Local AI Showcases - Chat Edition

A local AI showcase demonstrated an autonomous infrastructure deployment where an AI agent, Deepseek v4 running on VLLM, stood up an Outline wiki on a new Ubuntu VM, configured nginx TLS, Postgres, Redis, and Microsoft Entra single sign-on, and completed the end-to-end login, with the author declaring 'Infrastructure-as-Code is dead, long live Infrastructure-as-Claude!'

Machine: lol the basement lab is a constellation of machines Problem: I needed to test out a wiki. Prompt: We need a wiki for the lab, i want you to stand up the Outline wiki, nginx TLS-fronted, backed by our Postgres, with Microsoft/Entra sign-in as the only login. Done = I can browse to it and complete a "Continue with Microsoft" login end to end. we want to use the URL https://wiki.top-s3cret-lab-domain.com to reach the wiki Use the right tool for each job: - Proxmox — build the ubuntu VM on the same lab subnet and our usual initial sizing - RCON — install it on the new VM first so it's remotely manageable; wait for it to load and confirm XConnect can reach it before proceeding. curl -fsSk https://xconnect.top-s3cret-lab-domain.com/bootstrap/install.sh | RCON JOIN TOKEN=obviously not real 7R2zviGYo sh - Cloudflare-DNS MCP — create an unproxied DNS-only A record wiki.top-s3cret-lab-domain.com → the VM's IP. - certbot MCP — find the cert that covers wiki.top-s3cret-lab-domain.com. If one exists deliver it to the box via the pull link and wire nginx; since this box is brand new, that's the initial bootstrap delivery — also set up the monthly keyhash refresh for future renewals. If no cert covers the name, STOP and tell me. - XConnect — on database.top-s3cret-lab-domain.top, create a dedicated outline Postgres role + database. - Azure CLI MCP — create the Entra app registration in our tenant and wire up SSO, make sure user assignment is required, and assign users Three and Meta as users of the app. Add Three as the apps OWNER. Outline's requirements — don't skip these: - Postgres the DB above and Redis required — run Redis alongside Outline on the new VM . - Run Outline as a container; FILE STORAGE=local on a persistent volume from docker.getoutline.com/outlinewiki/outline:latest - Generate SECRET KEY and UTILS SECRET 32-byte hex on the box; set URL=https://wiki.top-s3cret-lab-domain.com, DATABASE URL, REDIS URL. - nginx reverse-proxies 443 → Outline 127.0.0.1:3000 and must forward websocket upgrade headers. - Entra: web redirect URI = https://wiki.top-s3cret-lab-domain.com/auth/azure.callback, a client secret, delegated openid profile email offline access + User.Read. Wire AZURE CLIENT ID/SECRET/TENANT ID into Outline. Confirm the exact auth env-var names and callback path against Outline's docs for the version you deploy they've changed across releases . Guardrails: - Verify each layer before moving on DNS resolves → TLS serves the wiki cert → app is up → login works . Don't declare success until the Microsoft login actually completes. - Before anything irreversible deleting the VM, dropping a DB, replacing an existing DNS record , stop and wait for user confirmation. - Keep secrets client secret, SECRET KEY, cert key out of chat — write them straight into the box's env file. Model: Deepseek v4 on VLLM Harness: Turnstone Result: A wiki, stood up and running with a vm, database, dns, certificate, single sign on in azure entra id… No but seriously, i posted a whole series of youtube videos in another thread. Infrastructure-as-Code is dead, long live Infrastructure-as-Claude