DEPLOYMENT · VULTR · OBSERVABILITY

clickstack-vultr

Desired state for one ClickStack observability server: ClickHouse, MongoDB, the HyperDX OpenTelemetry collector and the HyperDX UI on a single guarded Vultr instance in Amsterdam.

One host, both halves: clickstack.bigconfig.online serves the dashboard and accepts OTLP/HTTP on /v1/logs, /v1/traces and /v1/metrics over the same port 443. An exporter needs no endpoint beyond the hostname, and 4317/4318 are never exposed.

What is tracked here

colors.yml (the only editable desired state), the installed clickstack Package Skill payload and lockfile, a root launcher copied from that payload, toolchain files, and documentation. Credentials live in gitignored .envrc.private; generated output in .colors/ is never committed.

Lifecycle

direnv allow
./green build
./green create --dry-run
./green create

Build and dry-run are credential-free and never read ~/.ssh. Real creation converges the instance, its firewall, the proxied Cloudflare record, and the Compose stack, then creates the initial HyperDX team and proves ingestion by sending one OTLP log over public HTTPS and reading the row back out of ClickHouse. Deletion stays guarded by compute-prevent-destroy: true.

The machine keypair is not in this repository

This deployment runs in keygen mode: colors.yml carries no vultr-ssh-keys, so the package generates and owns ~/.ssh/clickstack-vultr outside the checkout. Cloning this repository elsewhere does not carry machine access — copy the keypair deliberately, or create refuses rather than regenerating a key that cannot reach the live host.

Reaching the host

Convergence writes one ~/.ssh/config block following the workspace SSH Config Standard, so ssh clickstack-vultr connects with no address, user or -i flag. The block sits at the top of the file, above any Host * stanza that would otherwise win on User and IdentityFile, and delete removes it before destroying the instance.

Credentials are generated on the server

The admin password, the OTLP ingestion key and the HyperDX session secret are never supplied here. Convergence creates the initial team — until one exists the collector binds no OTLP receivers at all — and the ingestion key is that team's own apiKey, minted by the application and so unknowable in advance. They land only in /etc/clickstack/admin.env, /etc/clickstack/ingestion.env and /etc/clickstack/session.env on the server, mode 0600, each written once so a re-converge never rotates it. The session secret is not optional hardening: without it HyperDX signs session cookies with a constant published in its own repository.

Source

This deployment on GitHub · Package Skill source · Featured on getcolors.ai