Module catalog reference · Reference

Generated by npm run catalog:doc from packages/module-catalog/src. Do not edit by hand.

143 modules in 9 categories, each split into subcategories (the same grouping as the Studio's module menu, from packages/module-catalog/src/taxonomy.ts). * = required, (1) = single cable. Every module also has a net input (NIC) as its last left-hand terminal.

Metrics says where the software's own metrics come from (built in, a separate exporter, an optional agent in the guest, Incus, or none), then the port and path, the format when it is not metrics text, and whether they are off or reachable only on localhost by default. "(set)" marks a port the class chooses because the software has no default. A class whose metrics a collector reads as text on a port has a mon output, and a drawn mon connection opens exactly that port (MODULE-PORTS.md). How to turn each one on, the signals worth watching and how well the facts were checked are in packages/module-catalog/src/metrics.ts and in the Studio inspector.

Networking

Application network (3) · Routing (3) · Load balancing (4) · DNS & discovery (5) · DHCP & IPAM (2) · VPN (4) · Firewalls (3)

Application network

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Gateway (`gateway`)	`wan` network (1), `net` network (1)	`lan` http	1 / 256	Incus	Public DNS name, Terminate TLS
Network (`network`)	`uplink` network	`net` network	1 / 64	Incus	—
Resolver (`resolver`)	`net` network (1)	—	1 / 128	none	—

Routing

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
FRRouting (`frr`)	`peer` bgp, `wan` network (1), `net` network (1)	`routes` bgp, `lan` network, `mon` metrics	1 / 512	exporter · 9342 `/metrics`, off by default	Local AS number, Router ID, BGP, OSPF, BFD fast failure detection, Forward packets between interfaces
BIRD (`bird`)	`peer` bgp, `net` network (1)	`routes` bgp, `mon` metrics	1 / 256	exporter · 9324 `/metrics`, off by default	Local AS number, Router ID, Role, OSPF
Keepalived (`keepalived`)	`net` network (1)	`check` http, `mon` metrics	1 / 128	exporter · 9165 `/metrics`, off by default	Virtual IP address, Virtual router ID, Priority, Take the address back after recovering

Load balancing

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
HAProxy (`haproxy`)	`in` http*, `net` network (1)	`out` http, `mon` metrics	1 / 512	built in · 8405 (set) `/metrics`, off by default	Balance algorithm, Sticky sessions, Proxy mode, Health check path, Check interval (s), Max connections, Client timeout (s), Server timeout (s), Terminate TLS, Certificate secret reference, Compress responses, Statistics page, Release branch
Traefik (`traefik`)	`in` http*, `net` network (1)	`out` http, `mon` metrics	1 / 256	built in · 8080 `/metrics`, off by default	Terminate TLS, Entrypoints, Enable dashboard
Envoy (`envoy`)	`in` http*, `net` network (1)	`out` http, `mon` metrics	1 / 256	built in · 9901 (set) `/stats/prometheus`, off by default	LB policy, Max connections
Varnish (`varnish`)	`in` http*, `net` network (1)	`origin` http (1)	1 / 1024	built in (counters)	Cache size (MiB), Default TTL (s)

DNS & discovery

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
CoreDNS (`coredns`)	`dns` dns*, `net` network (1)	`fwd` dns, `mon` metrics	1 / 128	built in · 9153 `/metrics`, off by default, localhost by default	Zone, Cache time (s), Health and readiness endpoints, Metrics endpoint
PowerDNS (`powerdns`)	`dns` dns*, `api` http, `net` network (1)	`db` postgres (1), `mon` metrics	1 / 512	built in · 8081 `/metrics`, off by default, localhost by default	Zone storage, Sign zones (DNSSEC), HTTP API, API key secret reference
Unbound (`unbound`)	`dns` dns*, `net` network (1)	`fwd` dns, `mon` metrics	1 / 256	exporter · 9167 `/metrics`, off by default	Allowed client networks, Validate DNSSEC, Cache size (MiB), Forward over TLS
BIND 9 (`bind9`)	`dns` dns*, `net` network (1)	`primary` dns (1), `fwd` dns	1 / 512	built in (json), off by default	Role, Zone, Sign zones (DNSSEC), Allow zone transfers to
Consul (`consul`)	`api` http*, `dns` dns, `net` network (1)	`mon` metrics	1 / 1024	built in · 8500 `/v1/agent/metrics?format=prometheus`, off by default	Datacenter, Expected servers, Gossip key secret reference

