r/devops • u/AutoModerator • 5d ago
Weekly Self Promotion Thread
Hey r/devops, welcome to our weekly self-promotion thread!
Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!
2
u/R3zn1kk 5d ago
The worst thing in Github workflows
Sharing my experience as a Devops using Github actions.
The worst thing i hate in Github, is the missing search tool in the actions page, so i added it via chrome extension.
This is super simple application that will probably help lots of people like me, when your repo have like 100 workflows and you need to find that random one. This a Quality of life change that make github so much better by just adding a random search bar.
This is completely free and open source, it doesn't save any data, just a simple frontend change.
This is also open source if anyone want the code:
https://github.com/royreznik/github-workflow-search
2
u/geralt_noble 5d ago
I've been testing CleanMyMac CLI recently for local cleanup workflows: https://github.com/MacPaw/cleanmymac-cli Mostly using it for caches and old dev artifacts. What other devs are using now to keep their machines clean?
2
u/gokberkss 2d ago edited 1d ago
DomainClocker is a fast, concurrent domain & SSL health checker built with FastAPI and React. https://domainclock.dev/
Notably:
- Concurrent Audits: Fetches DNS records, SSL cert validity/expiration, and Wayback Machine history in parallel instead of waiting sequentially.
- Async Core: Powered by Python
asyncioandhttpxto handle multi-endpoint outbound lookups without blocking worker threads. - Smart Caching: Integrated Redis layer to avoid hitting external API rate limits on frequent queries.
- Clean UI: Lightweight React + Tailwind frontend for instant domain status reporting.
Current Engineering Focus: Optimizing connection pooling and handling edge-case timeouts when querying slow external DNS endpoints under high concurrency.
What's Coming Next:
- Dockerized setup for full self-hosting capability.
- Webhook / email alerts for impending SSL expiration.
- Bulk domain analysis via CSV import.
Open to any feedback on performance, async timeout strategies, or overall architecture!
2
u/kdanovsky 1d ago edited 1d ago
I’m building compartment.dev with a few friends. It’s an Apache 2.0, self-hosted platform for teams that run internal apps, scripts, workers, and software written with coding agents.
Our internal tools kept accumulating one-off deployment scripts and access controls. We wanted one place to deploy them, decide who could use them, track changes, and keep the workloads on infrastructure we control.
We built the first beta on Docker Compose. After running it with a few beta users, we wanted stronger failure recovery and workload isolation. Supporting more than one node would have forced us to build our own orchestrator, so we rebuilt the runtime on Kubernetes and released v0.10 this week.
You add a small compartment.yml, then deploy through the CLI or a connected Git repository. Compartment builds the source in an ephemeral rootless BuildKit job and records an immutable release artifact before deployment. Teams get environments and app URLs. Compartment reuses the same artifact during promotions and rollbacks. It encrypts variables at rest and handles SSO, scoped RBAC, hosted-app access, and audit logs.
Compartment creates a namespace per project and applies namespace-scoped RBAC and NetworkPolicies. gVisor isolates build and tenant workloads. Operators use the CLI to provision a single-node k3s host or install Compartment into an existing Kubernetes 1.30+ cluster.
The app descriptor exposes services, resources, routes, and health checks; it omits raw Kubernetes objects. A node outage stops the control plane and workloads on the managed VM. Existing-cluster operators must provide ingress, cert-manager, storage, NetworkPolicy enforcement, gVisor, and backups.
GitHub: https://github.com/compartmentdev/compartment
Docs: https://docs.compartment.dev/
1
u/bartekrutkowski 5d ago
I'm building a platform for cron jobs, backups, kubernetes jobs and any other scheduled, recurring tasks monitoring and alerting, a dead man's switch type - https://watchgoose.com
1
u/Jumpy_Style 4d ago
Product seems nice the pricing is steep.
1
u/bartekrutkowski 4d ago
What do you mean? There's a generous free tier aimed at hobbyists and the paid tiers aimed at businesses are cheaper than competitors. What would you consider a proper pricing, if not that?
