Launching today
Kestrix
Repo-agnostic CI control plane with DAG-based triggers.
31 followers
Repo-agnostic CI control plane with DAG-based triggers.
31 followers
Kestrix defines CI/CD pipelines in HCL and resolves them into a DAG. A task runs only when the repositories its trigger names have changed. Live task logs in a React Flow UI, and remote runners that only make outbound HTTPS requests.
Free Options
Launch tags:Developer Tools
Launch Team / Built With
CloudflareStill paying to deploy your apps? Try Cloudflare Workers for free
Promoted
Hi Product Hunt!
I'm Damian, the author of Kestrix.
I built it for myself, to keep my DevOps projects separate from my coding projects. Kestrix treats repositories as inputs rather than as owners of the pipeline, so one pipeline definition can react to changes in several repositories.
What it does:
1. Pipelines in HCL: Pipelines are declared with variables, dependencies, and trigger expressions instead of per-repository YAML.
2. DAG per run: Kestrix resolves a Directed Acyclic Graph for every run. A task runs when its trigger matches the changed repositories, and tasks that don't match are skipped.
3. Runners: Remote runners make only outbound HTTPS requests, so they need no inbound ports. In Docker mode, tasks run with `--cap-drop ALL` and `no-new-privileges`.
4. Terraform / OpenTofu: The provider (`terraform-provider-kestrix`) manages Kestrix projects.
Kestrix is self-hostable: one binary plus PostgreSQL, or Docker Compose. The source is public under PolyForm Noncommercial 1.0.0. It is free for non-commercial use, and commercial use needs a paid plan.
Repository: https://gitlab.com/kestrix/kestrix (GitHub mirror: https://github.com/Draqun/kestrix). Docs: https://kestrix.gitlab.io/kestrix/
Do you think this will catch on? Am I the only one who prefers to keep DevOps projects separate from strictly software development projects?
The remote runners making only outbound HTTPS requests is the part I'd want to understand first — with no inbound ports, how do live task logs get back to the React Flow UI, and what happens to a run if that outbound connection drops mid-task?
My free GitHub Actions minutes ran out this month so my CI now runs on my Mac at home. Can a Kestrix runner work behind a home router like that? And if three merges land during one run, does it run once on the newest commit?
Seeing why a task was skipped would matter as much as its logs here. With several repositories in one pipeline, the trigger needs to be easy to inspect.
@oleksii_sekundant Great catch, and I completely agree with that — debugging a skipped task without knowing which condition evaluated to false (especially across multiple repos) is frustrating. I'll work on it soon: we can surface the trigger expression along with the skip reason (e.g., in the task details panel / tooltip) so it's immediately obvious why it didn't run. I'll update the PR once it's in place. Thanks!