One command gives a business real infrastructure as code on Cloudflare. The done-when checks ship in the box, a watchdog keeps every service online, and when the checks pass the same setup graduates to AWS, Kubernetes and Argo CD.
It was clicked together in a dashboard, the person who set it up has moved on, and nobody finds out a service is down until a customer does. Enterprise teams solve this with infrastructure as code, pipelines, and on-call. That stack takes weeks to stand up, so a $10M business never gets it.
DevOps in a Box puts the same habits behind one command, on the platform that is cheapest to start on, and proves each habit with a check instead of a promise.
Onboarding is the product. Every prompt has a default, every error says the fix, and re-running picks up where it stopped.
The browser opens for wrangler login. If you're already signed in, the box skips this.
One account is picked for you. With several, you choose from a numbered list.
The box prints exactly which permissions to grant, then keeps the token in the macOS Keychain.
R2 state bucket, tofu apply for staging, a deployed sample app, scoped CI tokens, an optional GitHub repo with secrets set, and box check g0.
Cloudflare's browser sign-in can't create API tokens, so the user makes one. After init, OpenTofu only uses it to create narrower tokens for each CI job, and it can be revoked.
The check IDs come straight from the DevOps training plan's done-when lists. They are code in checks/, run by box check on a laptop and in CI, and every result lands in the run view.
The box installs and proves itself.
A push deploys; destroy and apply rebuilds.
Same modules, least privilege, timed restore.
Probe everything, repair with evidence.
Eject to the stack the plan teaches.
A Worker on a five-minute cron probes every service in services.yaml. Two failures in a row open an incident, and the incident follows the WEFT loop from the measurement guide. The watchdog collects evidence and names the seam. A person owns the repair.
Steps in gold are automatic. Green steps belong to the owner. Auto-rollback is allowed only for Environment seams on services marked eligible.
Environment: no response or a 5xx. Harness: the probe was refused. Task: the service is up but serves the wrong thing. Evaluator: the check can no longer tell pass from fail.
What one incident looks like from open to close.
The live watchdog is running now against the Organized AI services. Open the run view →
Every Cloudflare piece in the box stands in for a concept that transfers. When G3 is green, box eject writes the graduated stack next to the Cloudflare one, and the same check IDs run against it.
A gate passes when its checks are green in CI. Checks for unbuilt gates say "not built yet" instead of passing.
The watchdog gathers evidence and proposes one repair. Closing an incident takes the owner's token.
Every primitive maps to its AWS and Kubernetes equivalent, so a client who outgrows the box keeps the habits and the checks.
Node 20+, a Cloudflare account, and OpenTofu or Terraform.
A phased prompt that builds and verifies gate by gate.
Services, checks and incidents from the watchdog on this deploy.
Open run view →claude --dangerously-skip-permissions Clone github.com/organized-ai/devops-in-a-box into /Users/supabowl/devops-in-a-box and continue building it gate by gate. First apply the Organized Codebase agent templates to .claude/. A gate is done only when `node cli/box.mjs check <gate>` passes in CI. Keep checks honest: unbuilt work reports "not built yet". Next: finish G1 (tofu apply in CI with R2 state credentials, rebuild-clean job), then G2 (env-parity, token-scope, no-secrets with gitleaks, access-gated, restore-drill). Read README.md and RUNBOOK.md first. No time estimates anywhere.