The open-source control plane for research computing on AWS.
Self-service HPC clusters and cloud workstations for every project in your institution, with live budgets, per-user Linux accounts, and no per-seat licences.
🇹🇷 Türkçe · Quickstart · Docs · Architecture · Contributing
PeakOps Eleven is a web platform that lets a research-computing team run AWS the way researchers actually need it: an admin connects an AWS account once, creates projects with budgets, and researchers launch Slurm clusters (AWS ParallelCluster) or standalone EC2 machines from your own catalog of images, then log in with their own SSH key and their own Linux user. Spend is tracked live and resources are paused automatically when a budget runs out.
It is a management layer, not a replacement for the command line. Researchers keep
using ssh, sbatch, and their usual tools; Eleven handles the lifecycle, access,
and money around them.
A 60-second tour with demo data (MP4 version). Everything shown is fake, seeded with scripts/demo.
- Self-service per project. Researchers launch clusters and machines inside the projects they belong to. Admins set the guardrails once instead of filing tickets forever.
- Live budgets and auto-pause. Every running resource accumulates cost as it runs; projects get alerts at 75 / 90 / 100 % and resources are stopped automatically at the limit. Figures are reconciled daily against AWS Cost Explorer.
- Per-user Linux and SSH, with no bastion. Each user gets a stable Linux username and UID across every cluster and machine. Public keys are injected through AWS Systems Manager (SSM) Run Command. No shared keys, no jump host, no inbound management port.
- A golden-image catalog you bake yourself. Publish your own AMIs (compilers, MPI, Spack stacks, domain software) as an environment catalog. The catalog ships empty: nothing is pulled from anyone else's account.
- One CloudFormation stack to connect an account. A cross-account IAM role with an ExternalId, plus an SSM-enabled instance profile. Each organization can bring its own AWS account.
- Desktop client. PeakOps Connect (Tauri) gives one-click SSH terminals, port tunnels, and SFTP file transfer to your machines.
- Optional AI Composer and MCP. Describe a workload in plain language and get a suggested instance and image, or let an AI assistant manage machines through a Model Context Protocol endpoint. Both are optional and off unless you configure them.
- No per-seat licence. You own it. Apache-2.0, self-hosted, your database, your AWS accounts. Add as many researchers as you like.
| Area | What you get |
|---|---|
| Organizations & projects | Multi-organization, multi-project tenancy; member invitations; roles VIEWER < MEMBER < ADMIN per project, plus an instance-admin role |
| HPC clusters | AWS ParallelCluster lifecycle (create, inspect, delete), cluster templates, CloudWatch logs and metrics, events |
| Slurm administration | Partitions, QoS, accounts and associations, fair-share, node drain/resume, queue and job history, all through SSM against the head node |
| Machines | Standalone EC2 workstations (CPU or GPU) with start/stop/terminate, scheduled auto-stop, JupyterLab launcher, instance-type catalog with pricing |
| Access | Per-user SSH keys, automatic Linux user provisioning on clusters and machines, one-click "inject my keys" |
| Storage | S3 buckets for research data and shared file systems (EFS, FSx for Lustre) |
| Cost & budgets | Live cost estimates, per-project budgets with alerts and auto-pause, daily Cost Explorer reconciliation, cost-allocation tagging |
| Environment catalog | Golden AMIs in two tracks (standalone machine / ParallelCluster), image build jobs |
| Automation | REST API with OpenAPI docs, scoped API keys, global search, MCP endpoint |
| Desktop | PeakOps Connect: SSH terminal, tunnels, SFTP, local key discovery |
All screenshots use fake demo data (organization "Example Research University", AWS
example account 123456789012). Reproduce them locally with the
demo data seeder.
