infraweaver/features
Features
InfraWeaver is not one program. It is fourteen upstream projects installed in the right order with the right wiring, plus the console and API that make the result operable. This page is what that buys you, capability by capability.
Installation and lifecycle
ONE COMMAND, THEN A BROWSER
A single wget | bash starts a wizard on port 8080. On a Proxmox host it
offers to build a dedicated init VM first so nothing is installed on the hypervisor.
Eight steps later you click Deploy and watch the log.
IT MINTS ITS OWN PROXMOX TOKEN
Give the wizard a root@pam login once and it creates an
infraweaver@pve user with the minimum permission set, fills in the token,
and discards your password. Or paste a token you made yourself.
REDEPLOY IS A SUPPORTED PATH
bash scripts/redeploy.sh wipes the cluster and rebuilds it from the same
.env and users.yaml. Getting it wrong the first time is
expected, so getting back to zero is a documented command rather than a rescue mission.
UPSTREAM PULLS DO NOT CONFLICT
The committed manifests contain ${PLACEHOLDERS}, never values. Your
configuration lives in .env, envs/ and gitignored local
overlays, so git pull from upstream is normally a clean merge.
The platform surface
Fourteen components ship on every install. None of them are forks.
What the console gives you on day one
Operate
- Every application on one screenSync state, health, revision and last sync for all ArgoCD Applications, without the ArgoCD UI.
- Node and capacity viewPer-node CPU, memory and pod counts read from the Talos and Kubernetes APIs.
- Stop and start an appA real power switch that survives GitOps self-heal rather than being reverted five minutes later.
- Pod shell and logsFor when the dashboard is not enough and you would otherwise reach for kubectl.
Install
- Catalog with one-click installPick an app, the console writes its Application manifest and pushes to your git server.
- Feature groupsTurn monitoring, backup or runtime security on and off as declarative groups in platform.yaml.
- Placement and reservationsDecide which workloads may land on which nodes instead of hoping the scheduler agrees with you.
- GitOps diff before you syncSee exactly what a sync would change, then approve it.
Trust
- Users, groups and rolesSeeded from users.yaml into Authentik, then managed from the console with a privilege ceiling.
- Secret inventoryEvery OpenBao path, its sync state and its age. Values stay in OpenBao.
- Policy and image findingsWhich admission policies are enforcing, what they have blocked, and which images have advisories.
- Audit trailWho changed what, from the console, with the request that carried it.
Optional, and off until you say otherwise
Nothing in this list is installed by a default install. Each is a feature group you enable
in platform.yaml or from the console, and disabling it removes it again.
| Group | What it adds | Cost of enabling |
|---|---|---|
| Monitoring | Prometheus, Loki, Alertmanager, Grafana dashboards | The heaviest optional group. Budget several GB of RAM and real disk for retention. |
| External DNS | Creates and prunes DNS records through your provider API | Gives a cluster controller write access to your DNS zone. Scope the token. |
| Velero + MinIO | Cluster-level backup to local S3-compatible storage | Storage for the backup target, plus a restore rehearsal you actually run. |
| Falco | Runtime syscall-level threat detection | A privileged agent on every node and a stream of findings to triage. |
| Wazuh | SIEM and security event management | Substantial memory and index storage. |
| Homepage | A service dashboard | Redundant with the console's own homepage. Included for people who prefer it. |