Tools for running systems, built so the risky change is the hard one to make by accident.
Philosophy · About · Projects · Also here · Contributions · Get involved
English · 한국어
Most of what we work on starts the same way: something important is configured by hand, on a box, and the only record of why it looks like that is the person who did it. These projects turn that into something you can read, review, and undo.
For infrastructure control planes, the design goal is to declare the desired state, preview changes, and apply them in a way you can back out of. Actual support varies by project; each repository's README describes its scope and current stage.
 |
Henry Jang (장효찬) · @mack-erel Backend / infrastructure engineer. This org publishes infrastructure tools and independent projects. Each repository's README describes its scope and development stage.
Day job Side projects (what's below) |
These principles guide the infrastructure control planes; implementation varies by project.
| Principle | What it means |
|---|---|
| Desired state, not commands | Declare what should be true; tools reconcile only what they manage. |
| Plan before apply | Preview changes before applying them. |
| Safe by construction | Design for rollback, commit/confirm, and post-change verification. |
| Equal-power surfaces | Keep GUI, API, and CLI as equivalent interfaces where offered. |
| Light on dependencies | Prefer small dependency sets and familiar runtimes. |
| Open by default | Public issue trackers and READMEs that are clear about what is not finished yet. Check each repository for its license. |
|
Split-horizon DNS control plane — one desired state for internal DNS and Cloudflare | |
|
A control plane for nginx — HTTP, TCP, and UDP reverse proxying and load balancing | |
|
A host firewall you can't lock yourself out of — declarative nftables with auto-rollback | |
|
An open-source identity provider — one SvelteKit app, deployable to Cloudflare Workers or Node; OIDC, SAML 2.0, WebAuthn/Passkey, TOTP, LDAP | |
|
A mail server built from scratch — SMTP, IMAP, POP3, JMAP, ManageSieve, LMTP, zero runtime dependencies | |
|
OmniRoute member and usage layer — in development |
More are on their way here. Each repository's own README is the source of truth for what it does and how finished it is.
Smaller, standalone tools that don't need a control plane of their own:
|
A JDBC driver for Cloudflare D1 — zero-dependency, REST API or self-deployed Worker proxy | |
|
Converts WHOIS responses into RFC 9083 RDAP-shaped JSON | |
|
Unofficial experimental project to use the DJI Cellular Dongle 2 as a macOS LTE modem |
Work in other people's projects, kept here as forks — all listed pull requests have been merged:
| Repository | Pull requests |
|---|---|
| |
| |
|
Issues and pull requests are welcome on any repository. If you are running one of these in anger and something is missing, an issue describing your setup is more useful than a feature request in the abstract.