OpsCanopy

A canopy of free, private, browser-based tools for platform & DevOps engineers.

🌐 opscanopy.com · 42 tools · no signup · no servers · MIT licensed

OpsCanopy is a growing collection of focused utilities for DevOps and SRE work — validators, converters, testers and linters. Every tool runs 100% client-side in your browser using JavaScript and (where it helps) WebAssembly. There is no backend, no API and no account system, so anything you paste never leaves your device. Most tools keep working even with the network disconnected.

Why it exists

Engineers reach for quick tools dozens of times a day — validate a workflow file, decode a token, test a regex against log lines, work out a subnet, convert a suppression file. Too many of those tools ask you to paste sensitive internal data into a website that quietly uploads it to a server. OpsCanopy takes the opposite approach: fast, free, and private by construction, because there is nowhere for your data to go.

What's inside

42 tools across 13 categories. Every one runs entirely in your browser.

Observability

Tool	What it does
AlertLint	Unit testing for Grafana Loki alert rules.
Alertmanager Route Tester	Walk your Alertmanager route tree against alert labels to find the matching receiver(s) - in your browser.
Grafana Dashboard Validator	Lint Grafana dashboard JSON for broken variables, legacy panels and import traps — in your browser.
LogQL ↔ PromQL Helper	Translate and explain queries between Loki LogQL and Prometheus PromQL.
Prometheus Relabel Tester	Test Prometheus relabel_configs against sample labels and see exactly what survives.
PromQL Explainer	Paste a PromQL query and get a plain-English explanation.

Networking

Tool	What it does
CIDR / Subnet Checker	Check an IP against CIDR ranges, find overlaps, and merge lists.
IP Address Converter	Convert an IP between dotted decimal, integer, hex and binary.
MAC Address Formatter	Reformat a MAC across colon, hyphen, Cisco and bare — and read its bits.
Reverse DNS / PTR Helper	Build the in-addr.arpa / ip6.arpa PTR name and reverse zone for any IP.
Subnet Calculator	Network, broadcast, mask and host range from any IPv4/IPv6 CIDR.
Subnet Splitter	Split a parent CIDR into subnets and find the free space around allocations.

Utilities

Tool	What it does
Case Converter	Convert text between camelCase, snake_case, kebab-case and more.
chmod Calculator	Convert chmod between octal, symbolic and the permission matrix.
Data Size Converter	GiB vs GB, bits vs bytes — and how long that transfer really takes.
Slugify	Turn any title into a clean URL slug.
UUID / ULID Generator	Generate v4 UUIDs and ULIDs, or inspect one.

Security

Tool	What it does
AWS IAM Policy Generator	Build least-privilege IAM and S3 bucket policies — JSON and Terraform, with size limits and warnings.
Certificate Decoder & Chain Checker	Decode PEM certificates, check chain order, and verify signatures — in your browser.
CVE-Ignore Converter	Translate .trivyignore / .grype.yaml / .snyk in one click.
Hash Generator	Compute MD5, SHA-1, SHA-256 and SHA-512 digests of any text — plus HMAC.
JWT Decoder & Encoder	Decode, verify, and sign JWTs — HS/RS/PS/ES/EdDSA — with a built-in key generator.

Encoding

Tool	What it does
Base64 Encoder / Decoder	Encode and decode Base64 and URL-safe Base64, with Unicode support.
JSON ↔ YAML Converter	Convert JSON to YAML and back — with honest warnings about what changes.
Timestamp Converter	Convert between Unix epoch, ISO 8601 and human-readable dates.
URL Encoder / Decoder	Percent-encode, decode, and parse query strings — with per-component RFC 3986 rules.

CI/CD

Tool	What it does
GitHub Actions Expression Tester	Evaluate ${{ }} expressions and simulate workflow triggers.
GitHub Actions Validator	Check workflow YAML errors & security issues online — no install.
GitLab CI Validator	Lint .gitlab-ci.yml for YAML errors and pipeline misconfigurations — in your browser, no login.

Scheduling

Tool	What it does
Cron Expression Tester	Explain any cron expression in plain English — and see the next runs.
Cron to systemd Converter	Turn a crontab line into a systemd timer + service unit.
Systemd Unit Validator	Lint .service, .timer and .socket files for typos and misconfigurations — in your browser, no root.

Logs

Tool	What it does
jq Playground	Test jq expressions against your JSON — real jq 1.8.2 running in your browser.
Regex Log Tester	Test regular expressions against your log lines — live matches and groups.

