Building SwiftDeploy: A Self-Writing Infrastructure Tool with OPA Policy Enforcement and Prometheus Observability

Introduction

What if your deployment tool could refuse to deploy when your disk is full? What if it could block a canary promotion when error rates spike — automatically, based on policy — without a single hardcoded if statement in the CLI?

That's exactly what I built for Stage 4b of the HNG14 DevOps track. In this post I'll walk through the full journey: from a manifest-driven deployment engine to a policy-enforced, fully observable stack with a live terminal dashboard and audit trail.

The Architecture at a Glance

manifest.yaml (single source of truth) | v swiftdeploy CLI | +-- Jinja2 templates --> docker-compose.yml + nginx.conf | +-- OPA policy check --> allow / block + reason | v Docker Compose Stack ├── app (FastAPI + /metrics) ├── nginx (public ingress on swiftdeploy-net) └── opa (isolated on opa-internal, queried via docker exec)

Enter fullscreen mode

Exit fullscreen mode

The core…