, configuration, tests, and trade-offs behind them.
GitHub snapshot · 31 July 2026
THE COMPLETE TOOLKIT
Use one focused blueprint, combine several, or deploy XIB for a unified security-posture view. No fake “single pane” promise: the individual tools remain understandable and independently useful.
Understand the system and give teams a useful operating surface.
Know the blast radius before production teaches you.
Turn Terraform, Kubernetes, Ansible, Compose, CloudFormation, and Pulumi into a dependency graph with impact, drift, and security analysis.
Race-tested checks · 80.4% statement coverage
make demoDetails →See what the system is doing without renting your telemetry back.
Run metrics, logs, traces, profiles, dashboards, health tooling, and instrumented examples as an understandable self-hosted stack.
12 validated stack variants · 50 GitHub stars
make bootstrapDetails →Give developers real databases, real tooling, and a safe place to learn.
Five database engines, six web UIs, monitoring, backups, migrations, sample data, and connection helpers in one development platform.
CI-backed development and lab platform
make installDetails →Observe hostile behavior at the workload, cluster, and network layers.
Keep the cloud audit trail. Keep the detections. Keep the evidence.
Collect, normalize, search, and detect across AWS, GCP, Azure, and Cloudflare on Vector, PostgreSQL with TimescaleDB, and Grafana.
70 tests · measured 1M-event benchmark · HA and restore drills
make demoDetails →Detect what workloads do, not merely what their logs claim.
Falco runtime detection, routed alerts, searchable security events, ATT&CK dashboards, fleet collection, and optional private AI analysis.
64 tests · 96 GitHub stars
make installDetails →Bring runtime detection and explainable triage into the cluster.
A Helm-based Falco, Falcosidekick, Loki, Grafana, and optional AI-analysis stack for Kubernetes audit and runtime signals.
Core Helm stack shipped · roadmap edges disclosed
helm install sib-k8s .Details →See hostile traffic before the incident report has to explain it.
Suricata inspection, CrowdSec behavioral detection, network dashboards, and deliberate host or router blocking modes.
11 GitHub stars · current CI gap disclosed
make installDetails →Turn noisy findings into an ordered, evidence-backed queue.
Know which running images carry risk—and whether that risk is growing.
Discover running container images, scan them with Trivy, retain vulnerability history, and feed critical findings into AIB.
Recurring Trivy scans with retained history
make upDetails →Fix the vulnerabilities attackers are actually using first.
Correlate VIB findings with CISA KEV and EPSS so active exploitation and probability—not CVSS alone—drive the queue.
CISA KEV and EPSS correlation shipped
make upDetails →Turn container policy from a spreadsheet promise into evidence.
Check runtime configuration, SBOM licenses, and base-image end-of-life status while retaining CycloneDX evidence for review.
Runtime, SBOM, licence, and EOL evidence
make upDetails →Control identity and certificate trust without outsourcing either.
Put one identity boundary in front of the services you operate.
Package Authentik with its data services, generated secrets, identity health metrics, and an operational Grafana view.
Authentik deployment with health metrics
make upDetails →Issue internal certificates automatically and catch expiry before users do.
Run step-ca with ACME support, trust-bootstrap helpers, endpoint probing, and certificate-expiry dashboards.
step-ca, ACME, and endpoint monitoring
make upDetails →Decide what your coding agent may touch, and see what left the machine.
A local harness over Claude Code and Codex with per-folder policy, a redaction guard, an egress log, approval prompts, and analysis that sends code instead of data.
Over 150 tests · Ubuntu and macOS CI · MIT
hib serveDetails →OPERATIONALLY HONEST
The projects package real open-source components with explicit configuration, health checks, dashboards, examples, and operating commands. They reduce integration toil; they do not abolish capacity planning, threat modeling, backups, or knowing your environment.
That distinction matters. “Zero complexity” is marketing nonsense. Visible complexity with useful defaults is something an engineer can actually operate.
SELF-HOST IT OR GET HELP
Every project is free to inspect, fork, and run. For architecture review, a hardened deployment, or ongoing operations, the engagement shape and deliverables are explicit.