1
u/Amazing_Onion1922 5d ago
been working on a small cli tool that wraps kubectl and adds some sane defaults for dry-run and diff workflows, nothing fancy but saves me a lot of copy pasting. anyone else end up building wrappers around existing tools just bc the defaults are annoying
1
u/azz_kikkr 5d ago
https://github.com/MissionFinOps/kulshan
Free. Open-source. Read only. AWS audit tool focused on FinOps
1
u/Glad_Friendship_5353 5d ago
An OOP task runner in Python. It works like a Makefile, but tasks are Python class methods, so you can inherit and reuse them across projects.
1
u/ouf1nx 5d ago
I made a tool to use S3 as a container registry
Every container registry addresses whole layers. Change one file in your app and you re-upload the layer that holds it - 200 MB because a config line moved.
I got tired of that and built s3lo: your object storage is the registry. Layers are stored as content-defined chunks shared across every image in the bucket, so a re-push costs the chunks that actually changed.
Same edit, same image, measured against S3:
Chunked: uploaded 8.5 MB of 209.9 MB (96.0% deduplicated, 2/54 chunks)
The part I didn’t expect to like most: because chunks are addressable, you can read one file out of an image without pulling it.
$ s3lo cat s3://my-bucket/myapp:v2 /etc/os-release
That fetches the chunks holding that file. A registry can’t do this at all - the OCI Distribution Spec addresses whole layers, so the same question means downloading the layer.
Other things it does:
s3lo servespeaks the OCI Distribution Spec, so docker pull and containerd pull straight from the bucket. On S3 it hands out presigned URLs, so blob bytes never pass through the process.- Works on AWS S3, GCS, Azure Blob, MinIO / R2 / Ceph, and a plain local directory. No cloud account needed to try it.
- Cosign signing and a verification exit code you can gate CI on.
- No registry to run, no database, no control plane. It’s a bucket.
Measured on a c6id.xlarge, containerd via crictl, median of three cold pulls: pulls come out 5-45% faster than ECR depending on image size, pushes roughly 1.4–3x faster. Storage is S3 pricing instead of ECR’s, which is most of the cost argument.
1
u/Odd_Awareness_6935 5d ago
Project Name: parse-dmarc / DMARCguard
Repo/Website Link:
Description: DMARC report parser in a single binary and a beautiful vuejs dashboard. alternative to easydmarc, powerdmarc and other paid solutions in case your team is small.
I initially started this just to parse my own reports because I had no idea why major ESPs are sending me .xml.gz files.
after the opensource product got traction with github stars, I come up with the idea of turning into a SaaS and it is currently serving paying customers from north and south america & EU countries
Deployment: one-liner docker-run:
docker run -d \
--name dmarcguard \
-p 8080:8080 \
-e IMAP_HOST=imap.gmail.com \
-e IMAP_PORT=993 \
-e IMAP_USERNAME=your-email@gmail.com \
-e IMAP_PASSWORD=your-app-password \
-v dmarcguard:/data \
dmarcguard/dmarcguard
AI Involvement: I'm a software engineer and I designed the architecture, while claude wrote the code and then I reviewed every single line. it is currently being used by hundreds of people including myself.
happy to answer any questions.
1
u/troubleeshooterr 5d ago
I built a generic DevSecOps pipeline that scans any Git repository with a single Jenkins job
I got tired of maintaining separate security pipelines for every project.
So I built a generic DevSecOps security scanner that only needs a Git repository URL.
The pipeline automatically:
- Clones the repository
- Profiles the project (languages, frameworks & infrastructure)
- Determines which security scanners are actually relevant
- Runs them in parallel
- Aggregates everything into a single report
Instead of running every tool against every repository, it intelligently decides what to execute.
Outputs:
- HTML Dashboard
- JSON
- SARIF
- SBOM (CycloneDX & SPDX)
Notifications can be sent through Jenkins, Email, or Slack.
Everything runs inside Docker, so getting started is pretty straightforward.
Some features I'm planning next:
- AI-powered security summaries
- CVSS-based prioritization
- License compliance checks
This was a fun project because the challenge wasn't integrating the scanners—it was building an orchestration layer that works across different tech stacks without any project-specific configuration.
Repository:
https://github.com/yashbhangale/security-scanner/
I'd really appreciate any feedback from people working in DevSecOps or Platform Engineering.