DHCP & IPAM

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Kea DHCP (`kea`)	`api` http, `net` network (1)	`db` postgres (1), `ddns` dns (1), `mon` metrics	1 / 256	exporter · 9547 `/metrics`, off by default	Address family, Subnet, Address pool, Lease time (h)
NetBox (`netbox`)	`http` http*, `net` network (1)	`db` postgres (1), `cache` redis (1), `mon` metrics	2 / 2048	built in · 8080 (set) `/metrics`, off by default	Allowed host names, Secret key secret reference, Require sign-in to view, Metrics endpoint

VPN

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
WireGuard (`wireguard`)	`wan` network (1), `net` network (1)	`lan` network	1 / 256	built in (counters)	Listen port, Allowed IPs, Private key secret reference
OpenVPN (`openvpn`)	`wan` network (1), `net` network (1)	`lan` network	1 / 512	built in (counters), off by default	Port, Protocol, CA key secret reference
strongSwan (`strongswan`)	`wan` network (1), `net` network (1)	`lan` network	1 / 256	built in (counters)	Authentication, Local subnets, Remote subnets, Certificate or key secret reference
Headscale (`headscale`)	`http` http*, `net` network (1)	`db` postgres (1), `mon` metrics	1 / 256	built in · 9090 `/metrics`, localhost by default	Public URL, Address range, Name devices in DNS, Device domain

Firewalls

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
OPNsense (`opnsense`)	`wan` network (1), `net` network (1)	`lan` network, `mon` metrics	2 / 1024	exporter · 9100 `/metrics`, off by default	Default policy, Admin password reference
pfSense (`pfsense`)	`wan` network (1), `net` network (1)	`lan` network	2 / 1024	built in · udp/161 (protocol), off by default	Default policy, Admin password reference
OpenWrt (`openwrt`)	`wan` network (1), `net` network (1)	`lan` network, `mon` metrics	1 / 256	exporter · 9100 `/metrics`, off by default, localhost by default	Incoming from WAN, LAN address, Admin password secret reference

Runtimes & OS

Web servers (4) · Language runtimes (5) · Linux systems (8)

Web servers

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
NGINX (`nginx`)	`in` http*, `net` network (1)	`db` postgres (1), `up` http	1 / 512	built in `/stub_status` (page), off by default	Server name, Release channel, Worker processes, Gzip responses, Serve HTTPS, Enable HTTP/2, Certificate secret reference, Connections per worker, Max request body (MiB), Requests per second per client, Upstream balancing, Response cache (MiB)
Apache httpd (`apache`)	`in` http*, `net` network (1)	`db` mysql (1), `up` http	1 / 512	built in `/server-status?auto` (page), off by default	Server name, Processing model, Document root, Keep connections alive, Max request workers, Serve HTTPS, Enable HTTP/2, Certificate secret reference, Extra modules
Caddy (`caddy`)	`in` http*, `net` network (1)	`out` http, `mon` metrics	1 / 128	built in · 2020 (set) `/metrics`, off by default	Site address, Automatic HTTPS
Tomcat (`tomcat`)	`http` http*, `net` network (1)	`db` postgres (1), `mon` metrics	1 / 1536	exporter · 9404 (set) `/metrics`, off by default	Version, JVM options, Max threads

Language runtimes

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Node.js (`nodejs`)	`in` http*, `net` network (1)	`db` postgres (1), `cache` redis (1)	1 / 512	none	Node.js version, Start command, Environment
Python app (`python`)	`http` http*, `net` network (1)	`db` postgres (1), `cache` redis (1)	1 / 512	none	Version, App module, Workers
Java app (`openjdk`)	`http` http*, `net` network (1)	`db` postgres (1), `mq` kafka (1), `mon` metrics	1 / 1536	exporter · 9404 (set) `/metrics`, off by default	Version, JVM options, Application JAR
PHP-FPM (`php`)	`http` http*, `net` network (1)	`db` mysql (1), `cache` memcached (1)	1 / 512	built in (protocol), off by default	Version, Memory limit (MiB), Max children
Go app (`go`)	`http` http*, `net` network (1)	`db` postgres (1), `cache` redis (1)	1 / 256	none	Program path, Arguments, Threads running Go code

