Skip to content
    Opafra
    English
    Get a demo

    Stop SSHing into prod. Run plans instead.

    Opafra governs every change and every access to the servers you run. AI drafts each plan, Git keeps it as code, and every approval leaves the evidence your clients and auditors ask for.

    Fig. 1, run #4f2a, patch nginx across prod on 3 hosts

    Patch nginx across prod

    Upgrade nginx to 1.25.3 on web-01 web-02 web-03 and keep TLS 1.3 only.

    Activity

    1. Alex Moreau asked for this run14:28
    2. AI composer drafted 4 steps for @alex14:28
    3. Dry run on 3 hosts: 12 changes, 0 destructive14:29

    alex2 min ago

    Ready for prod. TLS 1.2 is out and session tickets are off.

    danajust now

    Checking the dry run for web-02 now.

    Changed 1 file+3-2
    Approve revision 7 of Patch nginx across prod?

    Alex Moreau asked, waiting 2m

    Dry run, revision 7

    12
    changes
    3
    hosts
    0
    destructive

    web-01 web-02 web-03

    You hold access to prod. This approval covers revision 7 only.

    Where Opafra fits. Four situations teams bring to it.

    Coming from AWX, Rundeck, SaltStack or Chef? Each comparison says where the other tool is the better choice.

    How a change goes through

    Four states. Each one leaves something you can read later.

    Every change to a server is drafted, dry-run on each host, approved for the exact revision and written to an append-only log.

    Fig. 2 Draft. Every step is marked as reading or changing. The composer never sees a credential.

    Plans /Patch nginx across prod

    Draft

    Request

    @alex

    14:28:31

    Patch nginx across prod and keep TLS 1.3 only.

    Drafted by the composer

    14:28:55

    4 steps, 3 hosts, environment prod derived from the targets

    1. 1Back up current configreads
    2. 2Upgrade nginx to 1.25.3changes
    3. 3Write nginx.conf and reloadchanges
    4. 4Verify TLS on :443reads
    Targetsweb-01web-02web-03
    Fig. 3 Dry run. The command for each host, and what would change, before anything does.

    Dry run #4f2a, revision 7

    14:29:40Passed on 3 hosts
    What the dry run found on each host
    HostChangesDestructiveTime
    web-0140810 ms
    web-02, diff shown40790 ms
    web-0340840 ms
    Total120
    Since the last run+20
    ssl_session_tickets added

    Diffweb-02

    /etc/nginx/nginx.conf+3/−2
    --- a/etc/nginx/nginx.conf
    +++ b/etc/nginx/nginx.conf
    @@ -1,7 +1,7 @@
     user  www-data;
    −worker_processes  4;
    +worker_processes  auto;
     pid /run/nginx.pid;
    @@ -31,6 +31,7 @@
         ssl_prefer_server_ciphers on;
    −    ssl_protocols TLSv1.2;
    +    ssl_protocols TLSv1.3;
    +    ssl_session_tickets off;
    Fig. 4 Approval. A protected environment waits for a person, for this revision only.

    Patch nginx across prod

    Upgrade nginx to 1.25.3
    blocked 2mweb-01, web-02, web-03console4 items

    @alex → AIDry-run passedApproval requiredAudit

    Revision
    Covers revision 7 only.
    Targets
    web-01, web-02, web-03 in prod, derived from the targets
    Approver
    Must hold access to prod
    Fig. 5 Record. Written whether the run succeeds or not, and exported as CSV or NDJSON.

    Audit log /run #4f2a

    Append-only5 entries
    The audit entries run #4f2a wrote, newest first
    TimeActorEvent
    14:33:19web-03reloaded nginx
    14:32:07danaapproved revision 7
    14:29:40alexdry run on 3 hosts, 12 changes
    14:28:55AIdrafted 4 steps for alex
    14:28:31alexrequested Patch nginx across prod
    ExportCSVNDJSON
    Who can touch production

    Being an admin is not access. Two hours of prod, on the record.

    A protected environment ignores the organization role. Everyone but the Owner, Admins included, needs a grant, and a grant can expire.

    How the product is constrained
    Fig. 6, who can touch prod, with a two-hour grant
    Who can touch

    prod

    Effective access to prod per member.
    MemberViewRunManageVia
    Ada LovelaceOwnerView allowedRun allowedManage allowedOrg role (owner)
    Bo ChenAdminView not allowedRun not allowedManage not allowedNo access
    Alex MoreauOperatorView allowed, expires in 2hRun allowed, expires in 2hManage not allowedGrant, expires in 2h
    Dana OkaforOperatorView allowedRun allowedManage not allowedGrant, permanent
    Eli NovakViewerView not allowedRun not allowedManage not allowedNo access
    Grant#a91cprod
    Alex MoreauOperator
    Run on prod for 2h, to patch nginx across prod.
    Approved by
    Dana Okafor, 14:02
    Window
    14:05 to 16:05
    Connections
    3, each on a 5 min certificate
    Ends on its own at 16:05

    The evidence clients ask for, produced by the work itself.

    Every approved change, access grant and restore test is written as it happens, then exported for one client against the framework they audit to.

    See the evidence
    What runs where

    Nothing to install on the hosts. The connection closes when the run does.

    Opafra connects over SSH as the user you set for each host. There is no daemon to patch and no new listener on the hosts you are protecting.

    Fig. 7, what a run needs from a host, and what crosses the network

    Your secret manager

    • HashiCorp Vault
    • Infisical
    • AWS Secrets Manager
    • GCP Secret Manager

    read only when a step runs

    Opafra's servers

    Runs and dry runs

    Your organization's certificate authority

    five-minute certificates

    Sealed credentials

    AES-256-GCM

    SSH

    Your network

    Bastion

    or directly

    prod

    • web-01
    • web-02
    • web-03
    1. SSH from Opafra's servers to each host, or through its bastion.
    2. A fresh key and a five-minute certificate from your organization's own certificate authority, or a key you give Opafra.
    3. Every host key, bastions included, checked against the one recorded on first contact. A different key is refused.
    4. Secret values stay in your secret manager until the step that needs them runs. The plan carries a reference, and the log shows the value masked.
    5. Credentials Opafra holds are sealed under your organization's own key.
    On the host
    An SSH login. Nothing stays running afterwards.
    Credentials
    Your existing keys, or five-minute certificates from your organization's own certificate authority.
    Inbound to your network
    SSH from Opafra's servers to the host, or to its bastion. Nothing is installed or left listening.
    To operate Opafra
    Nothing. It is hosted: no control-plane VM and no cluster to run.

    Works with what you already run. Any Linux host over SSH, on any cloud or bare metal, modules for Docker and NGINX, discovery from Terraform and Kubernetes, plans synced from GitHub.

    • Linux
    • Docker
    • Kubernetes
    • Terraform
    • Google Cloud
    • GitHub
    • NGINX

    Recently shipped

    1. An SSH certificate authority per organization
    2. Host keys pinned and checked on every connection
    3. Approvers need access to the environment

    From the security page

    See it against your own setup.

    Tell us what you run. You get a demo and your price in writing within one business day, with no call.

    Get a demo