Pulse

Appearance

PulseOne durable event bus for all your tools

Bots, agents, scripts and webhooks publish to one NATS JetStream stream. Each tool gets its own least-privilege credentials, and any new tool can replay years of history from a timestamp.

Get started
Try it locally
Clients & SDKs
Pulse

History you can replay

Every event lands in the EVENTS stream, kept until the stream reaches its size limit. Subscribe with a start time or sequence and get the past in order, then live events. Durable consumers keep their place.

Least privilege per tool

Each client is its own NATS user with permissions built from grants such as publish:evt.home.>. Credentials are shown once. Rotation and revocation disconnect live sessions within seconds.

NATS, HTTP or webhooks

Go, Python and TypeScript SDKs and a CLI over NATS TLS. HTTP tokens for publish, replay and an SSE tail. Signed inbound webhooks from GitHub, Stripe or any HMAC sender, and ordered, retried outbound webhooks.

Secure at the edge

pulsed terminates TLS behind Cloudflare with Authenticated Origin Pulls, gets Let's Encrypt for raw NATS, and bans addresses that keep failing authentication, in nftables, over HTTP and at Cloudflare.

Backups that keep their timestamps

Nightly, age-encrypted, deduplicated backups to S3-compatible storage on a 7/4/12 schedule. Restores keep sequence numbers and stored times, so replay by time works the same afterwards.

Users, roles and single sign-on

Dashboard users sign in with a password and TOTP or through any OpenID Connect provider. Four roles, from administrator to viewer, and every sign-in and change is in the audit log. Reach it by SSH tunnel or behind Cloudflare.

How it works ​

Tools connect straight to NATS on port 4222 with their own credentials. Browsers and webhook senders come in through Cloudflare to pulsed on port 443. pulsed runs the dashboard, rollups, bans and alerts, and sends backups, notifications and outbound webhooks. Operators sign in to the dashboard with a password and TOTP or with single sign-on, through Cloudflare when the public dashboard is enabled, or through an SSH tunnel. Webhook sendersGitHub · Stripe · HMACBrowsers, HTTPdashboard · tokens · /wsTools, bots, agentsown .creds, own grantsCloudflareWAF · rate limitOne VPSpulsedAPI · dashboard · bansrollups · alerts · SQLiteNATS JetStreamEVENTS · KV · objectsyears of history443mTLS4222, TLS, directS3encrypted backupsAlertsTelegram · DiscordYour servicesoutbound webhooksOperatorspassword + TOTP, or SSOvia Cloudflare or ssh -L

Pulse is small on purpose: one VPS with 2 GB of RAM, one distroless image plus the official NATS image, a single node.

  1. pulsed init sets NATS up in JWT operator mode, with its own operator, accounts and signing keys sealed by a master key.
  2. pulsed admin bootstrap prints a one-time link for the first administrator. You sign in to the dashboard with a password and TOTP, or later with single sign-on, and invite the rest of your people with a role each.
  3. You create a client per tool in the dashboard and give it grants. Its .creds file is shown once.
  4. Tools publish events such as evt.home.door.opened with a small CloudEvents-style envelope, over NATS, HTTP or a signed webhook.
  5. Any client with a subscribe grant replays from a time or sequence, then follows live events.

See it ​

Pulse overview with event counts, throughput over time and the top domains, types and subjectsPulse overview with event counts, throughput over time and the top domains, types and subjects
Overview: event counts, throughput and the top domains, types and subjects
Event explorer with filters and a list of eventsEvent explorer with filters and a list of events
Event explorer
Clients with their grants and live connectionsClients with their grants and live connections
Clients and their grants
Security page with automatic and manual bans and authentication failuresSecurity page with automatic and manual bans and authentication failures
Automatic bans and authentication failures
An outbound webhook's delivery log with delivered and retried attempts
Outbound webhooks with a delivery log
Alerts with a firing rule, Telegram and Discord notifiers and the rule list
Alerts to Telegram and Discord
System page with NATS, JetStream and certificate statusSystem page with NATS, JetStream and certificate status
NATS, JetStream and certificates
Sign-in page with email and password and a single sign-on buttonSign-in page with email and password and a single sign-on button
Sign-in: password and TOTP, or single sign-on
Users page listing people with their roles, sign-in methods and status
Users and roles

Where to go next ​

Released under the Apache-2.0 license.

Pulse contributors