Know your hardware before it fails
Every server is inventoried and health-checked automatically as soon as it comes online, so a failing disk or unexpected hardware gets caught before it becomes an outage — not after.
Provision compute wherever it lives, then deploy packaged workloads onto it — one console, one workflow.
Gough turns bare metal, LXD containers and VMs on your own hardware, and public cloud instances into ready-to-use capacity, then rolls out versioned workload bundles called Biomes. A Biome deploys repeatably like a Kubernetes Deployment — but it isn’t Kubernetes: it packages any OS or appliance that runs as an LXC container or a KVM VM, from a Kubernetes node to a Nextcloud server or a Windows Active Directory domain controller. Kubernetes is one Biome kind, not the product.
Highlights
Package once, deploy the same way every time
A workload — an LXC container or a KVM VM, with its cloud-init instructions and resource sizing baked in — becomes a versioned Biome you deploy repeatably, the way a Kubernetes Deployment rolls out a service (without being Kubernetes). Kubernetes nodes and storage agents ship as built-in Biomes; a Nextcloud server, a Windows Active Directory domain controller, or your own image are custom Biomes you author.
Access without shared passwords
Every connection between services and every remote login is short-lived and issued automatically — nobody hands out a password or key that outlives the person who needed it.
A record you can hand to an auditor
Every provisioning and deployment action is logged in a way that cannot be quietly edited after the fact, with a copy kept off-site — so "what happened and when" is never a guessing game.
One console, wherever your compute lives
Bare metal, LXD containers and VMs on hardware you own, and instances in AWS, Azure, GCP, Vultr, or MaaS all provision through the same API — instead of juggling a different tool for every environment.
Built for real deployments
Gough is open source under a Limited AGPL-3.0 license, with a commercial license required only if you resell it or offer it as a hosted service — the code stays auditable either way.
You are only charged for the servers Gough actually puts to work: the Community plan covers 3 nodes free, and you can inventory an entire datacenter before deciding what to activate.
Every service that handles credentials and machine identity runs locked down by default — least-privilege, with nothing long-lived to manage — so there is no separate hardening project standing between you and production.
6places to run compute from one console — your hardware plus 5 clouds
3network zones kept separate for safety
30written playbooks for common incidents