Pick a tool.
Each guide covers requirements, installation, a first session, the main commands and configuration, and links to the full documentation in the tool's public repository.
vpscfgfarm
A governor, contracts, runbooks, approvals and a journal in front of every command sent to an SSH fleet.
Discoverybadfarm
Read-only assessment of hosts, containers, Kubernetes and infrastructure code, with stored evidence.
Repairsgoodfarm
Plan, approve, submit, reconcile and verify service repairs. Ships with badfarm.
Early developmentfarmops
The catalog format, loader and journal for routine operations. Scheduling is planned.
Disk headroomoos
Free-space checks against a policy, and guarded cleanup into a quarantine you can restore.
Command safetyOut of Danger
A fail-closed policy wrapper for commands such as rm.
How they fit together.
- badfarm assesses targets read-only and stores findings with their evidence.
- goodfarm binds selected findings to a vpscfgfarm service contract, gets the exact request approved by vpscfgfarm, submits it once, and verifies recovery against a later badfarm scan. Today only the
service-deploy/v1recipe executes; distro security upgrades and reboots can be planned and approved, but their execution is refused until it is graduated. - vpscfgfarm holds all of the authority. Its governor, deny floor, scopes and postures apply to every request, including goodfarm's.
- farmops is planned to schedule routine work under standing grants that vpscfgfarm checks on every call. Only its catalog format, loader and journal exist today.
- oos and Out of Danger work on their own, on one machine. badfarm reports on the oos hourly agent where it is installed.
Versions and licenses.
| Tool | Language | Latest tag | License |
|---|---|---|---|
| vpscfgfarm | Python 3.9+ | v0.1.0 | Apache 2.0 |
| badfarm and goodfarm | Python 3.9+ | v0.4.0 | Apache 2.0 |
| farmops | Python 3.9+ | None (0.0.1) | MIT |
| oos | Go 1.24+ | v0.7.1 | MIT |
| Out of Danger | Rust | v0.1.0 | MIT |
None of these tools publishes packaged release downloads yet. Install from source as each guide shows. Development continues on each repository's default branch, so a guide can describe behaviour that is newer than the latest tag; the guides say so where it matters.