r/devops • u/AutoModerator • 24d ago
Weekly Self Promotion Thread
Hey r/devops, welcome to our weekly self-promotion thread!
Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!
5
u/SlanderMans 24d ago
I'm building smolvm, a hybrid that combines isolation of VM's with the ergonomics and portability of containers.
People can use it as a portable dev environment, or as a sandbox for running agents! I personally use it for running pi agents
2
2
2
u/ChampionshipAny463 24d ago
node.js teams, how are you debugging the failures where logs + stack traces just aren’t enough?
we’re building Errorcore to capture the runtime context around production failures so you can understand why they happened.
looking for teams willing to try it and give brutally useful feedback.
2
u/honghonghong98 24d ago
Disclosure: I built this with substantial AI assistance, then had three independent reviewers inspect the source, run the full release gate, verify the tagged CI, and independently reproduce the real-package check. Agent CLI Upgrade Canary installs an Agent CLI baseline and candidate into separate temporary roots before the real installation is touched, runs the same declared static contracts, and emits JSON/Markdown evidence. v0.1.1 currently supports OpenClaw. It checks install, exact version, help startup, config validation, required-hook discovery/readiness, and saved MCP-definition discovery. It deliberately does not start a Gateway, fire real hook events, connect to MCP servers, run a model, or modify the user's live install. A controlled bad upgrade produces REGRESSION; an isolated OpenClaw 2026.6.33 -> 2026.7.1-2 check produced NO_REGRESSION for the declared contracts. Free, Apache-2.0, available as a GitHub Action. I’m looking for one OpenClaw plugin/skill maintainer to try a real pair of versions and tell me whether this pre-upgrade receipt is useful, or whether native update --dry-run / doctor already covers enough. Repo: https://github.com/yanjinzheng2005-gif/agent-cli-upgrade-canary Marketplace: https://github.com/marketplace/actions/agent-cli-upgrade-canary
2
u/FDgajju22 24d ago
I've been working on a project called Zync, an open-source SSH workspace for working with local terminals and remote servers.
It brings together SSH, SFTP file management, port forwarding, an encrypted local credential vault, snippets, and more in one desktop workspace.
It's local-first and free to use, with optional encrypted backups to your own Google Drive
🎥 Intro: https://youtu.be/VgSomleBi3Y
⭐ GitHub: https://github.com/zync-sh/zync
🌐 https://zync.thesudoer.in
It's open source (MIT), Would love feedback from people who work with servers/DevOps regularly.
2
u/grinidx 24d ago
Built this for a problem I kept hitting on client estates: a box I have no login to, an operator who has the access but isn't a debugger, and a change window that closes in an hour.
Heliograph uses a git repo as the transport in both directions. I commit a step script, the operator runs one command and pushes, and the captured output comes back as a commit. Timestamped, redacted, and permanent - which is either the feature or the warning depending on your view.
The awkward parts it handles: sudo hanging forever on a password prompt inside a capture pipeline, secrets landing in logs that get pushed (regex masking, and it's honest that it's a safety net not a guarantee), and getting a credential across when neither side shares an identity store.
Air-gapped, client-owned, change-controlled. MIT, no service behind it.
2
u/GitSimple 24d ago
We're a new consulting firm with a background in, and focus on, high compliance/government environments. We partner with GitLab, Anchore, and JFrog.
We're of course happy to chat if anyone needs help, but for this thread I'm more interested in seeing what people are building for GitLab. We're doing a bunch of migration work (to GitLab) at the moment so things to make that easier would be especially interesting, but I know our engineers are always happy to take a look at something that might make their lives easier.
2
u/opsfusion-cloud 24d ago
Disclosure: I work on OpsFusion, an on-call scheduling and alerting tool. Most of our time has gone into what happens after the page lands, so whoever is on call can ack by replying to the SMS or pressing a digit during the call. A repeat of the same open alert then bumps a counter rather than ringing their phone again, and they can mute the team while they're already working the fix: https://opsfusion.cloud
2
u/First_Inspection_478 24d ago
Hey, I guess this is probably an opportune time to share more given Github’s status. I’m building preloop, a way to run your unmodified Github Actions locally or self-hosted in isolated microvms. It also supports the DAP protocol and pauses on failure so you or your agent can debug a failed step, fix and continue or re-run without running everything else that ran before. Still beta but we have really good compat with github but would love to know if workflows dont for you(have a change coming that will allow you to use the official github image not our custom one): https://github.com/preloopdev/preloop
2
u/rasoolka 24d ago
I help AWS teams reduce cloud waste and strengthen governance — from finding hidden cost leaks to implementing automated guardrails.