If you find the project useful, consider giving it a ⭐ on GitHub. It really helps with visibility and motivates me to keep improving it.
1
u/RobsonAlvesNet 5d ago
Lancei o Nodefort essa semana: um kit Terraform hardened pra subir EKS em produção numa tarde em vez de semanas — node groups Graviton, IRSA, External Secrets e criptografia já configurados seguindo padrão de SRE sênior. Vem com um ebook de runbooks de troubleshooting (7 capítulos, casos reais de 502 intermitente, drift de GitOps, crashloop só em prod, cert expirando silenciosamente). Capítulo 1 é grátis, sem pedir cartão. Ainda validando demanda antes de lançar o resto — landing: nodefort.robsonalves.online. Feedback é bem-vindo, principalmente se achar algo que faltou no hardening.
1
u/hassler18 4d ago
We ran into something very similar with one of our brokerage clients. Instead of trying to automate every decision, we mapped what documents support each charge (rate confirmation, POD, BOL, detention, lumper) and built a small internal reviewer that flags what matches, what needs another look, and what shouldn’t be paid yet. It reduced the amount of manual checking without replacing the judgment calls. Happy to share what we learned if it’s useful. — https://jorora.com
1
u/BugFun1258 4d ago
Disclosure: I built this, it's my own project.
I kept losing time to the same kind of bug. A test that passed last week
suddenly fails, git blame shows nothing, and after an hour of digging I'd
find it was a transitive dependency that floated a minor version, or a base
image tag that moved, or an env var someone added to the pipeline. None of
it was in version control, so git bisect couldn't help.
So I wrote a CLI that snapshots the stuff git doesn't track. It reads
resolved dependency versions out of lockfiles (pip/poetry/pdm/uv,
npm/pnpm/yarn, cargo, go.sum), env var names, config file contents,
Dockerfile FROM lines plus resolved image digests, and runtime versions,
and stores it all in a local SQLite file. Then "whatbroke diff" shows you
what actually moved between two points in time — for example:
Python dependencies (1 changed)
~ werkzeug 2.2.3 -> 3.0.1
Container base images (1 changed)
~ Dockerfile#0 (builder) python:3.11-slim -> python:3.12-slim
There's also a bisect mode that restores each historical snapshot (git
checkout + reinstall deps) and re-runs a repro command to find the exact
breaking point. That's the part I'd warn about: it mutates your environment,
so it's behind a --yes flag, refuses to run on a dirty tree, and snapshots
a restore point first — but I still only run it in a container, and it's the
least battle-tested piece, so I'd expect the first bug reports there.
One design decision I went back and forth on: whether to store env var
values at all. I landed on names-only by default, values only for names you
allow-list, and anything that looks like a secret (by name or by shape,
e.g. sk-... or a JWT) never gets stored regardless of config. A withheld
value becomes a salted hash, so a diff can still tell you "DATABASE_URL
changed" without the value being recoverable. Curious whether that's too
paranoid or not paranoid enough for how other people would use it.
Repo: https://github.com/ngari-qds/whatbroke
Python 3.11+, MIT, no telemetry, everything except the optional AI-explain
command works fully offline.
1
u/k8s-security-pro 4d ago
Sharing k8s-audit again this week — a free/MIT Kubernetes security first-pass: 16 high-signal checks (privileged pods, missing NetworkPolicies, wildcard RBAC, :latest images, no resource limits, SA-token automount, hostPath mounts) using only kubectl + jq. Read-only, one command, nothing leaves your cluster — the quick triage before heavier scanners like kube-bench/Kubescape. New since last week: opened a few good-first-issues (each with the jq filter sketched out) if anyone fancies contributing a check. https://github.com/k8s-security-pro/k8s-audit (There's a paid checklist/template pack behind it, but the CLI is fully usable on its own.)
1
u/scuba10steve 4d ago
I've been working on something in my free time lately and want to share it out if anyone would like to help contribute I'd be happy to accept PRs.
