oss-stack

learn · deploy · operate

A public repository dedicated to helping organizations, students, and IT professionals learn, deploy, and operate a production-ready, open-source on-premises infrastructure stack through hands-on guides, lab environments, and deployment automation.

Scripts · Labs · Blocklists · Roadmap

What is oss-stack?

oss-stack is a public repository dedicated to helping organizations, students, and IT professionals learn, deploy, and operate a production-ready, open-source on-premises infrastructure stack through hands-on guides, lab environments, and deployment automation.

What's in this repo?

oss-stack/
├── guides/        # Hands-on guides for learning and operating the stack
├── scripts/       # Deployment scripts for AlmaLinux 10+
├── labs/          # Lab files for testing the stack
├── blocklists/    # Domain and IP blocklists to help you reinforce your systems protection
└── assets/        # Images, diagrams, and other misc files

Who is this for?

oss-stack is a good fit if you:

• Want to learn how a production-grade open-source stack is built, piece by piece
• Run on-premises infrastructure and want reproducible, auditable deployments
• Need to stand up internal tools — ITSM, monitoring, identity, wiki, SIEM — without paying for SaaS
• Are building a homelab or a customer environment and want a solid, known-good starting point
• Want to teach or demo open-source stacks without spending hours on documentation
• Are a student or IT professional looking for hands-on, guided practice rather than just documentation

Why not use containers exclusively?

Running services directly on the OS removes an abstraction layer between you and what you're managing. You get native systemd integration, standard log paths, and services that behave exactly as upstream documented — nothing in between. That means more control over configuration, easier troubleshooting, and a clearer picture of what's actually running on your system. Some projects in this repo may only be available as containers. Where that's the case, containers are used. But when a native install is viable, that's the default.

Scripts

Run as root on a fresh AlmaLinux 10 server. Each script prompts for the required inputs — language, IP, FQDN — and handles the rest.

Note

Expand each service to reveal the one-line install command.

Group 1 — Core services

Prep Almalinux 10 — Linux Container

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/prep-lxc_al10.sh)

FreeIPA — identity & DNS

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/freeipa_al10.sh)

Keycloak — SSO & IAM

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/keycloak_al10.sh)

NetBox — network source of truth

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/netbox_al10.sh)

Passbolt — team password manager

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/passbolt_al10.sh)

Group 2 — Operations

Zabbix — infrastructure monitoring

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/zabbix_al10.sh)

Wazuh — SIEM & XDR

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/wazuh_al10.sh)

[!NOTE] Wazuh requires a minimum of 4 cores, 8 GB RAM, and 50 GB free disk.

GLPI — ITSM & asset management

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/glpi_al10.sh)

BookStack — team wiki

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/bookstack_al10.sh)

Group 3 — User services

OpenCloud — file sync & share

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/opencloud_al10.sh)

Nextcloud — file sync & share with a broader plugin ecosystem

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/nextcloud_al10.sh)

WordPress — CMS

bash <(curl -fsSL https://raw.githubusercontent.com/runtechx/oss-stack/main/scripts/wordpress_al10.sh)

Labs

Guided lab environments to help you learn and operate each element of the stack in context — how the services relate, how to validate them, and what a complete deployment looks like end to end.

This folder holds Vagrantfiles, OpenTofu configs, Ansible playbooks, Vagrant provisioning files, and any other tooling aimed at the same goal: spinning up a reproducible lab to practice against. This section is actively being built.

Blocklists

Maintained IP and domain blocklists for use with fail2ban, firewalls, and DNS resolvers.

blocklists/
├── domain-bl.txt      # 0.0.0.0 <domain> format — Pi-hole / AdGuard / /etc/hosts
├── ip-bl.txt          # Compiled IP list — firewall rules / IPSET
└── nodes/
    ├── n0.txt         # Shared IP list — node 0
    ├── n1.txt         # Shared IP list — node 1
    ├── n2.txt         # Shared IP list — node 2
    └── n3.txt         # Shared IP list — node 3

Requirements

Most services run comfortably on a 2-vCPU / 2 GB RAM VPS. Wazuh is the exception — see the note above.

Roadmap

Planned additions for AL10:

• Cachet — status page
• Gitea — self-hosted Git
• Grafana + Prometheus — metrics and alerting
• MantisBT — issue and bug tracker
• Mattermost — team messaging
• Nextcloud — alternative to OpenCloud for a broader plugin ecosystem

Pull requests and issue reports are welcome.

License

MIT © 2026 runtech