gitwtfhub

wtf is privacy-first-stack-terraform?

lefred/privacy-first-stack-terraform — explained in plain English

Analysis updated 2026-05-18

0HCLAudience · ops devopsComplexity · 4/5Setup · hard

TL;DR

A Terraform bundle that deploys MariaDB, Nextcloud, and Passbolt together as a self hosted privacy stack across five major cloud providers.

Mindmap

mindmap
  root((Privacy Stack))
    What it does
      Deploys MariaDB
      Deploys Nextcloud
      Deploys Passbolt
    Tech stack
      Terraform HCL
      Ubuntu 24.04
      Multi cloud adapters
    Use cases
      Self hosted storage
      Self hosted passwords
      Consolidated or distributed
    Audience
      DevOps engineers
    Notes
      No license stated
      Self signed cert by default

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

Why would anyone build with this?

REASON 1

Deploy a self hosted file storage and password manager stack to a cloud provider of your choice.

REASON 2

Choose between running everything on one VM or splitting services across three VMs for isolation.

REASON 3

Reuse existing cloud networking or let Terraform provision new infrastructure automatically.

REASON 4

Run a privacy focused stack without relying on third-party SaaS storage or password tools.

What's in the stack?

TerraformHCLMariaDBNextcloudPassboltUbuntu

How it stacks up

lefred/privacy-first-stack-terraformanas727189/devsecops-pipelinebradleygamimarques/lizard
Stars000
LanguageHCLHCLHCL
Setup difficultyhardhard
Complexity4/54/5
Audienceops devopsops devopsops devops

Figures from each repo's GitHub metadata at analysis time.

How do you spin it up?

Difficulty · hard Time to first run · 1h+

Requires cloud provider credentials, Terraform, and careful handling of generated secrets like the Passbolt server key.

Wtf does this do

This project is a Terraform bundle that installs a self hosted Privacy First Stack, made up of MariaDB Server, Nextcloud, and Passbolt, directly onto Ubuntu 24.04 compute instances. It supports five cloud providers: AWS, Azure, Google Cloud, OpenStack, and Oracle Cloud Infrastructure, each with its own configuration directory. The stack can be deployed in two modes. In the consolidated mode, all three applications run together on a single virtual machine, which is the default. In distributed mode, Terraform creates three separate virtual machines, one for each service, with Passbolt and Nextcloud connecting to the database over a private network rather than exposing it publicly. Distributed mode uses roughly three times the compute and storage resources of consolidated mode. For each cloud provider, the project can either reuse existing network infrastructure you already have, like a subnet or resource group, or create everything itself, including virtual networks, subnets, and routing, when those values are left blank. Deploying requires copying an example variables file, filling in the required values such as credentials, and running the standard Terraform commands: init, plan, and apply. Once the virtual machine exists, a startup script continues installing the applications in the background, which can take several minutes, and progress can be checked through a log file on the instance. Passbolt is set up with a self signed HTTPS certificate by default, which browsers will flag as untrusted until it is replaced with one from a recognized certificate authority. Access to SSH and the applications is controlled through configurable network address ranges, and secrets generated during setup, including a private encryption key for Passbolt, need to be backed up carefully since losing them can break Passbolt's authentication. The README does not state a license for this project.

Yoink these prompts

Prompt 1
Help me configure terraform.tfvars for deploying this stack on AWS.
Prompt 2
Explain the difference between consolidated and distributed deployment mode here.
Prompt 3
Walk me through replacing the self signed Passbolt certificate with a trusted one.
Prompt 4
Show me how to restrict SSH and application access using the CIDR variables.

Frequently asked questions

wtf is privacy-first-stack-terraform?

A Terraform bundle that deploys MariaDB, Nextcloud, and Passbolt together as a self hosted privacy stack across five major cloud providers.

What language is privacy-first-stack-terraform written in?

Mainly HCL. The stack also includes Terraform, HCL, MariaDB.

How hard is privacy-first-stack-terraform to set up?

Setup difficulty is rated hard, with roughly 1h+ to a first successful run.

Who is privacy-first-stack-terraform for?

Mainly ops devops.

View the repo → Decode another repo

This repo across BitVibe Labs

Don't trust strangers blindly. Verify against the repo.