Linux systems

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Linux base (`linux-base`)	`net` network (1)	—	1 / 512	agent (optional) · 9100 `/metrics`, off by default	Hostname, Extra packages
Debian (`debian`)	`net` network (1)	—	1 / 512	agent (optional) · 9100 `/metrics`, off by default	Version, Hostname, Extra packages
Ubuntu (`ubuntu`)	`net` network (1)	—	1 / 512	agent (optional) · 9100 `/metrics`, off by default	Version, Hostname, Extra packages
Alpine Linux (`alpine`)	`net` network (1)	—	1 / 256	agent (optional) · 9100 `/metrics`, off by default	Version, Hostname, Extra packages
Rocky Linux (`rocky`)	`net` network (1)	—	1 / 512	agent (optional) · 44322 `/metrics`, off by default	Version, Hostname
AlmaLinux (`almalinux`)	`net` network (1)	—	1 / 512	agent (optional) · 44322 `/metrics`, off by default	Version, Hostname
Fedora (`fedora`)	`net` network (1)	—	1 / 512	agent (optional) · 44322 `/metrics`, off by default, unverified	Version, Hostname
openSUSE (`opensuse`)	`net` network (1)	—	1 / 512	agent (optional) · 9100 `/metrics`, off by default, unverified	Version, Hostname, Extra packages

Data

Relational (6) · Key-value & cache (4) · Document (4) · Wide-column & graph (3) · Search (4) · Analytics (6) · Object & file storage (6)

Relational

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
PostgreSQL (`postgresql`)	`sql` postgres*, `net` network (1)	`mon` metrics	2 / 2048	exporter · 9187 `/metrics`, off by default	Version, Database name, Max connections, Password secret reference
MariaDB (`mariadb`)	`sql` mysql*, `net` network (1)	`mon` metrics	2 / 2048	exporter · 9104 `/metrics`, off by default	Database name, Max connections, Root password secret reference
MySQL (`mysql`)	`sql` mysql*, `net` network (1)	`repl` mysql, `mon` metrics	2 / 2048	exporter · 9104 `/metrics`, off by default	Version, Database name, Max connections, Root password secret reference
CockroachDB (`cockroachdb`)	`sql` postgres*, `net` network (1)	`peer` postgres, `mon` metrics	4 / 8192	built in · 8080 `/_status/vars`	Replicas, Locality, Insecure mode (lab only)
YugabyteDB (`yugabytedb`)	`sql` postgres*, `net` network (1)	`peer` postgres, `mon` metrics	2 / 4096	built in · 9000 `/prometheus-metrics`	Replication factor, Placement, Password secret reference
PgBouncer (`pgbouncer`)	`sql` postgres*, `net` network (1)	`db` postgres (1), `mon` metrics	1 / 128	exporter · 9127 `/metrics`, off by default	Pool mode, Max client connections, Server connections per pool

Key-value & cache

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Redis (`redis`)	`in` redis*, `net` network (1)	`mon` metrics	1 / 1024	exporter · 9121 `/metrics`, off by default	Max memory (MiB), Eviction policy
Valkey (`valkey`)	`in` redis*, `net` network (1)	`primary` redis (1), `mon` metrics	1 / 1024	exporter · 9121 `/metrics`, off by default	Max memory (MiB), Eviction policy, Append-only persistence, Password secret reference
Memcached (`memcached`)	`mc` memcached*, `net` network (1)	`mon` metrics	1 / 512	exporter · 9150 `/metrics`, off by default	Memory (MiB), Max connections
etcd (`etcd`)	`kv` grpc*, `net` network (1)	`mon` metrics	1 / 1024	built in · 2379 `/metrics`, localhost by default	Cluster members, Backend quota (GiB)

Document

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
MongoDB (`mongodb`)	`mongo` mongodb*, `net` network (1)	`repl` mongodb, `mon` metrics	2 / 4096	exporter · 9216 `/metrics`, off by default	Version, Replica set name, WiredTiger cache (GiB), Admin password secret reference
FerretDB (`ferretdb`)	`mongo` mongodb*, `net` network (1)	`db` postgres (1), `mon` metrics	1 / 512	built in · 8088 `/debug/metrics`, localhost by default	Require authentication, Log level
CouchDB (`couchdb`)	`http` http*, `net` network (1)	`repl` http, `mon` metrics	2 / 2048	built in · 5984 `/_node/_local/_prometheus`	Version, Shards per database (q), Replicas (n), Admin password secret reference
ArangoDB (`arangodb`)	`http` http*, `net` network (1)	`mon` metrics	2 / 2048	built in · 8529 `/_admin/metrics`	Database name, Root password secret reference

