Skip to content

safe-devops v0.4.1 — Secure DevOps access and reviewed shell commands

Choose a tag to compare

View all tags
@0xfnzero 0xfnzero released this 31 Oct 00:52
v0.4.1
5a1de88

safe-devops v0.4.1 — Initial public release

Open-source, self-hosted DevSecOps access control for development and operations teams. Built with Go, Next.js and Electron; SQLite by default, with optional PostgreSQL.

Highlights

  • General shell commands with independent review, scoped terminal commands and short-lived diagnostic sessions with continuous input/output, completion and history search.
  • Explicit low-risk rules, independent AI review, visible human escalation and signed human approval.
  • Enrolled-device Ed25519 signatures on every authenticated request, replay prevention and optional IP restrictions.
  • Outbound mTLS Server Connectors that independently enforce local policy, signatures, scope and execution budgets.
  • Recent-operation risk assessment, temporary account locks and independently signed recovery.
  • Multi-tenant teams, projects, members and multiple servers per project.
  • Shared accessible dropdowns, single-border input focus, Chinese/English, light/dark themes, Docker Compose, Linux systemd, backup/restore and discoverable Make commands.

Getting started

git clone https://github.com/0xfnzero/safe-devops.git
cd safe-devops
git checkout v0.4.1
make
make setup
make dev

Open http://127.0.0.1:3000 for the disposable local demo. Production deployment requires independent credentials, enrolled device public keys, trusted TLS and explicit network isolation.

Validation

  • CI: Go race tests and vet, PostgreSQL integration, real Linux execution-account isolation, Web type/lint/build, desktop and release-script tests, and actual SQLite/PostgreSQL Docker Compose deployment checks.
  • Native builds: four server/Web targets and six desktop targets. Installer builds do not imply runtime testing on every supported OS.

Downloads and verification

Choose assets matching the operating system and architecture. server packages contain the Go CLI and systemd installation tools; production services target Linux, while macOS CLI packages support administration and development. web bundles contain Next.js standalone dependencies for the named platform and require Node.js 22.18+. The source bundle includes the Makefile, Docker build sources and deployment documentation.

Electron installers connect to an existing Web console. They do not contain production credentials or a bundled control plane. These desktop builds are unsigned and macOS builds are not notarized. Verify downloads against the attached SHA256SUMS from this release.

Security scope

This is an early public release, not an independently audited security product. Local demo shell commands run as the current non-root OS user; use a disposable development machine. General shell commands require an installed executor and exact single-use approval. Unknown or mutating shell commands require humans; root commands require two humans. Full-screen PTY sessions are not supported. Device signatures prove software-key possession rather than hardware attestation. Review the architecture and deployment requirements before production use.

简体中文

首个公开版本：包含多团队/多项目服务器管理、逐请求设备签名、规则 → AI → 人工分层审核、连续终端、风险账户锁定、SQLite/PostgreSQL 部署及跨平台打包命令。运行 make 查看全部命令。生产部署请先阅读安全边界和证书/网络配置；本版本未经过独立安全审计。

Website · English README · 中文说明 · Deployment · Commands · Security policy

Assets 22
Loading