Change control / witnessed systems

Infrastructure changes, with witnesses.

Ryuki turns requests into signed, reviewable evidence across every site—from draft to retire. Dry-run first. Live execution only after a human gate.

Read the field guide View source

17Provider adapters

110+Catalog contracts

3,900+Tests · 100% Rust

Operations registryReadout / 01

The infrastructure your team already operates.

One governed path for the four jobs that matter: operate, protect, observe, and prove. Named integrations stay visible because infrastructure claims should be inspectable.

Current Ryuki Closed Orbit portal dashboard showing change-control state, server-boundary safeguards, decision queues, protection posture, and the live-execution gate. — Role-filtered Closed Orbit portal dashboard captured from a running instance in static dry-run mode. It uses labeled synthetic state; HTTP, secrets, raw payloads, and provider execution remain disabled.

OPS / 01

Operate

Provision, patch, image, place, and retire compute under capacity and approval policy.

VMware · Hyper-V · Proxmox · Nutanix AHV · Xen · KVM · Packer

OPS / 02

Protect

Track backup coverage, test restores, orchestrate recovery, and expose repository risk.

Veeam · Commvault · Rubrik · Cohesity · NetBackup

OPS / 03

Observe

Enroll hosts, route alerts, open maintenance windows, and detect drift across the fleet.

Zabbix · Prometheus · Datadog · Grafana · SolarWinds

OPS / 04

Prove

Reconcile inventory and seal approval, execution, CMDB, and physical-site evidence.

ServiceNow · CMDB graph · audit packs · site registry

Change switchboardReadout / 02

Nine governed states. No evidence bypass.

Every request moves through the same implemented control path. A failed request is terminal and keeps its evidence. Break-glass changes move faster, but they do not become invisible.

Draft → Intake → Validated → Planned → Approved → Locked → Executing → Verifying → CompletedSwitchboard / 01—09

State / 05

Approved

An attributed role-based decision binds the reviewed plan to the change record before a live grant can exist.

Emits
approval lineage

Post-completion lifecycleRoadmap / 10—13

ProtectBackup coverage + monitoring enrollment

PublishCMDB + service catalogue visibility

MaintainPatching + compliance + ownership

RetireGoverned decommission + final evidence

System boundaryReadout / 03

Provider access stays behind the plane.

The browser never calls a provider. The portal keeps a same-origin boundary; the API owns policy and request state; secrets resolve by handle; agents execute on infrastructure the operator controls.

Primary control pathTLS / same origin

01 / TLSBrowser

02 / SSRPortal UI

03 / POLICYPlatform API

04 / DOMAINEngine

STATE / SQLXPostgreSQL

SECRETS / HANDLEVault

EXECUTION / SIGNEDAgent

Default deny. Explicit egress only to PostgreSQL, Vault, the execution agent, and approved provider endpoints. Provider credentials do not pass through the browser or control-plane evidence.

Boundary registry4 enforced edges

Component	Stack	Control responsibility
Portal boundary	Leptos / Axum	SSR, role-filtered navigation, and same-origin browser access.
Policy plane	Axum / Rust	Authorization, validation, request state, and evidence generation.
Execution edge	Agent / Runner	Operator-deployed execution using short-lived signed grants.
State & secrets	PostgreSQL / Vault	Durable records and secret handles without browser credential flow.

One gated path to live infrastructureOperator-owned boundary

Nothing applies until the exact plan is witnessed.

Every domain can plan, validate, and record evidence without touching live systems. Live Terraform and Ansible execution runs through an operator-deployed agent only after the trust gate closes around one reviewed plan.

GrantSigned with the control plane's Ed25519 key.

BindingRequest, plan digest, approver, and expiry under 24 hours.

CredentialsRemain on operator-owned infrastructure.

Inspect the trust gate

01
Plan
The agent runs a live plan against the real backend and returns scrubbed evidence plus a digest. Nothing mutates.
02
Approve
An admin approves that exact digest. The control plane mints a short-lived signed grant bound to the request and approver.
03
Verify
The agent refuses bad signatures, wrong requests, expired grants, digest changes, or disabled live mode—and reports the refusal.
04
Apply
The agent applies the saved plan bytes, then returns redacted result evidence. Production access remains an operator decision.

Operator field guideReadout / 04

Start dry. Verify the boundary.

Bring up PostgreSQL and verify the workspace build. The field guide carries the full API, portal, configuration, and first-test sequence.

Local control plane

The default posture is safe for evaluation. Real provider credentials and live execution remain opt-in, explicitly configured, and operator-owned.

Getting started First test acceptance Configuration All documentation

Shell / build baseline

# Clone, start state, and verify the workspace
$ git clone https://github.com/mvandenbulcke/ryuki.io.git && cd ryuki.io
$ docker compose -f deploy/compose/compose.yaml up -d platform-db
$ cp .env.example .env
$ cargo build --workspace

Make every change leave a record.

Self-hosted, open source, and built for the system engineers who have to explain what changed after the maintenance window closes.

Read the field guide Inspect source

Custodian mark / RY-06

Request. Plan. Approve. Execute. Evidence.

Reviewable / signed