Skip to content
YA
All projects
Cloud & DevOps

InfraForge — Infrastructure Automation Platform

GitOps-driven, event-driven infrastructure automation platform. Self-service requests → OPA policy checks → NetBox → generated Terraform + Ansible → GitLab CI → real KVM VMs, fully observable.

GitHub GitLab
Role
Personal engineering project
Year
2026
Status
Active
infraforge — Dashboard
Dashboard
infraforge — Request form
Request form
infraforge — Progress view
Progress view
infraforge — NetBox view
NetBox view

Challenges & solutions

  1. 01

    Infrastructure requests take days and drift from documentation

    architecturegitops
    Problem

    Manual ticket-based provisioning is slow, error-prone and hard to audit.

    Solution

    Self-service portal + GitOps: every request becomes reviewed code in Git, with NetBox as the single source of truth.

  2. 02

    Enforce compliance before anything is provisioned

    securitypolicy-as-code
    Problem

    Sensitive research workloads need network isolation and policy checks up-front.

    Solution

    Open Policy Agent validates each request (and gives feedback as the user types) before code generation.

  3. 03

    Detect configuration drift after provisioning

    observability
    Problem

    Desired state and actual state diverge over time.

    Solution

    Drift detection compares NetBox/IaC state with running VMs and raises alerts in the monitoring stack.

Deep dive

⚙️ InfraForge

GitOps-driven, event-driven infrastructure automation platform. Transform self-service infrastructure requests into secure, reproducible and observable infrastructure.

🎯 Overview

InfraForge demonstrates how modern infrastructure can be managed through code, policies and Git — instead of manual operations and tickets. It mirrors the architecture of a university campus infrastructure platform.

The problem

Researcher needs a VM
    ↓
Email IT helpdesk → wait 3–7 days
    ↓
Manual provisioning by an engineer
    ↓
Documentation drifts from reality

The solution

Researcher fills a form
    ↓
Policy validation (OPA) → Source of truth (NetBox)
    ↓
Code generation (Terraform + Ansible) → Git commit
    ↓
CI/CD pipeline → Real VM provisioned → Configured → Monitored
    ↓
Ready in minutes, fully auditable

🏗️ Architecture

InfraForge high-level architecture

InfraForge data flow

Component Role Technology
Frontend Self-service portal React 18, Vite, Tailwind CSS
Backend REST API + WebSocket + orchestration Python 3.11, FastAPI
Database Persistent state PostgreSQL 15
Source of Truth Infrastructure inventory NetBox
Event Bus Async communication NATS
Policy Engine Compliance enforcement Open Policy Agent (OPA)
CI/CD Pipeline automation GitLab CI
IaC Provisioning + config Terraform, Ansible
Virtualization Real VM provisioning KVM / Libvirt
Monitoring Metrics + dashboards Prometheus, Grafana

✨ Features

  • 🎛️ Self-service portal — request infrastructure without tickets, with real-time progress over WebSocket and policy feedback as you type
  • 🔐 Policy-as-Code — OPA enforces compliance, knowledge-security requirements and network isolation for sensitive data
  • 📚 Source of truth — NetBox tracks every VM, IP and VLAN; fully auditable
  • 📝 Infrastructure as Code — auto-generated Terraform + Ansible, version-controlled and reviewable
  • 🚀 GitOps workflow — everything goes through Git with peer review via Merge Requests
  • 🔄 CI/CD pipeline — 8-stage GitLab pipeline: validation → security → plan → apply → configure → verify, with manual approval gates
  • 🖥️ Real provisioning — actual KVM VMs created end-to-end, no simulation
  • 📊 Observability — Prometheus metrics, Grafana dashboards, SLO tracking
  • 🕵️ Drift detection — compares desired vs actual state and alerts on configuration changes

🔄 Request workflow

  1. User submits a request via the self-service portal
  2. OPA validates policies (compliance, security)
  3. NetBox registers the VM (source of truth)
  4. Terraform + Ansible code is generated
  5. A GitLab branch + Merge Request is created
  6. The CI/CD pipeline is triggered
  7. Terraform provisions a real KVM VM
  8. Ansible configures the VM
  9. Monitoring is enabled
  10. WebSocket updates the user in real time — infrastructure ready!

📡 API (excerpt)

POST   /api/requests            Create request
GET    /api/requests/{id}/code  Get generated code
POST   /api/policies/validate   Validate request
POST   /api/pipeline/trigger    Trigger pipeline
GET    /api/netbox/vms          List VMs
GET    /api/monitoring/slos     SLOs

🔒 Security

  • ✅ JWT authentication with refresh tokens
  • ✅ Role-based access control (admin, engineer, researcher, viewer)
  • ✅ Policy-as-Code enforcement via OPA
  • ✅ Network isolation for sensitive data (VLANs)
  • ✅ Audit trail via Git + NetBox
  • ✅ Secrets never in code

🗺️ Roadmap

  • Self-service portal · Policy-as-code (OPA) · Source of truth (NetBox)
  • Terraform + Ansible code generation
  • GitLab CI/CD pipeline · Real KVM provisioning
  • WebSocket real-time updates · Drift detection · Monitoring
  • Kubernetes support
  • Multi-tenant projects
  • Cost tracking
  • Chaos testing
Next project
Cloud-Native DevOps Platform