GREEN · RED · BLUE PACKAGE SKILL · VULTR · DIGITALOCEAN · SIGNOZ

SigNoz Package Skill

A reproducible Green, Red, and Blue workflow for a single-node SigNoz — ClickHouse, ClickHouse Keeper, a Postgres metastore, the application and the OpenTelemetry ingester — behind Caddy and Cloudflare on a guarded Vultr instance or DigitalOcean droplet.

One host, both halves. Caddy proxies OTLP/HTTP on the standard /v1/{logs,traces,metrics} paths to the collector and serves the SigNoz UI on everything else, so an exporter needs only https://your-host and a bearer token. Every other port stays on loopback; SigNoz community edition has no ingestion keys of its own, so that token — generated on the server — is what keeps the endpoint from being an open write path.

Quick start

npx skills add getcolors/signoz
cp .agents/skills/package-signoz-green/green ./green
chmod +x green
./green build
./green create --dry-run

Equivalent Red and Blue skills ship red and blue launchers.

Build renders reproducible output and dry-run walks the workflow without provider side effects. Real creation and deletion require explicit authorization.

Architecture

Compute

One Vultr instance or one DigitalOcean droplet, selected by provider-compute, and a provider firewall opening 22, 80 and 443. On DigitalOcean the droplet joins the region's default VPC, discovered at plan time. In keygen mode the account SSH key resource is named after the profile and lives in this deployment's state on either provider.

DNS

One proxied Cloudflare A record for the configured host; Caddy obtains TLS from Let's Encrypt.

Server

Docker Compose: ClickHouse, ClickHouse Keeper, Postgres, the migrator, SigNoz, the ingester, and Caddy — every image pinned by its own key in colors.yml.

Acceptance

Convergence proves ingestion end to end on the server; the workflow then checks the public UI and OTLP endpoint over HTTPS.

The machine keypair

The deployment owns its SSH key, following the workspace SSH Keypair Standard. Leave vultr-ssh-keys (or digitalocean-ssh-keys) out of colors.yml and the first real create generates ~/.ssh/<profile>, registers it at the provider under the profile name, and a successful delete removes it last — never before.

The key lives outside the checkout. Cloning a deployment repository does not carry machine access with it; copy ~/.ssh/<profile> deliberately. A key with no state is never overwritten, and a provider key named after the profile that this deployment's state does not own stops the run — if its fingerprint is not yours, do not delete it.

Supplying <provider>-ssh-keys opts out entirely: the package then generates, validates and deletes no key material. Rotation is a rebuild, because machine key lists are ForceNew on both providers.

Two compute providers

provider-compute selects vultr or digitalocean. Each provider is a template directory of its own with its own credential — COLORS_PAR_VULTR_API_KEY or COLORS_PAR_DO_TOKEN — and its own provider-scoped keys; the unselected provider's keys are ignored, so one colors.yml can carry both. <provider>-name is optional and defaults to the profile.

Switching providers is a rebuild, never an apply. Both providers share one state key, so a profile whose state already holds a machine refuses a create or delete under a different provider-compute until it is set back and deleted.

The SSH config block

Convergence also writes one ~/.ssh/config block, following the workspace SSH Config Standard, so ssh <profile> reaches the host with no address, user or -i flag. The block names an IdentityFile only in keygen mode, where the package knows the key because it generated it. It is inserted above the first Host line, because ssh_config takes the first value it obtains and a Host * stanza higher in the file would otherwise win on User and IdentityFile.

Delete removes the block before destroying the instance, the reverse of the keypair: a block that outlives its host is stale but harmless, while a key removed early locks you out of a machine that still exists.

Exposure

Port	Exposure	Purpose
22	`<provider>-ssh-sources`	Key-only SSH for convergence and recovery
80 / 443	`<provider>-http-sources`	Caddy: SigNoz UI, and OTLP/HTTP ingestion behind a bearer token
4317 / 4318 / 13133	loopback	Collector OTLP and health, reached through Caddy
8080	loopback	SigNoz UI and API, reached through Caddy
8123	loopback	ClickHouse HTTP

Safety

Credentials are COLORS_PAR_* variables in the gitignored .envrc.private — never in colors.yml.
Never export COLORS_PAR_PROFILE; the profile keys remote state.
.colors/ is generated output: never edit or commit it.
compute-prevent-destroy: true guards deletion behind a one-run override.

Source on GitHub · Configuration reference · In the Package Skills Catalog · Featured on getcolors.ai