Change a fleet. See the change first.
Building blocks and your own scripts, on many VMs at once — with a dry run before anything changes.
Windows baselinerunning · started 12s ago by Jana Weber Cancel
| VM | Disable IPv6 on all adapters | C:\Verlocx\info.txt | Windows Time running + automatic | Firewall HTTPS inbound | Example Root CA | Refresh group policy |
|---|---|---|---|---|---|---|
| web-prod-01 | ||||||
| web-prod-02 | ||||||
| web-prod-03 | ||||||
| app-prod-01 | ||||||
| app-prod-02 | ||||||
| db-prod-01 |
Click a cell for its message and output. changed = something was (or in check mode would be) changed · ok = already as wanted.
Click any cell for its message.
Your own scripts, right between the blocks.
PowerShell, cmd, sh or bash — run in the guest by the agent, output straight into the run.
NameServer baselineSlug (used by VMs / tags)server-baselineDescriptionBaseline for Windows and Linux servers
When the deployment finishes
Header when finishedBaseline appliedSummary card titleBaseline appliedSummary text (**bold** supported)**{{vm.name}}** matches the server baseline.Connect command
1Baseline1 task · 3 steps · 50s
Stage titleBaselineCaption (e.g. “Proxmox · pve-02”) Pause before (s)0
TaskServer baselineKindStep counterIconsettingsDetail (bar tasks) Header while runningServer baseline
StepDisable IPv6 on all adaptersCommand (shown in mono) Seconds10Log lines while running — one per line; “@0.6 text” switches at 60%; tokens {pct} {n:120} {i:14} {item} {item} values — one per line
ActionIPv6 on adapters (Windows)Building block · Windows · agent ≥ 0.0.33
Enable or disable the IPv6 binding (ms_tcpip6) on network adapters.
IPv6DisabledAdapters*Adapter name or wildcard; * = all.
Only when (optional){{deploy.domain}} · {{vm.os_family}} == windowsStep timeout (s)5400Continue on error
StepWindows Time running + automaticCommand (shown in mono) Seconds10Log lines while running — one per line; “@0.6 text” switches at 60%; tokens {pct} {n:120} {i:14} {item} {item} values — one per line
ActionEnsure service (Windows)Building block · Windows · agent ≥ 0.0.33
Bring a Windows service to a state and/or startup type.
Service name *W32Timee.g. W32TimeStateRunningStartup typeAutomatic
Only when (optional){{deploy.domain}} · {{vm.os_family}} == windowsStep timeout (s)5400Continue on error
StepWrite /etc/motdCommand (shown in mono) Seconds30Log lines while running — one per line; “@0.6 text” switches at 60%; tokens {pct} {n:120} {i:14} {item} {item} values — one per line
ActionRun scriptBuilding block · Windows · agent ≥ 0.0.33
Run a script in the guest, stream its output, check the result (exit code / text / JSON).
Shellbash (Linux)Script *want="{{vm.name}} · {{project.name}} · owner {{vm.owner}}"
if [ "$(cat /etc/motd 2>/dev/null)" = "$want" ]; then
echo "VERLOCX_RESULT=ok"
else
printf '%s\n' "$want" > /etc/motd
echo "VERLOCX_NOTE=motd updated"
fiVariables like {{vm.name}} are filled in; {{secret:join}} reaches only the agent.Timeout (s)60Expected exit code0Accept any exit codeOutput must contain Output must not containPermission deniedJSON output must match path=value per line, e.g. Status=Running (output must be JSON, e.g. ConvertTo-Json).Retry until the check passesReboot afterwards
Only when (optional){{vm.os_family}} == linuxStep timeout (s)120Continue on error
The four results
- okAlready as wanted — nothing touched.
- changedWas different, now isn’t.
- skippedNot run — condition, OS or check mode.
- failedThat VM stops here, the others carry on.
Eight building blocks. Each one looks before it touches.
Point at a tile
File systemSystemNetwork & trustWindows guests · other OS: skipped
Also in a workflow — no preview
- SCRRun scriptskipped in check modeCounts as changed unless its output says VERLOCX_RESULT=ok.
- RBTReboot guestskipped in check modeCompletes when the agent is back.
