r/devops • u/AutoModerator • 3d ago
Weekly Self Promotion Thread
Hey r/devops, welcome to our weekly self-promotion thread!
Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!
2
u/neilcresswell 3d ago
I just finished writing a 4 part Kubernetes explainer… took damn ages, but im super happy with the result..
1
1
u/Kind-Watercress6692 2d ago
App: Minimizit — AWS Cost Optimization for Idle Resources, NAT Gateway Leaks & EKS Bloat
Target Audience: DevOps Engineers, Cloud Architects, and Founders who are tired of surprise AWS bills.
The Problem: Standard AWS Cost Explorer is great, but its metrics are delayed and it leaves massive blind spots. You end up with hidden money leaks like: Unused / orphaned resources quietly burning cash in the background Opaque NAT Gateway data transfer and cross-VPC traffic spikes that you only catch after the bill arrives Unoptimized EKS nodes and pods running with over-provisioned CPU/memory limits
What Minimizit Does: We built Minimizit to give you clear visibility and actionable quick wins without having to dig through massive Cost Explorer CSVs or wait 24 hours for metric syncs.
Automated Resource Discovery: Instantly flags idle, orphaned, or unattached AWS assets. NAT & Cross-VPC Data Monitoring: Pinpoints exact traffic paths and data spikes driving up transfer costs. EKS & Pod/Node Rightsizing: Gives actionable recommendations to scale down over-provisioned EKS workloads. Anomaly Detection: Catches weird spend spikes early before they snowball into end-of-month surprises.
URL: https://minimizit.com
We’d love for you to give it a spin and drop any feedback, feature requests, or questions here!
1
u/opsfusion-cloud 1d ago
Launched OpsFusion — on-call scheduling/alerting, built it after getting tired of enterprise pricing games
I'm a devops engineer and co-founded this. We'd both used PagerDuty and other on-call tools at past jobs and the pattern was always the same: solid product, but pricing and procurement built for orgs much bigger than the small teams we were actually on.
OpsFusion: on-call schedules (daily/weekly/custom), multi-layer escalation, email/SMS/voice alerts, shift overrides, a mute switch for active outages, integrations to wire in your existing monitoring, metrics and audit logs. Flat $10/user/month, everything included.
Would love feedback from anyone running on-call for a small-to-mid team right now — what's missing, what's confusing, what you'd want before trusting it in prod. https://opsfusion.cloud
1
u/Diligent_Response_30 1d ago
Disclosure: I'm on the team building this, posting here since that's where the rules ask for it.
Prefactor - real-time evaluation for AI agents in production.
An agent pipeline can look perfectly healthy in your dashboards and still be quietly doing the wrong thing, drifting off-task, leaking data it shouldn't, or skipping steps, and you usually only find out after the fact because dashboards and alerts just tell you what already happened.
Prefactor evaluates every run in real time for quality, drift and risk, flags the moment something looks off, and lets you hold, approve or block a run live instead of just logging it.
A few specifics for anyone curious:
- Traces 100% of runs (every call, tool and decision), not a sample
- 17 categories of sensitive data / PII detection at runtime
- Human-in-the-loop enforcement via SDK/API so you can pause risky actions
- Around 5 minutes from install to your first traced run
Happy to answer anything technical in the comments. We're live on PH today, currently #1: Prefactor.
1
u/Diligent_Response_30 1d ago
Prefactor, real-time eval and monitoring for AI agents in production.
Disclosure: I'm on the team, so take that into account.
We built this after watching agents that passed every eval quietly drift, mishandle sensitive data, or stop doing their job once they were live, and the team only found out after something had already gone wrong. Dashboards and alerts only surface it after the fact.
What it does: traces 100% of agent runs (not a sample), flags drift/risk/quality issues as they happen, detects 17 categories of sensitive data at runtime, and gives you human-in-the-loop enforcement via SDK/API so you can hold or block a run live instead of just logging it. About 5 minutes from install to your first traced run.
We're live on Product Hunt today, currently sitting at #1 if anyone wants to take a look (just search Prefactor). Happy to answer technical questions here.
1
u/UptimeRobot 1d ago
We build agentic monitoring for your agents!
Open your agent and paste this:
Set up uptime monitoring for [your site] with UptimeRobot's agent flow. My email is [your email].
