OpsKnight

Transparent, self-hosted incident operations.
From alert ingestion and on-call routing through response, customer communication, and learning.

opsknight.com

📦 Current Stable Release: v1.4.0

Paging reliability — delayed escalations remain delayed, orphaned work is recovered safely, and notification routes avoid duplicate delivery.

Operational confidence — the administrator Health Center consolidates supported runtime checks, while the release contract validates installation, upgrades, recovery, incident delivery, deployment rendering, and stable AMD64/ARM64 images.

Release notes · Integrations · Changelog

v1.2 added Slack ChatOps incident war rooms — setup guide.

• Why OpsKnight?
• Demo
• Key Features
• Mobile Command Center
• Integrations
• Built With
• Quick Start
• Container Images
• Deployment Options
• Architecture
• Documentation
• Security
• Roadmap
• Community & Support
• Support the Project

Own the incident loop, the operational evidence, and the data.

OpsKnight is an open-source, self-hosted alternative to per-seat on-call SaaS (including PagerDuty and Opsgenie). It is not affiliated with those companies. Designed for teams that want incident data on their own machines.

Whether you are an SRE team at a startup or a platform team at a larger organization, OpsKnight connects detect → route → respond → communicate → learn on infrastructure you control. Reliability and transparent operational evidence—not raw feature count—are the product contract.

Respond to incidents from anywhere. OpsKnight includes a fully installable Progressive Web App (PWA) for iOS and Android.

• 🔔 Push Notifications: Get critical alerts instantly on your device.
• 👆 One-Tap Install: No App Store required. Just "Add to Home Screen".
• 🔒 Secure: Supports biometric authentication (FaceID/TouchID).

OpsKnight plays nicely with your entire observability and engineering stack.

View All 22+ Integrations →

OpsKnight is built on a modern, type-safe stack designed for performance and developer experience.

• Docker & Docker Compose
• Git
• openssl (ships with macOS and most Linux distributions)

# 1. Clone the repository
git clone https://github.com/opsknight-labs/OpsKnight.git
cd OpsKnight

# 2. Create your environment file
cp env.example .env

# 3. Generate the two secrets OpsKnight requires
printf 'NEXTAUTH_SECRET=%s\n' "$(openssl rand -base64 32)" >> .env
printf 'ENCRYPTION_KEY=%s\n'  "$(openssl rand -hex 32)"    >> .env

# 4. Start OpsKnight and PostgreSQL
docker compose pull
docker compose up -d

The main-branch Compose file defaults to the patched ghcr.io/opsknight-labs/opsknight:1.4.0-hotfix image. You do not need to switch branches or manually configure latest.

Open http://localhost:3000. The database schema is created on first boot, so there is no migration step to run yourself.

ENCRYPTION_KEY encrypts integration credentials at rest — keep it safe and back it up. Losing it means re-entering every integration secret.

Before exposing this to a network, change the default PostgreSQL password in .env and set NEXTAUTH_URL / NEXT_PUBLIC_APP_URL to your real hostname.

To run the published image against your own PostgreSQL, rather than the bundled one:

docker run -d --name opsknight -p 3000:3000 \
  -e DATABASE_URL="postgresql://user:password@your-db-host:5432/opsknight" \
  -e NEXTAUTH_URL="https://opsknight.example.com" \
  -e NEXT_PUBLIC_APP_URL="https://opsknight.example.com" \
  -e NEXTAUTH_SECRET="$(openssl rand -base64 32)" \
  -e ENCRYPTION_KEY="$(openssl rand -hex 32)" \
  ghcr.io/opsknight-labs/opsknight:1.4.0-hotfix

PostgreSQL 14+ is required. See the deployment guides for TLS, connection pooling and scaling.

Images are published to the GitHub Container Registry and are public — no authentication needed to pull.

# Pin the patched v1.4 runtime — recommended for affected v1.4 deployments
docker pull ghcr.io/opsknight-labs/opsknight:1.4.0-hotfix

# Do not use `latest` for affected v1.4 deployments; the original 1.4.0 image is immutable.

Pinning an exact version is strongly preferred in production: latest moves whenever a release ships, so a container restart can change versions underneath you.

Browse all published versions →

We support multiple deployment strategies to fit your infrastructure needs.

Method	Best For	Guide
Docker Compose	Local Development, small teams	Read Guide
Helm Chart	Production Kubernetes (Recommended)	Read Guide
Kustomize	GitOps (ArgoCD/Flux)	Read Guide

Note: For production, we recommend using an external managed PostgreSQL database.

OpsKnight runs as a single Next.js application (UI + API routes + server actions) with an internal DB-backed scheduler and a Postgres-backed job queue.

_{High-level architecture: clients → app (Next.js) → PostgreSQL (Prisma) → outbound channels.}

• Full details: Architecture docs

Everything you need to configure and extend OpsKnight.

• Hosted Documentation (Recommended)
• In-Repo Guides (v1.5):
  • ⚡ Getting Started
  • 🧩 Core Concepts
  • 🔌 Integrations
  • 🛡️ Security
  • 📡 API Reference
  • 🔧 Administration
  • 📈 Prometheus Metrics

OpsKnight handles on-call rotations, integration credentials and incident data, so security is treated as a first-class concern:

• Integration secrets are encrypted at rest with envelope encryption, keyed by ENCRYPTION_KEY
• Inbound webhooks and Slack requests are signature-verified and rejected when they cannot be verified — there is no fail-open path
• Every push is scanned by CodeQL, Trivy, TruffleHog, Checkov and OWASP ZAP in CI
• RBAC governs incident, service and schedule access

Found a vulnerability? Please do not open a public issue — see SECURITY.md for private disclosure.

Hardening guidance: Security documentation

🔥 Currently In Active Development: OpsKnight 2.0 (Next Major Evolution)

• Core Incident Management & On-Call Schedules
• Slack ChatOps Incident War Rooms & Interactive Cards
• Native inbound parsers (catalog size in docs; includes Events API v2 ingest, GitLab, Vercel, Nagios, Icinga, Datadog, Prometheus, etc.)
• Forensic Webhook Ingestion Security & Mandatory Key Authentication
• Master Encryption Key Architecture (12-Factor Security)
• Tier-2 SLA Engine Hardening & Custom Business Hours
• Jira Cloud Bi-Directional Synchronization & Real-Time Note Sync
• Public Status Pages with Subscriber Notifications
• Mobile PWA with Biometric Security & Push Notifications
• Administrator Health Center & Release-Quality Contract
• Reliable Delayed Escalation Recovery & Multi-Architecture Releases
• 🚀 OpsKnight 2.0: Redesigned UI, real-time push engine, and availability hardening

See the full ROADMAP.md

We are actively seeking contributors! Whether you're a developer, designer, or technical writer, come help us build OpsKnight.

We love contributors! Please check our Contributing Guide to get started.

OpsKnight is an independent open-source project. If it helps you sleep better at night, consider supporting its development.

• 🌟 Star the repo: It helps others find us.
• 💝 Sponsor: Become a Sponsor

Built with ❤️ by Dushyant Rahangdale