Nagios fires. Someone pastes the alert into Slack. Someone else SSHs in, runs the same three diagnostic scripts, and types "looks like disk" twenty minutes later. Tomorrow it happens again. StackStorm's whole pitch is that loop as code: event in, rule matches, workflow runs, ChatOps posts the result, and a human only wakes up if the workflow freezes.
StackStorm (StackStorm/st2, ~6.5k GitHub stars, Apache-2.0, Python) calls itself IFTTT for ops. Sensors watch the outside world. Triggers represent events. Rules map those to actions or workflows. Packs bundle integrations from exchange.stackstorm.org (on the order of 160 packs and thousands of actions). Docs and installer: docs.stackstorm.com.
Sensors, rules, workflows, packs
Architecture in plain language:
- Sensors are Python plugins that notice something (a webhook, a timer, a Sensu/Nagios alert, a Jira change) and fire a trigger.
- Actions are outbound: SSH, HTTP, Docker, cloud APIs, or any script with a metadata file. You can run them from the CLI, API, web UI, or as a step in a workflow.
- Rules are the IFTTT bit: when this trigger looks like X, run that action, mapping payload fields to inputs.
- Workflows chain actions with order, conditions, and context. Most real remediations are more than one step (diagnose, evacuate, ticket, maybe PagerDuty).
- Packs are how you install and share that content. ChatOps wires the same action library to Slack/Mattermost so
!st2in chat is a controlled run, not a random shell.
The audit trail stores who/what triggered an execution. That is the difference between a clever bash loop and something you can show an incident review.
Not Huginn, not OliveTin, not Kestra
Huginn is personal IFTTT (RSS, scrape, email). StackStorm is the ops version: monitoring events, SSH into boxes, ChatOps. OliveTin is a button that runs a command you already wrote. StackStorm is a rules engine plus a pack ecosystem. Kestra and Airflow are pipeline orchestrators; ST2 is "something broke, do this." You can run both. Do not pretend they are the same install.
Why self-host?
Remediation workflows hold SSH keys, cloud credentials, and a map of how you actually recover. That belongs on infrastructure you control, especially for Canadian shops that cannot send incident context to a US automation SaaS. Apache-2.0 is straightforward internally.
The cost is a real platform: nginx, MongoDB, RabbitMQ, Redis (or ZooKeeper), plus st2auth/api/stream. Docs size a test box at dual CPU / 2 GB RAM / 10 GB disk, and production at four cores / 16 GB+ / 40 GB. Supported OS list in the 3.9 docs is Ubuntu 20.04/22.04 and RHEL/Rocky 8/9 (64-bit). This is not a single Go binary. If you only need five buttons, use OliveTin.
Quick start
Official path is a 64-bit Ubuntu or Rocky box and the installer (change the password immediately):
curl -sSL https://stackstorm.com/packages/install.sh | bash -s -- \
--user=st2admin --password='Ch@ngeMe'Read the script, pin a version from current docs, and do not leave Ch@ngeMe in production. UI typically sits on 80/443 via nginx; internal ports include Mongo 27017, RabbitMQ, Redis, and st2auth/api/stream (9100–9102). Put TLS and auth in front. ChatOps needs a bot token; treat that like root.
Who it is for
Good fit: SRE teams with noisy monitoring and repeatable runbooks; shops that already live in Slack and want !restart to be an audited action; people composing OpenStack/AWS/Jenkins steps as packs instead of tribal wiki pages.
Skip it: if crontab or GoCron covers you; if you wanted Zapier for marketing RSS; if nobody will own Mongo and RabbitMQ. Six thousand stars and 600 open issues is an established ops tool, not a weekend toy.
Hosting in Canada
Give StackStorm a CloudBox that matches those RAM numbers, not a 2 GB leftover. Keep Mongo on a volume you snapshot. Canadian residency matters because execution history is an incident log. ChatOps still talks to Slack's cloud; the sensors and SSH stay on your side of the fence.
Bottom line
StackStorm is event-driven ops automation you can git: packs, rules, workflows, ChatOps, audit. Self-host it when auto-remediation is a real job and the credentials cannot leave the building. Start with one webhook and one SSH action. Grow packs only after that loop is boring.
Talk with Swift Host if you want a Canadian VPS sized for ST2 (RAM, disk, TLS), not a tiny trial VM. We are in St. Albert and actually answer the phone.