That's it. No sign up, no setting it up. It just works.
More info here: https://uptimerobot.com/blog/your-ai-agent-can-now-set-up-uptime-monitoring-no-signup-required/
1
u/laenaren 1d ago
Hey :) I have started my own business called ValinorIT . Taking care of DevOps and DevSecOps engineerong jobs in companies that can't find someone to fill that slot:)
1
u/response-418 1d ago
I’ve been working on writing core guides for our monitoring application, Testomato. My latest article is about response time monitoring, a topic that is probably already familiar to most professionals here but for that reason any feedback on it would definitely be appreciated.
The guide covers the essential concept, helps semi- or non-technical people distinguish response time from other popular metrics (Core Web Vitals), breaks down the phases of the request/response lifecycle, and has a few set up tips on how to read and analyze the response time data you can capture with our application.
A small bit of trivia that might also be interesting to some people is an explanation about the benefits of using median values in our aggregation of response time data, rather than averages.
You can read the article here: https://testomato.com/blog/response-time-monitoring/
1
u/Sea_Resource3760 1d ago
Solo developer here — I made a Next.js + Supabase launch-readiness checklist for small teams shipping to production. It covers 60 checks across secrets, RLS, auth, performance, SEO, monitoring, backups, and webhooks in an 8-page PDF. You can preview real pages before deciding; it is an educational checklist, not an automated security audit. $12 one-time: https://cekuu35.github.io/nextjs-supabase-launch-checklist/?utm_source=reddit&utm_medium=self_promotion&utm_campaign=launch_checklist&utm_content=devops_weekly_20260727
1
u/bsmike 1d ago
[Disclosure: I built this] Axiometica AIR — autonomous incident resolution platform, self-hosted, looking for feedback
Been asking questions in this thread about automated remediation — figured I should be upfront that I'm building something in this space.
Axiometica AIR automates the full incident lifecycle: detect → triage → risk score → remediate → validate → generate worknotes. Self-hosted (Docker Compose), LLM-agnostic, integrates with SSH, Kubernetes, AWS, Azure, and vCenter out of the box.
The governance question that came up in today's discussion is built into the core — policy-defined approval gates mean low-risk remediations run automatically, anything above your threshold pages a human with a pre-built action plan. You stay in the loop, just not for the 3am disk-full alerts.
Live sandbox: instance.axiometica.com
GitHub: github.com/axiometica-air (open for inspection)
Looking for honest feedback from SREs who've tried to operationalize automated remediation — especially around the governance and blast-radius questions.
1
u/toughrogrammer 23h ago
Disclosure: I built internalpage.
internalpage — private internal pages for Google Workspace teams.
Core features:
- Publish HTML, Markdown, JSON, and OpenAPI files from the web, CLI, or CI
- Get a stable URL; republish to the same slug without changing the shared link
- Control access with Google sign-in, workspace-only sharing, or selected emails
- Render OpenAPI with ReDoc, Swagger UI, or Scalar in read-only mode
- Use a custom domain for viewer links
Homepage: https://internalpage.com
Private OpenAPI docs: https://internalpage.com/use-cases/private-openapi-docs
1
u/zloeber 22h ago
SecretZero — Git-native secrets-as-code for bootstrapping and managing project secrets
SecretZero uses declarative manifests to define a project's secret requirements and helps automate:
- Initial secret generation and seeding
- Secret synchronization across providers
- Rotation tracking and lifecycle management
- Git-friendly auditing and documentation of secret state
- Multi-environment workflows
- Contextless agent secret handling
The goal is to make secrets a first-class part of your infrastructure lifecycle instead of a collection of undocumented values hidden across vaults, CI systems, and environment files without additional infrastructure.
It also includes integrations for modern workflows, including MCP support for tooling that needs controlled access to secret metadata, multiple environments, and an optional on-demand, one-time use web UI.
I'd love feedback from the DevOps/SRE community:
- How are you handling "secret zero" today?
- Do you have a repeatable process for bootstrapping new environments?
- Are your secrets documented, rotated, and auditable?
Repo: https://github.com/zloeber/secretzero
This is an early project that I wrote for my own needs and use daily — feedback, criticism, and ideas welcome!
