OPNMGR
Self-hosted OPNsense fleet management for MSPs and IT teams: monitor every firewall, back up and diff configurations against an approved baseline, and roll out updates in safe, staged rings.
The problem
An MSP with firewalls at many customer sites needs to know which are healthy, which configs changed, and which still need updates. Doing that one web interface at a time doesn’t scale, and updating a high-availability pair carelessly can take a site offline.
Why existing tools fell short
OPNsense has no built-in way to manage a fleet: each firewall has its own web interface, and there’s no central view of health, config drift, or update state.
The solution
OPNMGR collects regular check-ins from an agent on each OPNsense firewall, raises incidents, keeps configuration backups, and compares each config with an approved baseline. Updates roll out as campaigns through canary, pilot, and production rings inside maintenance windows. Nothing is ever restored automatically.
- Agent check-ins for gateways, VPN, CARP, services, and certificate expiry
- Configuration backups and drift detection against an approved baseline
- Update campaigns through canary, pilot, and production rings
- Incidents, maintenance windows, and grouping by customer and site
- Optional AI configuration review with secrets redacted
Engineering involved
Verified from the public repository: README, dependency manifests, and source files.
- Backend
- Plain PHP 8 with no framework, on Apache or Nginx; scheduled work runs from cron.
- Database design
- MySQL 8 / MariaDB with an 80-table schema covering customers, sites, firewalls, check-ins, incidents, backups, and update campaigns.
- Agent
- An OPNsense plugin that checks in every two minutes with a per-firewall API key; agent updates are Ed25519-signed.
- Security
- Secrets encrypted with XChaCha20-Poly1305 via libsodium; TOTP two-factor sign-in.
- Automation
- Ringed update campaigns with high-availability safety rules and maintenance windows.
- Testing
- A custom test runner with around fifty test files, run in CI.
What makes it interesting
High-availability pairs get special treatment in update rollouts: both members of a CARP pair are never updated at the same time, and the second member isn’t touched until the first comes back healthy. It’s a small rule that prevents the worst possible outcome of “update everything.”
Outcome
Measured Public GitHub figures as of 10 October 2026: 28 stars, 1 forks, and 20 published releases since the repository was created in February 2026. Stars and forks show public interest, not active installations — the project doesn’t collect usage data.
Current status
Open Source Free, MIT-licensed, self-hosted. The source code is public on GitHub.
Open source under the MIT license and actively developed. Customers and sites are an organizational grouping, not separate tenant logins.
See it working
Screenshots with demo data are in the repository: github.com/agit8or1/OPNMGR. Overview: mspzero.com/tools/opnmgr.
Want something similar?
Need a system like this, built around your own business? MyAppDone can design, build, deploy, and maintain an application tailored to your workflow.
Related projects
ClientSt0r
Problem: MSPs keep runbooks, assets, passwords, and tickets in separate rented products, so a technician opening a ticket has to hunt across systems for context.
Self-hosted IT documentation and service desk for MSPs. A ticket opens with the client’s contract, the affected asset, the runbook, and the vault entries the technician needs — all in one database.
- Client documentation, assets, runbooks, and an encrypted password vault
- Opt-in service desk: queues, SLA timers, time entries, quotes, invoices, and contracts
- One organization per client, with parent/child organizations
- Enforced TOTP 2FA and optional Entra ID SSO or LDAP
- PSA and RMM integrations and a browser extension
Depl0y
Problem: The Proxmox interface shows one cluster per login and none of the server hardware underneath — so managing several sites means many tabs and no hardware health at all.
Proxmox infrastructure and server hardware management in one dashboard: many clusters and hosts in one view, Dell iDRAC and HPE iLO health over Redfish, VM provisioning with cloud-init, and VM import.
- Multi-cluster dashboard, topology graph, and VM metrics
- Dell iDRAC and HPE iLO hardware health, inventory, and power control
- Create-VM wizard with cloud images and cloud-init
- VM import from OVA/OVF, VMDK, VHD, QCOW2, or ESXi/vCenter
- Admin, operator, and viewer roles with TOTP and an audit log
Exploit Hound
Problem: MSPs end up with thousands of vulnerability findings across customers and no useful answer to the only question that matters: what should we fix first?
A hosted exposure-management platform that discovers assets, correlates vulnerabilities, ranks remediation by the attack paths it removes, and verifies fixes by re-checking — across every customer environment.
- “Fix First” — findings grouped into technician actions, ranked by attack paths removed
- Asset discovery: external surface, onsite LAN probe, and endpoint agents
- Remediation verified by re-checking, not by trusting a tool’s “success”
- Threat Radar: known-exploited and most-likely-exploited vulnerabilities
- Multi-tenant MSP console with per-customer exposure graphs