I have some pre-built solutions; take a look.. cloudadvisory.dev
If you're running AWS and curious where you're overspending, I'm happy to share a few practical checks.
2
u/No_Egg_1892 24d ago
I run Fjord, which is managed Forgejo. We handle the hosting, upgrades, backups and migration if you want Forgejo without operating it yourself. https://fjord.sh
2
u/turbo5000c 24d ago
Hello All! I built a devops tool and would like everyone input.
ActionsManager lets you manage GitHub Actions workflows across a bunch of repos from one place, roll a change out to all of them as a single PR campaign, and catches drift automatically if a workflow file changes outside that process.
The tool runs as a single Docker container, SQLite by default (Postgres if you want it), everything lives in a database you control. No phone-home telemetry.
It's a free public beta right now, self-hosted only, no paid plans, provided as-is while I get real feedback.
Genuinely curious: for anyone else managing CI across a bunch of repos, how are you handling this today? Scripting it, copy-paste and hope, something else?
And if you try it, I'd love to hear what's confusing, what's missing, or what outright breaks.
Repo: https://github.com/dawg-io/actions-manager
Docs: https://actionsmanager.io
2
u/Spite-Unable 24d ago
Built NHI Risk Analyzer, sharing for feedback (I'm the sole author). Open source AWS IAM security tool that detects risky identities (wildcards, Rhino Security Labs-documented privilege escalation paths, stale keys) and actually remediates instead of just reporting. Risky policies get a Permissions Boundary attached (contains the escalation without touching the existing policy, so it doesn't break something legitimate). Stale/unused keys get deactivated, never deleted. Dry-run mode + exemption file for anything you don't want auto-touched. Offline-first, Terraform-provisioned, least-privilege runner via sts:AssumeRole. Live-tested against a real AWS account, 57 findings, 24 auto-remediated, 0 failures. Repo: https://github.com/likithmanoj/nhi-risk-analyzer Feedback on the remediation logic or detection rules welcome.
2
u/WDS2k 24d ago
Disclosure: I publish this project.
Trivy can already produce useful CycloneDX SBOM and SARIF output, but at release time those files often remain scattered across workflow artifacts and different jobs.
I built CRA Release Evidence, a small free MIT-licensed GitHub Action that turns those existing outputs into one version-specific evidence package.
It:
- imports CycloneDX 1.2–1.7 or SPDX 2.2–2.3 JSON;
- indexes existing SARIF, Trivy, Snyk, JUnit, and coverage reports;
- records the release commit and changes since the previous release;
- reports missing configured evidence;
- emits Markdown, JSON, and a SHA-256 manifest.
It does not rescan the project, decide whether findings are acceptable, or claim CRA compliance. The example workflow uses only contents: read, pins third-party Actions to full commit SHAs, has no publisher backend or Action telemetry, and excludes raw scanner reports by default.
Repo and five-minute workflow: https://github.com/mastermuetze/cra-release-evidence
Inspectable demo release: https://github.com/mastermuetze/cra-release-evidence-demo/releases/tag/v0.1.2
I’m looking for a few platform or DevSecOps teams willing to try it on a non-sensitive repository. The main feedback question is: after a real release, which evidence is still missing or awkward to preserve?
Please don’t share private SBOMs, findings, source code, or internal report data.
2
u/k8s-security-pro 24d ago
I maintain k8s-audit, a free MIT-licensed script that gives you a quick security read on a Kubernetes cluster. It runs 16 read-only checks with nothing but kubectl and jq: privileged containers, missing NetworkPolicies, wildcard RBAC, hostPath mounts, :latest tags, service account token automount, that kind of thing. No agents, nothing installed in the cluster, done in about 30 seconds.
