Hey r/devops,

I built Kestrix (https://gitlab.com/kestrix/kestrix) for myself, to keep my DevOps projects separate from my coding projects. It is a repo-agnostic CI/CD control plane written in Go. Repositories are inputs, and the pipeline is defined separately in HCL (pipeline.tf) instead of in a .gitlab-ci.yml or workflow file inside each repository.

What a pipeline looks like

project "platform_services" { default_image = "golang:1.25-alpine" ci_repo "core" { path = "services/core" } ci_repo "api" { path = "api/v1" } ci_task "unit_tests" { trigger = "repo.core.changed || repo.api.changed" execute { repo = "core" script = "go test ./..." } } ci_task "build_container" { trigger = "repo.core.changed" depends_on = ["unit_tests"] execute { repo = "core" script = "docker build -t app:latest ." } } ci_task "deploy_staging" { trigger = "repo.core.changed" depends_on = ["build_container"] execute { repo = "core" script = "tofu apply -auto-approve" } } ci_task "gate_production" { trigger = "repo.core.changed" manual = true depends_on = ["deploy_staging"] execute { repo = "core" script = "echo approved" } } } 

I checked this example with kestrix validate.

How it behaves

• Trigger resolution: Kestrix parses dependencies, rejects cycles, and evaluates each trigger against the repositories that changed. If only api changed, unit_tests runs and the tasks triggered only by core are skipped.
• Single-task reruns: If one integration test dies on a network timeout, you rerun that node from the UI and only that task executes.
• Manual gates: manual = true pauses a task until an operator approves it.
• Remote runners: They make only outbound HTTPS requests, so they need no inbound ports. In Docker mode, containers run with --cap-drop ALL, --security-opt no-new-privileges, and a PID limit (default 256).
• Terraform / OpenTofu: terraform-provider-kestrix manages Kestrix projects (kestrix_project).

License

The source is public under PolyForm Noncommercial 1.0.0. It is free for non-commercial use, and commercial use needs a paid plan (from $3/month). It is not an OSI open-source license.

Limits

One serve process per database is supported. Multi-instance coordination is not implemented.

• Repository: https://gitlab.com/kestrix/kestrix (GitHub mirror: https://github.com/Draqun/kestrix)
• Documentation: https://kestrix.gitlab.io/kestrix/

Do you think this will catch on? Am I the only one who prefers to keep DevOps projects separate from strictly software development projects?