Idea validation · nothing is shipping yet

Patch Orchestration — Early Access

We're exploring whether the safety choreography around patching deserves to be a proper workflow.

You've already automated the patching itself. Ansible runs, the updates land, that bit works.

What still costs you the evening is the choreography around it.

The patch is the easy part

Pause and resume monitoring

Silence the right checks for the right window, and get them back on afterwards - so a reboot is not an incident and a real failure during the window is still noticed.

Snapshot before, clean up after

Take VM snapshots ahead of the change, keep them long enough to roll back, and remove them once the estate is healthy instead of six months later.

Verify the backup first

Confirm a recent, restorable backup exists before the patch runs, rather than discovering during a rollback that the job has been failing quietly since March.

Most people stitch that together with their own scripts around vanilla Ansible or AAP. We're trying to find out whether it deserves to be a proper workflow instead.

Why we're asking

No post on this blog has drawn more readers over the past year than a write-up from 2022 on fully automated Windows Server patching with Ansible. Four years on, people still find it every week. That suggests the problem never really got solved — only worked around, over and over, in everyone's private scripts.

That's a signal. It isn't proof. This page is how we tell the difference.

To be completely clear about what this page is: none of this exists yet. There is nothing to buy, nothing to download, and no date. We are testing whether the need is real before we write a line of it. If the answer turns out to be "this is fine as it is", that is a useful answer and we would rather have it now.

If this sounds like your patch night

The list is below. When you join it, hit reply on our first email and tell us, in a sentence or two: how many servers, what the Linux/Windows mix looks like, and whether they can reach the internet. That reply is worth considerably more to us than the signup is — it's the part that tells us whether we understood the problem.

What you get: one email from Roman, written by a person, asking about your setup. A note if and when there is something real to try. Nothing else — no newsletter, no drip sequence, no sales call.

What happens to your address: we store it to contact you about this early-access test and for nothing else. We also record which link brought you here — the referring site's name and any campaign tag, never the full address you came from — so we can tell which of our posts actually reach people. We don't share any of it or sell it. Reply "remove" to any message and we delete it — you can join and leave without ever telling us your name. Full details in our privacy policy.

Join the waitlist

Tell us how you patch today and we will come back to you with what we build - and nothing else.