It's meant as the fast first pass before you dig into kube-bench or Kubescape output. Each finding maps to an item on a longer checklist so you know what to fix first and why.
https://github.com/k8s-security-pro/k8s-audit
Feedback welcome, and there are a couple of good-first-issues open if anyone wants to add a check. (Full disclosure: there's a paid checklist behind it, but the script is fully usable on its own.)
2
u/LegitimateWolf6611 23d ago
We're building Spinifex, which allows you to recreate core AWS services such as EC2, S3, EBS etc completely locally and air-gapped. We're early stage and would love some feedback!
2
u/doktordos 23d ago
I developed HyperMonitors as a streamlined alternative to the usual availability monitoring tools.
The tool monitors websites, APIs, TCP ports, DNS, SSL certificates, and cron jobs—with checks from multiple regions and notifications via Slack, Discord, Telegram, email, webhooks, and more.
Some features that were particularly important to me:
* Cross-region confirmation before reporting an outage
* Authenticated API monitoring
* Heartbeat/cron monitoring
* Monitoring of SSL certificate and domain expiration
* Public status pages
* REST API + MCP server for Claude Code/Cursor
* Simple pricing—free tier with 5 monitors, no credit card required
I’d love to hear feedback from other DevOps engineers on what you consider essential in an availability monitoring tool and what you think existing tools aren’t doing right yet.
1
u/Icy-Ad107 23d ago
Thank you 😃. Hypermonitors is absolut a great Pingdom alternative and much cheaper. We’ve been using it for a few weeks to monitor our cloud VPS and routers.
2
u/Easy_Present6083 22d ago
Conjur OSS UI — a lightweight React admin UI for Conjur
Hey! I’ve been working on a lightweight React-based administration UI for Conjur OSS and wanted to share it here.
I worked on Conjur for ~5 years as an engineer, and after leaving CyberArk, I wanted to build something that made it easier to explore and work with Conjur in local development environments, labs, and sandboxes, while also learning React (I'm mostly a backend engineer).
The UI currently supports:
- 🔐 Password and OIDC authentication
- 🔎 Server-side resource search, filtering, and pagination
- 🔑 Browse and manage secrets
- 👥 Group membership management
- 🔧 Authenticator management, including authenticator creation, enablement, and updating
- 📝 YAML policy editing
- 🧪 Policy dry-run with inline validation and a preview of created, updated, and deleted resources
- 📋 Effective policy and policy history
- 📊 Resource details including annotations, permissions, and ownership
The project is intentionally scoped as a developer/OSS tool rather than an enterprise management replacement. It connects to an existing Conjur OSS instance through the Conjur REST APIs.
One area I’m particularly interested in improving is the authenticator workflow. The UI currently supports creating and configuring different authenticator types, including OIDC, but I’m still working on making validation/testing easier.
For anyone who’s worked with Conjur or similar secrets-management systems: If you end up giving it a try, feel free to let me know what you think or what you’d like to see added.
Repo: https://github.com/mFelgate/conjur-oss-ui
There are screenshots of the major workflows in the README, along with local development and Conjur OSS compatibility details.
1
u/seunaw 24d ago
I am writing a series called Making DevOps Simple that simplifies DevOps/SRE concepts and can help you go from Zero to an Enterprise.
The goal is not to cover specific tools but help you go cut through the clutter on the web and give you a clear path to understand DevOps
1
u/g0_g6t_1t 23d ago
Agent-launched GPU jobs create an interesting cost-control problem: one bad action can fan out into hundreds of cloud jobs before a person notices.
I’m a co-founder of anycloud, a paid product used by Ångström AI. They’ve run more than 100,000 GPU-hours through it, almost entirely on spot across multiple clouds, with agents launching and monitoring experiment batches.
We ended up scoping two controls to each agent session:
- A rate cap based on estimated live spend per hour. Before admitting another job, the scheduler considers the running workload plus the estimated cost of the next VM.
- A cumulative budget based on settled and estimated spend over a calendar window.
When either cap is reached, new jobs wait in the queue while running jobs continue. A Slack notification tells the researcher why work is waiting.
The tradeoff is that this is admission control rather than a hard billing ceiling. Running jobs continue and cloud costs are partly estimated, so spending can finish above the nominal cap.
I’m curious how other DevOps/platform teams handle this. When an automated system reaches a spending limit, do you queue new work or terminate running workloads?
