PatchOps
A self-contained Linux patch governance platform — Aptly mirror/snapshot promotion, a custom-built AWX standalone install orchestrating everything on a schedule, and Grafana dashboards backed by a Postgres governance DB.
A from-scratch rewrite of production patch-governance patterns, built as a portable single-machine platform. Aptly mirrors upstream Ubuntu repos and cuts immutable snapshots that promote through dev/staging/prod behind real bake-time SQL gates, not documentation. AWX (built from source: a patched standalone image that runs execution environments via Docker instead of Podman) orchestrates 14 job templates across 7 schedules. Security packages are enriched with real CVE IDs parsed straight from package changelogs and scored against Ubuntu's public security tracker. Rollback actually downgrades already-patched clients, not just the repo metadata.
Highlights
- ▹Built a custom AWX standalone image and execution environment from scratch, fixing real Podman-to-Docker isolation bugs along the way
- ▹Implemented real CVE/CVSS enrichment by parsing package changelogs and scoring against Ubuntu's security tracker
- ▹Wrote a rollback role that actually downgrades already-patched clients instead of only re-pointing repo metadata
- ▹Validated the full pipeline live through AWX — real scans, real patches, real email notifications, real audit trail