Wide-column & graph

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Cassandra (`cassandra`)	`cql` cassandra*, `net` network (1)	`peer` cassandra, `mon` metrics	4 / 8192	exporter · 9404 (set) `/metrics`, off by default	Version, Cluster name, Replication factor
ScyllaDB (`scylladb`)	`cql` cassandra*, `net` network (1)	`peer` cassandra, `mon` metrics	4 / 8192	built in · 9180 `/metrics`	Cluster name, CPU shards
Neo4j (`neo4j`)	`bolt` tcp*, `net` network (1)	`mon` metrics	2 / 4096	built in · 2004, off by default, localhost by default, unverified	Version, Heap size (MiB), Password secret reference

Search

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Elasticsearch (`elasticsearch`)	`http` http*, `net` network (1)	`mon` metrics	4 / 8192	exporter · 9114 `/metrics`, off by default	Version, Heap size (GiB), Primary shards, elastic user password secret reference
OpenSearch (`opensearch`)	`http` http*, `net` network (1)	`mon` metrics	4 / 8192	exporter · 9200 `/_prometheus/metrics`, off by default	Version, Heap size (GiB), Admin password secret reference
Solr (`solr`)	`http` http*, `net` network (1)	`mon` metrics	2 / 4096	built in · 8983/8989 `/solr/admin/metrics?wt=prometheus`	Version, Default core, Heap (MiB)
Meilisearch (`meilisearch`)	`http` http*, `net` network (1)	`mon` metrics	2 / 2048	built in · 7700 `/metrics`, off by default	Master key secret reference, Environment, Indexing memory (MiB)

Analytics

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
ClickHouse (`clickhouse`)	`http` http*, `net` network (1)	`mon` metrics	4 / 8192	built in · 9363 `/metrics`, off by default	Version, Max memory (GiB), Default user password secret reference
InfluxDB (`influxdb`)	`http` http*, `net` network (1)	`store` s3 (1), `mon` metrics	2 / 2048	built in · 8086/8181 `/metrics`	Version, Node ID, Organization, Admin token secret reference, Retention (days), Data files, Accept older write and query APIs, Processing engine (Python plugins)
Trino (`trino`)	`http` http*, `net` network (1)	`store` s3 (1), `db` postgres, `mon` metrics	4 / 8192	built in · 8080 `/metrics`	Role, Max memory per query (GiB), Heap size (GiB)
Spark (`spark`)	`submit` http*, `net` network (1)	`store` s3 (1), `mon` metrics	4 / 8192	built in · 4040 `/metrics/executors/prometheus/`, off by default	Version, Executors, Executor memory (GiB)
Airflow (`airflow`)	`ui` http*, `net` network (1)	`db` postgres (1), `mq` redis (1)	2 / 3072	built in (protocol), off by default	Executor, Fernet key secret reference
Superset (`superset`)	`ui` http*, `net` network (1)	`db` postgres (1), `cache` redis (1), `src` postgres	2 / 2048	built in (protocol), off by default	Secret key secret reference, Web workers, Load example data

Object & file storage

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
MinIO (`minio`)	`s3` s3*, `net` network (1)	`mon` metrics	1 / 1024	built in · 9000 `/minio/v2/metrics/cluster`	Default bucket, Access key secret reference
Garage (`garage`)	`s3` s3*, `net` network (1)	`peer` s3, `mon` metrics	1 / 1024	built in · 3903 `/metrics`, off by default	Copies of each object, S3 region name, Capacity offered (GiB), Cluster secret reference
SeaweedFS (`seaweedfs`)	`s3` s3*, `net` network (1)	`peer` s3, `mon` metrics	2 / 2048	built in · 9327 (set) `/metrics`, off by default	Replication, Volume size limit (MiB)
Ceph (`ceph`)	`s3` s3*, `net` network (1)	`mon` metrics	4 / 8192	built in · 9283 `/metrics`, off by default	Replica count, Placement groups
NFS server (`nfs`)	`nfs` nfs*, `net` network (1)	`mon` metrics	1 / 512	exporter · 9100 `/metrics`, off by default	Export path, Access
Samba (`samba`)	`smb` smb*, `net` network (1)	`auth` ldap (1)	1 / 512	built in (counters)	Share name, Share path, Server role, Allow guest access

Messaging

Brokers & queues (4) · Streaming (4)

