SERVERS
Every host, inventoried and under control.
Add a server with a hostname and an SSH key. Talos discovers what is on it, keeps the inventory current, and records every later change as a tracked job with a named owner.
THE MANUAL WAY
What managing hosts by hand looks like.
THE INHERITED FLEET
Fourteen servers, three of them set up by someone who left. Nobody can say which runtimes are installed, which ports are open, or what would break if you patched one.
THE SHARED KEY
One SSH key in a password manager, pasted into four laptops and two CI configs. Rotating it means finding every copy first, so nobody rotates it.
AFTER THE OUTAGE
Something changed on the box at 02:00. Shell history is per-user, was not captured, and the person who ran it is asleep.
WHAT TALOS DOES
Six things you stop doing over SSH.
Agentless connection
Hostname, port, user, key. Nothing is installed on the target. Talos connects over plain SSH and disconnects when the job ends.
Read-only discovery
OS, kernel, runtimes, open ports, running containers, database engines. It writes nothing to the host, so your first run leaves the host unchanged.
Encrypted key storage
Keys are pasted once and encrypted at rest. They are decrypted in memory for the length of a job and never reach a log line or a job payload.
Ansible playbooks as jobs
Repeatable configuration runs as a tracked job, with the same live output and audit entry as every other action.
Terraform provisioning
Create the host and register it in one flow, with state kept by Talos rather than on somebody’s laptop.
Plan-then-apply reset
Decommissioning shows you the exact list of what will be destroyed, and how each item was identified, before anything runs.
HOW IT RUNS
Every action is a tracked job.
WHAT MAKES THIS DIFFERENT
Decommissioning shows its plan before it acts.
In most tools, a reset runs in one step against whatever the tool decides belongs to the server. Talos splits it in two. First it produces a plan: every database, volume, bench and container it intends to destroy, each annotated with how it was identified. You read that list. Only then does the reset run, and only against exactly what the plan named.
RELATED CAPABILITIES
Point it at one server first.
Discovery is read-only. It will tell you what it found before it changes anything.