 Projects: every team, its region and budget |
 Project members with roles, per-member limits and invitations |
 Budgets: live spend per project, alert thresholds, auto-pause |
 HPC clusters (AWS ParallelCluster + Slurm) across projects |
 Cluster detail: overview plus Slurm queues, jobs, QoS, fair-share |
 Standalone machines with per-user SSH, Jupyter and VS Code links |
 Environment catalog of golden AMIs for machines and clusters |
 Connect an AWS account with one CloudFormation stack |
 Settings: AWS integration with ExternalId and role ARN |
 Per-user SSH public keys, injected via SSM |
flowchart LR
subgraph Clients
W[Web UI<br/>Next.js]
D[PeakOps Connect<br/>desktop, Tauri]
A[Scripts & AI agents<br/>REST / MCP]
end
subgraph Control["Eleven control plane (your server)"]
API[FastAPI API<br/>+ scheduler]
DB[(PostgreSQL)]
R[(Redis)]
end
subgraph Target["Target AWS account (per organization)"]
ROLE[PeakOpsAccess role<br/>ExternalId]
PC[ParallelCluster<br/>Slurm head node]
EC2[EC2 machines<br/>PeakOpsMachineInstanceProfile]
SSM[Systems Manager<br/>Run Command]
CE[Cost Explorer]
end
W --> API
D --> API
A --> API
API --- DB
API --- R
API -- "STS AssumeRole" --> ROLE
ROLE --> PC
ROLE --> EC2
ROLE --> SSM
ROLE --> CE
SSM -. "sacctmgr / scontrol / useradd" .-> PC
SSM -. "users & SSH keys" .-> EC2
D -. "SSH (user's own key)" .-> EC2
D -. "SSH (user's own key)" .-> PC
The control plane never stores long-lived AWS keys for target accounts. It assumes a role in each organization's account with a per-organization ExternalId, and it performs all in-instance management (Slurm administration, Linux users, SSH keys) through SSM Run Command. See docs/architecture.md.
Prerequisites: Docker, Python 3.12, Node.js 20+ and pnpm 10.
git clone https://github.com/PeakOps/eleven.git
cd eleven
# 1. PostgreSQL 16 + Redis 7
docker compose -f infra/docker/docker-compose.yml up -d
# 2. API (http://localhost:8000, OpenAPI docs at /docs)
cd apps/api
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
export APP_SECRET_KEY="$(openssl rand -hex 32)"
alembic upgrade heads
uvicorn app.main:app --reload --port 8000
# 3. Web UI (http://localhost:3000), in a second terminal
cd eleven
pnpm install
pnpm --filter @peakops/web devOpen http://localhost:3000, register the first account (this also creates your organization, with you as its admin), then follow the onboarding wizard. Full walkthrough, including granting instance-admin rights: docs/quickstart.md. Production deployment with TLS and backups: docs/self-hosting.md.
- Pick the AWS account that will run Eleven (the platform account) and set
PLATFORM_AWS_ACCOUNT_IDto its 12-digit ID. - Host
deploy/cloudformation/peakops-iam-role.yamlsomewhere reachable (for example an S3 bucket) and setCFN_TEMPLATE_URLto it. - In the web UI, open Settings → AWS Integration. The wizard shows the ExternalId
for your organization (
{EXTERNAL_ID_PREFIX}-{org_slug}-{org_id[:6]}) and a one-click link to launch the stack in the target account. - Paste the
RoleArnoutput back into the wizard. Done.
The stack creates the cross-account PeakOpsAccess role (trusting only the platform
account, with an sts:ExternalId condition) and the PeakOpsMachineRole /
PeakOpsMachineInstanceProfile pair that lets SSM manage machines. Details, required
permissions, and SSM prerequisites: docs/aws-setup.md.
