r/devops • u/AutoModerator • 4d ago
Weekly Self Promotion Thread
Hey r/devops, welcome to our weekly self-promotion thread!
Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!
2
2
u/SnooHobbies950 4d ago
Hi! I created a JavaScript compiler with defer support (from Go), so you can safely close resources:
https://github.com/xjslang/djs
The "defer" statement replaces the cumbersome "try/catch", making closing resources easy and intuitive.
2
u/SevereSpace 4d ago
Hi, I've built Compass - https://github.com/adinhodovic/compass.
It is a landing page for your services, dashboards, and documents, discovered automatically from sources such as Docker, Kubernetes, and Tailscale. It's centered around auto-discovery and minimal configuration.
Deployed via Docker image and Kubernetes Helm chart.
Thanks!
2
u/Goldziher 3d ago
poly, a linter and formatter for repos that are not one language. https://github.com/Goldziher/poly
One Rust binary. ruff, oxc, biome, mago, taplo, rumdl, sqruff, malva and markup_fmt are compiled in and run in-process, so a CI image needs no Python, Node or PHP runtime to lint Python, JS, TS, PHP, CSS, SQL, TOML, YAML or Markdown. One TOML config for all of it.
The part relevant to this sub is the hook runner. It validates the staged index rather than stashing your working tree, so a hook that crashes mid-run cannot lose uncommitted work. It also ships as a GitHub Action, and warnings do not fail a run by default, so adding it will not redden a pipeline that was green yesterday.
Django is 3,113 files in 0.82s and home-assistant is 25,000 in 3.5s on my machine, cold cache. Those are poly's own numbers, not a comparison against anything else.
MIT, pre-1.0, I maintain it. Disclosure: my project.
2
u/wartownrep 3d ago
I built runtime policy enforcement for AI coding agents — looking for DevOps/security feedback
I’ve been working on a product called Oconee Runtime, and I’m launching it today.
The problem I’m trying to solve is pretty straightforward:
AI coding tools are moving from generating code to actually taking actions.
An agent can potentially:
execute shell commands
modify files
interact with repositories
install dependencies
access credentials or sensitive data
invoke tools and external services
A lot of AI security focuses on the prompt/input side, but I became interested in what happens after the model proposes an action.
The architecture I’m working toward is essentially:
User / Context → AI Agent → Proposed Action → Policy Evaluation → Execution
Instead of:
User → AI Agent → Execution
The policy layer can evaluate things like the action being attempted, repository/environment, resource sensitivity, and organizational policy before producing a decision such as:
ALLOW / WARN / BLOCK
For example, the same action could generate a warning in a development workspace but be blocked when attempted against a critical repository.
The broader principle behind it is:
The model can propose an action. It shouldn’t be the authority that decides whether that action is allowed.
I’ve built this into Oconee Runtime, which I’m releasing today.
I’m especially interested in feedback from DevOps, platform engineering, DevSecOps, and security folks:
Where would you want this enforcement boundary to live in your environment?
And what would make something like this useful—or completely impractical—in your existing CI/CD, IDE, repo, and agent workflows?
Demo: https://www.oconeeruntime.com/demo
2
u/opsfusion-cloud 3d ago
OpsFusion is on-call scheduling and alerting where each person sets their own notification ladder, so one engineer can take an email first and a call ten minutes later while someone else goes straight to SMS. Escalation picks from six targets including the next scheduled member or another team entirely, rather than only re-paging the same person. Flat $10/user/month with a 30-day trial that doesn't need a card: https://opsfusion.cloud
2
u/sup_bruh_1 3d ago
Latchkey (latchkey.dev): managed runners for GitHub that heal errors in real-time. Free no credit card required. PM me and I’ll send you 10k free minutes to use for your builds.
2
u/sagacious123 2d ago
Built this tool to simulate real world scenarios and incidents in local kubernetes - snowopslabs
3
u/mr_chip 3d ago
A few of us at my company have been building an open-source SRE agent harness called AURA. We're deliberately trying to figure out what it takes to give agents useful access to production systems without just handing an LLM god mode.