Brokers & queues

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
RabbitMQ (`rabbitmq`)	`amqp` amqp*, `net` network (1)	`mon` metrics	1 / 1024	built in · 15692 `/metrics`, off by default	Virtual host, User password secret reference
NATS (`nats`)	`in` nats*, `net` network (1)	`peer` nats, `mon` metrics	1 / 512	exporter · 7777 `/metrics`, off by default	JetStream persistence, Max payload (KiB)
ActiveMQ (`activemq`)	`in` amqp*, `net` network (1)	`peer` amqp, `mon` metrics	2 / 2048	exporter · 9404 (set) `/metrics`, off by default, unverified	Broker, Admin password secret reference
Mosquitto (`mosquitto`)	`in` mqtt*, `net` network (1)	`bridge` mqtt	1 / 256	built in · 1883 (protocol)	Allow anonymous clients, Max connections

Streaming

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Kafka (`kafka`)	`in` kafka*, `net` network (1)	`peer` kafka, `mon` metrics	4 / 8192	exporter · 9404 (set) `/metrics`, off by default	Version, Default partitions, Replication factor, Retention (h)
Pulsar (`pulsar`)	`in` pulsar*, `net` network (1)	`peer` pulsar, `mon` metrics	4 / 6144	built in · 8080 `/metrics/`	Cluster name, Retention (h)
Debezium (`debezium`)	`net` network (1)	`db` postgres (1), `mq` kafka (1), `mon` metrics	1 / 1024	exporter · 9404 (set) `/metrics`, off by default	Topic prefix, Tables to capture, Initial snapshot, Database password secret reference
Flink (`flink`)	`ui` http*, `net` network (1)	`mq` kafka (1), `store` s3 (1), `mon` metrics	2 / 4096	built in · 9249 `/metrics`, off by default	Task slots, Default parallelism, Task manager memory (GiB)

Observability

Metrics (5) · Logs (4) · Traces (3) · Dashboards (3) · Alerting & uptime (2)

Metrics

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Prometheus (`prometheus`)	`scrape` metrics, `api` http, `net` network (1)	`alerts` http, `mon` metrics	1 / 1024	built in · 9090 `/metrics`	Scrape interval (s), Retention (days)
VictoriaMetrics (`victoriametrics`)	`scrape` metrics, `api` http, `net` network (1)	`mon` metrics	1 / 1024	built in · 8428 `/metrics`	Retention (months), Scrape interval (s)
Node exporter (`node-exporter`)	`net` network (1)	`mon` metrics	1 / 64	built in · 9100 `/metrics`	Extra collectors, Service states
Blackbox exporter (`blackbox-exporter`)	`net` network (1)	`probe` http, `mon` metrics	1 / 64	built in · 9115 `/metrics`	Check, Timeout (s)
Zabbix (`zabbix`)	`ui` http*, `agent` tcp, `net` network (1)	`db` postgres (1), `mail` smtp (1)	2 / 2048	built in · 10051 (protocol), off by default	Pollers, Configuration cache (MiB), Database password secret reference

Logs

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Loki (`loki`)	`api` http*, `net` network (1)	`store` s3 (1), `mon` metrics	2 / 2048	built in · 3100 `/metrics`	Retention (days), Separate tenants
Vector (`vector`)	`in` syslog, `net` network (1)	`out` http, `mq` kafka (1), `mon` metrics	1 / 512	built in · 9598 `/metrics`, off by default	Role, Disk buffer (MiB)
Fluent Bit (`fluent-bit`)	`in` syslog, `net` network (1)	`out` http, `mon` metrics	1 / 128	built in · 2020 `/api/v2/metrics/prometheus`, off by default	Flush interval (s), Monitoring endpoint
Logstash (`logstash`)	`in` syslog*, `net` network (1)	`out` http (1)	2 / 2048	built in · 9600 `/_node/stats` (json), localhost by default	Pipeline workers, Batch size

Traces

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
OTel Collector (`otel`)	`otlp` grpc*, `net` network (1)	`traces` grpc, `mon` metrics	1 / 512	built in · 8888 `/metrics`, localhost by default	Batch processor, Memory limit (MiB)
Jaeger (`jaeger`)	`traces` grpc*, `net` network (1)	`store` http (1), `mon` metrics	1 / 1024	built in · 8888 `/metrics`	Sampling rate (%), Trace retention (h)
Tempo (`tempo`)	`otlp` grpc*, `api` http, `net` network (1)	`store` s3 (1), `mon` metrics	2 / 2048	built in · 3200 `/metrics`	Retention (h)