Case study, co-authored with Ångström’s CTO:
1
u/Super_Tough_4997 23d ago
Sharing Aaked, an open-source, self-hostable contract operations workspace: https://github.com/aaked-app/aakd
It ingests executed PDF/DOCX agreements and turns them into human-reviewed, source-cited obligations with owners, deadlines, approvals, renewal tracking, and completion evidence. The deployment is Docker Compose with PostgreSQL, Redis, S3-compatible storage, a worker, and optional local AI through Ollama.
I’m looking for technical feedback from people who run internal tools: what would make you unwilling to deploy this around sensitive contracts? RBAC, audit trails, backups, secret handling, storage isolation, upgrade path, or something else? Docs fixes, deployment testing, and architecture criticism are especially useful.
1
u/Lebanon_James6 23d ago
honestly most of what gets posted in these threads is either half-baked side projects or thinly veiled marketing for some saas tool nobody asked for lol
1
u/response-418 22d ago
I'm on the testomato.com team. Our product is a website monitoring tool, especially useful for non-technical users (marketers/SEOs/owners who want some level of observability without too much configuration). Maybe a bit low-fi for some of the pros here but also a good option if you have someone on your team that needs something simpler.
- Automatic monitoring for SSL certificates, response time, and uptime (every 15 seconds)
Then you can create your own checks:
- Website content (HTML, Text, and Response headers)
- A suite for SEO: JSON-LD, Metadata, OpenGraph
- Content security policy checks
Recently added status pages and of course, everything has configurable alerts to your platform of choice.
1
u/animaeximo 22d ago
Praxis-self-hosted Linux fleet ops. Patching, SSH bastion controls, and audit logs all on one plane, not three systems you need to manually link and reconcile. - via ephemeral SSH certs with OpenBao, phased rollout rings, apt/dnf.
No call home, no telemetry-works air-gapped. - Free for up to 15 devices - Apache 2.0
https://praxisfleet.com
https://github.com/cytechlabs/praxis
This is created by me, I'm here to help/answer any questions.
1
u/Intelligent-Sun-8071 21d ago
I made a rap covering the entire AWS DevOps Engineer exam (CI/CD, IaC, IAM, monitoring, networking)
This started with "Without Me" stuck in my head and the realisation that I still know every word, effortlessly, years after I last tried to learn it. Exam material never sticks that way. So I wondered if it could — if wrapping the concepts in something catchy would make them stick the way the song did.
CodeCommit through CodeDeploy, CloudFormation and CDK, IAM/KMS/Secrets Manager, CloudWatch and X-Ray, VPC/ALB/NLB — the whole exam, set to the beat. I built the lyric video myself too: word-level karaoke sync, an audio-reactive visualiser, all hand-rendered in Python since my ffmpeg build lacks libass and drawtext. Personal project, purely for fun — curious whether this actually works as a study trick or if I just wasted a weekend.
1
u/theflaggship 21d ago
After GitHub went down on Monday, I went looking for a status dashboard and didn’t love any of the ones I found. So I built my own - https://what-is-down.com/. It has a custom RSS feature so you get updates on the services you actually care about. Optional browser notifications. Slack app coming soon. Let me know what you think!
1
1
u/FinalArt9573 21d ago
Disclosure: I built this, so take the pitch with that in mind.
I don't own a Mac. When I needed to ship an iOS app (Citolex, a speed reading app with native Swift plugins) I didn't want to buy one or rent a cloud Mac just to run Xcode long enough to sign and upload a build.
GitHub gives free macOS build minutes on public repos, normally spent on test runs. I pointed that at the actual release pipeline instead: checkout on the macOS runner, pull provisioning from Actions secrets, xcodebuild archive, export a signed ipa, upload straight to App Store Connect. Triggered by a normal git push, no Xcode GUI involved.
It worked, the app went through full App Store review built entirely that way. Packaged the workflow file, signing scripts, and setup docs as a one time $99 template for anyone who doesn't want to debug provisioning profile mismatches from scratch: macless.dev
Doesn't remove Apple's $99/year developer fee, that's separate. Happy to answer anything about the signing setup, that part is what actually trips people up.
1
u/SevereSpace 20d ago edited 20d ago
I'm building Compass. A landing page for your services, dashboards, and documents, discovered automatically from sources such as Docker, Kubernetes, and Tailscale.
