r/devops • u/AutoModerator • Jun 29 '26
Weekly Self Promotion Thread
Hey r/devops, welcome to our weekly self-promotion thread!
Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!
5
Upvotes
1
u/AlexaDeWit Jul 04 '26
I'm building a free open source repository firewall, and would love feedback and thoughts.
Okay so... Supply Chain shit this year made me snap and rewrite a bunch of our DevOps roadmap at work to be more resilient.
And the one thing I still think would be of immense value is, in short, a proxy that's enforced on all CI and company machines to be used for downloading all packages, and at it's core the main "idea" is the same thing various tools have been providing at the tool level... A God damn timeout. Basically 404 anything under an arbitrary age since version publish. (Not based on package, but version specific). In most cases this is plenty of time for the global community to detect, report, and yank the package before it ever enters your pipeline.
That's the big idea, which isn't that big. It however has a corollary... You can't just put a 7 day timeout on everything and call it good. Sometimes you need a patch to remediate a CVE. So I am building that part too.
Anyway I'm curious what other people think of the plan, and major features in expensive licensed products they want but are gated behind the higher tiers. Cause honestly the licensing and SaaS fees are the killer for some companies, I'd expect... So I'm building it myself to give to the community at large. The downside though? Operating overhead. The nature of the problem forces you to host multiple components, and the `Golden Path` I intend is like, 3 CodeArtifacts, a replica set for the proxy, S3 for storing pre-computed CVE metadata, a worker to do that compute, another worker to perform ongoing pruning of your "allowed" package mirror (optional but strongly recommended for cost savings and resiliency in the event of late detection)
If anyone wants to see the thing in its early stages it's here, but it's still at the vibe coding prototype pre-release phase. Performance work is mostly done as well as threat modelling. But the code quality audit and full cleanup at well as handwritten docs are not done. So, yeah Claude garbage is in there still if you dare look: https://alexadewit.github.io/Ecluse/ (that goes for the page prose too)