Dashboards

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Grafana (`grafana`)	`ui` http, `net` network (1)	`query` http, `src` postgres, `mon` metrics	1 / 512	built in · 3000 `/metrics`	Admin password secret reference, Allow anonymous viewers
Kibana (`kibana`)	`ui` http*, `net` network (1)	`es` http (1)	1 / 1024	built in · 5601 `/api/status` (json)	Base path, Service account secret reference
OpenSearch Dashboards (`opensearch-dashboards`)	`ui` http*, `net` network (1)	`os` http (1)	1 / 1024	built in · 5601 `/api/status` (json)	Base path, Service account secret reference

Alerting & uptime

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Alertmanager (`alertmanager`)	`api` http*, `net` network (1)	`notify` http, `mail` smtp (1), `mon` metrics	1 / 256	built in · 9093 `/metrics`	Wait before the first notification (s), Repeat interval (h)
Uptime Kuma (`uptime-kuma`)	`ui` http*, `net` network (1)	`probe` http, `mail` smtp (1), `mon` metrics	1 / 512	built in · 3001 `/metrics`, off by default	Check interval (s), Retries before down

Security & identity

Identity providers (5) · Directories (2) · Secrets & certificates (4) · Threat detection (3)

Identity providers

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Keycloak (`keycloak`)	`http` http*, `net` network (1)	`db` postgres (1), `ldap` ldap (1), `mon` metrics	2 / 2048	built in · 9000 `/metrics`, off by default	Default realm, SSO session idle (min), Brute-force detection, Admin password secret reference, Public host name, Strict hostname, Start mode, Proxy headers, Health endpoints, Metrics endpoint
Authentik (`authentik`)	`http` http*, `net` network (1)	`db` postgres (1), `cache` redis (1), `mon` metrics	2 / 2048	built in · 9300 `/metrics`	Public host name, Secret key secret reference, Bootstrap password secret reference, Send error reports
Authelia (`authelia`)	`http` http*, `net` network (1)	`ldap` ldap (1), `cache` redis (1), `mon` metrics	1 / 256	built in · 9959 `/metrics`, off by default	Protected domain, Default policy
Zitadel (`zitadel`)	`http` http*, `net` network (1)	`db` postgres (1), `mon` metrics	2 / 1024	built in · 8080 `/debug/metrics`	External domain, Master key secret reference
Pocket ID (`pocketid`)	`http` http*, `net` network (1)	`db` postgres (1), `mon` metrics	1 / 256	built in · 9464 `/metrics`, off by default, localhost by default	Public URL, Allow user sign-up, Encryption key secret reference

Directories

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
OpenLDAP (`openldap`)	`ldap` ldap*, `net` network (1)	`repl` ldap	1 / 512	built in · 389 (protocol), off by default	Base DN, Admin password secret reference, Require TLS
FreeIPA (`freeipa`)	`ldap` ldap*, `web` http, `net` network (1)	`repl` ldap	2 / 4096	built in · 389 (protocol), off by default, unverified	Kerberos realm, Domain, Integrated DNS, Admin password secret reference

Secrets & certificates

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Vault (`vault`)	`api` http*, `net` network (1)	`audit` syslog, `mon` metrics	1 / 1024	built in · 8200 `/v1/sys/metrics?format=prometheus`, localhost by default	Require TLS, Default lease TTL (h), Unseal key secret reference
OpenBao (`openbao`)	`api` http*, `net` network (1)	`db` postgres (1), `audit` syslog, `mon` metrics	1 / 1024	built in · 8200 `/v1/sys/metrics?format=prometheus`, localhost by default	Storage, Require TLS, Default lease TTL (h), Unseal key secret reference
step-ca (`step-ca`)	`api` http*, `net` network (1)	`db` postgres (1), `mon` metrics	1 / 256	built in · 9102 (set) `/metrics`, off by default	CA host names, Provisioner, Default certificate lifetime (h), Key password secret reference
Vaultwarden (`vaultwarden`)	`http` http*, `net` network (1)	`db` postgres (1), `mail` smtp (1)	1 / 256	none	Public URL, Allow sign-ups, Admin token secret reference

Threat detection

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
CrowdSec (`crowdsec`)	`api` http*, `in` syslog, `net` network (1)	`mon` metrics	1 / 512	built in · 6060 `/metrics`, localhost by default	Detection collections, Share signals and use the community blocklist
Suricata (`suricata`)	`wan` network (1), `net` network (1)	`lan` network, `alerts` syslog	2 / 2048	built in (counters)	Mode, Protected networks, Update rules daily
Wazuh (`wazuh`)	`agent` tcp, `api` http, `net` network (1)	`index` http (1), `audit` syslog	2 / 4096	built in · 55000 (json), off by default	Vulnerability detection, API password secret reference

