HOMELAB CONTROL PLANE · SOVEREIGN ORCHESTRATION

Orchestrate, converge,
and secure your infrastructure.

An unprivileged control plane for self-hosted fleets. Run Ansible playbooks with factual drift detection, manage OpenTofu remote state with plan diffs and approval gates, and store envelope secrets with age encryption. Everything runs through one serialized queue in plain SQLite with zero sudo and zero SaaS dependencies.

Explore Capabilities Deploy in 60s Documentation →

Ansible AWX Alternative OpenTofu Remote State Age Envelope Secrets Exit-Code Truth Zero Sudo MCP Agent Protocol

INTERFACE AS A FUNCTIONAL CONTRACT

Healthy is quiet. Failure is loud.

An instrument panel built for rapid comprehension under operational stress. Signal colour is spent only where an operator decision is required. Every state is a word plus a colour.

exocomp Web Dashboard in dual Obsidian and Lab Notebook themes

Dual-theme Web Console. Obsidian dark mode on the left and warm Lab Notebook light mode on the right across real-time queue rows, reachability checks, and attention bands.

Web Console Spec →

STANDARDS-BASED CAPABILITIES

Pinned tools. Standard protocols.

exocomp coordinates state ledgers, schedules, and security sandboxes, delegating execution to established open source tools without proprietary formats.

CONFIGURATION MANAGEMENT

Ansible Core

Replaces AWX and Semaphore for homelabs. Runs playbooks and ad-hoc commands across your inventory with check-mode drift detection and automatic SSH fleet key distribution.

CLI & Playbook Ledger

INFRASTRUCTURE AS CODE

OpenTofu

Built-in HTTP remote state backend and execution runner. Delivers automated plan diffs with resource change counters, CEL policy verification, and gated applies before modifying infrastructure.

State & Plan Diff Engine

DISASTER RECOVERY

Restic & Litestream

Per-second SQLite WAL replication via Litestream combined with scheduled deduplicated, encrypted Restic snapshots to local NAS or S3 endpoints.

3-Leg Redundancy

ENCRYPTION & SECRETS

Age & SOPS

Envelope encryption using modern age keys. Secrets stay encrypted at rest and in git, decrypted in memory only inside the sandboxed execution boundary.

Envelope Cryptography

AGENT INTEGRATION

Model Context Protocol

Native Model Context Protocol (MCP) server at /mcp. Lets autonomous coding agents query fleet posture, inspect workspaces, and trigger queued actions with scoped tokens.

POST /mcp Endpoint

MOBILE COMPANION · COMING SOON

Mobile Approvals Coming Soon

Currently in development. Direct mobile alerts without cloud intermediaries. Receive notifications on your phone with action buttons to approve or reject mutating jobs directly from the lock screen.

Coming Soon · ntfy Gateway

SYSTEM INVARIANTS

Architectural rules that never yield.

Every execution path, data model, and user interface surface is governed by immutable constraints. Breaking any of these fails review.

INVARIANT 01

One operator, single process, plain SQLite

No external database. No PostgreSQL cluster, no Redis queues, and no distributed consensus. Runs directly as a user systemd service or inside a rootless container with WAL-mode SQLite and continuous Litestream replication to S3 or SFTP.

Storage: SQLite WAL Local File

INVARIANT 02

Zero bespoke data formats

Nothing is stored in a proprietary format. Data stays in plain restic repositories, plain git bundles, plain age or SOPS envelope files, and standard OpenTofu state files. Recovery requires only standard open source tools.

Tools: restic · age · git Portable

INVARIANT 03

Exit codes decide correctness

Subprocess truth is strictly exit 0 versus non-zero. Parsed output enriches the user interface and agent queries, but exit codes strictly dictate state transitions, ledgers, and notifications.

Execution: Exit Codes Deterministic

INVARIANT 04

Secrets never leak

Secrets never appear in logs, CLI flags, job events, docs, commits, or test fixtures. Run secrets are injected via Landlock and bwrap sandboxed memory pipes or scrubbed environment variables.

Sandboxing: Landlock / bwrap Zero leakage

INVARIANT 05

The one queue is the only executor

Every execution path routes through the single FIFO job queue. Concurrency keys, execution locks, and approvals live in the queue engine rather than scattered application logic.

Queue: Serialized FIFO Lock Protected

INVARIANT 06

Zero sudo across the system

Nothing in exocomp runs root. It runs unprivileged as your host user or inside a rootless container. Work requiring elevation on target machines is delegated through explicit operator-approved flags.

Privilege: Unprivileged Host User Audited

COMMAND ERGONOMICS

Designed for operators and autonomous agents.

Predictable flags, muscle-memory guards, per-host structured JSON output, and real-time polling progress.

CLI Contract · Exit Code Driven

$ exocomp command --host 'web*' --output json -- hostname -f

{"schema_version":1,"kind":"command.result","data":{"job_id":42,"state":"succeeded","exit_code":0,"hosts":{"web01":{"status":"CHANGED","rc":0,"changed":true,"stdout":"web01.internal.homelab"},"web02":{"status":"CHANGED","rc":0,"changed":true,"stdout":"web02.internal.homelab"}}}}

DISASTER RECOVERY PROPERTY

Restore onto dead hardware in 5 minutes.

Disaster recovery never depends on exocomp itself, a running daemon, or an online container registry. Recovery relies entirely on standard POSIX tools.

STEP 1 The Recovery Card

Physical Age Key

At bootstrap, exocomp generates a printed recovery card containing the master age private key and storage locations.

STEP 2 Cold Storage Fetch

Fetch Encrypted Snapshot

Retrieve the encrypted Restic repository or Litestream WAL replica from your NAS, S3 bucket, or offsite storage.

STEP 3 Execute recovery.sh

Zero-Dependency Restore

Run recovery.sh on any clean Linux machine. Standard age and restic tools decrypt your database and fleet keys.

STEP 4 Instant Takeover

Restart Service or Container

Point your restored directory to a new service instance or rootless container. The daemon boots immediately with all state and secrets intact.

DEPLOYMENT FREEDOM

Host service or rootless container. Your choice.

No external PostgreSQL cluster, no Redis queues, and no background worker sidecars. exocomp is a single static Go binary. Run it natively as a user systemd service on your host or inside an unprivileged rootless container.

Loopback · Port 8080 · Plain SQLite

mkdir -p ~/.config/systemd/user
cat << 'EOF' > ~/.config/systemd/user/exocomp.service
[Unit]
Description=exocomp homelab control plane
After=network.target

[Service]
ExecStart=%h/.local/bin/exocompd --port 8080
Restart=always
RestartSec=5s
Environment=XDG_DATA_HOME=%h/.local/share

[Install]
WantedBy=default.target
EOF
systemctl --user daemon-reload && systemctl --user enable --now exocomp

Orchestrate, converge,and secure your infrastructure.