# nanoinfra

> A self-hosted agent for infrastructure. It reaches your servers with credentials you hold, and another process decides on every remote command.

nanoinfra is a self-hosted agent for infrastructure work. It runs on a machine you
own, reaches your servers over SSH, Ansible or AWS SSM with credentials you hold,
and a capability gate in a separate process decides on every remote command. The
agent that asks holds neither the credential nor the decision. This file describes
the marketing site; the reference documentation is its own site, linked below.

## Pages

- [Features](https://nanoinfra.org/en/features): every capability, in six groups, each row linking to the page that specifies it.
- [Simulated session](https://nanoinfra.org/en/demo): one command answered three ways — allowed while you watch, refused at 02:35, and rehearsed at creation. Nothing on that page reaches a host.
- [Install](https://nanoinfra.org/en/install): the four steps from nothing to a refused command.
- [Blog](https://nanoinfra.org/en/blog): what broke, and what the kernel actually does.
- [Contact](https://nanoinfra.org/en/contact): discussions, issues, and private security reports.

## Documentation

- [Documentation](https://docs.nanoinfra.org/): the reference site.
- [Quick start](https://docs.nanoinfra.org/quick-start/): install, onboard, first run.
- [Capability gates](https://docs.nanoinfra.org/capability-gates/): the four answers, the three scopes, the three contexts, and every shipped default.
- [Configuration](https://docs.nanoinfra.org/configuration/): one config file, and what each key does.
- [Secrets and servers](https://docs.nanoinfra.org/secrets-and-servers/): the inventory, the credential store, and how a secret is resolved for one action.
- [Deployment](https://docs.nanoinfra.org/deployment/): the four accounts that make the kernel enforce the split.
- [Extending it](https://docs.nanoinfra.org/my-tool/): skills, MCP servers and plugins.

## Source

- [GitHub](https://github.com/nanoinfraorg/nanoinfra): the whole agent, the gates and the helpers.
- [PyPI](https://pypi.org/project/nanoinfra/): `uv tool install nanoinfra`.

## Posts

- [Two routes built the same payload, and only one of them signed](https://nanoinfra.org/en/blog/two-routes-one-signature): An image opened from the file tree reported that it could not be served from the current workspace. A list of callers is what missed the second caller.
- [The workspace moved after three processes were already confined to it](https://nanoinfra.org/en/blog/workspace-moved-after-confinement): A migration that is correct on a host is a split brain in a container. The order of two startup steps is the whole bug.