We finally have a demo that I think shows why we're excited about it: https://www.youtube.com/watch?v=TERHoRzT8cE
tl;dw: We trigger a Kubernetes incident on an ecommerce site so checkout starts throwing 502s. The agent works backwards from the PagerDuty alert and finds an OOMing upstream service. It correlates service memory growth in Grafana to a deploy, finds the PR that introduced the regression, and proposes a code fix, reporting its findings to an incident channel in Slack every step of the way. Then it pauses for human approval before taking a write action. When approved, it triggers a merge and a CI deploy. Finally, it verifies that the system is healthy again after the fix ships.
The whole thing is written in Rust, Apache 2-licensed, and the agent roles/tools/permissions/models are defined in a config file. I'm one of the people working on it. Would genuinely love feedback, questions, criticism, weird edge cases you think would break it, etc. Happy to talk about how any of it works.
You can get it on brew, or there's a GitHub Repo with install scripts, RPMs, DEBs, and straight binaries. https://github.com/mezmo/aura/
2
u/verylowsodium 3d ago
Guy who recorded the demo video here - just want to underscore how useful this is being open source.
I have a config that I wrote for my homelab with worker agents to query grafana data, another worker with read access to my repos, and another which can talk to the homeassistant API. The coordinator-worker model just absolutely nails root cause on weird issues I have with various automations between services. I just use the CLI from my laptop.
Almost exclusively using Deepseek v4 flash via baseten ($0.13/1m tokens).
1
u/the_pwnererXx 3d ago
A lot of work to get worse performance than Claude code out of the box
1
u/mr_chip 3d ago
Interesting. What benchmark are you using for that comparison? I’d genuinely like to understand what you ran Claude Code against and where it outperformed this setup.
1
u/the_pwnererXx 3d ago
Why would your setup perform any better if Claude is connected to the same mcps/plugins to pull data from? It's not like you are doing anything special here. Really feels like reinventing the wheel
1
u/mr_chip 3d ago
If Claude Code and a couple MCPs work great for you, then you should absolutely use that.
That said, making the model smarter than Claude Code isn't what we're trying to do. You're right, it should perform about the same if you've got it hooked up to the Anthropic API!
What we're trying to solve is the set of problems that come up when you want to let an agent operate production systems:
- How do you keep agents from acting on hallucinated solutions to alerts when they don't have all the evidence?
- How do you make sure the part of the system that scrapes log files isn't burning Fable tokens?
- How do you preserve evidence between investigations?
- How do you wrap the probabilistic agent in enough determinism that you can build a repeatable workflow?
- How do you put approval boundaries around write actions that will carry the identity of the approver, not the agent?
- How do you minimize Lethal Trifecta attack paths when agents are working with production data?
- How do you leave a complete audit trail of the models' decisions and actions?
- How do you do it on a private network segment that's got no internet access?
- How do you coordinate multiple agents, each with its own context and LLM?
That's what we're building. If you don't have those requirements, then Claude Code or Codex plus some MCPs will probably do you just fine.
1
u/Nylor_Tech 3d ago
Datadog Bill Audit — fixed-fee, $3,500. I look at your account for 48 hours with a read-only key, then send back a written report plus the actual config diff (log exclusion filters, cardinality limits, retention tuning), not just a dashboard telling you what's expensive.
Brand new, no client list yet, so verify me through LinkedIn/GitHub on the page rather than taking my word for it: satyawiwijj.github.io/datadog-bill-audit
Mostly relevant if your Datadog bill has ever made you go "wait, why is this so high" and nobody's had time to actually dig in.
1
u/sagacious123 3d ago
I would like to share my project snowopslabs . It is a kubernetes simulator for simulating real world scenarios and experiment on them. I feel it can be a great learning and experimentation tool.
1
u/iElectric 3d ago
We've released secretspec 0.20, a declarative interface for every secret provider. OSS.
https://secretspec.dev/blog/secretspec-0-20-git-docker-inline-specs-and-five-new-providers/
1
u/Jealous_Pea_3915 3d ago
I was testing whether I could remove reusable authority from the app itself, so a compromised client doesn’t automatically come with a useful API key or signing credential.
Used Gitea and S3-compatible storage as the practical examples, with Tide/Forseti handling the authorization side.
1
u/JohnDaly 3d ago
I built software that can inspect a business from the outside, using only public data customers can see.
In one controlled test, a website had 122 public pages.
An update quietly broke the customer path across 37 of them.
Noticer found all 37.
It identified where the problem originated and what needed to change to restore the required outcome.
And it did it without logging into the website, accessing the source code, or being told where the problem was.
