infrastructure automation in pure Go

Salt's mental model.
One static binary.

Zester is a SaltStack alternative powered by NATS JetStream and nkeys. No Python runtime, no external database, no ZeroMQ — same flavor family as Salt, sharper tool.

Get started Migrate from Salt

operator@bastion

$ zester 'web-*' state.highstate
  web-01   OK   14 states applied    1.8s
  web-02   OK   14 states applied    1.9s
  web-03   OK   2 changed           2.1s
$ zester 'G@os_family:debian' pkg.installed nginx
  42 peels matched · 42 returned · 0 failed

Coming from Salt? The vocabulary translates.

Minion→Peel

Grains→Facts

Pillar→Settings

Mine→Basket

Syndic→Leaf node

ZeroMQ→NATS JetStream

Everything Salt does. Less to carry.

One static binary

No Python interpreter, no pip, no virtualenvs. Ship a single Go binary to every node and install in seconds.

NATS JetStream built in

Durable events, KV storage, object storage, and horizontal scaling from a production-grade message bus — not a custom ZeroMQ protocol.

Ed25519 nkeys + TLS 1.3

A three-tier trust hierarchy with modern cryptography and least-privilege peel credentials. No RSA key exchange.

Built for 100k nodes

Commands fan out in ~250ms. Facts live in NATS KV, and superclusters with leaf nodes replace Salt syndic chains.

Jinja2-compatible templates

State files render with Gonja, including a Salt compatibility layer — grains, pillar, and salt[...] keep working.

Fleet self-update

A dedicated watchdog swaps binaries atomically, soaks on readiness, and rolls back automatically. Batched fleet rollouts included.

Ready to peel off the Python stack?

Spin up the Docker Compose playground — a master, five peels, and NATS — in one command.

Read the Quick Start

Salt's mental model.One static binary.