❌

Normal view

Received — 29 October 2026 ⏭

Kestrix: CI/CD pipelines defined in HCL outside the repositories, with DAG-based triggers

✇posts from Frontend, drupal, Panama, reactjs, devops, selfhosted, webhosting, Wordpress, web_design, webdev, PHP, technology, ProgrammerHumor, CRM
By: /u/Draqqun
29 October 2026 at 02:08
Kestrix: CI/CD pipelines defined in HCL outside the repositories, with DAG-based triggers

Hey r/devops,

I built Kestrix (https://gitlab.com/kestrix/kestrix) for myself, to keep my DevOps projects separate from my coding projects. It is a repo-agnostic CI/CD control plane written in Go. Repositories are inputs, and the pipeline is defined separately in HCL (pipeline.tf) instead of in a .gitlab-ci.yml or workflow file inside each repository.

What a pipeline looks like

project "platform_services" { default_image = "golang:1.25-alpine" ci_repo "core" { path = "services/core" } ci_repo "api" { path = "api/v1" } ci_task "unit_tests" { trigger = "repo.core.changed || repo.api.changed" execute { repo = "core" script = "go test ./..." } } ci_task "build_container" { trigger = "repo.core.changed" depends_on = ["unit_tests"] execute { repo = "core" script = "docker build -t app:latest ." } } ci_task "deploy_staging" { trigger = "repo.core.changed" depends_on = ["build_container"] execute { repo = "core" script = "tofu apply -auto-approve" } } ci_task "gate_production" { trigger = "repo.core.changed" manual = true depends_on = ["deploy_staging"] execute { repo = "core" script = "echo approved" } } }

I checked this example with kestrix validate.

How it behaves

  • Trigger resolution: Kestrix parses dependencies, rejects cycles, and evaluates each trigger against the repositories that changed. If only api changed, unit_tests runs and the tasks triggered only by core are skipped.
  • Single-task reruns: If one integration test dies on a network timeout, you rerun that node from the UI and only that task executes.
  • Manual gates: manual = true pauses a task until an operator approves it.
  • Remote runners: They make only outbound HTTPS requests, so they need no inbound ports. In Docker mode, containers run with --cap-drop ALL, --security-opt no-new-privileges, and a PID limit (default 256).
  • Terraform / OpenTofu: terraform-provider-kestrix manages Kestrix projects (kestrix_project).

License

The source is public under PolyForm Noncommercial 1.0.0. It is free for non-commercial use, and commercial use needs a paid plan (from $3/month). It is not an OSI open-source license.

Limits

One serve process per database is supported. Multi-instance coordination is not implemented.

Do you think this will catch on? Am I the only one who prefers to keep DevOps projects separate from strictly software development projects?

submitted by /u/Draqqun to r/devops
[link] [comments]
❌