One admin. One VM. Your whole fleet, polished.
Built from the frustration of stitching together five SaaS tools to monitor a hundred laptops. Opale ships the lot in one container — enable what you need, hide what you don’t.
The core that everything else hangs off. Populate it however suits you: manual entry, optional Microsoft Intune sync, or the optional cross-platform Go agent (Windows, macOS, Linux) for hardware, disk, network and bandwidth telemetry every 15 minutes.
intune · agent · ed25519 · all opt-inDisk thresholds, prolonged offline, non-compliant devices — computed live from device state. Web-Push to admins on critical changes, biometric unlock on mobile.
vapid push · service worker · webauthnOpen / in-progress / resolved workflow, tags, Kanban view, links to devices. “Proposed” tickets land from a mail-to-AI ingestion pipe and wait for your review.
kanban · mail-to-AI · device-linkedReal terminal in a tab via WebSocket + xterm.js, over your existing mesh VPN. Netbird, Tailscale, ZeroTier — whatever you already trust.
xterm.js · ssh2 · mesh-vpn awareopale is a Go binary with Cobra, PKCE auth and shell completion. Devices, tickets, scripts, deployments — everything the UI does, scriptable.
PowerShell library, queued execution at next checkin, results streamed back. Quick-script tray for the four commands you run twenty times a week.
powershell · queued · result diffThe agent rotates the local admin password, escrows it RSA-OAEP encrypted. Admins decrypt one-shot from the UI — the server never sees plaintext.
rsa-oaep · escrowed · one-shot decryptGuided checklists for new device or new collaborator, with optional IdP group assignment when you wire one up. The thing you forget to do half the time.
checklist · idp groups · opt. · auditableInstallable on iOS and Android, WebAuthn unlock, push notifications. Tap an alert at 23:47, triage from bed, sleep again.
pwa · webauthn · offline-readyEvery UI action has a CLI counterpart with PKCE auth and shell completion. Script your fleet from anywhere.
$ opale devices list --compliance=non-compliant --last-seen=<7d ┌──────────────────────┬─────────────────────────┬──────────┬─────────┐ │ HOSTNAME │ USER │ DISK % │ STATUS │ ├──────────────────────┼─────────────────────────┼──────────┼─────────┤ │ LAB-DESK-04 │ a.smith │ 97.5 │ critical│ │ DESKTOP-OFFICE-21 │ j.morgan │ 47.6 │ warning │ │ DEV-LAPTOP-12 │ p.fischer │ 94.9 │ warning │ └──────────────────────┴─────────────────────────┴──────────┴─────────┘ 3 devices · 1 critical · 2 warning $ opale scripts run --name="clear-temp" --target=LAB-DESK-04 → queued · result in ~15min · run id 4f2c8e $ opale scripts wait 4f2c8e ✓ exit 0 · 4.2 GB freed · 412 files removed $ opale tickets create --device=LAB-DESK-04 --tag=hardware \ --title="Disk filling too fast, replacement candidate" ✓ ticket #847 · status=open · assigned to you $
Single-tenant by design — one Opale instance per organisation. No multi-tenancy gymnastics, no shared blast radius.
One maintainer’s tool, opened up. We tell you what it is and what it isn’t.
Things that will still run a decade from now. No build step on the front-end — the SPA is Vanilla JS that you can read.
Opale is experimental and maintained by one person. It runs in production for its original organisation, but the public release is recent and APIs may shift. There is no commercial support, no SLA, no roadmap promises. Issues are read, not contractually answered.
If you can’t pin to a commit and read AGPL-licensed code when something breaks, this isn’t the right tool for you — and that’s deliberate. Contribute via issues or PRs; security reports via SECURITY.md.
For TLS, Entra app registration and the Windows agent rollout, see INSTALL.md.
git clone https://github.com/4rtefakt/opale.git cd opale cp .env.example .env # fill in the required values ./setup.sh # vendor front-end deps
docker compose -f docker-compose.example.yml up -d # API + Postgres now on :3010 # → browse to http://localhost:3010