Break free from Big Tech.
Active Directoryfor Linux.
One web dashboard runs it all. Logins, what each person can touch, and a record of everything they do.
Expected before the end of 2026
Identity, access, and audit in one place.
The control of Active Directory, none of the Windows baggage, and none of the learning curve.
adamance decides who gets into your machines, controls what each person is allowed to do once they're in, and keeps a tamper-evident record of all of it. No per-machine accounts, no SSH keys scattered across boxes, no spreadsheet of who can touch what.
The same dashboard manages a single machine or a fleet of hundreds, and it stays just as simple as you grow. No Windows, no cloud subscription, no login you rent by the month. No telemetry, no middleman, no BS. Built for home labs, home offices, and small-to-mid-size orgs.
Where it stands. Every feature here is designed. Most is built, the rest is being built. The first public release lands before the end of 2026, and probably sooner: that's the worst case rather than the plan. If something isn't ready, the date moves before the bar does.
Self-hosted in Docker.
The server runs the web console and the control plane; every host you manage runs one small, headless agent.
If it's 64-bit, it almost certainly runs. That's virtually every machine and VM built in the last decade, x86 or ARM.
Then add what you actually need. A private Tailscale mesh instead of open ports, Wazuh for threat detection, and a second approver on sensitive access.
All off by default, and adamance runs perfectly well without any of them. See what's optional, and what lands after v1.
One console, and you can look around it now.
Logins, what each person may touch, and the record of what they did, on one screen. Seven of its fullest screens in four themes, screenshots of the real thing rather than mockups.
Two commands, start to finish. Three if you check it first.
One command stands up the server, one more brings a machine under management. A wizard handles everything in between. There are two ways in, and the slower one is the one I would take.
Clone it, and verify what you got
$git clone https://github.com/kevwillow/adamance $git -C adamance rev-parse HEAD
Compare that one line against the release commit published on this site.
Install from the source you just checked
$cd adamance && ./deploy/setup/install.sh
Now nothing has run on your machine that you did not verify first.
Bring a machine under management
$curl -fsSL https://your-server-ip-or-fqdn/api/v1/enroll | sudo bash
The same command as the easy path, and on this path it is not the same risk, which is the point of having done the first two steps.
Stand up the server
$curl -fsSL https://get.adamance.dev | sh
One command installs the control plane. Nothing to download first and nothing to compile: every artifact it fetches is signature-checked before it unpacks or runs any of it. The one thing that cannot check itself is the script you just piped into a shell, which is the whole reason the path above exists. Then a setup wizard opens in your browser and walks you through the rest: your settings, your admin account, the break-glass recovery path, and your first user accounts. No config files, nothing to guess.
Enroll a host
$curl -fsSL https://your-server-ip-or-fqdn/api/v1/enroll | sudo bash
Paste one command on the machine, match the short code in the console, click Approve. That's the whole enrollment. Repeat for every box you want managed.
Your whole fleet, one screen.
Run every Linux machine you own, servers, workstations, and laptops alike, from one place through a full web console. Add a person, set the rules, watch what's happening. No config files to hand-edit.
Access you actually control.
Hand someone access in seconds, and take it back just as fast when they're gone. Grants are per person and scoped to the machines they need, so nobody ends up with a leftover account on a box nobody checks anymore.
Hand over a slice, not the keys.
Helping someone shouldn't mean making them an admin. Scope an operator to part of the estate, give an auditor read-only with no SSH and no secrets, or delegate a subset of what you already hold. Nobody gets the whole fleet just because they needed one corner of it.
One login for every host.
Single sign-on for the whole team. Sensitive actions ask admins for a second factor, on by default, and everyone else is one switch away. You can drop that requirement on a small setup. Every person and group lives in one directory, not a separate account on each machine.
Add a box in one line.
Paste the command, click Approve in the console, done. No secret to copy around.
Keys that expire on their own.
Ephemeral SSH certificates instead of forever-keys sitting in authorized_keys. Each one is granted per person and expires exactly when your policy says it should, down to the second. Revoke one and it's gone, not still sitting in a file on some box you forgot about.
A record you can trust.
Every privileged action lands in an append-only, hash-chained log. Change one entry and the chain breaks, so you find out. An encrypted copy ships off the box on a timer, so if someone takes the whole system, the record of how they did it is already somewhere they never touched.
The server can go down. Your rules don't.
Every host holds a signed copy of the policy and decides locally, so the decision is made on the machine, by the machine.
It picks itself back up.
A watchdog notices when something has wedged and restarts it, usually before you'd have known. What it won't do is quietly paper over a security failure. Self-healing should save you a 2am reboot, not hide the one alert you needed to see.
Keep your Active Directory, or be it.
Already run AD? adamance sits alongside it. Nothing gets copied and nobody gets a second password. Joining the two takes real setup, once, by someone with domain admin rights. Or switch on the optional Samba module and adamance becomes the domain itself, with Windows machines joining it natively. How both work.
Sensitive actions ask again.
Signing in once is not a licence to do anything for the rest of the day.
Watch any privileged session back.
SSH and sudo sessions are recorded, signed, and played back in the console. Require it on the machines that warrant it, and privileged access is gated on the recorder being live: if it isn't recording, it isn't happening.
Ask the rules before you commit.
Describe a situation, a person, a host, a command, and the policy engine tells you what it would decide and why, without touching anything. Try a draft rule the same way, in a sandbox that cannot touch what your hosts are enforcing. How the dry run works.
