Local81
A lean, operator-readable deploy & runbook control plane. Onboard the fleet, plan, deploy, repair, and prove it. Push-based over plain SSH + rsync — no agent or daemon on your hosts — dry-run-first by default, with a tamper-evident audit ledger and compliance reporting built in.
# install — one Python package, nothing on the targets python3 -m venv .venv && source .venv/bin/activate pip install -e . # bring a fleet to readiness, then prove every run local81 onboard --hosts web,papi,napi,worker,pgdb,cache,mq,batch,cdn,jvm local81 doctor --fleet local81 plan --summary local81 deploy --latest --forks 10 local81 audit verify # tamper-evident Merkle ledger local81 audit prove --run-id <run> # O(log n) inclusion proof
Ten hosts. One operator. The BAR Exam.
We stood up ten heterogeneous Linux containers — web, API, database, cache, queue, worker, batch, CDN, JVM — and pointed Local81 at them. Every frame below is real captured output from that run: push to all ten over SSH+rsync, break two hosts on purpose, and converge them back. The kind of demo you can re-run on your own hardware.
Push to ten hosts at once. One plan, ten targets over SSH+rsync, recorded to a run journal — ok=10 changed=10.
Prove the history wasn't touched. Every deploy appends a hash-chained, Merkle-rooted entry. verify recomputes the whole chain.
Drift in, drift out. Two hosts tampered out from under us; deploy --check flags exactly those two, a re-deploy converges them, the rest no-op.
From bare hosts to deployable. Key out, read-only uptime + tooling sweep, a per-fleet readiness report — before a single byte ships.
Make landfall
onboard + doctor --fleet: key the hosts, prove they carry sshd + python3 + rsync, nothing else.
Run the line
plan → deploy → upgrade → rollback: explicit steps, content-addressed by sha256, reversible from the run journal.
Hold the line
audit verify / prove / emit: a tamper-evident ledger and signed receipts that survive an audit.
Built like a union shop.
Fleet onboarding over SSH
keys, onboard, and doctor --fleet take bare hosts to deployable: generate & copy keys, sweep uptime and tooling, write a readiness report. No agent ever lands on the target.
Desired-state deploy & repair
Plan, deploy, upgrade, roll back. Re-deploy is a no-op when nothing changed; --check detects drift and a converge run repairs only what moved — content-addressed by sha256.
Tamper-evident Merkle ledger ★
Every run appends a hash-chained, Merkle-rooted entry. audit verify proves the chain, prove gives an O(log n) inclusion proof, and emit POSTs a signed receipt to your collector.
Secrets never at rest
Config holds references, never literals — env://, bao://, sops://, delinea:// (Secret Server). Sudo passwords stream in on stdin and are scrubbed from every artifact.
Web UI & automation
Render a multi-user Semaphore front end on PostgreSQL 17, or drive the whole pipeline from an n8n workflow. The CLI stays the engine; the UI just fronts it.
Compliance & multi-DB
Read-only checks mapped to recognized control themes (AC, CM, IA, SC, AU) with inventory and advisory hardening plans — plus safe db doctor/backup/audit for PostgreSQL, Oracle, SQLite.
Operator-readable, all the way down.
No dashboards required: plans, runs, drift checks, and proofs are plain text on disk you can grep, diff, and hand to the next operator.
A tribute to Local 81.
Named for the real Local 81 — the bakery union local at the Chef Pierre plant in Traverse City, Michigan — where members ran the line for years. We borrowed that union-hall ethos on purpose: skilled hands, dependable shifts, plans you can read, and work you can trust. Every run is union-made — planned, audited, accountable.
Not just fleets — everyday jobs too.
The same control plane runs the chores everyone has. Back up your files to Google Drive, Dropbox or S3; triage and brief your inbox; sweep your machine for OS, security and virus problems — each a readable, dry-run-first, audited template.
Back up to the cloud
Documents, photos & desktop to Google Drive / Dropbox / S3 on a 3-2-1 plan — resumable and never destructive.
Security & virus sweep
Pending updates, a CIS-style score, rootkit + ClamAV scan — captured to plain text and a signed receipt.
Inbox triage & daily brief
Label what matters, move urgent mail, archive noise, and draft a one-page digest every morning.
Built in port. Proven at sea.
Run the BAR Exam yourself, or let us harden Local81 for your fleet. Construimus, Batuimus.