Developer tools

Source control (3) · Build & release (4)

Source control

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Gitea (`gitea`)	`http` http*, `net` network (1)	`db` postgres (1), `mon` metrics	1 / 1024	built in · 3000 `/metrics`, off by default	Root URL, Open registration, Secret key secret reference
Forgejo (`forgejo`)	`http` http*, `net` network (1)	`db` postgres (1), `cache` redis (1), `mon` metrics	1 / 1024	built in · 3000 `/metrics`, off by default	Root URL, Open registration, Built-in CI (Actions), Secret key secret reference
GitLab (`gitlab`)	`http` http*, `net` network (1)	`db` postgres (1), `cache` redis (1), `store` s3 (1), `mon` metrics	4 / 8192	built in · 80 `/-/metrics`, localhost by default	External URL, Root password secret reference, Puma workers

Build & release

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Jenkins (`jenkins`)	`http` http*, `net` network (1)	`mon` metrics	2 / 2048	exporter · 8080 `/prometheus/`, off by default	Executors, Jenkins URL, Admin password secret reference
Woodpecker (`woodpecker`)	`http` http*, `agent` grpc, `net` network (1)	`forge` http (1), `db` postgres (1), `mon` metrics	1 / 512	built in · 8000 `/metrics`, off by default	Public URL, Anyone on the forge may sign in, Agent secret reference
Harbor (`harbor`)	`http` http*, `net` network (1)	`db` postgres (1), `cache` redis (1), `store` s3 (1), `mon` metrics	4 / 8192	built in · 9090 `/metrics`, off by default	Host name, Admin password secret reference, Vulnerability scanning
Registry (`registry`)	`http` http*, `net` network (1)	`store` s3 (1), `cache` redis (1), `mon` metrics	1 / 512	built in · 5001 (set) `/metrics`, off by default	Allow deleting images, Pull-through cache, Upstream registry, HTTP secret reference

Applications

Collaboration (4) · Websites & wikis (4) · Mail (3) · Business (2)

Collaboration

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Nextcloud (`nextcloud`)	`http` http*, `net` network (1)	`db` postgres (1), `cache` redis (1), `store` s3 (1), `mon` metrics	2 / 2048	built in · 80 `/metrics`, localhost by default	Trusted domain, Admin password secret reference, Max upload (MiB)
Mattermost (`mattermost`)	`http` http*, `net` network (1)	`db` postgres (1), `store` s3 (1), `mail` smtp (1)	2 / 4096	none	Site URL, Open sign-up, Max file size (MiB)
Synapse (`synapse`)	`http` http*, `net` network (1)	`db` postgres (1), `mail` smtp (1), `mon` metrics	2 / 2048	built in · 9000 (set) `/_synapse/metrics`, off by default	Server name, Open registration, Federate with other servers, Registration secret reference
Jitsi Meet (`jitsi`)	`http` http*, `net` network (1)	`auth` ldap (1), `mon` metrics	2 / 4096	built in · 8080 `/metrics`, localhost by default	Public URL, Require sign-in to create rooms, Public media address

Websites & wikis

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
WordPress (`wordpress`)	`http` http*, `net` network (1)	`db` mysql (1), `cache` memcached (1)	1 / 1024	none	Site URL, Database password secret reference, Multisite
Ghost (`ghost`)	`http` http*, `net` network (1)	`db` mysql (1), `mail` smtp (1)	1 / 1024	none	Site URL, Environment
Drupal (`drupal`)	`http` http*, `net` network (1)	`db` mysql (1), `cache` redis (1)	1 / 1024	none	Site name, Admin password secret reference, Max upload (MiB)
MediaWiki (`mediawiki`)	`http` http*, `net` network (1)	`db` mysql (1), `cache` memcached (1)	1 / 1024	built in (protocol), off by default	Wiki name, Server URL, Allow file uploads, Secret key secret reference

Mail

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Postfix (`postfix`)	`smtp` smtp*, `net` network (1)	`deliver` smtp (1), `relay` smtp (1), `auth` ldap (1), `mon` metrics	1 / 512	exporter · 9154 `/metrics`, off by default	Host name, Mail domain, Max message size (MiB), Offer TLS
Dovecot (`dovecot`)	`imap` imap*, `lmtp` smtp, `net` network (1)	`auth` ldap (1), `mon` metrics	1 / 512	built in · 9900 (set) `/metrics`, off by default	Mailbox format, Quota per user (MiB), Also serve POP3
Roundcube (`roundcube`)	`http` http*, `net` network (1)	`imap` imap (1), `smtp` smtp (1), `db` postgres (1)	1 / 256	none	Product name, Session encryption key secret reference

