From 39b44eb2b439c6ea74e2ff113f7139920b663fa1 Mon Sep 17 00:00:00 2001 From: Romamo Date: Thu, 8 Oct 2026 17:14:26 +0300 Subject: [PATCH 1/3] Redesign the landing page for founders leaving the cloud and for MSPs The old page opened on the agent and the record, which read as a DevOps tool to founders and as "too small" to teams running servers for clients. The new one leads with the bill and the on-call worry, rotates its call to action between the Render and Neon migration paths, gives MSPs their own section on gated operations and the record as the page they send a client, explains the gate with the architecture and a real decision record, and ends on a free pilot by email. The look moves from the dark default to a light, illustrated one. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 6 + site/public/index.html | 907 ++++++++++++++++++++--------------------- 2 files changed, 450 insertions(+), 463 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 92c6e31..7a0bc09 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -70,6 +70,12 @@ Notable changes to Cloudfall. The format follows ### Changed +- The site's landing page is redesigned for technical founders leaving the + cloud and for teams running servers for clients: a light, illustrated + look, the hero's call to action rotating between moving off Render and + moving off Neon, a section for MSPs on gated operations and the record + as the page sent to a client, a section on how the gate works with a + real decision record, and a free pilot by email - The README, the site, the roadmap and the architecture say what is built on a team's own Ansible repository (the operations catalog, the gate, decision records and `cloudfall why`) instead of calling it unbuilt, show diff --git a/site/public/index.html b/site/public/index.html index 9b600b6..b63ec85 100644 --- a/site/public/index.html +++ b/site/public/index.html @@ -3,11 +3,11 @@ -Cloudfall — the record behind your self-hosted AI operator - +Cloudfall: cut the cloud bill, keep your sleep + - - + + @@ -15,200 +15,158 @@ - + - - + + - + + + + - + -
-
- -
-
+ +
-
-
-
-
Migration and operator proven live · open source · AGPL-3.0
-

Your servers, run by an agent.
With a record that answers why.

-

- Cloudfall is the operator's record for self-hosted servers run by an - AI agent. It moves your applications and data onto one or two servers - you own — hardened baseline, monitoring, health-gated deploys with - rollback, a real DNS cutover — and an always-on operator runs them - there. Every operation is verified, every decision leaves evidence: - what the fleet looked like, what was proposed, who approved, what - happened. Plain systemd and nginx. No Kubernetes. -

-
- View on GitHub - Read the migration guide +
+
+

Cut the cloud bill. Keep your sleep.

+

A $1,000 monthly cloud bill often runs on about $100 of bare metal or VPS. Cloudfall moves your apps and data there. Your AI agent runs it. Cloudfall checks every step and writes it down.

+
+ Move off Render + Free pilot
+
uv tool install cloudfallOpen source, AGPL-3.0.
+

Import your render.yaml: apps, data and a DNS cutover that pauses until you flip it.

+

Run servers for clients? See how the agent works within your rules →

+
-
-
- -
cloudfall migrate
-
- 
$ uv run cloudfall import render render.yaml --application acme --server h1
-$ uv run cloudfall migrate --build web=main --yes
-  ✓ baseline       converge every server to the managed baseline
-  ✓ services       converge every declared infrastructure service
-  ✓ data:acme-db   migrate external data with row-count verification
-  ✓ build:web      build a release artifact for web
-  ✓ deploy:web     deploy web behind its health gate
-  ✓ domains-http   render every declared domain route over HTTP
-  ⏸ dns-verify     paused: point acme.example.com at your server, then resume
-$ uv run cloudfall migrate --yes   # resume after the DNS flip
-  ✓ dns-verify     public DNS points at the declared proxy servers
-  ✓ domains-tls    Let's Encrypt issued, HTTPS routes enabled
-  ✓ inspect        read-only server evidence collected
-  ✓ audit          compliant: config matches the observed servers
-  ✓ verify-routes  every declared route healthy over HTTPS
-
+
+ + + + + + + + + + + + + + + $1,000/mo + + + + + + + + + + + + + your apps + data + + + + + + ≈ $100/mo + + + + + + + + + + your bare metal + + + + + + + + + + + + + +
-
-
-

- Proven live, not promised. The full journey ran on disposable - Hetzner servers: an application actually hosted on Render was cut over with its - data and a real TTL-lowered DNS flip on an owned domain, resuming to byte-identical - responses from the Cloudfall host, with a deliberately bad release rolled back - automatically along the way — the entire run driven by an AI agent through - its MCP server alone. The operator then remediated an induced failure - with a single approval, remediated the next identical failure autonomously under - declared policy in 2m06s, proved a real backup restorable in a timer-driven drill, - and delivered an alert to a second machine across the public network, receipts - throughout. - Read the proving-run reports -

+ +
+
+

Two ways in, one record

+

Where are your servers today?