All backend settings are environment variables (pydantic settings). The most important ones:
| Variable | Default | Description |
|---|---|---|
APP_ENV |
development |
development or production |
APP_SECRET_KEY |
none | Required. JWT signing key. The API refuses to start in production if it is empty or the default |
DATABASE_URL |
local Postgres | postgresql+asyncpg://… connection string |
REDIS_URL |
redis://localhost:6379/0 |
Redis connection string |
AWS_REGION |
us-east-1 |
Default AWS region |
AWS_PROFILE |
unset | Optional named profile for local development |
PLATFORM_AWS_ACCOUNT_ID |
unset | Account that assumes roles into target accounts |
CFN_TEMPLATE_URL |
unset | Where you host the IAM CloudFormation template |
EXTERNAL_ID_PREFIX |
eleven |
Prefix of generated ExternalIds |
PUBLIC_APP_URL |
http://localhost:3000 |
Public URL of the web UI (used in emails and links) |
API_PUBLIC_URL |
http://localhost:8000 |
Public URL of the API |
CORS_ORIGINS |
http://localhost:3000 |
Comma-separated allowed origins |
EMAIL_BACKEND |
console |
console, smtp, or ses |
NOTIFICATIONS_ENABLED |
false |
Send invitation and budget emails |
COMPOSER_ENABLED |
false |
Enable the AI Composer (Amazon Bedrock) |
MCP_ENABLED |
true |
Enable the MCP endpoint |
NEXT_PUBLIC_API_URL |
http://localhost:8000 |
API URL used by the web UI |
The complete reference, including SMTP/SES and desktop settings, is in docs/configuration.md.
apps/
api/ FastAPI backend: REST API, scheduler, AWS/SSM/Slurm services, Alembic migrations
web/ Next.js web UI
desktop/ PeakOps Connect desktop client (Tauri v2 + React)
deploy/
cloudformation/ Cross-account IAM role + machine instance profile template
infra/
docker/ Docker Compose files and Dockerfiles
templates/ ParallelCluster helper scripts (e.g. Slurm accounting setup)
scripts/ Example environment recipe, image bake helper, demo data seeder
docs/ Documentation (English) and docs/tr/ (Turkish)
- Backend: Python 3.12, FastAPI, SQLAlchemy 2 (async) + asyncpg, Alembic, APScheduler, boto3, AWS ParallelCluster
- Frontend: Next.js 16, React 19, TypeScript (strict), Tailwind CSS 4, Vitest
- Desktop: Tauri v2 (Rust), React, xterm.js
- Data: PostgreSQL 16, Redis 7
- AWS: STS, EC2, ParallelCluster, Systems Manager, CloudWatch, Cost Explorer, S3, EFS, FSx, CloudFormation, optional Bedrock
| Guide | |
|---|---|
| Quickstart | Local development in about ten minutes |
| Self-hosting | Production deployment, TLS, secrets, backups |
| AWS setup | IAM model, CloudFormation, SSM, ParallelCluster version |
| Configuration | Every environment variable |
| Architecture | How the pieces fit together |
| Golden AMIs | Machine vs. cluster images and how to bake your own |
| Desktop client | PeakOps Connect |
| AI Composer & MCP | Optional AI features |
| FAQ | Common questions |
- AWS Parallel Computing Service (PCS) as a second cluster backend next to ParallelCluster
- Open OnDemand bridge for institutions that already run an OnDemand portal
- Helm chart for Kubernetes deployments of the control plane
- Multi-cloud backends, later, once the AWS experience is solid
Ideas and priorities are discussed in GitHub Discussions.
Contributions of all sizes are welcome: bug reports, docs, tests, features. Please read
CONTRIBUTING.md (Conventional Commits, DCO sign-off with git commit -s)
and our Code of Conduct.
Please do not open public issues for vulnerabilities. Use GitHub's private vulnerability reporting as described in SECURITY.md.
Licensed under the Apache License 2.0. "PeakOps" and the PeakOps logos are trademarks; see TRADEMARKS.md for what that means for forks.
PeakOps Eleven was created by Çağlar Taşkıran and is developed by PeakOps, a team that builds and runs research-computing platforms.
Eleven is fully usable on its own. If your institution would like a hand with onboarding, AWS account setup, a curated and tested catalog of research environments (AI/ML, bioinformatics, CFD, molecular dynamics, ...), custom images, or ongoing support, PeakOps offers that as an optional commercial service. Everything in this repository stays open source either way.