Tools for running systems, built so the risky change is the hard one to make by accident.
Philosophy · About · Projects · Also here · Contributions · Get involved
English · 한국어
Most of what we work on starts the same way: something important is configured by hand, on a box, and the only record of why it looks like that is the person who did it. These projects turn that into something you can read, review, and undo.
Whatever the subject, they take the same shape — you declare the state you want, the tool shows you what will change, and it applies that change in a way you can back out of.
 |
Henry Jang (장효찬) · @mack-erel Backend / infrastructure engineer. This org is where the tools above land once they're finished enough for a README, a license, and a build badge — smaller scripts and day-to-day experiments stay on the personal account until one of them earns a spot here.
Day job Side projects (what's below) |
| Principle | What it means |
|---|---|
| Desired state, not commands | You declare what should be true. Reconciliation is the tool's job, and it only ever touches what it manages. |
| Plan before apply | Every change is previewable. You see the impact before anything moves. |
| Safe by construction | Rollback timers, commit/confirm, verification after the change lands. The move that breaks things is hard to make by accident. |
| Equal-power surfaces | GUI, API, and CLI are the same product. Nothing is only clickable, nothing is only scriptable. |
| Light on dependencies | Few moving parts, boring stacks, and no runtime you have to adopt to get value. |
| Open by default | Apache-2.0, public issue trackers, and READMEs that admit what is not finished yet. |
|
Split-horizon DNS control plane — one desired state for internal DNS and Cloudflare | |
|
A control plane for nginx — HTTP, TCP, and UDP reverse proxying and load balancing | |
|
A host firewall you can't lock yourself out of — declarative nftables with auto-rollback | |
|
An open-source identity provider — one SvelteKit app, deployable to Cloudflare Workers or Node; OIDC, SAML 2.0, WebAuthn/Passkey, TOTP, LDAP | |
|
A mail server built from scratch — SMTP, IMAP, POP3, JMAP, ManageSieve, LMTP, zero runtime dependencies |
More are on their way here. Each repository's own README is the source of truth for what it does and how finished it is.
Smaller, standalone tools that don't need a control plane of their own:
|
A JDBC driver for Cloudflare D1 — zero-dependency, REST API or self-deployed Worker proxy | |
|
Converts WHOIS responses into RFC 9083 RDAP-shaped JSON |
Work in other people's projects, kept here as forks — merged unless noted otherwise:
| Repository | Pull requests |
|---|---|
| |
| |
|
Issues and pull requests are welcome on any repository. If you are running one of these in anger and something is missing, an issue describing your setup is more useful than a feature request in the abstract.