+
+
+ + +

In a cloud or on a PaaS

Render import is built in; from anywhere else, describe your apps in config. Migrate apps and data, cut DNS, keep the difference as runway.

Read the migration guide →
+ + + +

Already on servers, yours or your clients'

Managed by hand, with scripts or with Ansible. Start from Cloudfall's baseline operations, or point it at the Ansible repo you already run.

See how it fits →
+
-
-
-
The record
-

Ask why. Get the story, not a log.

-

- A real decision from the maintainer's six-host production fleet: a - converge of the team's own site.yml. Every sentence - is drawn from a field of the record, as JSON for agents or as one page for people. -

-
-
- -
cloudfall why
-
- 
$ cloudfall why --operation converge
-It was based on 6 host snapshots in tmp/observed, the latest observed at 2026-09-21T10:39:30Z.
-At 2026-09-22T19:38:45Z the mutating operation converge (site.yml) was proposed against the whole fleet with no inputs.
-Check mode would have changed no host and left 3 hosts untouched; the diff is decisions/converge-20260922193845.diff (sha256 4c8458ca26c5…, 48061 bytes).
-It waited for an approval: a mutating operation runs in check mode first and waits for an approval of the recorded diff.
-roman approved it at 2026-09-22T19:39:51Z.
-The run at 2026-09-22T19:39:51Z exited 0 and changed no host; the log is decisions/converge-20260922193845-execution.log.
-The verify step at 2026-09-22T19:40:39Z exited 0 and changed no host; the log is decisions/converge-20260922193845-verify.log.
-It ended verified: the run succeeded and the verify step changed nothing.
+ +
+
+
+

For agencies and MSPs

+

Hand the routine to an agent. Keep the rules and the record.

+

Disks filling up, certificates expiring, backups nobody has tested. Your agent takes the routine across client servers, but only through operations you allow. Each one has a risk level, a verify step and a record. An operation you haven't declared doesn't exist to the agent.

+

No baseline yet? Start from Cloudfall's operations for hardening, PostgreSQL, backups and deploys. Already on Ansible? Declare the playbooks you run, as on the right. No import, no second copy of anyone's fleet.

+
+
+
operations/deploy.ymlon Ansible
+
id: deploy
+playbook: playbooks/deploy.yml   # your existing playbook
+risk: mutating                   # read | mutating | destructive
+targets: component
+inputs:
+  version: string
+preconditions:
+  - health: ok
+verify:
+  playbook: playbooks/health.yml
-
-
-
-
Who it is for
-

Two ways in, one record

-
-
-

Leaving a PaaS

-

- A small production app with a database costs about $83 a month on - Render and runs on a Hetzner server for under €10. Cloudfall moves - your applications and data onto servers you own, and an always-on - operator runs them there with a receipt for every action. -

-
-
-

Already running Ansible

-

- Point Cloudfall at your own repository. Each playbook you declare - becomes an operation with a risk level, a verify step and a record; - your agent sees exactly those as tools, a mutating one waits for a - person to approve its check-mode diff. No import, no second copy of - your fleet. -

-
-
+
+
readRuns freelyFacts, health, inventory. Nothing to gate.
+
mutatingCheck mode, then approvalThe diff is recorded first and a person approves it. Once your policy licenses the class, the next identical failure gets fixed alone.
+
destructiveAlways a humanData deletion, DNS cutover, promotion. No policy and no prompt can unlock it.
-
-
-
-
Why Cloudfall
-

An operator that can't fake success

-

- Agents can already run your servers. What they lack is a record: - what they may do, whether it worked, and why they did it. Cloudfall - is that record, and it happens to make leaving the cloud safe too. -

