Fiber — Durable CI

Self-hosted, canvas-first Jenkins alternative. Rust control plane, TypeScript UI (TanStack Start + React Flow + shadcn).

Docs: docs/ — getting started, development (make help), architecture, pipeline YAML, agents, artifacts, authz, CLI, API, operations, roadmap.

Quick DX

make help
make infra          # Postgres + Redis
make api            # :18080  (or make api-s3 after make infra-s3)
make ui             # :3100
make login

Login admin / fiber. Env template: .env.example.

Agents vs Fibers

	Agents	Fibers
What	Worker processes that run CI pipeline steps	Durable control-plane background tasks
Where	Global Agents nav; fiber-agent binary	Per-project Fibers page; fiber-durable
Primitives	Lease, shell/docker, logs, artifacts	step / stash / sleep, resume after crash

Durability & security

See docs/operations.md, docs/authz.md, and docs/artifacts.md for full detail.

• CI steps are at-least-once. Make run side effects idempotent.
• Schema via versioned sqlx migrations in crates/fiber-core/migrations/ (applied on API boot).
• Schedules: on.interval_minutes and/or on.cron (6-field with seconds). Cron wins if both set — triggers.
• GitHub webhooks: push/PR + path filters; PR paths need GITHUB_TOKEN — triggers.
• Matrix / if: pipeline YAML.
• Project roles: reader < writer < admin < owner — authz.
• Secrets: encrypt at rest with FIBER_SECRETS_KEY (64 hex chars).
• Artifacts: local or S3 presign — artifacts.
• Retention / agents / OTel: configuration + operations.

openssl rand -hex 32
# export FIBER_SECRETS_KEY=<that>

Durable fibers

Built-ins: ping, sleep_demo, interval_task. Details: docs/durable-fibers.md.

cargo run -p fiber-cli -- login
cargo run -p fiber-cli -- fibers create $PROJECT_ID --name sleep_demo --input '{"seconds":3}'
cargo run -p fiber-cli -- members list $PROJECT_ID
cargo run -p fiber-cli -- agents rotate $AGENT_ID

Quick start (local)

Full walkthrough: docs/getting-started.md.

Smoke scripts

python3 scripts/smoke_authz_agents.py   # roles + agent CRUD/rotate
python3 scripts/smoke_artifacts.py      # artifacts + path filters (needs agent)
python3 scripts/smoke_s3_presign.py     # S3 presign (needs make infra-s3 + FIBER_S3_*)

1. Infrastructure

docker compose -f deploy/docker-compose.yml up -d fiber-postgres fiber-redis

Postgres is 17-alpine. Upgrading from 16: down -v then recreate.

2. API

export FIBER_DATABASE_URL=postgres://fiber:fiber@127.0.0.1:15432/fiber
export FIBER_REDIS_URL=redis://:fiber@127.0.0.1:16379   # Compose Redis password (FIBER_REDIS_PASSWORD)
export FIBER_SECRETS_KEY=$(openssl rand -hex 32)   # recommended
cargo run -p fiber-api

API: http://127.0.0.1:18080. Login admin / fiber.

3. Web UI

cd apps/ui && pnpm install && VITE_FIBER_API_URL=http://127.0.0.1:18080 pnpm dev

Open http://localhost:3100

4. CLI / agent

cargo run -p fiber-cli -- validate examples/fiber.yml
cargo run -p fiber-cli -- login
cargo run -p fiber-cli -- agent --token "$FIBER_AGENT_TOKEN"

Full Compose

cp deploy/.env.example deploy/.env      # set FIBER_SECRETS_KEY (openssl rand -hex 32) and FIBER_ADMIN_PASSWORD
docker compose -f deploy/docker-compose.yml pull
docker compose -f deploy/docker-compose.yml up -d

That runs the published fiber-api and fiber-agent images (amd64 and arm64); add --build to compile from this tree instead.

Add a worker with docker compose -f deploy/docker-compose.yml --profile agent up -d fiber-agent (set FIBER_AGENT_TOKEN in deploy/.env first), or attach another machine with scripts/install-agent.sh — see agents.

• UI: http://localhost:3100 · API: http://localhost:18080 (both loopback-only by default — see operations for TLS / exposure)
• Postgres 15432 · Redis 16379 · S3 store (RustFS) 19000 (loopback-only)

Workspace

docs/                  # product documentation
apps/ui/
crates/fiber-api/
crates/fiber-core/
crates/fiber-scheduler/
crates/fiber-agent/
crates/fiber-cli/      `fiber` binary
crates/fiber-durable/
crates/fiber-proto/
examples/              # sample fiber.yml pipelines

Naming: fiber-* / FIBER_* — see .claude/rules/naming.md.

Contributing

Issues and pull requests are welcome. CONTRIBUTING.md covers the local setup, the gate every change has to pass (make check, make test, and the smoke scripts), and the handful of invariants — at-least-once steps, the immutable run snapshot, append-only migrations — that a patch has to respect.

By participating you agree to the Code of Conduct.

Security

Please do not open a public issue for a vulnerability. SECURITY.md has the private reporting channel, along with the trust model: what Fiber defends against, and what it deliberately does not.

License

Apache License 2.0. See NOTICE for attribution.