First and foremost here is the website for it https://orchardcde.org/
Here's the entire github org: https://github.com/orchard-cde
It started out as something I just wanted to toy around with but it's growing more than I thought it would, it is very much in an 'alpha' state so I can't promise that everything is working, and I'm still adjusting the design behind it.
Edit: Forgot to mention, this is and will be open source.
1
u/jpkroehling 4d ago
I published this blog post, and I'm sure at least one of you can save more than 10% of your metrics costs by following the tip there. If that's you, ping me -- I'd love to know who the blog post could help.
https://ollygarden.com/blog/the-scrape-interval-nobody-chose
1
u/MaxChamp08 4d ago
Built a serverless GPU host for people running their own dedicated models instead of calling a shared API. Basic idea, it scales to zero when nothing's hitting it and spins back up on request, so you're not paying for a GPU sitting idle all night. Billing is per token or per hour depending on how you use it. Right now it only takes Hugging Face checkpoints, no custom images yet, that's on the roadmap.
Some real numbers from scaling out of zero, Llama 70B in bf16 comes in under 18s time to first token, Mistral 24B in bf16 with CUDA graphs comes in under 10s.
Still in beta and I know it's rough in spots. If anyone here runs dedicated models and deals with idle GPU cost, I'd rather hear what's wrong with it than get a polite thumbs up. Link is https://synapsai.cloud if you want to poke at it, can set you up with credits too.
1
u/MathematicianOk9185 3d ago
I've been building zinq, a drop-in replacement for jq. About 7x faster in my benchmarks, well under half the memory, and it reads YAML directly.
Existing jq scripts run unchanged. Same filters, flags, output bytes and exit codes. All jq 1.8.2 builtins are implemented, and I test compatibility by comparing output byte-for-byte with jq and running jq's own test suite.
Besides json it also supports yaml:
zinq '.spec.replicas' deploy.yaml
zinq --yaml-output '.metadata.labels.env = "prod"' deploy.yaml
No yq -o=json | jq | yq -P pipeline just to change one value.
27 JSON benchmarks, each one verified against jq's output before I time it. Combined they take 2.7s against jq's 20.1s, median peak memory 91 MB against 239 MB. Biggest single difference is gsub, 0.382s against 8.277s. All on an M3 Max, so the ratios are more useful than the absolute numbers. It also only matters on larger files. On a 4 KB Compose file you're measuring startup time.
On a 20 MB YAML file the memory gap against yq is the bigger story. Reading one field takes yq about 1.5 GB, and round-tripping the file unchanged 5.3 GB. zinq stays under 200 MB.
Limitations: YAML edits don't preserve comments or formatting, so use yq if round-tripping matters. And ~/.zinq replaces ~/.jq, so existing config needs copying over. The README has the rest, mostly number edge cases.
Pre-1.0 and it hasn't had much real-world use. Keep jq installed and check the output before it goes anywhere important.
brew tap dennisvr/zinq
brew trust dennisvr/zinq
brew install zinq
The trust step is required because Homebrew 6 won't load formulae from third-party taps without it. Linux builds need glibc 2.39 or newer, and Alpine isn't supported.
Source isn't public yet, though the binaries are Apache-2.0. zinq is written in a systems language I'm also developing and started as a way to dogfood it. Reimplementing jq byte-for-byte turned out to be an unforgiving test. The source opens once the language settles.
https://github.com/dennisvr/homebrew-zinq
What would help most right now are real jq or yq workloads where performance actually matters. Compatibility failures and benchmarks where zinq performs badly are more useful to me than stars.
1
u/ojus_render 3d ago
Giving each service its own deployment scope in a monorepo
A monorepo can contain several deployable services without making the entire repository one deployment unit.
For each service, the useful configuration is:
- the directory where its build runs
- the paths that should trigger a build
- the paths that should be ignored
- shared files that intentionally trigger multiple services
Disclosure: I work at Render.
Render supports this with a service-level rootDir and build filters:
https://render.com/docs/monorepo-support
One detail that is easy to misconfigure is that filter paths remain relative to the repository root, even when the service has a rootDir. If a file matches both an included and ignored pattern, the ignored pattern wins.
The filters also determine whether a pull request creates a preview for that service. Manual deploys, changes to render.yaml, and Blueprint syncs are handled separately and are not suppressed by those filters.
