Low-hanging fruit that **fit the symmetry aesthetic** and **cost ≤ 1 extra binary / 1 config file each**:

## 🧩 **Core Services (≤ 1 binary / ≤ 1 file)**

| # | Service | One-line install | Single-file config snippet |
|---|---------|------------------|----------------------------|
| 1 | **NTP + PTP** | `apt install chrony` | `/etc/chrony/chrony.conf` ➜ `allow 10.0.0.0/16` |
| 2 | **Central syslog** | `apt install rsyslog` | `/etc/rsyslog.d/10-remote.conf` ➜ `*.* @@ns.infra.mycorp.net:514` |
| 3 | **mDNS repeater** | `apt install avahi-daemon` | `/etc/avahi/avahi-daemon.conf` ➜ `enable-reflector=yes` |
| 4 | **TFTP / PXE** | *(none)* | `/etc/dnsmasq.d/30-pxe.conf` ➜ `dhcp-option=66,10.0.255.1` |
| 5 | **WireGuard hub** | `apt install wireguard` | `/etc/wireguard/wg0.conf` *(single key pair)* |
| 6 | **Prometheus exporter** | `apt install prometheus-node-exporter` | *(none)* |
| 7 | **ZTP for switches** | *(reuse TFTP)* | `/etc/dnsmasq.d/40-ztp.conf` ➜ `dhcp-match=set:ztp,…` |
| 8 | **Split-horizon DNS** | `apt install unbound` | `/etc/unbound/unbound.conf.d/20-split.conf` |
| 9 | **APT cache** | `apt install apt-cacher-ng` | `/etc/apt-cacher-ng/zzz-custom.conf` ➜ `PassThroughPattern: .*` |
|10 | **NetBox inventory** | `docker run -d -p 8000:8080 netboxcommunity/netbox` | *(container = config)* |
|11 | **Git-ops configs** | `apt install etckeeper` | `/etc/etckeeper/etckeeper.conf` |
|12 | **802.1X wired auth** | `apt install hostapd` | `/etc/hostapd/wired.conf` |
|13 | **Firmware mirror** | `apt install rsync` | systemd timer drop-in |
|14 | **Internal pastebin** | `docker run -d -p 7777:7777 haste-server` | *(container = config)* |
|15 | **Internal ACME CA** | `step ca init …` | `/etc/step-ca/config/ca.json` |
|16 | **Phone VLAN via DHCP opt 43** | *(none)* | `/etc/dnsmasq.d/50-voip.conf` |
|17 | **Tiny IPAM (phpipam)** | `docker run … phpipam` | nginx location block |
|18 | **DNS sinkhole** | `curl -sSL https://install.pi-hole.net | bash` | `/etc/pihole/setupVars.conf` |

---

1. NTP + PTP (time symmetry)  
   ```
   apt install chrony
   echo "allow 10.0.0.0/16" >> /etc/chrony/chrony.conf
   systemctl enable --now chrony
   ```
   Clients in every subnet now get the *same* stratum-1 time source (`ns.infra.mycorp.net`).

2. Central syslog + logrotate (single pane)  
   ```
   apt install rsyslog
   echo '*.info @@ns.infra.mycorp.net:514' >> /etc/rsyslog.d/10-remote.conf
   systemctl restart rsyslog
   ```
   One file, logs flow to the host itself—no extra daemons.

3. mDNS repeater (Bonjour across VLANs)  
   ```
   apt install avahi-daemon avahi-utils
   sed -i 's/#enable-reflector=no/enable-reflector=yes/' /etc/avahi/avahi-daemon.conf
   systemctl enable --now avahi-daemon
   ```
   Ensures `printer-01.lan.mycorp.net` is discoverable from `dmz.mycorp.net`.

4. TFTP/PXE “boot farm” (one-line DHCP option)  
   Add to `/etc/dnsmasq.d/30-pxe.conf`:
   ```
   dhcp-option=66,10.0.255.1   # TFTP server
   dhcp-option=67,pxelinux.0
   ```
   Net-install any OS from the same box.

5. WireGuard hub (one interface, one key pair)  
   ```
   apt install wireguard
   wg genkey | tee /etc/wireguard/wg0.key | wg pubkey > /etc/wireguard/wg0.pub
   ```
   Tunnel address: `10.254.0.0/24` (mirrors `10.0.x.0/24` pattern).  
   Add peer configs via a **single** `/etc/wireguard/wg0.conf`.

6. Prometheus node exporter (metrics symmetry)  
   ```
   apt install prometheus-node-exporter
   systemctl enable --now prometheus-node-exporter
   ```
   Metrics reachable at `http://ns.infra.mycorp.net:9100/metrics`.

Below is a **lightweight, copy-paste-ready** cheat-sheet that keeps the **cost ≤ 1 extra binary *or* 1 extra config file** rule.  
Everything is grouped by *single-line install* and *single-file config* so you can mix-and-match as your “infra-core” grows.

