lefred/privacy-first-stack-terraform — explained in plain English
Analysis updated 2026-05-18
Deploy a self hosted file storage and password manager stack to a cloud provider of your choice.
Choose between running everything on one VM or splitting services across three VMs for isolation.
Reuse existing cloud networking or let Terraform provision new infrastructure automatically.
Run a privacy focused stack without relying on third-party SaaS storage or password tools.
| lefred/privacy-first-stack-terraform | anas727189/devsecops-pipeline | bradleygamimarques/lizard | |
|---|---|---|---|
| Stars | 0 | 0 | 0 |
| Language | HCL | HCL | HCL |
| Setup difficulty | hard | — | hard |
| Complexity | 4/5 | — | 4/5 |
| Audience | ops devops | ops devops | ops devops |
Figures from each repo's GitHub metadata at analysis time.
Requires cloud provider credentials, Terraform, and careful handling of generated secrets like the Passbolt server key.
This project is a Terraform bundle that installs a self hosted Privacy First Stack, made up of MariaDB Server, Nextcloud, and Passbolt, directly onto Ubuntu 24.04 compute instances. It supports five cloud providers: AWS, Azure, Google Cloud, OpenStack, and Oracle Cloud Infrastructure, each with its own configuration directory. The stack can be deployed in two modes. In the consolidated mode, all three applications run together on a single virtual machine, which is the default. In distributed mode, Terraform creates three separate virtual machines, one for each service, with Passbolt and Nextcloud connecting to the database over a private network rather than exposing it publicly. Distributed mode uses roughly three times the compute and storage resources of consolidated mode. For each cloud provider, the project can either reuse existing network infrastructure you already have, like a subnet or resource group, or create everything itself, including virtual networks, subnets, and routing, when those values are left blank. Deploying requires copying an example variables file, filling in the required values such as credentials, and running the standard Terraform commands: init, plan, and apply. Once the virtual machine exists, a startup script continues installing the applications in the background, which can take several minutes, and progress can be checked through a log file on the instance. Passbolt is set up with a self signed HTTPS certificate by default, which browsers will flag as untrusted until it is replaced with one from a recognized certificate authority. Access to SSH and the applications is controlled through configurable network address ranges, and secrets generated during setup, including a private encryption key for Passbolt, need to be backed up carefully since losing them can break Passbolt's authentication. The README does not state a license for this project.
A Terraform bundle that deploys MariaDB, Nextcloud, and Passbolt together as a self hosted privacy stack across five major cloud providers.
Mainly HCL. The stack also includes Terraform, HCL, MariaDB.
Setup difficulty is rated hard, with roughly 1h+ to a first successful run.
Mainly ops devops.
This repo across BitVibe Labs
Don't trust strangers blindly. Verify against the repo.