PatchOps
A self-contained Linux patch governance platform — Aptly mirror/snapshot promotion, a custom-built AWX standalone install orchestrating everything on a schedule, and Grafana dashboards backed by a Postgres governance DB.
~/patchops
$ awx job launch patch-cycle
✓ aptly snapshot promoted
✓ cve enrichment cvss scored
! hosts needing action 5
· upgrades pending 30
✓ audit trail recorded
Overview
A from-scratch rewrite of production patch-governance patterns, built as a portable single-machine platform. Aptly mirrors upstream Ubuntu repos and cuts immutable snapshots that promote through dev/staging/prod behind real bake-time SQL gates, not documentation. AWX (built from source: a patched standalone image that runs execution environments via Docker instead of Podman) orchestrates 14 job templates across 7 schedules. Security packages are enriched with real CVE IDs parsed straight from package changelogs and scored against Ubuntu's public security tracker. Rollback actually downgrades already-patched clients, not just the repo metadata.
Highlights
- Built a custom AWX standalone image and execution environment from scratch, fixing real Podman-to-Docker isolation bugs along the way
- Implemented real CVE/CVSS enrichment by parsing package changelogs and scoring against Ubuntu's security tracker
- Wrote a rollback role that actually downgrades already-patched clients instead of only re-pointing repo metadata
- Validated the full pipeline live through AWX — real scans, real patches, real email notifications, real audit trail
Stack
AnsibleAWXAptlyPostgreSQLGrafanaDockerDocker Compose