That's what makes Noticer different.
I offer a white glove treatment, if you run the code, see the couple free findings it gives you and you are horrified and you purchase the rest of the report, that $249 used for the report can be put towards the complete comprehensive repair.
For a site with 122 pages, I'm going to charge at least 2500 for a repair, if you have a smaller website, smaller business, less revenue, I'm really happy to work with you and get your website dialed in.
Noticerapp.com
1
u/kadirism 3d ago
I created an iPad app for my personal needs, then released it on App Store: Devrim.
It's a tmux-like interface that brings browsers and terminals together, in one screen.
You can have multiple terminal windows side-by-side, even floating, distributed on 4 desktops.
1
u/Si0_x 2d ago
PingParrot - On-call critical alert paging for modern teams, alternative to PagerDuty.
1
u/efunction 2d ago
We made a browser game about one of the great joys of working in infrastructure: getting paged at 2 a.m. because production suddenly needs more capacity.
Disclosure: I work at Tinybird. We built this as part of a campaign for our Cluster Management API, but instead of making another SaaS landing page we decided to turn the problem into a game.
https://tinybird.co/2amclickhouse
Interested to hear whether the 2 a.m. scenario feels sufficiently painful to this crowd.
1
u/k8s-security-pro 2d ago
I maintain k8s-audit, a free MIT-licensed script that gives your Kubernetes cluster a quick security once-over with nothing but kubectl and jq. 16 read-only checks in about 30 seconds: privileged containers, missing NetworkPolicies, wildcard RBAC, hostPath mounts, :latest tags, service account tokens mounted where they shouldn't be. Nothing gets deployed, nothing leaves your machine. https://github.com/k8s-security-pro/k8s-audit
New since last week: I now offer done-for-you audits, and the first three customers get the full async review for $99 (goes to $500 after that) in exchange for honest feedback and a testimonial. Read-only and credential-free, you run the scans, I turn the output into a prioritized fix plan mapped to CIS. https://k8s-security.pro/audit-service
The script stays fully usable without paying anything. Happy to answer questions either way.
1
u/vorjdux 2d ago
TXC – The offline Swiss-army knife for developer text manipulation
Text utilities for the terminal. Everything the online text tool sites do, done locally: your text never leaves the machine, there is no network call, and there is nothing to paste into a web form.
143 operations across 10 categories, each usable as an argument, over a pipe, or from an interactive interface.
1
u/Recent-Tangerine2745 2d ago
VerifyCue critiques your actual interview answers and points out what’s vague, missing, or strong.
www.verifycue.com (new tool I built, looking for feedback)
1
u/forever-butlerian Solaris 8 Enjoyer 2d ago
I wrote up Github Continuous Disintegration, which is a guided study on how to do webhook-driven Github CD instead of letting Github Actions directly screw around with resources in your AWS account.
1
u/smartjj 2d ago
[Release] LukaOTP: a local-first TOTP authenticator for Chrome
Hi everyone — sharing a Chrome TOTP authenticator built around local user control.
LukaOTP:
- requires no account;
- makes no external network requests and sends no user data from the Extension;
- keeps the vault encrypted in Chrome local storage;
- provides a user-controlled encrypted offline backup and restore flow with a separate backup password and a secret-free preview before confirmation.
There is no cloud recovery. If you clear extension data or uninstall before making a backup, the local vault may be unrecoverable; forgotten passwords cannot be reset by the developer.
Try it:
https://chromewebstore.google.com/detail/lukaotp/dpdifplamdcnboedaadeihnppefgiabp?hl=en
Privacy details: https://lukaotp.pages.dev/privacy-policy
I’m looking for feedback on the local-first workflow and backup/restore UX. Please do not post OTP seeds, QR codes, passwords, recovery codes, session secrets, cookies, credentials, or unredacted backup files.
1
u/Inevitable_Point_649 2d ago
I've spent enough late nights jumping between Alertmanager, Prometheus, Grafana, Loki, Tempo, and Slack trying to answer one question:
"What actually caused this?"
The alert is usually the easy part. Figuring out why is where the time goes.
So I built Popov.
Popov is a self-hosted AI incident response platform that takes an alert and investigates it using the observability data you already have.