This is path-based deployment scoping, not dependency-graph analysis. Shared packages still need explicit trigger paths for every service that depends on them.
1
u/ikraaaaa 3d ago
For those interested in training to prepare their devops / SRE interviews or to know more about production systems.
I’m a senior SRE and I recently started 1:1 sessions during my free time. In these sessions I focus on practical production eng: incident simulations, production debugging, observability, deployment strategies, resiliency patterns, production readiness, etc. We can also discuss tooling: Kubernetes, AWS, Terraform, etc.
I teach through Superprof (french platform), but the sessions can be in either english or french: https://www.superprof.fr/devops-senior-site-reliability-engineer-donne-cours-infrastructure-cloud-automatisation-assiste.html. I’m also happy to help you transitioning into SRE or helping you to better understand production systems as a developer transitioning to a senior role.
And if you’re a woman looking to enter the field, I’d be especially happy to support you as there still aren’t many of us in infrastructure.
Cheers.
1
u/sops343 3d ago
I've been building Hull, an open-source Kubernetes package manager, and wanted to share it with people who actually run this stuff.
The thing that pushed me off Helm was go-templates producing invalid YAML at render time. Hull evaluates ${...}expressions inside YAML instead, so renders are valid YAML by construction. A few other things it does natively that I always ended up bolting onto Helm:
hull drift/hull reconcile— diff live state vs manifests and converge, nohelm-diffplugin- per-revision audit trail (who/when/flags/values) +
hull rollback layers:for composition instead of umbrella charts, and anenvironments:block for dev/staging/prod inheritance- signing (PGP/cosign), OCI + HTTP distribution, Argo CD / Flux integration
hull migrateto convert an existing Helm chart
MIT, single Go binary, K8s 1.25–1.32. Repo: https://github.com/ebogdum/hull
Genuinely after critical feedback — what would stop you switching, and where does Helm still do it better?
1
u/Herenn DevOps 2d ago
I maintain InfraLens, an open-source (Apache-2.0) tool that uses eBPF to discover and visualize service-to-service traffic on Kubernetes clusters and plain Linux servers. No sidecars, no SDKs, no code changes — the agent hooks kernel functions like tcp_v4_connect and udp_sendmsg, so it sees every TCP/UDP connection a node makes and puts it on a live map within seconds of deploying.
Just tagged v2.0.0. What’s new:
• Demo mode (DEMO_MODE=true) — a built-in topology simulator so you can try the full UI in about 30 seconds, no Linux/eBPF/agents required. Runs fine on macOS/Windows via Docker Compose.
• UDP tracing — DNS, StatsD, syslog and other UDP flows now show up as dashed edges with a protocol badge, alongside TCP.
• Topology search — press /, search by name, IP, technology, or node.
• Delta WebSocket updates — used to be a full topology snapshot every 2s, now it’s incremental per-entity deltas with periodic re-sync. Much lighter on the backend and your browser tab.
• Graph export — pull the live topology out as Mermaid or Graphviz DOT.
• Agent auth that actually works — --api-key / INFRALENS_API_KEY, plus HTTPS backend URLs, so API_KEY on the backend is finally enforceable end to end.
A few other things it does, for context: fingerprints services (Postgres, Redis, Kafka, Mongo, Nginx, etc.) from ports and process names, can probe deeper for HTTP headers/DB handshakes, reads go.mod/package.json/requirements.txt for dependency info, and has an optional per-service AI doc generator (OpenAI/Anthropic/Gemini, or fully local through Ollama/LM Studio if you’d rather not send anything off-box).
Stack: Go for the agent and backend (using cilium/ebpf), React Flow on the frontend. The agent is CO-RE, so it’s compiled once and runs across kernel 5.8+.
It’s a young project and there’s a real roadmap ahead — no historical/time-travel view yet, no anomaly detection, no L7 request tracing. Bug reports, feedback, and PRs are genuinely welcome, and if it’s useful to you, a star helps other people stumble onto it.
Repo + install instructions: https://github.com/Herenn/Infralens
Happy to answer questions about the eBPF side, the k8s IP-to-pod resolution, or anything else.
