adamance ← back home
Under the hood

Specs, stack & features.

The short version of everything adamance does. It's a lot for a hobby project, but I don't like leaving gaps where the important stuff goes.

Identity & access

  • Single sign-on over OIDC, with MFA and step-up on sensitive actions
  • One directory for people and groups (FreeIPA / Kerberos)
  • Short-lived SSH certificates, no standing keys in files
  • Per-person grants, optional dual-control approvals
  • One-line host enrollment with approve-to-join

Policy & enforcement

  • Policy as code in Rego, evaluated by OPA
  • Signed policy bundles pushed to every host
  • Governs SSH, sudo, and the firewall (ACLs via UFW)
  • Deny-by-default, fail-closed
  • Enforced locally on each host, keeps working offline

Network & transport

  • mTLS enforced everywhere, mutual certs, both directions
  • Tailscale private-mesh integration
  • Encrypted end to end

Audit & compliance

  • Append-only, hash-chained audit log with tamper detection
  • Session recording, gate privileged access on it
  • Reports mapped to SOC 2, ISO 27001, NIST 800-53, CIS

Secrets & supply chain

  • Sealed vault for secrets (OpenBao)
  • Key custody anchored to real hardware (TPM)
  • Ed25519-signed release bundles with an SBOM (cosign)

Run & operate

  • Self-hosted in Docker: web console, control-plane server, headless host agent
  • One-command install with a browser setup wizard
  • One-command upgrade and rollback, auto-rollback on failure
  • Command-line tool plus a self-service user portal
  • High availability, Grafana / Prometheus dashboards
  • Backup and restore, self-healing watchdog
  • Root-gated break-glass recovery

Foundations

  • Go and React
  • GNU AGPL-3.0 (commercial licenses available)
  • 300k+ lines, public on GitHub at v1

Tested hard

  • Red-teamed with experimental AI-agent pentesting frameworks
  • Reviewed by a panel of frontier models (US and China)
  • Every finding that held up got fixed and re-tested
Built on

The open-source foundation.

This is the industry-standard, battle-hardened open source that's quietly run serious infrastructure for years, each project brilliant and best-in-class at its one job. adamance doesn't reinvent any of it. It wires them together behind a single console, and gets out of the way.

FreeIPAIdentity, groups, and Kerberos, the directory every host checks against
KeycloakSingle sign-on, OIDC, and step-up MFA
OPAThe policy engine, access rules written in Rego
step-caThe certificate authority, short-lived SSH and TLS certs
OpenBaoThe sealed secrets vault
PostgreSQLThe data store, over TLS
Grafana + PrometheusMetrics and dashboards
DockerHow the whole thing ships and runs
Go + ReactThe control plane, host agent, and web console
Optional

Flip on what you need.

Off by default, enabled per deployment. adamance runs great without any of them.

WazuhSIEM, file-integrity monitoring, and threat detection
TailscaleReach your fleet over a private mesh instead of the open internet
Dual-controlRequire a second approver before sensitive grants go through
On the roadmap

Coming down the line.

Not in the first release, but this is where it's headed.

Guest accountsLocked-down, temporary access with ephemeral certs that expire on their own
Kids accountA hardened, locked-down account type for family and shared machines
DNS sinkholeNetwork-wide ad, tracker, and malware-domain blocking, wired into Pi-hole, NextDNS, or your VPN
Get notified when it ships → ← Back to the overview Commercial licensing