When an alert fires:
- Popov receives and triages it
- Correlates metrics, alerts, deployments, and past incidents
- Forms a hypothesis
- Investigates the relevant logs, metrics, and traces
- Produces a root-cause assessment with evidence and recommended actions
The idea is simple: Don't just tell me that something is broken. Help me figure out why.
After the root-cause assessment lands, you can keep digging — ask the agent follow-up questions directly in chat, and it pulls from the same investigation context when available. No context-switching to another tool.
It also keeps incident history as institutional memory, provides a War Room for incident operations, and can verify whether things actually recovered after a fix.
Under the hood:
- Multi-agent pipeline built with LangGraph — each agent has a specific role (triage, planning, log analysis, metrics, traces, correlation) rather than one LLM trying to do everything
- Bring your own LLM key (OpenAI, OpenRouter, Gemini, or OpenCode)
- Backend: Python/FastAPI · Frontend: React 19 · DB: MongoDB
And because it's self-hosted: Your telemetry and incident data stay in your infrastructure. No telemetry. No phone home. No SaaS.
It's currently at release candidate stage and has been running in production. I'm releasing it publicly because I want to see how it performs outside my own environment.
If you deal with production incidents, I'd love for you to try it and break it.
GitHub: https://github.com/putra-asmarjoe/popov
I'm especially interested in:
- Where the investigation gets it wrong
- What data you expected it to use
- What you'd want it to investigate next
- Anything that makes setup painful
Happy to answer questions about the architecture or the investigation pipeline.
1
u/Sibikrish3000 2d ago
dcd — figures out why a Docker layer wasn't cached, which BuildKit never tells you.
It wraps docker buildx build, snapshots everything the cache depends on, and diffs against that snapshot on the next build. Output is "step 4 broke because build arg NPM_FLAGS changed, steps 5-9 are just collateral" rather than eleven highlighted misses that are really one problem.
Also catches the stuff nobody suspects: base image moved under a mutable tag, dist/ leaking into the build context, and --cache-to mode=min (the default) making intermediate steps uncacheable in CI no matter what your Dockerfile does.
BuildKit only, needs two builds to have anything to compare, alpha. Go, Apache 2.0, single binary. I wrote it, obviously.
1
u/Ali-WAIL 2d ago
I’ve been building WAIL, a runtime control layer for production AI applications.
The problem I wanted to solve is what happens when an AI request technically succeeds, but the runtime behavior is unhealthy — latency degradation, unstable token delivery, repeated failures, etc.
WAIL wraps the provider client and observes execution in real time. When runtime conditions justify intervention, it can retry or reroute execution and records signed evidence of what was observed, what decision was made, and what happened afterward.
It currently works with OpenAI, Anthropic, Gemini, OpenRouter, Ollama, and OpenAI-compatible runtimes.
It runs in the customer environment; prompts, responses, and API keys aren’t sent to WAIL.
I’m the founder, so obvious self-promotion disclosure.
GitHub: https://github.com/wailinfra/wail-runtime
I’d especially be interested in feedback from people running LLMs in production: when an inference request is technically successful but operationally unhealthy, how are you handling the decision to retry, reroute, or leave it alone today?
1
u/Redcxx 2d ago
Disclosure: I work on Brain.
We’ve open-sourced a self-hostable runtime for operating AI-agent sessions.
Brain runs as one Rust binary with no required external store. It provides an HTTP/SSE session API, append-only journaling, restart recovery, cancellation, and live event streaming. Tools can execute in-process or in separate browser, microVM, and remote environments.
It’s MIT licensed and still an early preview:
https://github.com/aexhq/brain
I’d particularly value DevOps feedback on deployment, observability, recovery, and tenant-isolation requirements.
1
u/Vance84 1d ago
I wanted a more comfortable way to read Kubernetes The Hard Way on an electronic reader, so I built a small project that converts the upstream repository into an EPUB.
It tracks the current upstream default branch and records the exact source commit in the book. Every six hours, it checks for changes and automatically publishes an updated EPUB when necessary.
Tables, code blocks, images, and navigation are formatted for EPUB readers. The styling is designed to remain readable in both light and dark mode.
Security was also important to me. The builder rejects JavaScript, executable files, unsafe embedded content, remote resources, and malformed archives. Every release passes the project’s security checks and official EPUBCheck validation. Releases also include an SHA 256 checksum and build provenance attestation.
