Own the Stack. Keep the Answers.
Twelve self-hosted infrastructure blueprints, grouped by the operational questions they answer rather than the acronyms on their repositories.
The In a Box family did not begin as a product strategy. It began as a recurring engineering reaction:
This should be inspectable, self-hosted, and repeatable. Package the useful defaults. Keep the moving parts visible.
One repository became several. Several became twelve. The tools covered infrastructure context, observability, databases, runtime detection, network security, vulnerability management, threat intelligence, compliance, identity, and PKI.
The website still presented the portfolio as a handful of unrelated acronyms.
That was the wrong abstraction. Nobody wakes up wanting “twelve repositories.” Operators want answers:
- What exists, and what breaks if it changes?
- What is the system doing?
- Is the behavior hostile?
- Which risk matters first?
- Who and what should be trusted?
The portfolio now groups around those questions.
What exists, and what breaks if it changes?
AIB — Assets in a Box turns Terraform, Kubernetes, Ansible, Docker Compose, CloudFormation, and Pulumi into a dependency graph. It handles blast-radius analysis, drift, single points of failure, cycles, orphaned assets, certificate tracking, and infrastructure security checks.
Configuration tells you what a resource should look like. A dependency graph tells you what else cares when that resource disappears.
That is why AIB remains the portfolio’s sharpest entry point:
Know the blast radius before production teaches you.
AIB is not another CMDB. It is a reasoning layer over infrastructure evidence that already exists.
What is the system doing?
OIB — Observability in a Box packages metrics, logs, traces, profiles, health tooling, dashboards, and instrumented examples into a self-hosted observability environment.
It does not replace Prometheus, Loki, Tempo, Grafana, or Pyroscope. Those are the components. OIB wires them into an understandable starting point so a team can reach useful telemetry without spending the first week connecting empty boxes.
DIB — Database in a Box provides PostgreSQL, MariaDB, Redis, ClickHouse, and a MongoDB-compatible FerretDB environment, plus six web interfaces, exporters, dashboards, backup and restore helpers, migrations, connection strings, and sample data.
It is a development, testing, and learning platform—not a magic high-availability database architecture. That boundary matters. A useful blueprint should remove setup toil without pretending stateful systems stopped requiring operations.
Is the behavior hostile?
SIB — SIEM in a Box handles runtime security signals with Falco, routed alerts, searchable events, ATT&CK-oriented dashboards, fleet collection, and optional private AI-assisted analysis.
It is inspectable security telemetry and analysis tooling. It does not replace a staffed SOC, mature enterprise SIEM, incident-response process, or the judgment required to distinguish an alert from an incident.
SIB-K8s brings the runtime-detection stack to Kubernetes through Helm. Falco, Falcosidekick, Loki, Grafana, and optional AI analysis form the current core. Some cloud audit-forwarding paths remain roadmap work; the product page says that instead of marketing a future diagram as a shipped feature.
NIB — NIDS in a Box combines Suricata inspection and CrowdSec behavioral detection. Its enforcement model is deliberate: sensor mode observes first, while host or router blocking is an explicit choice.
Calling every IDS an inline IPS is how you eventually lock yourself out of something important.
Which risk matters first?
VIB — Vulnerability in a Box discovers running container images, scans them with Trivy, stores vulnerability history in VictoriaMetrics, and can feed critical findings into AIB.
Discovery and recurring history matter because a point-in-time scan is not fleet visibility. It is a photograph of whatever somebody remembered to scan.
TIB — Threat Intelligence in a Box correlates those CVEs with CISA’s Known Exploited Vulnerabilities catalogue and EPSS probability.
CVSS tells you how bad a vulnerability could be. KEV and EPSS help answer whether attackers are using it and how likely exploitation is. Together with VIB, they turn “we have thousands of findings” into a queue a human might actually finish.
CIB — Compliance in a Box checks container runtime policy, SBOM licenses, and operating-system end-of-life status while retaining CycloneDX evidence.
A container can be free of known critical CVEs and still be running as root, built on an end-of-life base, or carrying a license the organization cannot accept. Vulnerability status is one dimension of posture, not the whole answer.
Who and what should be trusted?
IIB — Identity in a Box packages Authentik with generated secrets, health metrics, and an operational dashboard.
PIB — PKI in a Box packages step-ca, ACME support, trust-bootstrap helpers, endpoint probing, and certificate-expiry monitoring.
Identity answers who can enter. PKI answers which systems and certificates should be trusted when they talk to each other. Both tools expose enough of the machinery to remain operable instead of turning trust into a vendor checkbox.
How does the security posture fit together?
Security Posture in a Box (XIB) composes VIB, TIB, CIB, IIB, and PIB through pinned submodules and provides a unified Grafana entry point.
The important boundary is architectural: each tool retains its own data and remains independently deployable. XIB unifies the decision surface. It does not pretend vulnerability, threat, compliance, identity, and PKI data are one database merely because a dashboard can show them together.
That separation is useful in both directions:
- adopt one component without inheriting the suite;
- adopt the suite without losing each component’s ownership boundary.
Twelve projects, different maturity
The old website used familiar infrastructure-marketing phrases:
- “Production-ready”
- “One command”
- “Zero complexity”
They sound decisive and mean almost nothing.
The projects have different maturity levels. AIB, OIB, and SIB have substantial active CI and test coverage. Other projects are focused deployment blueprints with lighter automated verification. Some are better suited to a lab or small-team starting point than an unreviewed production rollout.
Presenting all twelve as equally production-ready would be easy marketing and bad engineering.
The new promise is narrower and more defensible:
Inspectable, self-hosted infrastructure blueprints. Own the stack. Keep the answers.
A blueprint reduces integration toil. It does not abolish capacity planning, backup design, access control, threat modeling, or the requirement to understand your own environment.
“Zero complexity” is nonsense. Visible complexity with useful defaults is something an operator can work with.
That is the common thread across all twelve tools: not hiding the stack, but arranging it so the answers are easier to reach.
Explore the complete toolkit or inspect the projects on GitHub.
The site launch produced its own useful failure: new HTML reached production while Cloudflare continued serving a four-month-old immutable stylesheet. The full debugging report—headers, hashes, broken cache contract, and corrected verification path—is published separately on Packets & Regrets.