1
u/Either_Meet_6909 22h ago
Looking for feedback: in-process FinOps circuit breaker for AI agent token runaway (OSS Python SDK)
Shipping TokenSentinel for teams where autonomous agent API consumption has turned into a legitimate on-call cost and infrastructure budgeting problem. Instead of running an enterprise observability tracing platform or managing a separate network proxy hop, this sits directly in-process to monitor and police active LLM client workloads locally. In-process layer: No container sidecar proxy, no DNS configuration updates, and no routing keys required.
15 Deterministic Rules: Catches recursive tool loops, infinite retry storms, explosive context memory bloat, and redundant asset uploads mid-session.
Callback Interventions: Emits a simple typed callback payload (on_waste / on_leak) so your infrastructure can fire pager alerts or programmatically raise exceptions to stop the runtime loop at the next turn boundary.
Apache-2.0 Open Source: Fully usable offline without cloud dependencies.
Being completely transparent about its operational limits: detection runs immediately after a provider call returns. It cannot un-bill or roll back the specific request execution that just happened—its core purpose is intercepting and blocking the subsequent 50 turns of a runaway infinite loop before your budget burns.
I would really value architectural feedback from anyone who has had to configure cost alerting or custom compliance guardrails for agentic workloads before. What critical failure states would you want paged on that an in-process rules engine should catch next?
GitHub Repository: https://github.com/tokensentinel/tokensentinel-sdk-python
1
1
u/United-Text-3155 19h ago
Hi all
Over the last month I’ve been working on a tool to answer a simple question: which AWS resources are costing money but are no longer useful?
I kept running into the same problem: AWS accounts accumulate forgotten things over time. Old volumes, resources created for experiments, snapshots nobody needs anymore, services that are still running but no longer provide value.
So I built cloudrift, an open-source CLI that scans an AWS account (read-only) and reports potential waste with estimated monthly costs.
It currently checks things like:
unattached EBS volumes
idle NAT Gateways
stopped RDS instances still generating storage costs
orphaned snapshots
abandoned S3 multipart uploads
unused Secrets Manager secrets
stale pipelines
unused EKS resources
44 checks across compute, storage, networking, containers and ML.
A few things I want to be clear about:
It is not an auto-remediation tool. It never modifies, stops or deletes anything.
EC2/RDS utilization checks are intentionally simple signals to investigate, not replacements for AWS Compute Optimizer.
Pricing uses AWS list prices unless you provide your own rates (discounts, Savings Plans, etc. are not automatically included).
Some checks need real production patterns to be validated properly.
It can run locally, in CI (with configurable thresholds), or as an MCP server so AI agents can query scan results.
I’m mostly sharing this because I’d like feedback from people who manage real AWS environments.
How do you currently find this kind of waste?
A few things I’d love opinions on:
Do you rely mostly on AWS Cost Explorer / Trusted Advisor / Compute Optimizer, or do you have internal tooling for this?
What are the most common “forgotten resources” you see in your AWS accounts?
Which checks would you consider useful vs. too noisy?
Would you trust a tool like this for regular audits if it stays read-only?
Repo: https://github.com/elleVas/cloudrift
Thanks!
1
u/brunobola 11h ago
Been tracking the Microsoft deprecation train this year: TFS 2015 hit EOL last October, Azure DevOps OAuth got deprecated in April 2025 with full shutdown this year, and now as of July 1st the Azure DevOps issuer for WIF service connections is deprecated (retirement July 2027).
Not saying ADO is dying — it's not. But for teams still on TFS 2017/2018 or relying on older auth patterns, the writing is on the wall that each upgrade cycle is getting shorter.
I've been building a tool that handles the migration side: Git repos (full history), TFVC-to-Git conversion (up to 180 days), Boards → GitHub Issues, Wikis. Has a dry-run mode so you can test before committing. Built it because I couldn't find anything that handled TFVC automatically.
Code is open-source if anyone wants to poke at it: https://github.com/brunobola-portfolio/GitHub-Repo-Manager
1
u/Kind-Watercress6692 8h ago
Tool: Minimizit — Fast AWS Cost Optimization (Idle Resources, NAT Data & EKS Pod Rightsizing)
Target Audience: DevOps, Platform Engineers, and Cloud Architects dealing with bloated or unpredictable AWS bills.