Calibre is not required. The EPUB is constructed directly with Python and should work with any standards compliant reader.
This is an unofficial, noncommercial reading format adaptation. It is not affiliated with or endorsed by Kubernetes, CNCF, The Linux Foundation, or Kelsey Hightower. The EPUB remains under the upstream CC BY NC SA 4.0 license.
You can download the EPUB here:
https://github.com/terrytrent/kubernetes-the-hard-way-epub-builder/releases/tag/epub-master
The source code and build instructions are here:
https://github.com/terrytrent/kubernetes-the-hard-way-epub-builder
I mainly built this because I wanted it for myself, but I figured it might be useful to other people too. If you try it, let me know how it looks in your reader, especially if you find any formatting problems in light or dark mode.
1
u/EmbeddedMagicX 1d ago
Open sourced our k8s-native AI platform for distributed multi-model inference at scale
GitHub:
https://github.com/axem-solutions/shaide
I’m one of the co-founders of axem. We recently open sourced Shaide, a Kubernetes-native platform we built for deploying and operating multiple LLMs across GPU nodes.
We originally started with vLLM, but once we needed several models, multiple replicas, routing, model storage and deployments across different environments, the amount of infrastructure around it started growing quickly.
Shaide is our attempt to make that whole setup reproducible instead of rebuilding and reconfiguring it for every cluster.
Current setup:
- vLLM for inference
- llm-d for multi-instance orchestration
- multiple models running and scaling independently
- KV-cache-aware scheduling
- internal OCI registry for container images + model weights
- OpenAI-compatible API
- the entire platform is managed as infrastructure as code
- interactive installer that runs from Docker against an existing Kubernetes cluster
- can operate fully air-gapped with no cluster egress
We currently run it on on-prem RKE2, and it also works with EKS/GKE/AKS.
It’s Apache 2.0 and we only recently made the repo public.
Would be interested to hear how other DevOps/platform teams are handling this once LLM serving becomes more than a couple of standalone deployments.
Feedback on the setup or repo is very welcome.
1
u/ajitnk 1d ago
I'm a solo AWS Solutions Architect (AWS Certified, Community Builder) running CloudNestle. If your AWS bill or architecture has a problem you can't quite pin down, cost,security, migration, GenAI, reliability, send it to me at cloudnestle.com/aws-problem and I'll personally look at it. No sales team, no auto-generated report on the other end.
1
u/LeftAssociation1119 1d ago
I’m validating a CDN idea before building it and would appreciate feedback from people who actually manage production infrastructure.
Proposed economics are roughly:
$8/TB flat worldwide, no regional surcharges and no large monthly commitment, using an established global CDN network underneath.
The intended customer is probably doing 5–200+ TB/month and cares about global edge coverage, but doesn't want enterprise CDN commitments/pricing.
The technical layer would eventually provide provider-independent DNS/routing, API, configuration, TLS, purge, analytics and multi-CDN failover.
What I’m trying to determine is much simpler:
At $8/TB, would this be compelling enough for you to put 1–5 TB of real production traffic through a pilot?
If not, what kills it for you — price, trust, features, observability, SLA, origin behavior, vendor dependency, existing CloudFront/Bunny/Cloudflare pricing, something else?
Would especially appreciate answers from anyone managing tens of TB/month or more.
1
u/kavee-core141 1d ago
Plexavo open-source AWS misconfig/privilege-escalation scanner (IAM, S3, EC2, networking). Pure Python/boto3 detection, no AI in the finding logic. Runs on your own local credentials, zero telemetry.
Real users have already run it against their own accounts and caught genuine issues a forgotten stale access key, an open security group.
Repo: https://github.com/plexavo/Plexavo
Sample Report - https://plexavo.com/sample-report
1
1
u/p_khor 1d ago
Made a network multitool iOS app - ping, SSH, DNS, port scan, etc. All in one, completely free.
I do a fair amount of network troubleshooting away from my desk - checking if a host is up, doing a quick DNS lookup, scanning a port, working out a subnet on the fly. On mobile that always meant three or four different apps, half of them plastered with ads or asking for payment.
So I built my own - Network Tools: Net Toolkit.
It's an iOS app that bundles all the tools in one: Ping and traceroute, SSH (scp, ssh-copy-id, proxy jump, port forwarding), DNS lookup, Port scanner, Subnet / CIDR calculator, Whois, Telnet, LAN scan, Speedtest, iperf3, Wi-Fi link survey.