-
-
-

A record that answers why

-

- An agent's own log says a tool was called. Cloudfall's record - says what the fleet looked like when it was, what was proposed, - who approved, and what verify reported. After an incident, that - is the page you open. -

-
-
-

Verified, not just ran

-

- Deployments produce receipts. Status is derived from validated - observations, and cloudfall audit reports drift between - your config and the observed servers with distinct exit codes. - Cloudfall never reports success it cannot prove. -

-
-
-

Good-enough databases, with proof

-

- Managed Postgres is mostly insurance. Cloudfall keeps the coverage - and drops the premium: loopback PostgreSQL and Redis with receipted - backups and timer-driven restore drills that prove a real backup - restorable instead of assuming it. -

-
-
-

Autonomy earned, never assumed

-

- The always-on operator diagnoses from evidence and proposes fixes - you approve, from the CLI or through - cloudfall mcp serve. Autonomy is granted per operation class, licensed by - declared policy and earned receipt history; DNS cutover, data - deletion, and promotion always require your confirmation. -

-
-
-

The bill buys computers, not margins

-

- A steady cloud bill is mostly margin on commodity compute and - managed databases: an app that costs $83 a month on Render runs - on a Hetzner server for under €10. The difference is runway, - every year. -

-
-
-

systemd, not containers

-

- Applications run as native systemd services with artifact releases - and symlink rollback on long-lived Debian servers. It is all plain - systemd, nginx, and Postgres, so any Linux admin can take over - without Cloudfall. No lock-in if you ever hire one. -

-
+
+
+ + + + + + + + + + + + + + + + + dental-group · 3 + + + + + + shop-eu · 2 + + + + + + saas-crm · 3 + + waiting for your approval + +
+
+

After an incident

+

The record is the page you send your client

+

Your client doesn't want an Ansible log. They want to know what happened, who allowed it and whether it worked. Every sentence below comes from a field of the record.

-
-
-
-
How it works
-

From render.yaml to your own server

-

- One resumable migration: it pauses where you must act and picks up - exactly where it left off. -

-
-
-
1
-

Import

-

- cloudfall import render maps your Render blueprint onto - typed Cloudfall config with an explicit gap report. Nothing is - guessed silently. -

-
-
-
2
-

Migrate

-

- cloudfall migrate converges the baseline and services, - migrates your data with row-count verification, deploys behind - health gates, and pauses at DNS verification before issuing TLS. -

-
-
-
3
-

Operate

-

- Cut DNS and the bill starts buying computers. The always-on - operator watches declared alerts and audited drift, remediates - what its record proves reversible, and writes an audit entry for - every decision; you approve only what can't be undone. -

-
-
+
+
$ cloudfall why --operation converge● verified
+
    +
  1. Converge of site.yml proposed against the whole fleet, based on 6 host snapshots.
    2. +
  2. Check mode: no host would change. Diff saved as converge-20260922193845.diff.
    3. +
  3. Waited for approval. roman approved the recorded diff.
    4. +
  4. Run exited 0 and changed no host.
    5. +
  5. Verify exited 0. Ended verified.
    6. +
-
+
+ Put one client's PostgreSQL under the gate + Bring your Ansible repo +
+
-
-
-
Status
-

Pre-1.0, honestly labeled

-

- Cloudfall is early. Here is exactly where it stands. -

-
-
-

Implemented and proven live

-
    -
  • Hardened Debian baseline, nftables firewall, UTC time
    • -
  • Loki / Grafana / Alloy logging with metrics and declared alert rules over mTLS
    • -
  • Loopback PostgreSQL and Redis with timer-driven restore drills
    • -
  • Health-gated deploys with automatic rollback of bad releases
    • -
  • Let's Encrypt TLS and nginx routes from declared domains
    • -
  • Render blueprint and live-API importers with guided data migration
    • -
  • Resumable migrate with a real DNS cutover on an owned domain
    • -
  • cloudfall mcp serve agent server, confined to one fleet
    • -
  • sops/age secret references rendered to per-component env files
    • -
  • Always-on operator: receipted proposals, policy-bounded autonomy
    • -
  • On your own Ansible repository: declared operations, check-then-approve gate, decision records and cloudfall why, run on the maintainer's production fleet
    • -
-
- -
+ +
+
+

Under the hood

+

The gate lives in Cloudfall, not in the prompt

+

An agent can be talked out of a rule in its instructions. It can't be talked out of a process that refuses to run a destructive operation without a person.

