Local81 · runbooks for the rest of us

Recipes.

The same operator-grade control plane that pushes to a ten-host fleet works just as well on the chores everyone has — backing up your files, taming your inbox, keeping your machine clean. Every recipe below is a readable template: dry-run-first, journaled, and audited. No agent on anything. No black boxes.

Copy a config · run a plan · prove the run dry-run before anything changes secrets never written to disk
The pantry

Pick a job. Run the line.

Each card is a real, self-contained Local81 template you can drop in and run today. The full files live in the open-source repo under examples/recipes/personal/.

Back up my files to the cloud

Push Documents, Photos & Desktop to Google Drive, Dropbox, or S3 on a 3-2-1 plan — resumable, never destructive, fully previewed first.

# preview exactly what would move — change nothing
local81 --profile cloud-backup plan --summary
local81 --profile cloud-backup deploy --latest --dry-run

# back it up, then fan out to your cloud remote
CLOUD_REMOTE=gdrive \
  local81 --profile cloud-backup deploy --latest --execute

local81 --profile cloud-backup history   # every run, on disk
rsync over sshrclone fan-out3-2-1
Honest by design: rclone owns your cloud tokens on the vault host — referenced by name, never written into the config.
🛡

Check my machine for OS, security & virus problems

A read-only morning sweep: pending updates, a CIS-style hardening score, a rootkit check, and a ClamAV virus scan — captured to plain text and a tamper-evident receipt.

# readiness + security posture (read-only)
local81 doctor --fleet
local81 compliance report --scope all   # AC·CM·IA·SC·AU
sudo lynis audit system --quick

# virus scan — report only, never auto-delete
sudo freshclam && clamscan -r -i ~/ /tmp /srv
local81 audit emit --to "$COLLECTOR"  # signed receipt
complianceclamavlynis · rkhunter
Honest by design: Local81 orchestrates the real OS tools and labels which steps are read-only vs. which would change the box.

Flag my important email & brief me daily

Each morning: label what matters, move Urgent mail out of the firehose, archive the noise, and draft a one-page digest of the few things that actually need you.

# preview the moves — labels nothing yet
DRY_RUN=1 local81 --profile inbox-triage \
  deploy --latest --execute

# go live weekday mornings (cron or n8n schedule)
0 7 * * 1-5  local81 --profile inbox-triage \
  deploy --latest --execute
# -> labels Important/Urgent/FYI, drafts the daily brief
gmail apirules + LLMdaily digest
Honest by design: your OAuth token stays in your keychain; every relabel/move is journaled so you can see what moved and why.
🌐

Publish my website or blog

Push a built static site to your host over SSH+rsync. Re-publish is a no-op when nothing changed; drift is detected and only the moved files ship.

# build, then preview the upload
local81 --profile site plan --summary
local81 --profile site deploy --latest --check  # drift?

# ship only what changed, content-addressed by sha256
local81 --profile site deploy --latest --execute
static sitedesired-stateno-op safe
💾

Back up my database, on schedule

Safe, planned backups for PostgreSQL, Oracle, or SQLite — readiness-checked first, with the dump shipped offsite by the same backup recipe above.

# prove the DB is reachable & healthy
local81 db doctor

# plan a backup (dump tool chosen per engine), then run it
local81 db backup --plan
local81 db backup --execute   # pg_basebackup / expdp / .backup
postgres 17oracle 19csqlite

Prove my backups actually restore

A backup you have never restored is a rumor. This recipe pulls the latest copy to a scratch host, restores it, and runs a health probe — then files the proof.

# pull latest backup to a throwaway target & restore
local81 --profile restore-drill deploy --latest --execute

# verify it came back, then prove you tested it
local81 --profile restore-drill status
local81 audit verify   # the drill is in the ledger
3-2-1health probeaudited
Anatomy of a recipe

One readable file. Four honest steps.

🌴

1 · Configure

Edit one operator-readable config.ini or runbook — your paths, your targets. No DSL, no daemon.

📝

2 · Plan & dry-run

plan then deploy --dry-run show every step before a single byte moves.

🔨

3 · Execute

--execute runs the line, backing up anything it would overwrite and journaling the result.

4 · Prove it

audit verify recomputes the hash-chained ledger; emit files a signed receipt.

★ Veteran-built

Your chores, union-made.

Grab the templates from the open-source repo, or tell us the job and we will write the recipe. Construimus, Batuimus.