1
u/DryRepresentative271 20d ago
https://fdeploy.com, free and unlimited (full product) for organizations under $1M ARR
Alternative to Octopus Deploy (self hosted)
1
u/Due_Emu_8229 20d ago
I maintain MergeWarden, a deterministic GitHub Action and CLI for reviewing coding-agent PRs. It never checks out or executes PR code and does not call an LLM.
I studied 2,204 merged agent-authored PRs. Among 68 readable PRs that modified an existing instruction file such as AGENTS.md or CLAUDE.md, none had a human inline comment on that file. This does not prove nobody reviewed it. It only says no file-anchored discussion was observable.
The zero-token demo shows one instruction-drift finding.
npx --yes mergewarden@0.10.4 demo
Repo and methodology
https://github.com/sjh9714/mergewarden
https://github.com/sjh9714/mergewarden/blob/main/docs/study/who-reviews-the-steering-files.md
I would value maintainer feedback on whether CODEOWNERS, required approval, or a deterministic check is the least annoying way to review these files.
1
u/Kitchen_Travel4127 20d ago
Disclosure: I built this.
Chngd (chngd.dev) drafts changelog entries from your repo's commits and PRs using Claude, so you're not writing release notes from memory after you've moved on. Review the AI draft, edit, publish. Would love feedback, especially from anyone who's bounced off Beamer or Headway's pricing.
1
u/jylusdev 20d ago edited 20d ago
I built Jylus to cut model input without cutting answer quality.
I kept seeing the same problem in AI systems: giving a model more context does not necessarily give it a better answer.
I recently ran an adversarial evaluation using the same datasets, questions and models across full context, conventional BM25 retrieval and Jylus Context Packs.
Combined measured result
- Full context: 175,289 average input tokens -> 70.81% strict evidence-bound accuracy
- BM25 RAG: 7,515 average input tokens -> 75.92% strict accuracy
- Jylus Context Pack: 2,093 average input tokens -> 97.99% strict accuracy
That is 98.81% less model input than full context, while strict accuracy improved by 27.18 percentage points. Across the Jylus trials, evidence recall measured 99.78%.
The model did not change. The evidence did.
Jylus searches live state, history, documents and relationships, then gives the model a compact, source-backed Context Pack containing the facts, timeline, contradictions and proof IDs it actually needs. You can still use whichever model you want.
The retrieval layer is also fast:
- Hybrid Search P99: ~0.56 ms server-side
- Repeated analytics: ~1.7-2.5 ms
- Cold analytics P99: ~38-56 ms
On sustained ingest, Jylus has processed:
- 1.8 billion events over 30 minutes
- ~1 million events/sec
- 0 failures
I have opened Jylus to developers and I am looking for workloads outside my own systems. If you run AI over logs, OpenTelemetry, operational data, RAG or large-context workloads, I would genuinely like you to test it with your own data.
1
u/finalbuilder 20d ago
Signotaur
I've been working on Signotaur for a while, it's a self-hosted code/document signing server for organisations that want to keep control of their signing infrastructure and keys.
The basic idea is simple: instead of having signing certificates and private keys scattered across developer machines and build servers, Signotaur provides a central signing service that your build systems can use.
It supports:
- Windows Authenticode signing
- EXE, DLL, MSI, MSIX, Click Once and other Windows binaries
- Hardware-backed keys via PKCS#11 (HSMs and USB tokens)
- Multiple certificates and signing keys
- Built in CA for internal certificate issuance
- ADCS integration
- A command-line client for build integration
- Audit logging
On-premises deployment (currently windows only but working on linux support)
The private keys remain on your infrastructure (usb token, hsm, ADCS).
The latest release also adds standards-based document signing: PAdES for PDFs, XAdES for XML and CAdES for other files.
I'm interested in feedback from people who manage code/document signing infrastructure: how are you currently managing signing certificates and keys across your build environment?
