Self-hosted · Open source · Secure by design · Free forever
One console runs it all. Who gets into your Linux machines, how they prove it's really them, what they can touch, and the receipts for everything they did. Desktops, laptops, VMs, Pis and SBCs, and the server quietly running half your house from the closet. No Windows, no cloud subscription, no login you rent by the month.
Built for home offices, homelabbers, and small-to-mid-size orgs, whether that's three machines or three hundred.
First public release, landing soon.What it does
Self-hosted in Docker. Three pieces: a full web console, a control-plane server, and a small headless agent that runs on each host. You run all of it, on your own machines.
Every Linux machine you own, servers, work laptops, the homelab in the garage or shed, run from one place through a full web console. Add a person, set the rules, watch what's happening. No config files to hand-edit.
Hand someone access in seconds, and take it back just as fast when they're gone. Admins are always behind a second factor, and you can require one for everyone else with a flip of a switch.
One login for every host. Single sign-on for the whole team. Multi-factor is always on for admins, and a switch you can flip for everyone else. People and groups live in one directory.
Add a box in one line. Paste the command, click Approve in the console, done. No secret to copy around.
Keys that expire on their own. Short-lived SSH certificates instead of forever-keys sitting in authorized_keys. Granted per person, and revoking one actually works.
A record you can trust. Every privileged action lands in an append-only log nobody can quietly edit. Lines up with SOC 2, ISO 27001, NIST 800-53, and CIS.
Two steps, start to finish
One command stands up the server, one more brings a machine under management. A wizard handles everything in between. It really is this simple.
One command installs the control plane. Then a setup wizard opens in your browser and walks you through all of it: your settings, your admin account, the break-glass recovery path, and your first user accounts. No config files, nothing to guess.
Paste one command on the machine, match the short code in the console, click Approve. That's the whole enrollment. Repeat for every box you want managed.
Built to be trusted
It has to be. adamance holds the keys to every machine you point it at, so if it can't be trusted, nothing downstream can either.
So I built it the way a paranoid hobbyist would: zero trust from the ground up, mTLS everywhere, and access rules written as real code in Rego, signed and enforced on each host, that deny by default rather than fail open. Nothing gets a pass just for showing up.
The concrete stuff backs it up: SSH keys that expire on their own, secrets sealed in a vault, an audit log that flags its own tampering, and session recording that has to be live before anyone gets privileged access. Everything fails closed, so when something breaks, it breaks safe.
Security engineering wasn't bolted on at the end. It was the design process. Building each piece, I kept asking the same three questions: how would I break this, how would an attacker use it against you, and how do I close that door before it ships? A security-minded brain plus genuinely smart LLMs turns out to be a real way to build something that's actually secure, not just secure-sounding.
Then I tried to break it, over and over, with experimental AI-agent pentesting frameworks driven by a panel of frontier models (two from the US, one from China) all told to find the nastiest way in. Every finding that held up got fixed and re-tested. None of it is me reinventing cryptography; it's careful wiring of tools that already earned their trust, attacked hard and patched harder. This is the one part you don't get to be casual about.
And you won't have to take my word for it: when v1 ships, the entire 300k+ line codebase goes public on my GitHub, free for anyone to read, audit, and pick apart.
Why I'm building this
Hey, I'm Kev. I'm building adamance solo.
My day job is data analysis at a non-profit hospital. Everything else is self-taught, and has been for years: building PCs, wiring up networks, running my own servers, and lately learning to write and ship real software. I like taking things apart to see how they work, and breaking them to see how they don't.
Here's the honest reason it exists. Most teams stay on Windows for one thing: the management layer. Active Directory. One place to decide who's allowed on which machine, and to prove they are who they say. Linux never got a friendly, self-hosted version of that, so I'm making one.
Real talk: the genuinely hard parts were basically already solved for me. adamance stands on years of brilliant open-source work, FreeIPA, Keycloak, OPA, step-ca, Wazuh, OpenBao, so I didn't have to reinvent identity or cryptography or policy engines. What I did do was pour months of obsessive, careful work into wiring all of it into one console and API a normal human can actually run, without the seams showing. It's Go and React, and AGPL-3.0 licensed.
I'll own the secret sauce, too: one stubborn generalist who knows a little about a lot, paired with a genuinely smart LLM, turns out to be an absurdly capable combo. That pairing is a big part of why a solo hobbyist could pull off something this big, and honestly, we're barely scratching the surface of what it can do.
And it's yours where it counts. It runs on your hardware, answers to you, and costs nothing per seat. Big Tech keeps merging with itself and cozying up to governments, and the software that decides who gets into your machines shouldn't be rented from whoever's closest to power this week. It should be yours.
And here's the part that really lit the fire: Linux doesn't spy on you. No telemetry baked into the OS, no account you're forced to make, no quiet phone-home to a vendor. Your computer just works for you. Getting more people onto Linux means more people who genuinely own their machine again.
Mostly though, I build it because it's fun, and because every person who gives Linux a shot because of adamance is a win in my book. If that counts as a mission, then that's the mission.
- Kev
adamance is free forever. Brain fuel and compute, sadly, are not, so if it's saved you a headache, chip in and keep the project independent, and me suitably, let's say, motivated.
Privacy
adamance runs entirely on your hardware. There's no server of mine in the middle, so there's no pile of your data sitting with me, and nowhere for it to leak from. No accounts with me, no analytics, no catch.
One email when the first release ships. That's the whole list. No spam, no selling your address, and you can bail in one click.
Your address only ever gets used to tell you adamance is ready. Promise.
For businesses
adamance is free under the GNU AGPL-3.0. If you want to build on it, bundle it, or resell it without the AGPL's share-alike obligations, a commercial license is available. Reach out at kev@gurutechnology.services.