StackStorm — Event-Driven Automation for DevOps and SRE

Introduction

StackStorm (ST2) is an event-driven automation platform that wires together tools and services into automated workflows. It watches for events from monitoring systems, chat messages, or webhooks, applies rules to decide what to do, and executes multi-step workflows across infrastructure. It is used for auto-remediation, ChatOps, and continuous deployment.

What StackStorm Does

• Connects events from sensors (Nagios, Datadog, PagerDuty, webhooks) to automated actions
• Executes actions across remote hosts via SSH, APIs, or custom integrations
• Chains actions into multi-step workflows with branching, error handling, and parallel execution
• Provides ChatOps integration to trigger and observe automation from Slack or Mattermost
• Offers an audit trail of every event, trigger, and action execution

Architecture Overview

StackStorm consists of several microservices: sensors watch for events, the rules engine evaluates triggers against criteria, and the action runner executes tasks. Workflows are defined in YAML using the Orquesta workflow engine. A RabbitMQ message bus coordinates components, MongoDB stores state, and a REST API exposes all functionality. Packs bundle sensors, actions, rules, and aliases for specific tools or services.

Self-Hosting & Configuration

• Install on Ubuntu or RHEL using the official one-line installer or Docker Compose
• Deploy packs from the StackStorm Exchange for integrations (160+ packs, 6000+ actions)
• Define rules in YAML mapping triggers to actions with criteria filters
• Configure ChatOps by connecting the Hubot integration to Slack or Mattermost
• Scale action runners horizontally for high-throughput environments

Key Features

• 160+ integration packs covering AWS, Azure, GCP, Jira, PagerDuty, and more
• Orquesta workflow engine with task branching, joins, and error handling
• RBAC with fine-grained permissions for multi-team environments
• Event-driven auto-remediation reduces mean time to recovery
• Comprehensive REST API and Python SDK for custom integrations

Comparison with Similar Tools

• Ansible — Push-based automation; StackStorm is event-driven and reacts to triggers automatically
• Rundeck — Job scheduler with manual triggers; StackStorm adds event-driven rules and sensor integration
• n8n / Zapier — Visual workflow builders for SaaS; StackStorm targets infrastructure and DevOps automation
• PagerDuty Automation — Incident response; StackStorm is self-hosted with broader event source support

FAQ

Q: What is a pack in StackStorm? A: A pack is a bundle of integrations — sensors, actions, rules, and aliases — for a specific tool or service. Install packs from the StackStorm Exchange or create custom ones.

Q: Can StackStorm run without internet access? A: Yes. StackStorm runs fully self-hosted. Packs can be installed from local repositories in air-gapped environments.

Q: How does StackStorm handle secrets? A: StackStorm has a built-in key-value datastore with support for encrypted values. Secrets are stored encrypted and decrypted only at action execution time.

Q: Is StackStorm suitable for large-scale environments? A: Yes. StackStorm supports horizontal scaling of action runners and has been used to manage thousands of nodes in production.

Sources

• https://github.com/StackStorm/st2
• https://docs.stackstorm.com