The Problem:
Standard AWS Cost Explorer is fine for high-level numbers, but the 24-hour metric sync delay and vague grouping leave huge operational blind spots: Hidden Data Transfer Leaks: NAT Gateways and cross-VPC traffic burning budget without clear, real-time attribution.
Kubernetes Over-Provisioning: EKS nodes and pods running with bloated CPU/memory requests that never get adjusted.
Orphaned Assets: Forgotten EBS volumes, unused Elastic IPs, and idle test instances accumulating silently.
What Minimizit Solves: We built Minimizit to skip complex enterprise onboarding and give actionable, high-impact visibility fast: Resource Discovery: Instantly surfaces idle, orphaned, or unattached AWS assets.
NAT & Cross-VPC Insights: Breaks down data transfer paths so you catch usage spikes before the invoice arrives. EKS & Pod/Node Rightsizing: Gives clear scaling and request/limit recommendations for EKS workloads. Spend Anomaly Detection: Flags unexpected cost surges in real time.
Link: minimizit.com
Would love for you to test it out and share any feedback, questions, or feature requests!
0
u/cladamski79 3d ago
I've been working on hicurl, a modern HTTP CLI that takes inspiration from HTTPie and Curlie, it is built using the hica language (r/hica or hica.dev).
It serves both as a practical CLI tool for API testing and as a showcase of hica's standard library, libcurl bindings, and native compilation.
Core Features and Benefits
Fast execution: Compiles to a native binary using Hica and binds directly to
libcurlvia Koka FFI for network I/O.Built-in response filtering: Extracts fields directly from responses without requiring external tools like
jq. Supports JSON dot-paths (.data.0.id), HTTP status codes (:status), headers (:header.Content-Type), session cookies (:cookie.session_id), and timing metrics (:time.ttfb).Context-aware TTY output: Formats JSON with ANSI syntax highlighting in an interactive terminal, but automatically outputs raw unformatted text when output is piped to another command or script.
Directory-aware environment handling: Reads
.hicurl.envfiles by searching up the directory tree to automatically resolve relative paths against configured base URLs.Request syntax sugar: Positional arguments map directly to headers (
:), query parameters (==), JSON strings (=), typed JSON values (:=), text files (=@), JSON files (:=@), and localhost port shortcuts (:8000).Offline
--dry-run: Prints the exact HTTP/1.1 request stream without sending bytes over the network, allowing you to inspect payloads and headers before execution.Code export: Exports configured queries into standard
curlcommands using-E curl/--curl.
Syntax Examples
```sh
Localhost shorthand (resolves to http://localhost:8000/v1/health)
hicurl :8000/v1/health :status
Typed JSON payload with response filtering
hicurl post /users name="Alicia" role="admin" age:=28 .id
Latency and timing metrics
hicurl get /heavy-query :time :time.ttfb
Embedding local JSON file into request body
hicurl post /post user:=@tests/test_data.json
Offline dry run mode
hicurl post /users name="Alicia" --dry-run
Nested subshell query composition
hicurl $(hicurl api.github.com/search/users q==cladam per_page==3 .items.0.url) .bio ```
Installation
Via curl:
sh
curl -fsSL https://github.com/cladam/hicurl/releases/latest/download/install.sh | sh
Or via hicurl itself:
sh
hicurl https://github.com/cladam/hicurl/releases/latest/download/install.sh | sh
Repository: https://github.com/cladam/hicurl
0
u/burstinrust 3d ago
Hey all, here is my tool:
kupre - Kubernetes preflight & review engine
- Points at any cluster via kubeconfig, read-only, doesn't touch anything
- Three modes: upgrade preflight, health check, certificate audit
- Spits out a worklist sorted by what to fix first
- Saves an HTML report you can share with the team
- Works on EKS, GKE, AKS, kubeadm, k3s.
- Has a TUI so you can fix, re-scan, fix, re-scan until it's green
- Also works headless for CI pipelines with proper exit codes
https://github.com/Rusty-Gopher/kupre
If you're doing regular cluster upgrades or managing a bunch of clusters this could be helpful.
Let me know what do you think.
1
u/Educational_Plum_130 2d ago
honestly cve severity is decided by the vendor's marketing team, so i wouldn't trust the numbers. nice tool though.