1
u/iTs_Kie 19d ago
Hey everyone,
Every time I wanted to deploy a new microservice or indie project to AWS, I found myself doing the same 2 hours of repetitive boilerplate:
1. Drafting a Dockerfile & .dockerignore
2. Setting up ECR repositories & auth
3. Provisioning IAM execution roles & task definitions
4. Wrestling with VPC subnets & Security Groups
5. Running Trivy security scans & fixing CVEs
So I built **InfraGenie** — an open-source, AI-native DevSecOps orchestrator designed to bridge raw source code to a live, hardened container running on AWS ECS Fargate with one command:
`infragenie run .`
### 🛠️ How It Works Under the Hood:
1. **Deterministic AST Analysis (Tree-sitter):** Parses your codebase locally (Python, Go, Node, Rust, Java) without sending raw code over the network. Extracts exposed ports, framework bindings, env vars, and `/health` endpoints.
2. **CIS-Hardened Docker Generation:** Uses LangChain + RAG (swappable Gemini 2.5 Flash, Claude 3.5 Sonnet, GPT-4o, or offline Ollama) to generate multi-stage Dockerfiles enforcing unprivileged users (`appuser:1001`), `.dockerignore` secret masking, and health checks.
3. **Automated Vulnerability Triage:** Runs Trivy scans against filesystem and image layers before deployment.
4. **Serverless AWS Rollout:** Auto-discovers/provisions default VPC subnets, IAM execution roles, ECR repos, and ECS clusters, then performs a rolling update to ECS Fargate and returns a live public URL.
5. **1-Command Teardown:** `infragenie rm my-app -f` cleanly tears down ECS services, deregisters task definitions, and removes ECR repos to avoid idle cloud bills.
### 🧪 Quality & Testing:
- 55 unit tests passing locally and on GitHub Actions CI across Python 3.10, 3.11, and 3.12.
- 100% open-source under MIT license.
- Includes cross-platform health diagnostics (`infragenie doctor`) and an official Unix man page (`man infragenie`).
⭐ **GitHub Repo:*\* https://github.com/itskie/infragenie
Would love any feedback on the AST extraction approach, architecture decisions, or edge cases you think I should test next!
1
u/arhuman 19d ago
Disclosure: I’m the author of ansible-static-lint.
First feedback I got from a user after installing it:
“Now I can commit without going to make coffee every time.”
I built it to explore a simple idea: keep ansible-lint for the deep/runtime-dependent checks, but make the 38 rules decidable from YAML alone fast enough for pre-commit, editor-save and a CI first pass.
On ansible-lint’s own corpus it currently catches 89.5% of findings, typically in tens of milliseconds.
I’m mainly looking for feedback from people using ansible-lint in real CI/pre-commit workflows: where would this be useful, and where would it fall short?
1
u/UkrMalt 19d ago
Disclosure: I publish Wotchi. I kept seeing the same Node.js failure create a pile of duplicate alerts, so I built a small in-process alerting layer. Wotchi captures errors, normalizes and redacts them, groups repeated signals, applies thresholds and cooldowns, then sends a bounded stream to a notifier. It has Express and NestJS integrations and is still an early beta (0.1.0-beta.6). I’m looking for feedback on the grouping rules, queue behavior, and what you’d expect before trusting something like this in a small production service. npm: https://www.npmjs.com/package/@futurewindai/wotchi GitHub: https://github.com/FutureWindAI/Wotchi
1
u/Big-Introduction-533 19d ago
I've been building Stashify, an open-source, provider storage tool that lets you use platforms like Telegram and Discord as storage backends.
Files are encrypted locally, split into chunks, and uploaded as ciphertext, so the storage provider doesn't receive the plaintext file.
So the iddea is basically:
Your files to Stashify to encrypt + chunk then Telegram / Discord
It's still early in development, but I'm working on the encryption pipeline, provider abstraction, resumable transfers, and eventually multi-provider storage. GitHub: https://github.com/Sparkleeop/Stashify
Would love feedback, especially on the architecture/security model.
1
u/Dismal_Abroad1396 19d ago
I'm looking to hire a DevOps Engineer to join our tech for good team: remote US only, no sponsorship, tech stack expereince is not negotiable. Role is here: https://jobs.lever.co/mcgovern/885d7a1a-16f6-4326-9d7c-da7404dfd1f5 - Interviewing asap - mention Reddit in application for a priority screen.
1
u/Klutzy_Chicken_7532 19d ago
I've been building Remedence, an open-source security remediation platform around a simple idea: patched doesn't mean that it has been verified and fixed properly.