-
-
-
-
Get started
-

Sixty seconds to see how it thinks

-
$ uv tool install cloudfall -$ uvx cloudfall init my-project && cd my-project && uv sync -$ uv run cloudfall config validate
-
- Star on GitHub - See the roadmap +
+ + + + + Your agent + any MCP client + + + Cloudfall + CLI + MCP server + gate by risk + + + Ansible + your playbooks + + + + + + hosts + + + The record + OperationDecision + + + + a person approves the diff + + + + + + + + + + + declared tools only + verify → snapshots + diff · approval · outcome + + +
+ +
    +
  1. Observe snapshots
    2. +
  2. Decide operation, targets, why
    3. +
  3. Preview check mode, diff
    4. +
  4. Approve gate by risk
    5. +
  5. Run through Ansible
    6. +
  6. Verify update snapshots
    7. +
+ +
+
    +
  • Tool listGenerated from your declared operations. Risk levels go out as MCP tool annotations, so any client can gate on them too.
    • +
  • StatusDerived from validated observations, never from the agent saying so. cloudfall audit reports drift with distinct exit codes.
    • +
  • Your agentClaude Code, Codex or any MCP client. cloudfall init writes an AGENTS.md: every command sorted by effect and the gate it needs. Your agent reads it first.
    • +
  • Same surfaceOne CLI and one MCP server, the same commands for people and agents, JSON everywhere.
    • +
  • Exit planPlain systemd, nginx and PostgreSQL on Debian. Remove Cloudfall and any Linux admin can carry on.
    • +
  • LicenseAGPL-3.0. Read the gate before you trust it.
    • +
+
+
$ cloudfall why --operation converge --jsontrimmed
+
{
+  "apiVersion": "cloudfall/v1",
+  "kind": "OperationDecision",
+  "metadata": { "id": "converge-20260922193845" },
+  "spec": {
+    "proposedAt": "2026-09-22T19:38:45Z",
+    "operation": { "id": "converge",
+               "risk": "mutating" },
+    "targets": { "scope": "fleet" },
+    "gate": {
+  "requirement": "check-then-approve" },
+    "check": { "exitCode": 0, "changed": [],
+           "diff": { "bytes": 48061 } },
+    "approval": { "approver": "roman" },
+    "status": "verified"
+  }
+}
-
+
+ + +
+
+

Want us to set it up with you? The pilot is free.

We're taking three outside teams this quarter. We move one app or one client fleet onto Cloudfall together with you, and you keep running it. Write to pilot@cloudfall.dev

+
Email about a pilotStart with one PostgreSQL
+
+
+ + From 300e34c70a4295283e9cc2eb6391a62a601b0073 Mon Sep 17 00:00:00 2001 From: Romamo Date: Thu, 8 Oct 2026 17:17:21 +0300 Subject: [PATCH 2/3] Bring the manifesto page and the link preview into the new look The manifesto kept the old dark style and navigation, and og.png still showed the old title, so a shared link previewed a page that no longer exists. The manifesto text is unchanged; its navigation points at the new landing sections, and the preview shows the new headline and scene. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 3 +- site/public/manifesto.html | 197 +++++++++++-------------------------- site/public/og.png | Bin 66575 -> 106331 bytes 3 files changed, 60 insertions(+), 140 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7a0bc09..dacd0b0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -75,7 +75,8 @@ Notable changes to Cloudfall. The format follows look, the hero's call to action rotating between moving off Render and moving off Neon, a section for MSPs on gated operations and the record as the page sent to a client, a section on how the gate works with a - real decision record, and a free pilot by email + real decision record, and a free pilot by email; the manifesto page and + the link preview image follow the same look - The README, the site, the roadmap and the architecture say what is built on a team's own Ansible repository (the operations catalog, the gate, decision records and `cloudfall why`) instead of calling it unbuilt, show diff --git a/site/public/manifesto.html b/site/public/manifesto.html index 94df227..e378dea 100644 --- a/site/public/manifesto.html +++ b/site/public/manifesto.html @@ -15,131 +15,66 @@ - + - + + + +