It's basically the network multitool I wanted in my pocket. No ads, completely free.
I mostly built it for myself but figured some of you might find it handy too.
https://apps.apple.com/app/id6803009570
Feedback and critique is welcome.
1
1
1
u/sadoyan 22h ago
Hi . I have created custom, high performance k8s ingress controller https://aralez.rs/docs/kubernetes/
1
u/cemililkimteke 20h ago
I built VPS Graph, a free and open-source JetBrains plugin for inspecting a Linux VPS without turning the IDE into another server management panel.
The problem I was trying to solve was pretty simple: after a few months, I could no longer remember how my Docker containers, Caddy routes, systemd services, ports and networks were actually connected.
VPS Graph connects over public-key SSH and builds a read-only infrastructure view from what it discovers.
It currently covers:
- Docker and Compose
- Caddy routes and upstreams
- systemd services
- host listeners and ports
- Docker networks and mounts
- relationships between resources
- local snapshots and changes between scans
A big design constraint was least privilege.
The plugin does not deploy, restart or modify infrastructure. Deeper discovery uses an optional helper with one narrowly-scoped, argument-free sudo command instead of Docker group access or unrestricted sudo.
Infrastructure data stays local. No account, cloud backend or telemetry.
I've manually tested the current release on IntelliJ IDEA, PyCharm, WebStorm, GoLand and Rider.
Marketplace:
https://plugins.jetbrains.com/plugin/34022-vps-graph
GitHub:
https://github.com/Cemililkim/vps-graph
I'd be especially interested in feedback from people managing small VPS or self-hosted setups. I'm curious whether the topology/change-history approach matches how you mentally model your own servers.
1
u/Themenace0812 19h ago
Dgoldenvault.com
As a college it’s so hard keeping up with cost of living. I thought maybe this could help other people too.
Member can find discounts from local businesses and brands, earn rewards on top of APYfor saving money
1
u/ahmadpiran 13h ago
restoredrill: proves your Postgres or MySQL backups actually restore, not just that they exist.
Open source CLI. Takes a real backup, restores it into a throwaway container, and runs checks you define (row counts, grants, your own SQL assertions). Writes a JSON report built for an auditor, not a dashboard.
Shipped fast since launch: pgBackRest support, a role/grant check, and MySQL support, most of it from real feedback on the launch post here and on HN.
1
u/ivanzhaowy 7h ago
Affiliation: I’m building Monad Design.
If your coding agent can edit the repository but can’t see the exact native UI state you’re reviewing, I recommend giving Monad Design a look.
It adds a local visual loop around an existing iOS project: choose the Xcode or Expo project and Simulator, navigate to the real screen state, select or annotate the UI, and send that context to the coding agent. The agent edits the same repository and rebuilds the target. You can then compare the original with source-backed alternatives before approving one.
The app is the canvas.
This isn’t another app generator or coding agent. The useful part for me is reproducibility: explicit project and Simulator selection, inspectable source changes, a real rebuild, and an approval step before a variant becomes the chosen design.
It currently runs locally on macOS and works with supported agents including Codex and Claude Code.
1
u/MCMZL 4h ago
CrowdSec 1.8 new release — self-hosted bot detection at your origin
Bot detection landed in our Web Application Firewall this release. Automated-looking requests get a proof-of-work challenge plus browser fingerprinting: PoW puts a CPU cost on every attempt, the fingerprint makes faking a real browser expensive. Real users don't notice. Scrapers pay per request.
The part relevant here: it's scoped to browser-facing routes, and everything else — API paths, health checks, monitoring, CI, legit crawlers — goes on an allowlist. If you point it at an API endpoint you will break your own clients, so scope it deliberately.
Versus Cloudflare Bot Management: this runs at your origin, so you still eat the traffic — no edge absorption. In exchange the challenge page, its JS and the verification are all served from your own box under /crowdsec-internal/challenge/. No third-party script, no call home. Closest OSS comparison is Anubis, except this one lives inside an IPS, so the engine that bans an IP for brute-forcing also decides who gets challenged.
Same release adds a Kubernetes datasource that pulls logs straight from the API server, which may be the more interesting half for this sub.