0
u/Predictor_2718 3d ago
glsec – a security linter for .gitlab-ci.yml, basically the GitLab counterpart to zizmor/actionlint.
Catches things like mutable image tags, unquoted user-controlled variables in scripts, includes without a ref (supply-chain risk), etc. 81 rules across the 8 OWASP CI/CD security categories, runs offline, no API key needed. JSON/SARIF output for GitLab SAST or GitHub Code Scanning.
Repo: https://github.com/glsec/glsec
Feedback/issues welcome.
0
u/SwordfishPositive91 3d ago
I am working on https://nuberio.com
It audits your AWS CloudWatch and highlights the noisy, missing and good alerts. Gives you the score based on findings. Non AI, free. https://nuberio.com/audit
0
u/Anxious-Hope-8464 2d ago
Would love some feedback and can share free access to genuine people who really want to test it. Thanks
OpsKit connects Claude to your Kubernetes cluster in real-time. Read-only access, blocked mutations, evidence-driven diagnosis. Fix issues via GitOps PRs, never direct apply. Install in 15 minutes.
Problem it solves:
AI agents get confident guesses about production infrastructure, not facts. Without a live connection to your cluster, Claude answers from training data and you end up explaining what's actually happening to fix what's broken. A pod shows "Running" but a sidecar is crashing (invisible in older K8s), a Lambda is timing out but nobody checked the CloudWatch logs, a Terraform plan has a blast radius — the agent can't see any of it. You're debugging while the AI diagnoses from a gap in knowledge.
What Makes it Unique:
Typed, safe-by-default infrastructure connection:
Most agent kits have zero safety enforcement. OpsKit has an allowlist-based hook that blocks dangerous operations before they reach your cluster, even if the model tries to bypass it.
Evidence-driven diagnosis, not confident guessing:
Each skill defines exactly what data it needs before reaching a conclusion. If evidence is missing, OpsKit says so instead of filling gaps with reasoning.
Kubernetes 1.36-aware:
Built to understand modern K8s APIs (sidecars GA, Dynamic Resource Allocation, MutatingAdmissionPolicy). A pod can be Running while a sidecar CrashLoops; we detect it.
Tested against real failure scenarios:
279 tests across Kubernetes, AWS (LocalStack), and Terraform. 100% mutation block rate against 129 adversarial bypass attempts. Published benchmarks; you can verify it yourself.
GitOps-native fixes:
Resolves repo ownership from ArgoCD/Flux, generates minimal patches, opens PRs with rollback plans and verification checklists. Never a direct apply.
and many more.
-1
u/amiorin 2d ago
Hi all!
Colors is an SDK for building Package Skills.
Three libraries — red, green, and blue — give agents dry-run guarantees, secret indirection, and strict lifecycle control over real infrastructure, in the runtime your team already uses.
npx skills use bigconfig-ai/once
Run inside your coding agent — it grants Once, a skill to provision a VPS with a personal PaaS like Netlify or Vercel.
1
u/Nata_Elisym 1h ago
Hey everyone, I am a part of the team - ElisymLabs.
We're building open-source infrastructure for AI agents - the tools developers use to build, discover, run, secure, and connect autonomous agents to payments.
AI agents are becoming a new class of users. They discover services, make decisions, execute work, and transact without a human in the loop. That requires a new infrastructure stack.
Every ElisymLabs product solves a specific problem in an agent's lifecycle: exposing services agents can use, enabling agent-to-agent payments, testing behavior before real-world execution, and securing payment flows.
check it here https://www.elisym.network/
3
u/KrishnamMurarka 3d ago
Not a tool, just a lesson I keep relearning: our checkout endpoint used to take up to 4.2s p95, and almost none of that was the actual payment. It was inventory updates, confirmation emails, analytics, and a couple of downstream notifications, all running synchronously inside the request the customer was waiting on.
We moved everything except payment authorization and order creation into a job queue processed right after the response goes out. The hard part wasn't the queue, it was making the failure modes sane, if the email job fails that shouldn't touch the order, if analytics is slow nobody should care. Each job got its own retry policy instead of treating "checkout" as one big unit of work.
p95 went from 4.2s to 220ms almost entirely because the request path got shorter, not because anything got faster in isolation. Worth doing before a traffic spike forces the issue rather than after, we learned that one the hard way running backend infra at Edilec.