- WAITWait for conditionstill runs in check modeService running, port open, file exists or a script exits 0.
- PAUSEWaitstill runs in check modeA fixed number of seconds.
1FILEEnsure file
module.fileActionEnsure file (Windows)Building block · Windows · agent ≥ 0.0.33
Make sure a file exists with exactly this content (or doesn’t exist).
Path *C:\Verlocx\info.txte.g. C:\Verlocx\info.txtContentName: {{vm.name}}
Owner: {{vm.owner}}EnsurePresent
- Checks
- Reads the file and compares its content exactly — character for character, case-sensitive.
- Changes
- Writes the content as UTF-8 (creating the parent folder if needed), or deletes the file when it should be absent.
reportsokC:\Verlocx\info.txt up to datechangedcreated C:\Verlocx\info.txt
The same workflow on web-prod-03: dry run, real run, check again
web-prod-03 · workflow “Windows baseline” · 6 steps
- 1 · Check (dry run)Windows baseline check mode — nothing was changedcompleted · started 9 min ago by Jana Weber3 changed2 ok1 skipped
VM Disable IPv6 on all adapters C:\Verlocx\info.txt Windows Time running + automatic Firewall HTTPS inbound Example Root CA Refresh group policy web-prod-03 web-prod-03·Refresh group policyagent.scriptskippedSkipped in check mode — only building blocks can preview their changes
- 2 · Run for realWindows baselinecompleted · started 6 min ago by Jana Weber4 changed2 ok
VM Disable IPv6 on all adapters C:\Verlocx\info.txt Windows Time running + automatic Firewall HTTPS inbound Example Root CA Refresh group policy web-prod-03 web-prod-03·Refresh group policyagent.scriptchangedok · exit 0
{"Host":"web-prod-03","W32Time":"Running"} - 3 · Check againWindows baseline check mode — nothing was changedcompleted · started 2 min ago by Jana Weber5 ok1 skipped
VM Disable IPv6 on all adapters C:\Verlocx\info.txt Windows Time running + automatic Firewall HTTPS inbound Example Root CA Refresh group policy web-prod-03 web-prod-03·Refresh group policyagent.scriptskippedSkipped in check mode — only building blocks can preview their changes
The same workflow on one VM, three times. Click a cell to compare.
Five VMs at a time.
When one finishes, the next takes its slot.
5 start at once · 3 wait for a free slot
slot 1
web-prod-01db-prod-01
slot 2
web-prod-02app-prod-02
slot 3
web-prod-03
slot 4
web-prod-04app-prod-03
slot 5
app-prod-01
starttime →
Locked while it runs.
If you switch it on — power, delete and snapshots wait.
| VM ID | Name | OS | Owner | IP | vCPU | RAM | CPU % | ||
|---|---|---|---|---|---|---|---|---|---|
| 1204 | web-prod-02 | Windows Server 2022 | Jana Weber | 10.20.4.48 | 4 | 8 GB | 12% | ||
| 1205 | web-prod-03 | Windows Server 2022 | Jana Weber | 10.20.4.49 | 4 | 8 GB | 64% | ||
| 1206 | web-prod-04 | Windows Server 2022 | Max Becker | 10.20.4.50 | 4 | 8 GB | 7% |
Web•pve-cluster
web-prod-03Running
Windows Server 2022 · pve-cluster · pve-02 · IP 10.20.4.49
OverviewSnapshotsBackupsNetworkFirewallMetricsResourcesManagementStorageActivity
Locked while the configuration “Windows baseline” runs — power, delete, migrate, resources, snapshots and remote commands are unavailable until it finishes.All runs →
Go again in one click.
Pick how the last run ended.
- 1 · Run again ▾Windows baseline check mode — nothing was changedcompleted · started 4 min ago by Jana Weber9 changed21 ok
- 2 · ConfirmRun “Windows baseline” for real?This applies the changes on 6 VMs.CancelRun on 6 VMs
- 3 · StartedRun started on 6 VMsWindows baseline6 VMs · 0s ago
The same 6 VMs, with the workflow’s current version.
Start with a dry run on your own cluster.
Evaluate Verlocx check mode — nothing was changed3 changed
changed = something was (or in check mode would be) changed — nothing is modified until you click.
Related: deployments · the agent · governance