GREEN PACKAGE SKILL · RAMA · DIGITALOCEAN · WIREGUARD

rama

Provision and operate one private single-node Rama cluster with ZooKeeper, optional Cloudflare DNS and Resend mail, and a VPN-aware local Rama CLI.

Single node
Rama + ZooKeeper
WireGuard private
Local CLI adapter

#Introduction

The Rama Package Skill provisions a DigitalOcean Droplet and VPC, attaches a restrictive firewall, installs ZooKeeper and Rama Conductor/Supervisor services, and creates a WireGuard tunnel. Rama service ports bind to the VPN and are never exposed publicly.

Safe first stepsbuild renders local files and create --dry-run prints the workflow without contacting providers. Review both before approving a real operation.

#Quick start

npx skills add getcolors/rama
cp .agents/skills/package-rama-green/green ./green
./green build
./green create --dry-run
# after approval:
./green create
./green rama conductorReady
./green rama numSupervisors

#Workflow architecture

create/build  start ─ infrastructure ─ local SSH ─ remote converge ─ acceptance
                              ├─ optional Cloudflare DNS
                              └─ optional Resend registration + verification

local adapter  green rama … ─ WireGuard-aware rama.yaml ─ bundled Rama CLI

The package owns DigitalOcean infrastructure, firewalling, VPN keys, system services, optional DNS and mail integration, acceptance, and the local adapter.

#Desired state

Area	Keys and choices
Rama	Cluster name, single-node deployment, exact version and ZIP URL, data directory, supervisor range
ZooKeeper	Exact version and archive URL
Java	Major version
DigitalOcean	Region, size, image, SSH public-key path, VPC and source CIDRs
WireGuard	Port, network, server/client addresses, client name
Optional services	Cloudflare DNS-only host; Resend SMTP From address
License	Boolean flag; source path supplied only through the environment

See the configuration reference.

#Network and service boundary

SSH is limited to configured administrative CIDRs. WireGuard’s UDP endpoint may admit roaming clients, but Rama and ZooKeeper ports bind to private addresses. Cloudflare, when enabled, creates a DNS-only record; proxying would not carry the Rama protocol.

#Rama operations

./green rama … downloads and caches the configured Rama release, reads the generated VPN-aware rama.yaml, and runs Rama’s bundled Python CLI locally. Typical health checks are conductorReady and numSupervisors.

The generated WireGuard client is private retained local state. Protect it like a credential.

#Optional DNS and mail

DNS accepts Cloudflare or a disabled value. SMTP accepts Resend or a disabled value. With Resend enabled, the package creates and verifies notifications.<zone> and configures the host to relay through Resend. Disabled integrations render and run no provider stage.

#Command reference

Command	Effect
`./green build`	Validate and render
`./green create --dry-run`	Print workflow only
`./green create`	Provision and converge
`./green rama …`	Invoke the local VPN-aware Rama CLI
`./green delete`	Guarded destruction

#State and generated output

Backends are local, S3, or R2. Generated output includes infrastructure files, Ansible configuration, Rama CLI configuration, and WireGuard client material. It is sensitive, generated state—not documentation or source.

#Credentials and safety

DigitalOcean: COLORS_PAR_DO_TOKEN.
Optional Cloudflare and Resend credentials use matching COLORS_PAR_* names.
A commercial license path, when enabled, is COLORS_PAR_RAMA_LICENSE_SOURCE_PATH; license content never belongs in YAML.
Never export COLORS_PAR_PROFILE.
Keep compute-prevent-destroy: true.

#Troubleshooting

The local CLI cannot reach Conductor

Confirm WireGuard is active and the generated client routes the private Rama address before inspecting services.

Mail setup is absent

Check whether provider-smtp is explicitly enabled; null, false, and no disable it by design.

A license was not installed

Both rama-license: true and the approved local source-path environment variable are required.