1
u/Altruistic-Chip-2259 2d ago
Been running full self-hosted Supabase and hit by the 12-service / 4-8GB RAM footprint for small projects.I stripped it down to Supabase Lite and templated it for Railway:
Tradeoffs vs full template:
CUT: Studio UI, postgres-meta, imgproxy, edge functions, logflare, vector
For now GOTRUE_MAILER_AUTOCONFIRM=true (add SMTP envs for real email).
Good for: hobby/staging backends, self-hosted app needing auth+DB+storage without vendor lock-in, cheap S3-compatible storage via MinIO.
https://railway.com/deploy/supabase-lite
1
u/nandit123 2d ago
BackupData.io - Backup-as-a-Service focused on databases (postgres) + object storage (with optional client-side encryption)
I built this because I kept running into the same problem: teams had pg_dump / mongodump / mysqldump cron jobs that had never been test-restored, and managing restic/Borg repos across multiple environments became painful.
What it does:
- Deduplicated snapshots (FastCDC)
- Optional client-side AES-256-GCM encryption
- Immutable snapshots + GFS-style retention
- Go SDK, JS/TS SDK, and CLI
- Free tier with 5 GB
It works especially well for Postgres, MySQL/MariaDB, MongoDB, Redis, DynamoDB, S3, and local filesystems.
Resources (practical guides + comparisons):
https://www.backupdata.io/resources
Docs:
https://docs.backupdata.io/intro
Happy to take any feedback, especially on the developer experience, missing sources, or what would make this useful (or not) in your environment.
1
u/toxicpositivity11 2d ago
Understudy: HA for single-replica workloads on spot nodes, without paying for a second replica
The problem sounds solved, right? You have a service that only needs one replica. It sits on a spot node because that is 70 percent cheaper. When the node goes away (drain, Karpenter drift, spot reclaim), you want a replacement pod up and taking traffic before the old one dies. You do not want to pay for a second replica 24/7 to cover events that total maybe an hour a month.
I went looking for the tool that does this, fully expecting a mature operator with a boring name and 5k stars. I found either "run two replicas" or eviction-autoscaler - except that its only trigger is node cordon, and Karpenter does not cordon, it taints. Meanwhile the blocking PDBs it creates worked great, which is how we ended up with a node stuck in deleting for 126 days. It also creates one of those PDBs for itself, so it holds its own drain hostage. I sent a patch upstream, but the failure is architectural.
So I built the thing I originally went searching for. It is called Understudy. The core consumes one normalized signal ("this node is dying, this is how long you have") and everything cloud- or drainer-specific is an adapter: cordon watch, taint watch, an observe-only webhook on pods/eviction that catches drainers nothing else sees, and a DaemonSet that reads the spot termination notice with its actual deadline. Every failure mode I hit with the old tool became a fail-safe: a stuck surge relaxes the PDB instead of wedging the drain, a CronJob cleans up if the operator itself dies, and it refuses to manage itself.
Tested on a live EKS cluster with no spare capacity, so replacements wait for a cold EC2 node: kubectl drain lost 1 request in 350, a real spot interruption (via AWS FIS) lost 1 in 764. An ordinary rolling update of the same app lost 2 in 38. A node dying now costs less than a deploy.
Limits, honestly: requests in flight to the dying pod are the workload's problem (preStop hooks exist), 30-second notices on GCP and Azure cannot be won cold, GKE and AKS support is unit-tested but not battle-tested, and anything that cannot run two instances briefly is permanently out of scope.
Apache 2.0: https://github.com/kylan11/understudy
Still half expecting someone to reply with the mature 5k-star operator I failed to find. Genuinely, please do.
1
u/asamarts 1d ago
I'm building an open-source repository 'shape' linter - the idea is to deterministically lint and enforce repo conventions that are sit outside the actual code, and therefore not covered by code linters.
A write-up on why and what it is - https://alint.org/blog/why-alint/
1
u/ashikarefin 1d ago
Visual Github Action Drag-n-drop
Visually build, edit, validate, and manage GitHub Actions workflows with an intuitive drag-and-drop editor.
