GREEN · RED · BLUE PACKAGE SKILL · VULTR · DIGITALOCEAN · NETBIRD AGENT NETWORK · CLAUDE CODE

Agent Network Package Skill

A reproducible Green, Red, and Blue workflow for a minimal NetBird Agent Network demo: a keyless, policy-gated LLM endpoint on one guarded Vultr instance or DigitalOcean droplet — and an isolated agent container that can reach nothing else.

The isolation is the demo. The agent container sits on an internal Docker network with no internet route, doubled by DOCKER-USER firewall rules. Its only path to an LLM is the agent-network endpoint over its WireGuard tunnel, where the request carries the peer's identity, passes the policy, hits the model allowlist and the budget caps, and lands in the access log — with the Anthropic key held server-side, never in the container.

Quick start

npx skills add getcolors/agent-network
cp .agents/skills/package-agent-network-green/green ./green
chmod +x green
./green build
./green create --dry-run

Equivalent Red and Blue skills ship red and blue launchers.

Build renders reproducible output and dry-run walks the workflow without provider side effects. Real creation and deletion require explicit authorization.

Architecture

Compute

One Vultr instance or one DigitalOcean droplet, selected by provider-compute, and a provider firewall opening 22, 80, 443 and STUN — the same rule set on both. On DigitalOcean the droplet joins the region's default VPC, discovered at plan time. In keygen mode the account SSH key resource is named after the profile and lives in this deployment's state on either provider.

DNS

Two unproxied Cloudflare A records: the base name and its wildcard. The wildcard is contract — the endpoint hostname is a label management mints at bootstrap, and nothing knows it earlier. TLS splits: Traefik answers TLS-ALPN-01 for the base name, while endpoint hostnames behind the SNI passthrough are served from a wildcard certificate issued at converge time via DNS-01 — the pinned reverse proxy's per-name ACME is defective, and the package routes around it.

Control plane

Bootstrapped headlessly and reconciled by name: admin account, endpoint, the Anthropic provider (two claimed models, one allowlisted), a policy with per-group caps on the agents peer group, and an account-wide global ceiling.

Acceptance

Raw-TCP isolation probes with a success control; the tunnel up; the keyless call; both denial classes at zero upstream cost; headless Claude Code on the same path; access-log attribution; limits read back; an external probe proving the endpoint is tunnel-only; isolation re-asserted after a Docker restart and a reboot.

Fake-key mode

A deliberately fake COLORS_PAR_ANTHROPIC_API_KEY is a supported mode: acceptance then expects Anthropic's own 401 relayed through the proxy — proving isolation, tunnel DNS, policy authorization and server-side key injection with nothing billable. Swap in a real key and re-run create for real completions.

The machine keypair

The deployment owns its SSH key, following the workspace SSH Keypair Standard. Leave vultr-ssh-keys (or digitalocean-ssh-keys) out of colors.yml and the first real create generates ~/.ssh/<profile>, registers it at the provider under the profile name, and a successful delete removes it last — never before. Supplying <provider>-ssh-keys opts out entirely. Convergence also writes one ~/.ssh/config block per the SSH Config Standard, so ssh <profile> just works.

Two compute providers

provider-compute selects vultr or digitalocean. Each provider is a template directory of its own with its own credential — COLORS_PAR_VULTR_API_KEY or COLORS_PAR_DO_TOKEN — and its own provider-scoped keys; the unselected provider's keys are ignored, so one colors.yml can carry both. <provider>-name is optional and defaults to the profile.

Switching providers is a rebuild, never an apply. Both providers share one state key, so a profile whose state already holds a machine refuses a create or delete under a different provider-compute until it is set back and deleted.

Exposure

Port	Exposure	Purpose
22	`<provider>-ssh-sources`	Key-only SSH for convergence and recovery
80 / 443	`<provider>-http-sources`	Traefik: dashboard, REST API, gRPC, relay WebSocket, embedded IdP — and the SNI passthrough that hands endpoint TLS to the private reverse proxy
3478 / udp	`<provider>-stun-sources`	STUN, bundled into `netbird-server`. The only UDP published — no WireGuard port, because the only peer lives on the internal Docker network.
9000 / 9090 / 8443	closed	Healthcheck, metrics, and the proxy's direct port — asserted refused from outside

Disposable by design. No backups: recovery is a guarded delete followed by create, which regenerates the endpoint hostname and every peer identity. Nothing on the box is worth outliving it.

Safety

Credentials are COLORS_PAR_* variables in the gitignored .envrc.private — never in colors.yml.
Never export COLORS_PAR_PROFILE; the profile keys remote state.
.colors/ is generated output: never edit or commit it.
compute-prevent-destroy: true guards deletion behind a one-run override.
The agent's one-off setup key travels by file on tmpfs, is revoked after enrollment, and never appears in argv or compose configuration.

Source on GitHub · Configuration reference · In the Package Skills Catalog · Featured on getcolors.ai