itsup

itsUP is a Python-based home infrastructure stack that automates Docker service management with a focus on zero-downtime deployments and security. It manages a complete networking stack including DNS resolution, Traefik reverse proxy, and container workloads—all orchestrated from a project-based directory structure. Each service project has its own docker-compose.yml and configuration file, keeping infrastructure as code organized and versionable. Key capabilities: - **Zero-downtime rollouts**: Uses docker rollout to scale containers, wait for health checks, then replace old instances. Smart change detection skips rollouts when nothing changed. - **Managed proxy**: Generates Traefik configuration with SO_REUSEPORT for seamless updates. Supports TLS termination, TLS passthrough, TCP/UDP forwarding, and host port binding. - **Container Security Monitor**: Detects compromised containers by correlating DNS queries with direct IP connections. Integrates with OpenSnitch for optional iptables blocking. - **DNS Honeypot**: Routes all container DNS traffic through dnsmasq with logging for threat detection. - **Automated backups**: Nightly S3 backups with scheduled restores. - **Threat intelligence**: Daily reports via AbuseIPDB API integration. - **OpenVPN server**: Built-in VPN support with SSH access. The itsup CLI is the primary interface, with commands for init, apply, validate, dns/proxy/svc/monitor management. Systemd timers handle boot startup, nightly apply, backups, and health checks on Linux. On macOS, launchd agents provide similar automation. Prerequisites include Docker with the rollout plugin, uv for Python dependency management, port forwarding for 80/443, and a wildcard DNS domain. Configuration uses SOPS/age for secrets encryption with separate git repositories for projects and secrets.