Kubernetes

Tool	What it does
Kubernetes Label Selector Tester	See which pods a label selector matches — and why each one does or doesn’t.
Kubernetes Resource Calculator	Total CPU and memory requests and limits across pods and replicas.

Docker

Tool	What it does
Docker Run to Compose	Paste a docker run command, get a docker-compose service YAML — and convert back, all in your browser.
Dockerfile Linter	Paste a Dockerfile, get line-numbered best-practice and security findings with fixes — entirely in your browser.

Config

Tool	What it does
Env Example Checker	Find env vars your code uses but .env.example is missing.

IaC

Tool	What it does
Terraform Plan Summarizer	Paste terraform plan output, get a summary of adds, changes, destroys and replacements.

AI

Tool	What it does
LLM Token Counter	Count GPT tokens offline — o200k_base and cl100k_base, with the exact token boundaries.
LLM VRAM Calculator	Estimate the GPU memory a local LLM needs — weights, KV cache and runtime overhead, per quantization and context length.

👉 Or browse the full catalog at opscanopy.com/tools.

Tech

• Astro (static output, native i18n) + Tailwind CSS v4
• TypeScript, with WebAssembly for compute-heavy tools (e.g. AlertLint)
• Fully static, deployed on Cloudflare — no server-side code paths
• Localized in English, Spanish, German, French and Brazilian Portuguese

Self-hosting

Every tool already runs entirely in your browser, so the public site never sees your input. Self-hosting closes the remaining gap: an air-gapped network, or a policy that says internal config does not get pasted into a page loaded from the internet at all.

docker run -d --name opscanopy -p 8080:8080 \
  --read-only \
  --tmpfs /var/cache/nginx:uid=101,gid=101 \
  --tmpfs /var/run:uid=101,gid=101 \
  --security-opt no-new-privileges:true \
  ghcr.io/opscanopy/opscanopy.com:latest

The uid=101,gid=101 is not optional: the image runs nginx unprivileged, and a tmpfs mounts root-owned, which would otherwise mask the image's ownership and stop nginx creating its scratch directories.

Then open http://localhost:8080. Multi-arch (amd64 and arm64), so it runs on a Raspberry Pi or an Apple-silicon machine as-is.

With Compose — uncomment the image: line in docker-compose.yml to pull instead of building:

docker compose up -d     # http://localhost:8080

Or build it yourself from source:

docker build -t opscanopy .
docker run --rm -p 8080:8080 opscanopy

There is no database, no volume, no environment to configure and no account system — the image is nginx serving a directory of static files. It runs unprivileged and read-only, and it keeps the same Content-Security-Policy as production: _headers is Cloudflare syntax, so the build translates it into nginx form (scripts/headers-to-nginx.mjs) rather than quietly dropping the policy.

Analytics and the service worker are inert offline; nothing phones home.

Local development

All commands run from the project root:

Command	Action
npm install	Install dependencies
npm run dev	Start the dev server at localhost:4321
npm run build	Build the production site to ./dist/
npm run preview	Preview the build locally
npm run test	Run the unit tests

Contributing

Issues and pull requests are welcome — bug reports, new tool ideas, translations and fixes. Tools are engineered against real specifications and test vectors, so PRs that add or change behavior should include tests.

CONTRIBUTING.md covers the four-file shape every tool takes, the commands that gate a PR, and the rule that page copy ships to all five locales together. Translation fixes are a good first contribution.

• Open an issue — bug, tool request or translation
• Discussions — questions and ideas
• Code of Conduct
• What changed lately

Privacy

OpsCanopy collects nothing you type. All processing happens in your browser; there is no upload, no account, and no logging of tool input. See opscanopy.com/privacy.

Maintainers

Built and maintained by Pushkar Kumar and Asif Khan.

IndexNow

OpsCanopy pings IndexNow so Bing, Yandex and other participating engines re-crawl changed pages quickly. Ownership is verified by the key file at /a3f8c1d24b9e6705e2c8f4a17d093b6e.txt (committed in public/).

After deploying a new build, submit the live URLs:

npm run build      # generates dist/sitemap-0.xml
npm run deploy     # publish to Cloudflare first — the URLs must be live
npm run indexnow   # POST every sitemap <loc> URL to IndexNow

The script reads dist/sitemap-0.xml, submits up to 10,000 URLs in one batch, and exits non-zero if IndexNow does not return 200/202.

Zero-maintenance alternative: Cloudflare's native Crawler Hints feature (Cache → Configuration → Crawler Hints) auto-submits your content to IndexNow whenever it changes, so you can skip npm run indexnow entirely if it's enabled.

License

MIT © 2026 Pushkar Kumar and Asif Khan