The catalogue
The catalogue
38 modules across 7 categories. Each one knows how to install itself, check itself, configure itself, update itself, uninstall itself and report its state, on Ubuntu 22.04 and 24.04, amd64 and arm64.
Base
- System core.system Base packages, sized swap, memory guard, a dev user with sudo, zsh, tmux, git identity, the dev command.
- Hardening core.hardening ufw on SSH only, fail2ban, root closed and passwords off once a key opens dev.
- Backups core.backup Configuration, secrets, databases and projects, encrypted on the server and sent to your own S3 bucket on the interval you set.
Runtimes
- Node.js runtime.node Node, Bun, pnpm and Yarn through mise, at the versions you choose, in every shell.
- Java runtime.java Temurin through mise, Gradle daemon sized for the RAM.
- Python runtime.python uv and the Python version you choose, through mise.
- Go runtime.go Go at the version you choose, through mise, with GOPATH and go install binaries on the path.
- PHP runtime.php PHP at the version you choose, built by mise, Composer optional, memory limit yours.
- Ruby runtime.ruby Ruby at the version you choose, built by mise, Bundler optional.
- Docker runtime.docker Docker Engine and Compose, dev in the group so no command needs sudo, images where you want them.
- Rust runtime.rust Rust at the chosen version through mise and rustup; cargo, rustc and what cargo install builds on every shell’s path.
Databases
- MySQL or MariaDB db.mysql Bound to 127.0.0.1 on the port you pick, app and remote accounts you name, dumps in ~/dumps imported for you.
- PostgreSQL db.postgres The major version you choose, local only, app and remote roles you name, common extensions, dump import.
- MongoDB db.mongodb The major version you choose, local only, the app user you name, mongodump import.
- Redis db.redis Local only, a password it refuses to work without, persistence and a memory ceiling you set.
- Mailpit db.mailpit A local SMTP server that catches everything your projects send, and the interface that shows it, both on the loopback.
AI agents
- Claude Code ai.claude The native binary, checksum verified, with the machine context, the Pupitre skills and your own subscription.
- Codex ai.codex Installed through mise, same machine context and same skills, on your own subscription.
- Cursor CLI ai.cursor Cursor’s own package under its version, the agent and cursor-agent commands, the Pupitre skills, on your Cursor subscription.
- Gemini CLI ai.gemini Google’s open-source agent through mise, same machine context and same skills, on your Google account — the free tier is enough — or an API key.
- GitHub Copilot CLI ai.copilot Copilot’s terminal agent through mise, same machine context and same skills, on your Copilot subscription.
- OpenCode ai.opencode The open-source agent, its binary checked against the digest GitHub publishes, tied to no provider: a Claude, ChatGPT or Copilot subscription, or any key.
- Hermes Agent ai.hermes Nous Research’s agent through Python, the model providers you configure, a systemd service if always on.
- OpenClaw ai.openclaw The personal assistant reached from Telegram, Discord or WhatsApp, its gateway as a systemd service, the model providers you configure.
- Headless browser ai.browser Headless Chrome and the libraries it needs, which the screenshot tool of Pupitre’s MCP server uses to show a page to the AI agent.
Remote editors
- JetBrains Remote Dev editor.jetbrains Remote backend preinstalled for IntelliJ IDEA, WebStorm, PyCharm, PhpStorm or GoLand, JVM sized, your licence.
- VS Code Remote SSH editor.vscode code CLI and remote server preinstalled so the first connection is immediate; same for Cursor and Windsurf.
- Zed Remote Server editor.zed Remote server preinstalled for your version, opened through zed://ssh.
Exposure
- Cloudflare Tunnel exposure.cloudflare One tunnel on your own Cloudflare account, one route per project, DNS and certificate managed.
- Caddy exposure.caddy Reverse proxy with automatic Let’s Encrypt certificates, one route per project, for a domain outside Cloudflare.
- Tailscale exposure.tailscale The machine on your tailnet through an auth key: SSH and preview URLs from your phone or another computer, nothing exposed publicly. Lives beside Caddy or the tunnel.
Tools
- GitHub tool.github gh, HTTPS clone without a key, the server’s key registered on your account.
- 1Password tool.1password CLI and service account token, checked at install time, so a project builds its env file from your vault.
- Neon tool.neon The Neon CLI and your API key in the dev shell; your projects and branches stay yours to create.
- Wrangler tool.wrangler Cloudflare’s CLI and your API token in the dev shell; Workers, D1 and Pages deploy from the server.
- Vercel tool.vercel The Vercel CLI and your token in the dev shell; deploy, env and logs answer from the server.
- Supabase tool.supabase The Supabase CLI, its release binary checksum verified, and your access token in the dev shell; migrations, types and functions push from the server.
- Stripe tool.stripe The Stripe CLI, its release binary checksum verified, and a restricted key in the dev shell; stripe listen forwards webhooks to a project on the machine.