{
  "auto-update": {
    "title": "Automatic update (nightly)",
    "description": "Runs the full update every night at 02:00 – Debian packages, app, modules and iac, without a reboot. Log: journalctl -u iac-auto-update",
    "supports": ["lxc", "vm"],
    "default": true
  },
  "backup": {
    "title": "Backup (restic)",
    "description": "Daily backup with restic to SFTP, S3, a REST server or a local path – /etc, /root, /var/lib, the app's data and database dumps. Target: backup_repository in /etc/iac/settings.env",
    "supports": ["lxc", "vm"],
    "icon": "restic"
  },
  "desktop": {
    "title": "Desktop (XFCE, RDP)",
    "description": "XFCE desktop with Firefox via RDP (port 3389, private networks only). Log in as root, password: grep root_password /etc/iac/settings.env",
    "supports": ["vm"],
    "icon": "xfce"
  },
  "crowdsec": {
    "title": "CrowdSec",
    "description": "CrowdSec from Debian: detects attacks in the logs (SSH from the journal, nginx, Apache) and blocks the addresses with nftables (own tables). Shares signals with the CrowdSec community and uses its blocklist; private networks are never blocked. Manage with cscli",
    "supports": ["lxc", "vm"]
  },
  "elasticsearch": {
    "title": "Elasticsearch",
    "description": "Elasticsearch 9 from Elastic's APT repository (key pinned in iac-core), on localhost:9200 only, without login, 1 GiB heap",
    "supports": ["lxc", "vm"]
  },
  "fail2ban": {
    "title": "fail2ban",
    "description": "Blocks IP addresses after repeated failed SSH logins (nftables); own jails for app logins possible",
    "supports": ["lxc", "vm"]
  },
  "mariadb": {
    "title": "MariaDB",
    "description": "MariaDB server from Debian, reachable on localhost only",
    "supports": ["lxc", "vm"]
  },
  "mail-relay": {
    "title": "Mail relay (Postfix)",
    "description": "Postfix from Debian on localhost:25 and sendmail: apps, cron and system mail go out through your smarthost with TLS and login – never directly. Target: mail_relay_host, mail_relay_user, mail_relay_password in /etc/iac/settings.env",
    "supports": ["lxc", "vm"]
  },
  "node-exporter": {
    "title": "Prometheus node exporter",
    "description": "System metrics on port 9100 (private networks only)",
    "supports": ["lxc", "vm"],
    "icon": "prometheus"
  },
  "postgresql": {
    "title": "PostgreSQL",
    "description": "PostgreSQL server from Debian, reachable on localhost only",
    "supports": ["lxc", "vm"]
  },
  "unattended-upgrades": {
    "title": "Automatic security updates",
    "description": "Installs Debian security updates automatically every day (without a reboot)",
    "supports": ["lxc", "vm"],
    "icon": "debian"
  },
  "valkey": {
    "title": "Valkey (Redis)",
    "description": "Valkey server from Debian (Redis protocol), on localhost:6379 only",
    "supports": ["lxc", "vm"]
  }
}