README
¶
devopus-server
The workspace platform of Devopus: one workspace
per installation, with its members and roles (owner, maintainer, developer), invites,
projects and their versioned settings, end-to-end encrypted secrets, the agents' link,
sign-in by email code at /auth and the workspace's web interface. It runs no
containers of the projects: the agents on the team's machines do.
This is the open core. Run it yourself — see self-hosting:
curl -fsSL https://raw.githubusercontent.com/amalychev/devopus-server/main/install.sh | sh
sudo devopus-server install --domain ws.acme.com --workspace acme --owner owner@acme.com \
--mail smtp://user:password@smtp.acme.com:587 --mail-from devopus@acme.com
then, on your machine, devopus login ws.acme.com. Or with Docker Compose — the image
ghcr.io/amalychev/devopus-server and PostgreSQL (docker-compose.yml,
behind a proxy of your own docker-compose.proxy.yml):
curl -fsSLO https://raw.githubusercontent.com/amalychev/devopus-server/main/docker-compose.yml
# .env: DEVOPUS_DOMAIN, DEVOPUS_WORKSPACE, DEVOPUS_OWNER, DEVOPUS_MAIL, POSTGRES_PASSWORD
docker compose up -d
Layout
| Package | What |
|---|---|
cmd/devopus-server |
The binary: the core, with no extensions |
command |
Its commands (run, install, status, backup, restore, upgrade, uninstall), for builds with extensions |
platform |
The platform: API, access checks, roles, invites, projects, secrets, servers; platform.Extensions |
auth |
Sign-in: codes, sessions, access tokens, their keys |
authz |
Roles and their permissions |
selfhost |
Installing and keeping a platform on Ubuntu with systemd and Docker |
platformtest, pgtest |
A platform and PostgreSQL for tests, here and in the CLI's |
web |
The workspace's web interface (React); its build is committed in platform/webdist |
The contracts — proto, settings, signing, secrets — are in devopus-api.
Extensions
platform.Config.Extensions is how another build adds to the core; the core sets none.
| Point | What |
|---|---|
Policy |
Asked before an invite, joining by invite, a project, a server, an environment; a refusal's reason reaches the CLI and the web |
Setup |
The workspace and its owner at the first start, instead of --workspace and --owner |
Mount |
HTTP handlers and RPC of its own; Service.Check() is the access check for them |
Plan |
The plan GetWorkspace, devopus workspace show and the web show |
A build with extensions runs the same commands: command.Main(version, platform.Extensions{…}).
Development
devopus-server run --workspace acme --owner you@acme.dev # PostgreSQL: $DEVOPUS_SERVER_DATABASE_URL
go test ./... # PostgreSQL in Docker, or $DEVOPUS_TEST_DATABASE_URL
go tool -modfile=tools/go.mod sqlc generate -f platform/store/sqlc.yaml
(cd web && npm ci && npm run gen && npm run build) # rebuild and commit platform/webdist
To change the contracts along with the platform, put a clone of devopus-api next to
this one and use a go.work (not committed):
go work init . ../devopus-api
License
AGPL-3.0. The contracts (devopus-api) and the CLI (devopus) are Apache-2.0.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package auth is sign-in (ADR-0024, docs/architecture/auth.md): accounts, sign-in by email and one-time code, the browser (OAuth 2.0 + PKCE) and device (RFC 8628) flows, access and refresh tokens, sessions and JWKS.
|
Package auth is sign-in (ADR-0024, docs/architecture/auth.md): accounts, sign-in by email and one-time code, the browser (OAuth 2.0 + PKCE) and device (RFC 8628) flows, access and refresh tokens, sessions and JWKS. |
|
mail
Package mail sends Auth's emails: the sign-in codes.
|
Package mail sends Auth's emails: the sign-in codes. |
|
store
Package store is the database of accounts and sign-in (schema auth): the schema (migrations), the queries (sqlc) and the migration runner.
|
Package store is the database of accounts and sign-in (schema auth): the schema (migrations), the queries (sqlc) and the migration runner. |
|
token
Package token signs and checks Devopus access tokens: JWTs signed with Ed25519 (alg EdDSA) whose public keys Auth publishes as JWKS.
|
Package token signs and checks Devopus access tokens: JWTs signed with Ed25519 (alg EdDSA) whose public keys Auth publishes as JWKS. |
|
Package authz is the list of permissions, the roles that bundle them and the check (ADR-0023, docs/product/roles.md).
|
Package authz is the list of permissions, the roles that bundle them and the check (ADR-0023, docs/product/roles.md). |
|
cmd
|
|
|
devopus-server
command
devopus-server is the workspace platform of the core: no extensions (ADR-0021).
|
devopus-server is the workspace platform of the core: no extensions (ADR-0021). |
|
Package command is devopus-server's commands: the workspace platform (ADR-0021) — members, projects, settings, secrets, the agents' link and the workspace's web interface — and the installation of a self-hosted one on an Ubuntu server (docs/self-hosting.md).
|
Package command is devopus-server's commands: the workspace platform (ADR-0021) — members, projects, settings, secrets, the agents' link and the workspace's web interface — and the installation of a self-hosted one on an Ubuntu server (docs/self-hosting.md). |
|
Package pgtest gives tests a real PostgreSQL: one container per test binary, a fresh database per test.
|
Package pgtest gives tests a real PostgreSQL: one container per test binary, a fresh database per test. |
|
Package platform is the platform of one workspace (ADR-0021): it keeps the workspace's members, roles, permissions, invites, projects and the audit log.
|
Package platform is the platform of one workspace (ADR-0021): it keeps the workspace's members, roles, permissions, invites, projects and the audit log. |
|
store
Package store is the workspace server's database: the schema (migrations), the queries (sqlc) and the migration runner.
|
Package store is the workspace server's database: the schema (migrations), the queries (sqlc) and the migration runner. |
|
Package platformtest runs a real workspace platform for tests of its clients: the CLI and the agent.
|
Package platformtest runs a real workspace platform for tests of its clients: the CLI and the agent. |
|
Package selfhost installs the workspace platform on a customer's own server (ADR-0021): Ubuntu 24.04+ with Docker and systemd.
|
Package selfhost installs the workspace platform on a customer's own server (ADR-0021): Ubuntu 24.04+ with Docker and systemd. |
|
Package update is how a self-hosted platform learns of its new releases and applies one when its owner asks, the way GitLab tells an instance's admins "update available": the platform checks the releases of devopus-server now and then and shows the owner what is out.
|
Package update is how a self-hosted platform learns of its new releases and applies one when its owner asks, the way GitLab tells an instance's admins "update available": the platform checks the releases of devopus-server now and then and shows the owner what is out. |
Click to show internal directories.
Click to hide internal directories.