docs examples.md

Advanced examples

These five maintained Cookbooks show complete cloud workflows with Terraform state, managed recipe images, bounded ingress, scheduled teardown, explicit destroy actions, and provider inventory proof.

Complete the tutorials first. Every example is opt-in. Cloud use can create billable resources. Review the exact plan and cleanup path before a run.

AWS Terraform VM

Provision Linux or Windows EC2 instances with optional DNS, load balancing, reusable AMIs, and virtualization support.

Secret names
AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
Cleanup
A 12-hour destroy is scheduled. Run destroy-aws-vm-via-script when work finishes.

GCP Debian VM with Docker

Provision one Debian VM, install Docker, and optionally mint a bounded one-hour registry token for a configured workload.

Secret names
GOOGLE_CREDENTIALS and WORKLOAD_TOKEN
Cleanup
A 12-hour destroy is scheduled. Run destroy-vm when work finishes.

GCP Terraform Debian

Provision a Debian VM with DNS, certificate, load-balancer, and persistent Terraform state behavior.

Secret name
GOOGLE_CREDENTIALS
Cleanup
A 12-hour destroy is scheduled. Run destroy-gcp-vm-via-script when work finishes.

GCP Terraform VM and image builder

Launch Linux or Windows VMs, destroy them, create reusable disk images, list author-owned images, and relaunch from an exact image name.

Secret name
GOOGLE_CREDENTIALS
Network default
127.0.0.1/32; supply only an approved source prefix
Cleanup
A 12-hour destroy is scheduled. Run the exact destroy recipe when work finishes.

GCP VM with a custom SSH port

Use the GCP VM and image workflow with an optional saved-image SSH port from 10000 through 65535.

Secret name
GOOGLE_CREDENTIALS
Cleanup
A 12-hour destroy is scheduled. Run the exact destroy recipe when work finishes.

Credential and cleanup safety

  • The published source declares secret names only. It contains no cloud credential value.
  • The original Cookbook author binds each value through the write-only User Secrets catalog. LEMC injects accepted names as environment variables at job time.
  • These workflows can generate private SSH keys and Windows credentials as sensitive job output. Keep them within the authorized task and storage boundary. Never place them in Git, prompts, logs, or shared artifacts.
  • A successful destroy job is not enough. Query the provider with the recorded resource identity and prove that its inventory is empty.
  • Disable disposable secret bindings and confirm that no delayed or recurring cleanup job remains eligible.

Source contract

The website build copies only Git-tracked files from the five maintained Cookbook directories. It excludes internal fixtures, untracked files, local state, and secret-shaped artifacts. The canonical editable source remains under examples/cookbooks/.