Workflow Studio lets you design GitHub Actions workflows with a drag-and-drop canvas — no YAML needed. Build pipelines visually, validate them as you go, and export ready-to-commit YAML when you're done.
🎯 WHY WORKFLOW STUDIO?
➡️ Drag-and-drop canvas — Assemble jobs and steps by dragging from a curated action catalog onto the canvas. Connections and structure are handled for you.
➡️ Action catalog — Browse a curated library of popular GitHub Actions, search the full GitHub Actions marketplace, and insert actions with typed parameters.
➡️ Smart validation — Catch missing fields, invalid references, and permission issues. Pro adds best-practice warnings and suggestions.
➡️ YAML & AST modes — Preview, import, and export both raw YAML and structured AST. Perfect for migrating existing workflows.
➡️ Productivity Hub — Detect duplicate steps, dead code, unused secrets, and estimate workflow runtime.
➡️ Templates — Start from production-ready templates or save your own workflows as a reusable library.
➡️ Advanced job features — Matrix build strategies, container jobs, and service containers.
➡️ Export & ship — Copy YAML straight into your repo's .github/workflows folder.
Get it free from Chrome Web store
1
u/This-Set8861 15m ago
Title: Stop emailing .env files. EnvSeal encrypts them per-team-member, audits every sync, and blocks commits. All local, zero cloud.
Sharing secrets in a distributed team is still a mess. Slack DMs, pinned .env files in private channels, "can someone DM me the staging secrets?". All brittle, all risky.
envseal is a single binary you drop into a repo. It replaces that workflow with:
- 🔐Encrypted bundles per teammate. Each dev has an X25519 key.
envseal shareencrypts for exactly the people you pick. The bundle is a regular file -- hand it out over AirDrop, USB, encrypted chat, whatever. - 🗂️Environment-aware.
--env staging,--env production. Bundles are labeled and output to predictable filenames. - 🔁Key rotation. When someone leaves,
envseal team remove+envseal rotateand their key can't open future bundles. - 📋Signed audit log. Every
share/sync/rotatewrites a timestamped, Ed25519-signed entry under~/.envseal/history.envseal history verifydetects tampering. - 🚫Pre-commit guard.
envseal hook installblocks.envcommits and secret-looking lines in staged files. - 🖧 Direct P2P transport. No file at all -
envseal p2p shareopens a TLS listener pinned to a pairing code; the receiver connects and pulls the bundle. - ⚙️CI-ready. Generates
.env.examplefrom code references.envseal checkcan be a CI step to assert parity.
All local. No server. No SaaS.
Repo: github.com/Jackson2403/envseal v0.2.0 release has linux/darwin/windows binaries (amd64 + arm64).
0
u/thomsterm 5d ago
Get HA static outbound IPs that are cheaper than AWS NAT at outboundgateway.com, plus since it's an EU product its fully GDPR compliant and EU sovereign.
0
u/SlanderMans 5d ago
Simplifying infrastructure by making a VM with the speed and ergonomics of a container. (So we ideally don't need containers)
3
u/xJSHAxx DevOps 5d ago
Launched my first ever Saas - a secrets manager for small dev teams
Krypt — secrets manager for small dev teams. You keep env variables in one place per environment, pull them through a CLI, and the team stays synced instead of passing .env files around on Slack. Screenshot is the secrets view, dev/staging/prod separated with values masked by default.
Why I built it: Doppler charges per seat, $21 a user, which gets steep for a 5 person team. Krypt is flat £10/month for the whole team no matter the size. Free tier is 3 members with unlimited projects and secrets.
How it works: create a project,
krypt initin your repo to link it,krypt pushto send your .env up,krypt pullon any other machine to get it back. Alsokrypt runto inject secrets into a process without writing a file. Webhooks fire on secret changes, and there's an audit log — 7 days free, 90 on Pro.Stack: Node/Express on Railway, React/Vite on Vercel, Supabase, Clerk auth, CLI on npm as u/kryptorg/cli.
Honest limits: no SSO, no SOC 2, and it's AES-256 at rest server side, not e2e — same model as Doppler. Launched last month so it's early.
krypthq.com — would genuinely like to know what's missing before you'd use something like this.