ORDO
ordo · order · rank · arrangement

Order for the
machines you run.

Ordo is a self-hosted system for teams running real workloads on their own bare metal and VMs. It brings deliberate, auditable state management without standing up enterprise tooling to get it.

Read the docsSee where Ordo fits
Self-hosted by defaultAlways encryptedGet started in minutes
THE GAP

Too big to operate,
or too small to trust.

Most infrastructure tooling makes you choose one or the other. Ordo is built for the space between them.

TOO BIG

Enterprise orchestration

Solves hard problems, but assumes cloud-native workloads and a centralised control plane hosted somewhere else. That's significant investment just to run the tooling itself.

Ordo sits
in the gap
TOO SMALL

Scripts & ad-hoc SSH

Gets things done, but offers no guardrails, no audit trail, and no reliable way to know whether the fleet is actually in the state you think it is.

ARCHITECTURE

One orchestrator, agents on every machine.

orchestratorstate · audit logagent● in syncagent● driftagent● in syncENCRYPTED · AUTHENTICATED
1

The orchestrator holds the intent

Desired state and the full audit record live on one machine that never needs to be internet-accessible.

2

Agents own their identity

Each agent holds its own cryptographic key and must be explicitly approved before any work flows in either direction.

3

Trust is pinned, not issued

No certificates, no CAs, no expiry. Identities are pinned on first connection. If an agent's key changes it re-enters approval, and a changed orchestrator key is refused outright.

PRINCIPLES

Opinions, held on purpose.

Self-hosted by default

State, auth, audit, and metrics all run locally. The default path works on a single machine with no internet access.

Safe by design

Preview any change with a plan before it touches a machine. Nothing is applied until you say so.

Auditable by default

Who requested it, what was applied, what happened. Recorded for every action, with no extra configuration.

Opinionated where it matters

Sensible, secure defaults out of the box, with a documented path for the common cases, so the safe way is also the easy way.

CAPABILITIES

Declare it. Watch for drift.
Apply on your terms.

DECLARATIVE STATE

Describe what you want: files, services, config, packages. Ordo plans how to reach and maintain that state.

DRIFT DETECTION

Agents continuously check actual against declared. Drift is surfaced and alerted, never silently “fixed” behind your back.

PLAN MODE

An accurate diff of what would change, before you touch a machine. Nothing is applied during a plan.

CHANGE TRIGGERS

Reload or restart a service, or re-run a script, automatically when a resource it depends on changes — and see it predicted in the plan first.

SECRET DISTRIBUTION

Encrypted at rest, resolved server-side, redacted in every log and plan. Restrict by tag or node ID.

AUDIT LOG & HISTORY

Every applied state and state change, per agent, retained on a schedule you control and queryable via the API, the CLI, and the web UI.

IN PRACTICE

Real modules. Readable YAML.

A package, its config, and a systemd service, each a first-class resource with its own drift detection and a predicted plan.

caddy-site.ordo.yaml
# Serve a static site: package, config, service
name: caddy-site
supports:
  - {platform: linux, init_system: systemd}
resources:
  - id: caddy-pkg
    resource:
      package-apt: { name: caddy }
  - id: caddyfile
    depends_on: [caddy-pkg]
    resource:
      file-unix:
        path: /etc/caddy/Caddyfile
        template: caddyfile
  - id: caddy-service
    depends_on: [caddyfile]
    resource:
      service-systemd:
        name: caddy
        enabled: true
        running: true
        reload_on: [caddyfile]
Agents · Reconcileorchestrator web UI
web-01env=prod role=web
in sync
web-02env=prod role=web
in sync
web-03Caddyfile modified
drift
db-01env=prod role=db
in sync
3 in sync · 1 driftedApply
WHO IT'S FOR

For operators who run
their own infrastructure.

Small platform teams

Small teams who need guardrails and an audit trail, without standing up a cloud control plane to get them.

Homelab

Running real workloads on hardware you control, with the rigour to rebuild a failed box from declared state, not memory.

Self-hosting by principle

Teams whose whole reason for self-hosting is avoiding a hosted dependency, the exact assumption Ordo refuses to make.

Define state. Detect drift.
Then act, deliberately.

Install, bootstrap, and connect your first agent in minutes. Everything runs on infrastructure you control.

Read the docs

The docs walk you through install, bootstrap, and your first apply.