Run the Ansible playbooks you already have, even on Windows with no WinRM, and let Terraform-built machines join and get configured on first boot.
Salt is fast, event-driven, and great at Windows, but it asks you to learn a new world. Gardience meets you where you already are.
Gardience writes one playbook. Run it with the Ansible you already have and every host installs the agent, joins on its own while the enrollment is open, and brings its inventory groups. Plain ansible-core is enough.
Run existing playbooks through Gardience on Linux and Windows. No WinRM to open, no SSH keys to spread around, and vault secrets injected without ever touching a log.
The gdn command line works the way your hands expect: run a command on a group, run a playbook with --check, and read the same ok / changed / failed recap.
Inventory groups become Gardience groups automatically. Make your own in the console by picking machines, an OS, or a name pattern, and use them anywhere: runbooks, approvals, change windows, the vault.
Ansible is good at what it does: it connects, runs tasks, and reports. A patch program needs much more than that, and with Ansible each piece is another playbook, product, or server to maintain. Gardience has them built in.
A push only reaches machines that answer when the job runs. A laptop on the road or a server mid-reboot comes back unreachable, and someone has to notice and run it again. Gardience holds the work and runs it when the machine reconnects.
Ansible sees a machine only while a job is running. Gardience's agents stay connected, so a stopped service, a new administrator, or drift from your settings shows up in seconds, not at the next run.
At fleet scale, Ansible means AWX on Kubernetes or Automation Platform controllers, execution nodes, and execution environment images to build and keep current. Gardience is one Linux server and one install command.
Ansible reaches Windows over WinRM or SSH: listeners, certificates, firewall rules, and credentials on every machine. Gardience's agent connects out, so nothing on the machine waits for a connection.
A job log says a task ran. An auditor wants each machine's before and after, who asked, who approved, and a record nobody could edit. Gardience keeps per-machine results in a signed evidence pack anyone can verify, and a hash-chained audit log.
Ansible installs what you tell it to. Finding which CVEs reach which machines takes another product (for Red Hat, Lightspeed, on connected RHEL only). Gardience checks every Windows and Linux machine against each vendor's data every day, and fixes one CVE on just the exposed machines.
Salt keeps a live connection to every agent, so Gardience asks the fleet directly instead of waiting for the next scan.
Which machines have OpenSSL 3.0? Who is an administrator? What is listening on port 4444? Is this service running? Pick a question, and every machine answers in seconds. Asking changes nothing.
A new administrator account, a new listening port, a stopped security service, or a USB drive plugged in: Gardience notices and tells you, with the machine and the time.
CPU, memory, and disk for every machine, with 30 days of history and alerts when a disk fills or a machine stays maxed out.
Run a command, apply a state, start a runbook, or add the machine to a group, right where you found the problem. Approvals, change windows, and the audit log still apply.
Common settings, ready to use: install a package, manage a service, set a file, add a user, and more. Fill in a few fields, test it first, then apply.
Gardience sorts machines into Servers, Desktops, and Laptops on its own, so you can patch and harden the whole office, not just the server room.
Most teams build machines with Terraform and then configure them with a second tool. With the Gardience provider for Terraform and OpenTofu, a new machine joins Gardience on its own the moment it starts, lands in its groups, and gets its baseline within seconds. From then on Salt's always-connected agent reports what happens on it, so Gardience fixes problems in seconds instead of waiting for the next scheduled run. When Terraform destroys the machine, it leaves the fleet.
resource "gardience_enrollment" "web" {
label = "web tier"
groups = ["web"]
}
resource "gardience_event_rule" "web_join" {
id = "web-join"
kind = "join" # every new web server
scope = "group"
group = "web"
state = "web_base" # gets this state at once
}
resource "aws_instance" "web" {
ami = var.ami
user_data = gardience_enrollment.web.linux_script
}
Every enrollment gives a first-boot script for Linux and Windows. The machine installs the pinned, checksum-verified Salt agent and joins without anyone approving it. Works with Terraform, cloud-init, golden images, and Ansible.
A stopped service is restarted on the spot. A filling disk raises a warning. A new machine gets its state the moment it joins. No polling, and no connections out to each machine: the agent reports, Gardience acts, the audit log records it.
Enrollments, groups, saved states, event rules, runbooks, schedules, and change windows live in your Terraform or OpenTofu code, and one export writes an existing setup as code that adopts with no changes. The provider uses a configure key that can never run commands on the fleet, a schedule it saves waits for an admin to turn it on, and every change is in the tamper-evident audit log.
Point Gardience at the states folder of a Git repository. A push syncs it, and Gardience checks every state and shows what publishing would do before anything changes. Publish by hand, or let a merge to the branch be the approval. States that come from Git change only in Git, so the repository stays the source of truth.
New, changed, and removed states, each with its diff, plus anything skipped and why. The audit log records the commit that was published.
States are judged by what is in them, not by their name. One that would wipe a disk or remove the Salt agent is marked in the review and needs a second person to apply, whether it came from Git or the console.
Dry-run and apply as usual. Change windows, locks, approvals, and permissions all apply, and a missing or renamed folder never deletes your states.
Two or three lines is enough. A person will reply and set up a short call to size it.