Docs: https://docs.crowdsec.net/docs/next/appsec/bot_detection/intro
Release: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0
1
u/MCMZL 4h ago
CrowdSec 1.8 new release — self-hosted bot detection at your origin
Bot detection landed in our Web Application Firewall this release. Automated-looking requests get a proof-of-work challenge plus browser fingerprinting: PoW puts a CPU cost on every attempt, the fingerprint makes faking a real browser expensive. Real users don't notice. Scrapers pay per request.
The part relevant here: it's scoped to browser-facing routes, and everything else — API paths, health checks, monitoring, CI, legit crawlers — goes on an allowlist. If you point it at an API endpoint you will break your own clients, so scope it deliberately.
Versus Cloudflare Bot Management: this runs at your origin, so you still eat the traffic — no edge absorption. In exchange the challenge page, its JS and the verification are all served from your own box under /crowdsec-internal/challenge/. No third-party script, no call home. Closest OSS comparison is Anubis, except this one lives inside an IPS, so the engine that bans an IP for brute-forcing also decides who gets challenged.
Same release adds a Kubernetes datasource that pulls logs straight from the API server, which may be the more interesting half for this sub.
Docs: https://docs.crowdsec.net/docs/next/appsec/bot_detection/intro
Release: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0
1
0
u/TraditionalLayer3685 4d ago
Disclosure: we're the team building TokenTimer.
Quick update since we posted last week: we just released CA trust-anchor distribution in TokenTimer Core.
You can now approve a root or intermediate CA as a trust anchor and distribute/revoke it across specific machines through the TokenTimer agent. Initial support covers Windows, Debian/Ubuntu, and RHEL/Fedora trust stores. Fingerprints are pinned and re-verified before changes are applied, and TokenTimer tracks ownership so it won't remove CA material it didn't install.
Open source / AGPLv3:
https://github.com/tokentimerch/tokentimer-core
Curious how others here manage internal CA trust distribution across mixed Linux/Windows fleets today. GPO/Intune? Ansible? Config management? Something else?
0
u/bendem 4d ago
Was interested at first, then I saw the SSO tax. Open source but you have to pay to use it securely.
1
u/TraditionalLayer3685 3d ago edited 3d ago
Like many open source projects, you have an Enterprise edition. How do you expect us to live of our project if we only give everything for free to the community ?
SSO isn't a guarantee of security, you can setup basic auth with OTP, which is already secured. If you need Enterprise capabilities then yes, for now it's limited to our extension of Core called Enterprise, which is not OSS.
Such features are subject to be opened to the Core version, but for now we need ways to live out of our project.
Anyway since it's an open-source project, you are very welcome to contribute to the community or even fork the project to implement your own features.
1
u/TraditionalLayer3685 3d ago edited 3d ago
I've been working on this project for more than a year, giving most of my free time to it. We've been very generous to the OSS edition by giving nearly all the features we have been building. You cannot complain having "to pay to use it securely" just because SSO is available only in another edition that sits on top of the OSS edition...
0
u/8lue7or 1d ago
Disclosure: I’m the founder and developer of Det Mimir.
I started building it because Linux incidents often end in one of two places: staring manually at output from ten different tools, or restarting the service and losing the transient evidence that explained what happened.
Det Mimir is a self-hosted, read-only incident investigation CLI for Linux infrastructure. It collects bounded evidence from Linux, systemd and Docker through registered read-only commands, runs deterministic detectors, and produces reports where material findings remain tied to their evidence.
It cannot restart services, kill processes, edit configuration or apply remediation. There is no arbitrary-shell or LLM-to-command path. AI analysis is optional and happens only after the deterministic investigation.
One example I’ve been using for validation: the root filesystem was at 96%. A 512 MiB nginx log had been deleted, but nginx was still holding it open. Det Mimir correlated the filesystem pressure with the deleted-open file and holding process, while keeping the conclusion explicitly evidence-scoped. It did not “solve” or mutate the host.
It’s currently in private validation; there is no public download yet. I’m looking for Linux admins and SREs willing to tear apart the approach, review a generated report, or test controlled synthetic/personal-lab incidents.
What incident would you use to decide whether something like this is genuinely useful rather than just another layer of tooling?
Worked example: https://docs.det-mimir.com/worked-examples/storage-disk-full/
Roadmap: https://det-mimir.com/roadmap/
8
u/atkrad DevOps 4d ago
https://deployah.dev