Upgrades that can undo themselves.
Every upgrade snapshots first, verifies the new version came up clean, and rolls itself back automatically if it didn't. Backup and restore are one command each, so a bad day ends in a restore instead of a rebuild from memory.
Access that hands itself back.
Guest accounts for the contractor, the friend helping out for a weekend, the vendor who needs one box on Tuesday. Ephemeral certificates that expire on their own, so the cleanup happens whether or not anybody remembers to do it.
No single point of failure.
The machine that decides who gets in shouldn't be the one you can't afford to lose. Run the control plane highly available and a failure becomes a failover instead of an outage. Entirely optional: one server is a perfectly good way to start, and this is here for when that stops being enough.
See what it's actually doing.
Grafana and Prometheus dashboards ship with it, so the health of the control plane and every host is a screen you look at rather than a log you go digging through. Point them at your own monitoring instead if you already run some.
Mapped to the standards you answer to.
Controls mapped to SOC 2, ISO 27001, NIST 800-53, FedRAMP Moderate, HIPAA and PCI DSS, with CIS benchmarks scored on every host.
Your agent shouldn't be you.
An agent that can run commands on your machines is a coworker, not a tool. Give it what a coworker gets, and nothing more.
Ask what account your agent is using right now. For most setups it's yours: your keys, your reach, your name on every line of the log. That isn't the agent misbehaving. Nobody ever gave it anything smaller to work with.
So give it something smaller. Its own identity, scoped to these machines, these commands, this long.
How agent accounts will work, in detailSecurity is the whole point.
It has to be. adamance holds the keys to every machine it manages, which makes it the most sensitive thing you run. Get this part wrong and nothing else about it matters.
So I built it the way a paranoid hobbyist would: zero trust from the ground up, mTLS everywhere, deny by default at every layer. The actions that matter most need a real admin's sign-off before they go through. Nothing gets a pass just for showing up.
The backbone is built on proven technology: ephemeral SSH certificates, post-quantum key exchange between every agent and the server, and certificate verification everywhere.
Policy as code, not policy on paper.
Every access rule is real, version-controlled Rego, signed and enforced on each host, so what's allowed is auditable and provable, not a matter of trust or someone's memory.
Hardened by design, not by luck.
Read the threat model for what that covers and what it deliberately does not, or go straight to the documents themselves.
Encrypted at rest, not just in transit.
Sensitive fields are encrypted by adamance itself, in the database and in every backup, never plaintext columns.
Anchored to the hardware, if you have it.
If your server has a TPM chip, setup finds it and seals the vault's keys to that specific machine, so they're never sitting readable on the disk.
Tamper-evident audit, not just logs.
Every action lands in an append-only, hash-chained trail (HMAC-SHA256).
Evidence out of reach.
Set it up, and adamance backs up the audit log off-box on a timer, to email, a git repo, or external storage.
Security engineering wasn't bolted on at the end. It was the design process.
I put just as much work into breaking it, with experimental AI-agent pentesting frameworks driven by a panel of frontier models (two from the US, one from China) all told to find the nastiest way in.
You won't have to take my word for it, either: when v1 ships, the entire codebase goes public on my GitHub, free for anyone to read, audit, and pick apart.
And it ships when it is ready, not on a date. That means the mitigations in the threat model are actually implemented, an external review has been through it and its findings are fixed, and every claim on this site has been checked against the code that is supposed to back it. The date moves before the bar does.
I want more people on Linux.
Most teams stay on Windows for one thing: the management layer. Active Directory. One place to decide who is allowed on which machine, and one login for all of them instead of a separate account on every box. Linux never got a friendly, self-hosted version of that, so I am making one.
No online account you are forced to make, no telemetry, nothing phoning home. Your machines answer to you. Every person who gives Linux a shot because adamance made the management side bearable is a win in my book. The longer version, and who is behind it.
adamance is free forever. Brain fuel and compute aren't. If it's saved you a headache, chip in to keep the project independent, and me suitably motivated. What it costs to build.
Multi-forest federation.
One adamance server runs a site. A forest ties many of them into a single organization: a root realm, child realms beneath it, and trusts between them, so a person in one realm can be granted access in another without ever getting an account there.
A trust is a door between two organizations, which makes it the most security-sensitive thing adamance will ever do. It lands after v1 on purpose. This one gets built slowly.
How multi-forest federation will workNothing about you leaves your hands.
adamance runs entirely on your hardware. I don't run a server in the middle, so there's no copy of your data on my side, nothing to breach, subpoena, or sell. Your data has nowhere to go but your own machines.
No telemetry, ever
adamance never phones home or sends a single byte back to me.
Local and yours
Your identities, policies, logs and secrets live on your machines, under your control, and never leave.
Airgapped if you want it
Once it is set up, adamance runs with no internet at all, for the environments where that is the requirement rather than a preference.
Open, no black boxes
Built from open source top to bottom, adamance included, under the GNU AGPL-3.0. The entire codebase is yours to audit, every line, nothing hidden.
Know the moment it's live.
One email when the first release ships, which I expect before the end of 2026. That's the whole list.
No spam, no selling your address, and you can bail in one click. Promise.
Commercial licensing.
adamance is free under the GNU AGPL-3.0. If you want to build on it, bundle it, or resell it without the AGPL's share-alike obligations, a commercial license is available. Reach out at kev@gurutechnology.services.