formae-bootstrap

Stand up a self-hosted formae agent on a cloud provider. Each provider lives in its own directory.

How it works

Formae is a client + agent system. You run both locally to start, use that local install to provision the agent's own permanent home in the cloud, then point your local CLI at the now-remote agent via a profile and hand off. From then on the remote agent owns your infrastructure — reconciling, discovering, and syncing continuously — while your laptop is just a client that talks to it. See aws/README.md and the architecture overview for the full model.

AWS

aws/ installs a production formae agent on ECS Fargate, backed by RDS PostgreSQL (or your own database). One command, two secure access modes — there is no plaintext option:

• alb — public, internet-facing ALB terminating HTTPS with your own ACM certificate, plus HTTP basic auth.
• tailnet — private, reached only over your Tailscale tailnet (no public ingress), serving a trusted *.ts.net certificate, with basic auth on top.

Full instructions in aws/README.md.

Azure

azure/ installs a production formae agent on a VM, backed by Azure Database for PostgreSQL Flexible Server reached through a private endpoint (no public database access). One command, two secure access modes — there is no plaintext option:

• public — the agent terminates HTTPS itself with a self-signed certificate, served at a stable <name>.<location>.cloudapp.azure.com FQDN, plus HTTP basic auth.
• tailnet — private, reached only over your Tailscale tailnet (no public ingress), serving a trusted *.ts.net certificate, with basic auth on top.

Full instructions in azure/README.md.

GCP

gcp/ installs a production formae agent on a GCE VM, backed by Cloud SQL PostgreSQL. One secure access mode today:

• tailnet — private, reached only over your Tailscale tailnet (no public ingress), serving a trusted *.ts.net certificate, with basic auth on top.

Cloud SQL is reached through the Cloud SQL Auth Proxy (via the VM service account) and secrets live in Secret Manager. A public HTTPS mode (AWS alb equivalent) is not offered yet — a GCE-VM-backed load balancer needs instance-group membership the plugin doesn't implement. Until the GCP plugin is published, gcp/PklProject uses a local path dependency on the plugin schema.

Full instructions in gcp/README.md.