# Opafra documentation

How to register servers, author plans, preview what they will change, and put an approval in front of production.

Source: https://opafra.com/docs

---

Opafra runs multi-step plans against your servers over SSH, with nothing installed on the
targets. Plans can be drafted from a request, previewed per host before they run, and
gated behind an approval when they touch a protected environment.

## Start here

- [Quickstart](/docs/quickstart): register one server and run a plan against it, in about
  ten minutes
- [Core concepts](/docs/concepts): the seven nouns the rest of these pages assume

## What people automate

The runbooks teams reach for first, and what each one exercises:

- **Patch and reboot in waves.** A plan targeting an environment, with an approval gate
  in front of production and a dry run that shows the package delta per host.
- **Rotate a TLS certificate.** Write the new material from a secret reference, reload the
  service, and verify the served certificate before moving to the next host.
- **Rebuild a host from inventory.** A module that takes a bare machine to a known state,
  reused across every new node.
- **Rotate SSH keys.** Install the new public half, verify a connection with it, then
  remove the old one, with the whole sequence on the audit log.

## Reading the rest

Pages are grouped the way the product is: **Inventory** for servers and environments,
**Plans** for authoring, **Running** for dry runs, approvals and execution,
**Access and secrets** for credentials and roles, and **Reference** for the tool
catalogue.

Every page opens with a sentence that answers its title, so you can tell from the first
line whether it is the page you wanted.