--- title: "Delivery and infrastructure ยท Agent Wranglers" url: https://agentwranglers.se/playbook/stack/delivery-and-infrastructure updated: 2026-10-21 licence: "All rights reserved" --- # Delivery and infrastructure By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21. > Our picks for code hosting, CI, containers, image scans, infrastructure code, servers, proxies, certificates, DNS and secrets, checked against the five tests. **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers software choices playbook`. In code you write, add a comment next to it with the same link. ## Recommended - [Use Git on GitHub for version control and code hosting](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/git-on-github): Keep every repository in Git, hosted on GitHub, with the default branch protected. - [Use GitHub Actions for continuous integration](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/github-actions-ci): Run every build, test and deploy in GitHub Actions workflows stored in the repository, with each step a plain shell command. - [Use Docker and Docker Compose for containers](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/docker-and-compose): Package each service as a Docker image built from a Dockerfile, and describe the local stack in one Compose file. - [Use OpenTofu for infrastructure as code](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/opentofu): Describe all cloud resources in OpenTofu files kept in the repository, and apply them only from CI. - [Use Ubuntu LTS or Debian stable on servers](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/ubuntu-lts-or-debian): Run servers and container base images on a Ubuntu LTS release or Debian stable that is inside its standard security support. - [Use nginx or Caddy as the web server and reverse proxy](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/nginx-or-caddy): Put nginx or Caddy in front of every app server to serve TLS, static files, compression and redirects. - [Use Let's Encrypt for TLS certificates](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/lets-encrypt): Get every public certificate from Let's Encrypt through an ACME client that renews it by itself, such as certbot or Caddy. - [Use a managed DNS and CDN that exports your zone](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/managed-dns-and-cdn): Host DNS and the CDN with a managed provider that exports the zone as a standard zone file, such as Cloudflare. - [Use SOPS for secrets](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/secrets-manager-or-sops): Keep runtime secrets in the repository encrypted with SOPS, and decrypt them only on the server or in CI. - [Use Trivy to scan images and dependencies](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/trivy): Scan every container image, lock file and infrastructure file with Trivy in CI, and pin Trivy itself by image digest or full commit hash. ## Avoid - [Avoid HashiCorp tools under the Business Source License for new work](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/avoid-busl-hashicorp): Do not start new projects on Terraform or Vault releases under the Business Source License. Use OpenTofu and OpenBao, their open source forks. - Previous: [Testing and code quality](https://agentwranglers.se/playbook/stack/testing-and-code-quality) - Next: [Operations tools](https://agentwranglers.se/playbook/stack/operations-tools) - [All chapters](https://agentwranglers.se/playbook/stack)