---

## 🛠️ **Drop-in snippets**

```bash
# 1-liner to add any snippet above
sudo curl -fsSL https://gist.githubusercontent.com/you/abc123/raw/add-chrony.sh | bash
```

All snippets follow the **same directory layout** so you can commit the entire `/etc/infra.d/*.conf` tree to Git (via etckeeper) and roll back with `git checkout`.

---

### 19. **Real-time structural-monitoring MQTT bus**  
**Binary:** `apt install mosquitto`  
**Config:** `/etc/mosquitto/conf.d/10-bridge.conf`  
```
connection ns
address ns.infra.mycorp.net
topic # both 0
```
Attach cheap ESP32-based vibration sensors to any bridge/rack; data is instantly bridged to the central broker for Grafana alerts with zero custom code .

---

### 20. **NetBird overlay network (Zero-config VPN mesh)**  
**Binary:**  
```
curl -fsSL https://get.netbird.io/install.sh | sh
```  
**Config:** `/etc/netbird/config.json` (auto-generated on `netbird up --setup-key …`)  
Gives every node a stable 100.64.0.0/10 address and WireGuard-grade crypto without managing keys or firewall rules.

---

### 21. **Single-binary DERP map for Tailscale / Headscale**  
**Binary:** none (built into `tailscale`)  
**Config:** `/etc/headscale/derp.yaml`  
```
regions:
  900:
    regionid: 900
    regioncode: "infra"
    nodes:
      - name: ns
        regionid: 900
        ipv4: 10.0.255.1
```
Provides an internal relay when direct WireGuard hole-punch fails.

---

### 22. **OSQuery fleet launcher**  
**Binary:** `apt install osquery`  
**Config:** `/etc/osquery/osquery.conf` (single JSON file)  
```
{
  "schedule": {
    "listen_ports": {"query": "select * from listening_ports;", "interval": 300}
  }
}
```
Ship logs to the central syslog server already running on `ns.infra.mycorp.net`.

---

### 23. **Immutable firmware OSTree mirror**  
**Binary:** `apt install ostree`  
**Config:** systemd timer drop-in `/etc/systemd/system/ostree-mirror.timer`  
```
[Timer]
OnCalendar=Sat 02:00
```
Keeps a versioned `/srv/ostree` mirror of Fedora CoreOS / Ubuntu Core images for zero-touch edge rollbacks.

---

### 24. **Kuma / Uptime-Kuma “infra pulse”**  
**Binary:** `docker run -d -p 3001:3001 louislam/uptime-kuma`  
**Config:** web UI export → `/srv/kuma/config.json` (one click restore)  
Monitors internal DNS, WireGuard gateways, and PXE endpoints from the same box.

---

### 25. **Local LLM “help-desk” API**  
**Binary:**  
```
docker run -d -p 8000:8000 --name ollama ollama/ollama
docker exec ollama ollama pull llama3.2
```  
**Config:** single API call to `http://ns.infra.mycorp.net:8000/api/generate` gives chat-ops answers about your internal infra docs.

---

### 26. **SBOM & vuln-scanning pipeline**  
**Binary:** `apt install syft grype`  
**Config:** nightly systemd service `/etc/systemd/system/sbom-scan.service`  
```
[Service]
Type=oneshot
ExecStart=/usr/bin/syft /var/lib/docker -o json | /usr/bin/grype
```
Results land in the same syslog endpoint.

---

### 27. **Geo-replicated S3-compatible “cold” storage**  
**Binary:** `docker run -d -p 9000:9000 -p 9001:9001 minio/minio server /data --console-address ":9001"`  
**Config:** single env file `/etc/default/minio`  
```
MINIO_ROOT_USER=admin
MINIO_ROOT_PASSWORD=infraPass
```
Mount `/srv/backup` for immutable backups of WireGuard keys, NetBox DB, etc.

---

### 28. **AI-driven energy-optimiser for server racks**  
**Binary:** `apt install influxdb2 telegraf`  
**Config:** `/etc/telegraf/telegraf.conf` (one input + one output)  
```
[[inputs.ipmi_sensor]]
[[outputs.influxdb_v2]]
  urls = ["http://ns.infra.mycorp.net:8086"]
```
Grafana AI plugin suggests fan-curve tweaks that cut power 8–12 % .

---

### 29. **Single-sign-on portal (SSO)**  
**Binary:** `docker run -d -p 9000:9000 authelia/authelia`  
**Config:** `/config/configuration.yml` (single YAML) gives LDAP-less 2-factor auth in front of NetBox, Uptime-Kuma, phpIPAM, etc.

---

### 30. **Satellite imagery coastal-watch cron**  
**Binary:** `apt install aws-cli`  
**Config:** `/etc/systemd/system/coastal-watch.service`  
```
[Service]
Type=oneshot
ExecStart=aws s3 sync s3://sentinel-s2-l2a /srv/sat --no-sign-request --include "*T10*/*B02.jp2"
```
Feed into the same MQTT bus (#19) for AI flood-risk scoring .

---