Open source
Three projects, maintained in the open.
Each one was extracted from something that shipped. They are documented, tested, released on a real cadence, and each ships a section telling you when to use something else.
Library · TypeScript
octaflow
Durable workflows on the Postgres you already have.
Declare a DAG of Zod-typed steps. The engine runs each step as soon as its dependencies complete, persists every transition, retries failures, and picks up where it left off after a restart.
There is no workflow server to operate, no control plane and no vendor — it is a library you import, not a platform you adopt. If you already run Postgres, it adds no infrastructure: the queue is Postgres too.
Where Temporal, Inngest and Trigger.dev are imperative — you write a function, and the graph exists only as the trace of what it did — octaflow is declarative. The DAG is a plain value you can walk before anything runs.
Retries and timeouts, durable sleep, concurrency caps and rate limits, cron starts, start idempotency, dynamic fan-out, signals, sub-workflows, saga compensation and a pluggable observability seam. Pre-1.0, and honest about what it gives up: no dashboard, no polyglot SDKs.
- TypeScript
- Zod
- PostgreSQL
- pg-boss
- Vitest
Monorepo · TypeScript
@octabits-io/platform
The building blocks underneath everything else.
Two packages extracted from real products: an opinionated server framework toolkit and a Nuxt/Vue kit for admin SPAs. Everything heavy is an optional peer — you install only what you import.
framework ships behind granular subpaths: Result types, an IoC container, a structured logger, config-schema fragments, RBAC, JWT and API-key auth, scoped signing, a Vault secret loader, a captcha contract, PII encryption, Drizzle ORM helpers, iCal ingestion, Hono middleware, an OpenAPI and MCP harness, a pg-boss queue base, namespaced blob storage, and mail transport with dispatch.
nuxt-ui-kit covers the frontend half: an OIDC session harness, auth and organisation store cores, a route-guard builder, API-client seams, and source-shipped components for confirmation, dates and AI review.
These are not speculative abstractions. Each one was pulled out of a shipping application after it had earned its place there twice.
- TypeScript
- Hono
- Drizzle ORM
- Zod
- Nuxt
- pg-boss
- Turborepo
Kubernetes webhook · Go
cert-manager-webhook-porkbun
Wildcard certificates for Porkbun domains on Kubernetes.
A cert-manager ACME DNS-01 solver for domains hosted at Porkbun, which cert-manager has no built-in solver for. A maintained fork of an abandoned upstream — rewritten, hardened, and tested.
The original panicked the pod on a malformed response, reported every API failure as an opaque status string, ran with no HTTP timeout at all, hard-coded a TTL below the provider minimum, and bound a ClusterRole granting read access to every Secret in the cluster.
This fork rewrites the API client and solver: nil-safe decoding, surfaced error messages, status-checked responses, request timeouts, retry with backoff and jitter, serialised concurrent challenges, and correct handling of delegated sub-zones via the public suffix list.
It runs as uid 65532 on distroless with a read-only root filesystem and all capabilities dropped, restricted to named Secrets in named namespaces. Images are cosign-signed with SBOM and provenance attestations, and CI re-runs its vulnerability scan weekly so a dependency that goes bad after release is caught rather than left to sit.
- Go
- Kubernetes
- cert-manager
- Helm
- Let’s Encrypt
- cosign
- Trivy
Contributing
Bug reports with a reproduction are the most useful thing you can send.
Pull requests are welcome on all three. Each repository carries a CONTRIBUTING guide covering the setup, the boundaries the lint enforces, and the correctness requirements anything pluggable has to meet.