Hegemony.sh

Declarative Flow Engine

Define workflows in YAML or JSON and compose fork/join graphs with pluggable handlers — no orchestration glue to write.

Deterministic Execution

Reliable, resumable, fault-tolerant runs powered by Temporal. Long-running operations survive restarts and resume exactly where they left off.

Real-time Observability

Server-Sent Events stream live, step-by-step progress to the UI, backed by a persistent audit trail for compliance and debugging.

Run Anything in Containers

Execute arbitrary tooling in isolated containers via run_container steps — mount workflow attachments and render configs without bespoke handlers.

Pluggable Inventory

Target devices from the built-in inventory or external sources such as NetBox via pluggable inventory providers.

Git-backed Workflow Definitions

Version workflow definitions per repository — push, pull, or continuously sync individual workflows and their attachments with Git.

Configuration Exchange

Import and export the whole platform configuration as YAML, and sync or back up your entire platform state to Git.

Connectivity Monitors

Run background health and connectivity probes against device roles or addresses, collected as time-series with live tables and graphs.

Keycloak SSO & RBAC

Enterprise authentication via Keycloak OIDC with centralized, role-based access control (admin, operator, auditor, viewer, approver).

Secrets Management

Pluggable secret backends, with OpenBao bundled. Only references are stored — secret values never touch the database.

Notifications & Webhooks

Event-driven notifications and webhooks integrate Hegemony with your existing alerting and automation pipelines.

Run the full demo locally

One command brings up the whole Hegemony stack with a pre-loaded demo scenario — inventory, secrets, schedules, webhooks, and flows for the fictional operator “Meridian Networks”, including a self-contained virtual lab flow that provisions and tears down a multi-router OSPF datacenter:

Pre-launch note: the installer is not published yet and the repositories stay private until launch, so the command below does not work yet. It goes live with the public launch.

curl -fsSL https://hegemony.sh/install.sh | sh

The installer clones the platform and demo-data repositories and starts everything (API, worker, scheduler, UI, Temporal, Keycloak, OpenBao, Versity S3 Gateway) at http://localhost:8080. You need curl, git (with access to the platform repository), docker with the Compose v2 plugin, go-task, and a docker login ghcr.io session. Lifecycle commands and demo details are in hegemony-sh/hegemony-demo-data.

Demo credentials are hard-coded defaults for local evaluation only — never expose the stack to a network.

HegemonyDeterministic infrastructure workflows