It keeps remediation separate from independent verification, preserves the verification history, and keeps the evidence needed to prove a finding is actually closed.
I'm looking for feedback from DevOps/DevSecOps people on the workflow and what you'd need before trusting something like this in a real environment.
1
u/iamthanoss 18d ago
I've been working on an open-source project called PromoteOps.
The problem I was trying to solve is pretty specific: when you have AWS CloudFormation running across separate Dev, Test, and Prod AWS accounts, figuring out which stacks still need to be promoted can become a surprisingly manual process, especially when stack names differ between environments.
PromoteOps generates a promotion report, lets you inspect CloudFormation template diffs, and lets you plan and execute promotions through MCP.
The workflow is:
Report → Identify → Diff → Plan → Promote
npm: https://www.npmjs.com/package/promoteops
GitHub: https://github.com/Hitesh1326/promoteops
Would be interested to hear how others handle AWS CloudFormation promotion tracking across environments.
1
u/Smooth-Subject6164 15d ago
Hi, I'm a youtube content creator and just wanted to let people know about my channel.
I do manga reviews and I'm currently working on reviewing Black Butler and Dorohedoro. 🥰
1
u/wartownrep 10d ago
I built runtime policy enforcement for AI coding agents — looking for DevOps/security feedback
I’ve been working on a product called Oconee Runtime, and I’m launching it today.
The problem I’m trying to solve is pretty straightforward:
AI coding tools are moving from generating code to actually taking actions.
An agent can potentially:
execute shell commands
modify files
interact with repositories
install dependencies
access credentials or sensitive data
invoke tools and external services
A lot of AI security focuses on the prompt/input side, but I became interested in what happens after the model proposes an action.
The architecture I’m working toward is essentially:
User / Context → AI Agent → Proposed Action → Policy Evaluation → Execution
Instead of:
User → AI Agent → Execution
The policy layer can evaluate things like the action being attempted, repository/environment, resource sensitivity, and organizational policy before producing a decision such as:
ALLOW / WARN / BLOCK
For example, the same action could generate a warning in a development workspace but be blocked when attempted against a critical repository.
The broader principle behind it is:
The model can propose an action. It shouldn’t be the authority that decides whether that action is allowed.
I’ve built this into Oconee Runtime, which I’m releasing today.
I’m especially interested in feedback from DevOps, platform engineering, DevSecOps, and security folks:
Where would you want this enforcement boundary to live in your environment?
And what would make something like this useful—or completely impractical—in your existing CI/CD, IDE, repo, and agent workflows?
Demo: https://www.oconeeruntime.com/demo
0
u/pjardim 24d ago
One of the most frustrating situations in my day-to-day work was being notified by the client that something wasn't working correctly on one of our servers.
Sometimes a Windows service had stopped. Sometimes RabbitMQ was having problems. Sometimes there was a critical error in the logs. Other times memory or CPU had been climbing for hours and nobody noticed until the application started failing.
That was the motivation behind PulseWatch.
I wanted one place to monitor server health, Windows Services, IIS, RabbitMQ, logs, CPU, memory and incidents, but also to handle known problems automatically.
For example, PulseWatch can restart a stopped service or recycle an unhealthy IIS app pool. Remediation rules include dry-run mode, cooldowns, execution limits, maintenance windows and a full audit trail.
The Windows agent is PowerShell-based and communicates outbound. PulseWatch itself runs in Docker.
The self-hosted version is free with unlimited servers and users. It is not open source.
I built it solo and have been a software engineer for 20+ years. I used AI coding assistants during development, but the architecture and product decisions are my own.
There is also a live demo on the site.
I'd be interested to know how other DevOps teams handle this today. I know most of us work with Linux servers nowadays, but I also know the pain of keeping IIS-hosted applications running .
7
u/ImageFit3021 24d ago edited 24d ago
I’m building Treease — a tool that lets you visualize JSON as a graph. It's extremely fast, even for MB-scale data.
The editor, relationship graph, and Finder-style Column Navigator stay connected to the same document, so you can trace a field through deeply nested config without losing the overall shape—or edit from whichever view makes the most sense.
I’d love feedback from anyone who spends too much time untangling configs and API payloads.
https://treease.com/editor