CFEngine

CFEngine is agent-based configuration management for large server fleets: a GPL open source engine plus an Enterprise edition with a web console, sold by quote.

CFEngine keeps servers in the state their administrators define, with each host checking and correcting itself instead of waiting for someone to push a change. Northern.tech AS, an independent company in Oslo, develops it alongside its device management products. Administrators write policy that describes the desired state of every host, and the engine converges each machine towards it. The approach targets the configuration drift that builds up when large fleets are changed by hand. Every host runs an autonomous agent, cf-agent, which applies policy on a schedule and can preview pending changes in a dry run. The cf-secret component encrypts files such as an API token for one specific host. CFEngine Build is a catalogue of policy and modules from CFEngine, its partners and the community, added through the cfbs command line. The Enterprise edition adds Mission Portal, a web UI with dashboards, host inventory and compliance reports, backed by a reporting hub with an SQL database and REST APIs. It also brings alerts, change reporting, audit logs, file integrity monitoring, role-based access and Windows, AIX, Solaris and HP-UX support. CFEngine is built for DevSecOps teams and system administrators who run large fleets and want security and compliance enforced continuously. The Community Edition is open source under the GPL and suits Linux teams comfortable with community support and the command line. Organisations that need dashboards, audit trails and vendor support move to the Enterprise edition under a commercial license. HIPAA Vault, for one, has run the Community Edition since 2013 and moved to Enterprise for more visibility and security. Typical jobs are patch management, hardening hosts against a baseline such as the STIG sample policy for Red Hat, and producing compliance reports before an audit. Teams keep policy in Git and roll it out through their CI/CD pipelines. Modules from CFEngine Build cover jobs such as Docker Compose services, Windows packages through winget and Lynis security audits. When a host falls out of compliance, an alert's custom action can pass the problem to PagerDuty or Nagios. The CFEngine AI agent answers questions about the estate by generating SQL that anyone can inspect, using the model provider a team chooses, including one run on premises. CFEngine fits teams that would rather declare once how a server should look than fix it again by hand.