HostAtlas / AI & Automation / Automations

Deep dive 16 triggers · 200+ playbooks · YAML or visual

Your runbook, finally executable.

Stop pasting commands into Slack at 3 AM. Automations turn the steps you already do — restart, rotate, alert, escalate, snapshot, scale — into versioned, reviewable, idempotent playbooks that fire on real signals.

See the builder Browse 28 recipes →

Triggers

+ webhook · + chat command

Built-in actions

across infra, comms, code

Median fire-to-act

1.4s

across the active fleet

Dry-run

Always

test before you arm

— Anatomy

A small grammar that scales.

Every automation is the same shape: when X (and Y) → do Z. Build it visually, or write the YAML — they're the same file.

When

A trigger fires. metric.crossed, cve.match, cron, webhook, chat.command, or 11 more. Triggers are streamed — no polling.

Where (optional)

Conditions filter the firing. tags.includes("prod"), !silenced, region == "eu", now.hour > 22. They run client-side, so they're free.

Then

One or more actions. Run a playbook, post to Slack, page on-call, open a PR, snapshot a volume, restart a service. Steps run sequentially or in parallel.

Guarded by

Every automation has safety rails: rate limits, dry-run, approval gates, and a 1-click pause. You can't accidentally rm -rf the fleet.

Audited via

Every run lands in the audit log — who triggered it, what changed, what failed, what was reverted. Signed and immutable.

— Builder

Visual or YAML. Same file. Use what you feel like today.

The drag-and-drop builder writes the YAML. The YAML editor renders the builder. Switch between them mid-edit, no diff drama, no merge surprise.

force-rotate-and-fix-perms.yml · edited 4m ago by anna · armed

Trigger

Disk usage crosses threshold

metric: disk.used_pct · path /var · ≥ 85% for 5 min

Condition

Production hosts only, not silenced

tags.includes("prod") && !silenced

Action 1

Run playbook

playbook: force-rotate · target $host · timeout 60s

Action 2 — on success

Post a one-line summary to Slack

channel #ops · template "✓ rotated /var on $host · freed $freed_gb GB"

— YAML

For when you want to git-review your infra logic.

Automations live in .hostatlas/automations/ in your repo. Pull requests, code review, history, blame — exactly like everything else you write.

✓ Schema-validated on save (with hover docs)
✓ hostatlas automation lint in CI
✓ Diff-friendly, mergeable, blame-able
✓ Same file the visual builder edits

# .hostatlas/automations/force-rotate-and-fix-perms.yml
name: force-rotate-and-fix-perms
description: Runs when /var fills up on prod hosts

on:
  metric.crossed:
    metric: disk.used_pct
    path: /var
    over: 85
    for: 5m

if: tags.includes("prod") && !silenced

do:
  - run.playbook:
      name: force-rotate
      target: $host
      timeout: 60s

  - slack.post:
      when: success
      channel: "#ops"
      text: "✓ rotated /var on $host · freed $freed_gb GB"

limits:
  max_runs_per_host: 3 # per hour
  approval: none # dry-run was clean

— Run history

Every run, observable. Every failure, debuggable.

Each automation has its own runs view: status, duration, host, exit, full log, the trigger payload that fired it, and a one-click rerun.

StartedTrigger · targetDurationExitBy

2m ago · 14:32:41 keywest · disk.used_pct ≥ 85% for 5m on /var 3.4s 0 automation

11h ago · 03:14:00 db-prod-1 · cron · nightly 1m 12s 0 automation

2d ago · Apr 28 · 09:22 keywest · chat.command "/rotate keywest" 1.1s EACCES @anna

3d ago · Apr 27 · 18:04 api-prod-2 · dry-run 0.8s 0 @dmitri

5d ago · Apr 25 · 14:08 svps1 · webhook · github push 2.7s 0 automation

— Recipes

28 recipes from the community. Fork, rename, ship.

Real automations, cloned ~14k times. Every one has a public diff, a real run history, and a button that says use as starting point.

Disk fill auto-rotate

3.2k forks

disk > 85% → prod → force-rotate

Logrotate stalls. Disk fills. Pager fires at 3 AM. Now it just rotates.

by @hostatlas Use this →

CVE → 1-PR-per-service

1.8k forks

cve.match → github.openPR

New CVE drops, version bump PR opens for every affected service. Press merge.

by @prowlsec Use this →

SSL renew + reload

2.4k forks

cert < 14d → acme.renew → nginx -s reload

Renew, copy to all hosts behind the LB, hot-reload, post to Slack. Done.

by @opsacademy Use this →

SSH brute force ban

1.1k forks

attack.detected → firewall.ban 24h → slack

Geo + signature match → ban at firewall, log audit, post a 1-liner.

by @sentinel Use this →

/deploy from Slack

2.0k forks

chat.command → user.role=eng → deploy

/deploy api prod — only engineers can. Streamed back to the channel.

by @hostatlas Use this →

Domain expiry watch

980 forks

domain < 30d → linear.issue

WHOIS-based, per-domain. Files a Linear ticket assigned to the owner of record.

by @opsacademy Use this →

Browse all 28 recipes →

— Safety rails

Production-grade by default. Not "we trust you" by default.

Automations run with sharp tools. So we built the guards in, not as features behind a paywall.

Dry-run mandatory

New automations stay dry-run until you've seen at least 3 clean runs.

Rate limits

Per-host, per-tag, per-account caps. Default 3 runs / host / hour.

Approval gates

Mark steps as approval: required. Slack-confirmable in seconds.

One-click rollback

Most actions register an inverse. hostatlas automation revert <run-id>.

Global pause

One toggle stops every automation. Documented in audit log.

Signed audit log

Every run, every input, every output. Append-only, signed, exportable.

Concurrency lock

Same automation can't run twice on a host simultaneously.

RBAC + scopes

Automations run as a service identity with the minimum scopes you grant.

Discovery & Mapping

For developers