Business

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Odoo (`odoo`)	`http` http*, `net` network (1)	`db` postgres (1), `mail` smtp (1)	2 / 2048	none	Workers, Show the database manager, Master password secret reference
Matomo (`matomo`)	`http` http*, `net` network (1)	`db` mysql (1)	1 / 1024	none	Tracked site URL, Anonymise visitor addresses, Build reports every (min)

Microsoft Windows

Windows systems (3) · Directory & access (2) · Servers & apps (5)

Windows systems

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Windows Server (`windows-server`)	`net` network (1)	—	2 / 4096	agent (optional) · 9182 `/metrics`, off by default	Version, Edition, Computer name, Licence key secret reference, Administrator password secret reference
Windows 11 (`windows-11`)	`rdp` rdp, `net` network (1)	—	2 / 4096	agent (optional) · 9182 `/metrics`, off by default	Version, Computer name, Licence key secret reference
Windows 10 (`windows-10`)	`rdp` rdp, `net` network (1)	—	2 / 4096	agent (optional) · 9182 `/metrics`, off by default	Version, Computer name, Licence key secret reference

Directory & access

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
Active Directory (`active-directory`)	`ldap` ldap*, `net` network (1)	`repl` ldap, `mon` metrics	2 / 4096	exporter · 9182 `/metrics`, off by default	Domain name, Functional level, Recovery password secret reference, Licence key secret reference
RD Gateway (`rd-gateway`)	`https` http*, `net` network (1)	`rdp` rdp, `auth` ldap (1), `mon` metrics	2 / 2048	exporter · 9182 `/metrics`, off by default, unverified	Public host name, Require multi-factor authentication

Servers & apps

Module	Inputs (left)	Outputs (right)	vCPU / MiB	Metrics	Settings
IIS (`iis`)	`http` http*, `net` network (1)	`db` mssql (1), `auth` ldap (1), `mon` metrics	2 / 4096	exporter · 9182 `/metrics`, off by default	Site name, App pool memory limit (MiB), Windows authentication
SQL Server (`sql-server`)	`sql` mssql*, `net` network (1)	`repl` mssql, `mon` metrics	4 / 8192	exporter · 9182 `/metrics`, off by default	Version, Edition, Max server memory (MiB), sa password secret reference
Exchange (`exchange`)	`smtp` smtp, `owa` http, `net` network (1)	`auth` ldap (1), `mon` metrics	4 / 16384	exporter · 9182 `/metrics`, off by default	Organisation name, Version, Licence key secret reference
File server (`smb-files`)	`smb` smb*, `net` network (1)	`mon` metrics	2 / 2048	exporter · 9182 `/metrics`, off by default	Share name, Require SMB encryption, Quota (GiB)
.NET app (`dotnet`)	`http` http*, `net` network (1)	`db` mssql (1), `cache` redis (1)	1 / 1024	none	Runtime, Entry assembly, Environment

Deployable modules

7 of 143 classes have an Incus runtime; the others are design-only. A runtime is added only after its images have run on the disposable test cluster. The runtime decides the instance kind: a system container unless the class needs an OCI application container or a virtual machine (how a module becomes instances).

Module	Runtime	Image by setting
Resolver (`resolver`)	system container (`incus-system-container`)	`debian/13`
NGINX (`nginx`)	OCI application container (`incus-oci-container`)	channel = stable: `library/nginx@sha256:eb1c896deef8…` (1.30.6) channel = mainline: `library/nginx@sha256:bc4cad49969a…` (1.31.7)
Linux base (`linux-base`)	virtual machine (`incus-vm`)	`debian/13`
Debian (`debian`)	system container (`incus-system-container`)	version = 12: `debian/12` version = 13: `debian/13`
Valkey (`valkey`)	OCI application container (`incus-oci-container`)	`valkey/valkey@sha256:418652cfb58e…` (9.1.2)
Blackbox exporter (`blackbox-exporter`)	OCI application container (`incus-oci-container`)	`prom/blackbox-exporter@sha256:ea1c7aa3ef3f…` (0.29.1)
Uptime Kuma (`uptime-kuma`)	OCI application container (`incus-oci-container`)	`louislam/uptime-kuma@sha256:4b95dbe7ac53…` (2.5.7)