Wachd

Wachd sits between monitoring and the person holding the pager. An alert from Grafana, Datadog, Splunk or any compatible source arrives as a webhook, and rather than a bare threshold breach the on-call engineer receives a diagnosis with a probable cause and a suggested action.

In between, the pipeline gathers recent commits, error logs and metric history around the alert time, strips identifying data from that context before anything analyzes it, correlates events into a causal timeline, and looks up who is on call. No agent runs in your clusters: alerts come in over HTTPS and Wachd calls your monitoring APIs outbound.

The deployment is shaped to stay inside your own boundary.

• Local analysis: Ollama is the default backend, so an air-gapped install makes no external calls, with OpenAI available instead.
• PII removal: a sanitizer strips identifying data with twenty-one patterns before analysis runs.
• Authentication: local users, OIDC sign-on against Entra, Okta or Google Workspace, group mappings and API tokens.
• On-call: a schedule and rotation engine decides who gets each notification over Slack and email.
• Storage: PostgreSQL holds the data and Redis carries the job queue between server and worker.

Server and worker are Go with a Next.js dashboard, deployable through Docker Compose on a single VPS or the bundled Helm chart on Kubernetes. First startup prints a generated superadmin password to the log, and the documentation is blunt that the shipped encryption key must be replaced before production. Apache 2.0 licensed.