IT-101 v1.1 — Complete Four-Tier Specification Suite

IT-101 v1.1 — Complete Four-Tier Specification Suite

Adds Small, Medium, and Large production tier specifications to complement the PoC spec from v1.0. All four tiers are now specified and ready for implementation.

Four Tiers

Tier	Users	Nodes	Est. Monthly Cost
PoC	1–25	5	$0 (Oracle Free Tier)
Small (S)	25–100	9–11	$500–1,500
Medium (M)	100–500	20–27	$2,500–7,000
Large (L)	500–2,000+	100–200+	$12,000–40,000+

Key Architectural Transitions

PoC → S: K3s HA (3 servers), Longhorn replicated storage, Mattermost chat, Falco+Suricata MUST-HAVE, 2× replicas for critical services

S → M: RKE2, multi-AZ topology, dedicated node pools (ingress/DB/obs/workers), Teleport PAM required, Coraza WAF, Kyverno admission control, per-service PostgreSQL clusters, VictoriaMetrics cluster mode, Loki distributed

M → L: Multi-cluster architecture (mgmt+prod+obs), multi-region, Rook/Ceph distributed storage, OpenCost FinOps, Crossplane day-2 ops, Chaos Mesh quarterly testing, SOAR automation (Shuffle), SOC 2 Type II continuous compliance, SBOM pipeline

Same Core Stack Across All Tiers

All four tiers use the same 24 core tools — Keycloak, OpenBao, Stalwart Mail, Nextcloud, WireGuard+Headscale, ArgoCD, Forgejo, Woodpecker CI, Wazuh, Trivy, Restic+Velero, and more. The tools don't change; only their HA configuration and replica counts do.

See SPECS.md for the full tier comparison including migration path and security controls progression.

IT-101 v1.0 — Initial Specification

IT-101 v1.0 — Initial Specification

This release establishes the complete open-source day-1 IT infrastructure stack specification, produced by a collaborative AI agent team (CTO, CISO, DevOps, SysAdmin roles).

What's included

• SPEC.md — Full 1.0 specification covering all 12 infrastructure categories
• Stack selection — 30+ open-source tools across identity, email, storage, monitoring, security, GitOps, and operations
• Oracle Cloud Free Tier topology — 5-VM deployment fitting entirely within always-free resources ($0/month at PoC scale)
• Security baseline — CIS Level 1, zero-trust networking, secrets management, audit logging requirements
• Operational playbook — Day-1 checklist, monitoring thresholds, mandatory runbooks, user lifecycle, SLAs
• Project scaffold — Directory structure for OpenTofu, Ansible, Helm, ArgoCD, and documentation

Key Technology Choices

Category	Tool
Identity / SSO	Keycloak
Secrets	OpenBao (Vault fork, MPL-2.0)
Container Platform	K3s
GitOps	ArgoCD + Forgejo + Woodpecker CI
IaC	OpenTofu + Ansible
Email	Stalwart Mail Server
File Storage	Nextcloud
Monitoring	VictoriaMetrics + Grafana + Loki
Security	Wazuh + Trivy + Gitleaks
Backup	Restic + Velero

Next Steps

PoC implementation on Oracle Cloud Free Tier — see README for roadmap.