CroustyPatch

[ Croustylab ]

Patch management that is safe to leave on.

CroustyPatch keeps a fleet of Linux machines up to date. It decides what to patch and when, applies it, checks that the machine still works, and puts everything back if it does not.

Get startedRead the docsHow it works

01 · THE INTERFACE

See it at work

Real screens of the web interface, with demo data. Swipe, use the arrows or the keyboard.

Dashboard: The state of the whole fleet at a glance: what needs approval, what is quarantined, security updates and the next patch days.
DashboardThe state of the whole fleet at a glance: what needs approval, what is quarantined, security updates and the next patch days.
Hosts: Every machine with its group, status and pending updates, searchable and filterable.
HostsEvery machine with its group, status and pending updates, searchable and filterable.
Host detail: Hardware, agent, resources and the automatic patching state of one machine.
Host detailHardware, agent, resources and the automatic patching state of one machine.
Tasks and approvals: A patch awaiting approval, with the full risk reasoning behind the decision.
Tasks and approvalsA patch awaiting approval, with the full risk reasoning behind the decision.
Policy editor: Choose what is applied, when, and how it is rolled back, per group.
Policy editorChoose what is applied, when, and how it is rolled back, per group.
Docker: Container images across hosts, with newer tags suggested and applied through the compose file.
DockerContainer images across hosts, with newer tags suggested and applied through the compose file.
App center: Approved applications per machine, with All, Installed, Needs update and Not installed filters and their counts.
App centerApproved applications per machine, with All, Installed, Needs update and Not installed filters and their counts.
Notifications: Rules that route events to e-mail, ntfy, Gotify or signed webhooks.
NotificationsRules that route events to e-mail, ntfy, Gotify or signed webhooks.
Logs: What the server did: task changes, deliveries and its own messages, newest first.
LogsWhat the server did: task changes, deliveries and its own messages, newest first.

Slide 1 of 9: Dashboard

02 · FEATURES

What it does

Patch without fear

Every patch starts with a restore point and is watched by health probes afterwards. Two failed probes in a row roll it back by itself.

  • apt and pacman
  • Restore points and automatic rollback
  • Quarantine and frozen evidence if even the rollback fails
Read the guide
Dashboard: The state of the whole fleet at a glance: what needs approval, what is quarantined, security updates and the next patch days.

03 · THE PIPELINE

What happens to a patch

  1. 01

    Decide

    The policy engine rates contextual risk (CVSS, exploitation, exposure) and stability risk, then picks auto-deploy, approval or block. The reasoning is stored on the task.

  2. 02

    Prepare

    On the patch day the server signs a command for that one agent. The agent checks it, then builds a restore point and refuses to go on if a package cannot be restored.

  3. 03

    Apply and soak

    The update runs with fixed arguments, no shell. Then health probes watch the machine for the soak time you set.

  4. 04

    Roll back by itself

    Two failed checks in a row of the same probe restore the restore point. If even that fails, the host is isolated and its evidence frozen.

  5. 05

    Tell people

    Every step is audited in a hash-chained log, and the event goes to e-mail, a signed webhook, ntfy or Gotify.

agent log
policy      prod-security (priority 10)
contextual  Critical  (CVSS 9.8, exploited)
stability   Low
decision    REQUIRE_APPROVAL
planned     next patch day, 02:00 Europe/Paris

04 · EVERY SCREEN

In your pocket, too

The interface folds to a drawer on phones and keeps every action, so you can approve a patch from the train.

Dashboard on a phone: The interface adapts to small screens.

05 · AND ALSO

Built to be trusted

Patch days, not patch panicMaintenance windows with deadlines, so a host that was offline never patches late.
Servers, laptops and containersLinux, an eco mode for laptops on battery, and Docker Compose images.
Locked down by designTLS 1.3 only, one RSA identity per agent, server-signed commands, Argon2id and a hash-chained audit log.
AI, with a leashAn OpenAI-compatible model can rate risk but lower it by one level at most. An MCP server lets assistants request patches that wait for a human.

06 · ARCHITECTURE

How it fits together

The web interface is a static Next.js export served by the server itself, so there is a single thing to deploy.

Ready to try it?

Get startedInstall the server