# Private Instance

> Set up a new private instance (isolated VPC + EKS + ClickHouse + S3) for a customer

- **Type:** Skill
- **Install:** `agentstack add skill-aryansharma28-skills-aryan-private-instance`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Aryansharma28](https://agentstack.voostack.com/s/aryansharma28)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Aryansharma28](https://github.com/Aryansharma28)
- **Source:** https://github.com/Aryansharma28/skills-aryan/tree/main/langwatch/private-instance

## Install

```sh
agentstack add skill-aryansharma28-skills-aryan-private-instance
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Private Instance Setup

> **Full guide:** `infrastructure/docs/private-instance-setup-guide.md`

Use this skill when a new customer needs a private instance (dedicated VPC + EKS cluster + ClickHouse + S3 isolation). Uses the `modules/private-instance` terraform module.

## Prerequisites

1. **Customer organization ID** — query the LangWatch database for the org ID
2. **Customer name** — lowercase, alphanumeric (e.g., `backbase`, `acme`)
3. **Next available VPC CIDR** — must not overlap:
   - `10.0.0.0/16` — main VPC (taken)
   - `10.20.0.0/16` — Backbase (taken)
   - `10.21.0.0/16` — next available

## Process

### Step 1: Create the instance file

Copy `infrastructure/backbase-instance.tf` as a template:

```bash
cp infrastructure/backbase-instance.tf infrastructure/-instance.tf
```

### Step 2: Customize

In the new file, change:

1. **Provider alias** — `"backbase"` → `""`
2. **Module name** — `module "backbase"` → `module ""`
3. **`customer_name`** — `"backbase"` → `""`
4. **`org_id`** — the customer's LangWatch org ID
5. **`vpc_cidr`** — next available CIDR (e.g., `"10.21.0.0/16"`)
6. **`subnet_cidrs`** — matching subnets (e.g., `["10.21.1.0/24", "10.21.2.0/24"]`)
7. **Provider references** — update `kubernetes.backbase` → `kubernetes.` and `module.backbase` → `module.`

### Step 3: Adjust sizing (optional)

The module defaults to 1/4 production. Override via `clickhouse_config`:

| Tier | Instance | CPU | Memory | Hot storage | Est. cost/mo |
|---|---|---|---|---|---|
| 1/4 prod (default) | m8g.large | 0.5/1 | 2Gi/3Gi | 75 GiB | ~$260 |
| 1/2 prod | m8g.xlarge | 1/2 | 4Gi/6Gi | 150 GiB | ~$410 |
| Full prod | m8g.4xlarge | 2/3 | 8Gi/12Gi | 300 GiB | ~$1,230 |

### Step 4: Apply

```bash
cd infrastructure/
terraform init    # Register the new module instance
terraform plan    # Expect ~35 resources
terraform apply   # Takes ~15 minutes (EKS creation is slow)
```

### Step 5: Verify

- [ ] EKS cluster status is ACTIVE
- [ ] Node group status is ACTIVE (nodes joined)
- [ ] VPC peering status is active
- [ ] ClickHouse pods are Running (2 data + 3 keeper)
- [ ] NLB endpoint reachable from main VPC on port 8123
- [ ] K8s secret created in main cluster with routing env vars
- [ ] Test trace routes to private ClickHouse

## Reference Files

| File | Purpose |
|---|---|
| `infrastructure/backbase-instance.tf` | Template to copy for new customers |
| `infrastructure/modules/private-instance/` | Reusable module (VPC + EKS + CH + S3) |
| `infrastructure/modules/clickhouse/` | ClickHouse deployment module (called internally) |
| `infrastructure/docs/private-instance-setup-guide.md` | Full setup guide |
| `infrastructure/docs/backbase-private-dataplane.md` | Backbase architecture docs |

## Teardown

Set `enable_clickhouse = false` in the customer's instance file and run `terraform apply`. To fully remove, delete the instance file. S3 buckets have `prevent_destroy` — remove manually if needed.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Aryansharma28](https://github.com/Aryansharma28)
- **Source:** [Aryansharma28/skills-aryan](https://github.com/Aryansharma28/skills-aryan)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-aryansharma28-skills-aryan-private-instance
- Seller: https://agentstack.voostack.com/s/aryansharma28
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.