Production changes the whole team can run, each one dry-run, approved and recorded.

For platform and IT teams that run their own Linux servers. A plan is an ordered list of steps against named hosts. Anyone on the team can run one, every host shows its preview first, and your repository, your SSH keys and your hosts stay yours.

For the team that runs the servers

One person's shell history, turned into plans the team can run.

The base product is infrastructure automation. The governance is what lets more people use it.

Plans others can run: A routine that lives in one person's shell history becomes a plan the rest of the team can run, from a request in plain language or from your repository.
Access that expires: Give the team access to production for the window the ticket needs. It ends on its own, so someone leaving is removed rather than every key rotated.
An approval where you want one: Mark production protected and every run that touches it waits for a named person who holds access to it, for the exact revision that will run.
Git keeps it as code: Sync plans, scripts and templates from a repository. A synced plan is read-only in the builder, so a change goes through a pull request.

Previewed on each host

See what each host will change before anyone approves.

The dry run connects to every target and reports per host, so the differences between hosts surface before the change and not during it.

Fig. 1, dry run of #4f2a, revision 7, on 3 hosts

Dry run #4f2a, revision 7

14:29:40Passed on 3 hosts

What the dry run found on each host
Host	Changes	Destructive	Time
web-01	4	0	810 ms
web-02, diff shown	4	0	790 ms
web-03	4	0	840 ms
Total	12	0
Since the last run	+2	0
ssl_session_tickets added

Diffweb-02

/etc/nginx/nginx.conf+3/−2

 --- a/etc/nginx/nginx.conf
 +++ b/etc/nginx/nginx.conf
 @@ -1,7 +1,7 @@
  user  www-data;
−worker_processes  4;
+worker_processes  auto;
  pid /run/nginx.pid;
 @@ -31,6 +31,7 @@
      ssl_prefer_server_ciphers on;
−    ssl_protocols TLSv1.2;
+    ssl_protocols TLSv1.3;
+    ssl_session_tickets off;

The record

When your own customers or auditors ask, the answer is already written.

Every run writes to an append-only audit log that exports as CSV or NDJSON. The same records answer a client questionnaire and an ISO 27001 surveillance sample: see audit evidence and the answer pack.

Fig. 2, the audit entries run #4f2a wrote

Audit log /run #4f2a

Append-only5 entries

The audit entries run #4f2a wrote, newest first
Time	Actor	Event
14:33:19	web-03	reloaded nginx
14:32:07	dana	approved revision 7
14:29:40	alex	dry run on 3 hosts, 12 changes
14:28:55	AI	drafted 4 steps for alex
14:28:31	alex	requested Patch nginx across prod

ExportCSVNDJSON

Good to know

Moving in, scope and limits, stated plainly.

Bring what you have: Come from AWX, Rundeck or Chef. The Chef migration guide maps recipes to plans.
Built for Linux servers: Opafra connects over SSH, so it is built for Linux servers.
What is not in the record: Opafra records what goes through Opafra. Work done on a server by another route is not in these records.

Stop being the only one who can touch the servers.

Tell us what your team runs and who has to approve changes. You get a demo and your price in writing within one business day, with no call.

Get a demo