oci-aft-base
The OCI foundation the other modules build on — network, vault, bastion and a hardened ARM instance, provisioned in Terraform and Ansible. Sized to start within Oracle Cloud's Always Free tier; a one-line variable change moves you into paid OCI resources when you outgrow the free allocation.
Product Information
Summary ↑
oci-aft-base is the foundation infrastructure module of the Easier Web catalog — network, secrets vault, bastion access, and a compute instance on Oracle Cloud Infrastructure, starting at zero cloud cost. "aft" is OCI's Always Free Tier — the free compute allocation this edition is built to fit within under Oracle's current terms (see "Scaling Beyond the Free Tier" below for what happens past it).
A production-ready, self-hosted foundation built entirely on the OCI Always Free Tier —
currently the most generous free cloud tier available (2 OCPU / 12 GB RAM on ARM, at no cost under Oracle's present terms). You get
full Terraform and Ansible source code, a dev container for zero-setup onboarding, and helper
scripts. This module alone gets you a hardened, SSH-reachable OCI instance with Tailscale
installed. Add the separately purchasable oci-k3s module for a Kubernetes cluster, or
oci-ide-backend for per-developer remote development over SSH, on top of it — buy only what you
need.
Who it is for:
- Anyone building on OCI's Always Free Tier who wants the networking/vault/instance/bastion boilerplate already solved, correctly, with real Terraform state management
- Anyone planning to run
oci-k3soroci-ide-backend— both are built on top of this module and can't be deployed without it, so you install it first regardless of which (or both) you add - Technical founders who want infrastructure-as-code they fully own (perpetual license, no subscription, your own OCI account) rather than a managed platform
Details ↑
What Is Included
Infrastructure (Terraform)
A layered Terraform codebase that provisions the base cloud environment in the correct order:
- VCN and networking — Virtual Cloud Network with Internet Gateway, public subnet, and security rules
- Compute instance — ARM Ampere A1 instance (OCI Always Free, 2 OCPU / 12 GB RAM; sized to fit entirely within OCI's free allocation, with a documented path to scale up on your own OCI account)
- Block volume — persistent storage for whatever you run on top (K3s data, workspaces, databases)
- OCI Bastion service — secure SSH access without exposing the instance to the internet
- OCI Key Vault — stores SSH keys and secrets; no credentials in version control
Server Configuration (Ansible)
Idempotent Ansible playbooks that configure everything from a bare Ubuntu instance to a ready foundation:
- OS hardening — SSH hardening (no password auth, no root login), fail2ban, hostname and timezone setup
- Tailscale VPN — joins your tailnet so you can reach the instance and internal services securely
Scripts and Tooling
- Inventory generator — reads Terraform state and writes the Ansible inventory automatically; no manual IP tracking
- OCI Vault helper — read and write secrets to OCI Key Vault from the command line
- SSH helper — one command to print the bastion-tunneled SSH command for the instance
Dev Container
A pre-built development container (.devcontainer/) with Terraform, Ansible, kubectl, and the OCI
CLI already installed. Open it in VS Code or GitHub Codespaces and start deploying — no local
toolchain setup required.
Documentation
- Step-by-step deployment guide for each Terraform module and Ansible playbook
- A documented, versioned output contract other modules (
oci-k3s,oci-ide-backend) build on - Makefile with named targets for every common operation — no need to remember command-line arguments
Pricing and License
One-time purchase, no subscription.
You receive repository access upon purchase, along with a perpetual license to use and modify the Software. There's no subscription and no recurring fees. Your cloud infrastructure runs in your own OCI account using your own credentials — there are no usage fees, no data sent to us, and no per-seat charges.
Your license is perpetual and doesn't depend on continued access: repository access, updates, and the Discussions forum are services we may wind down (Section 12, "Term; Discontinuation of Access and Support", of the Software License Agreement). Keep your own clone of the repository once you have access, and it's yours to use regardless.
Full license terms are available on this product page and must be accepted at checkout.
Scaling Beyond the Free Tier
The default configuration is sized to run entirely within OCI's Always Free allocation (2 OCPU /
12 GB RAM on ARM) — zero cloud spend under Oracle's current Always Free terms. (Oracle sets and can change these terms; see Section 5, "Cloud Infrastructure", of the Software License Agreement.) Resizing is a one-line Terraform variable change
(num_cpu / memory_in_gbs) — no re-architecture required. Any usage beyond the free allocation
is billed by Oracle on your own OCI account at its standard on-demand Ampere A1 rates — check the
OCI price list for current rates.
Community and Support
After purchase you get access to a private GitHub Discussions forum in the repository. Use it to ask questions, share how you've extended the module, or discuss your setup. We participate actively.
Privacy
The software runs entirely within your own cloud account. We have no access to your environment, your data, or your infrastructure. No telemetry, no callbacks, no third-party analytics.
Dependencies ↑
Prerequisites: You need an Oracle Cloud account (free to create) and, if you plan to install
oci-ide-backend on top, a Tailscale account (free tier works). Basic familiarity with Terraform
and Ansible is helpful but not required — the documentation walks through every step.
Tech Stack
| Layer | Technology |
|---|---|
| Cloud provider | Oracle Cloud Infrastructure (Always Free Tier) |
| Infrastructure provisioning | Terraform |
| Server configuration | Ansible |
| VPN | Tailscale |
| Secrets | OCI Key Vault |