BakeX

Describe your hardened OS in a YAML blueprint; BakeX builds the CIS/STIG-benchmarked golden image on any cloud — or locally on KVM — and hands you the compliance evidence.

Why BakeX

Hardened image builds are usually manual, non-reproducible, and audited in a scramble: someone runs a checklist against a VM, someone else screenshots the scanner output, and six months later nobody can say why a rule was disabled. BakeX collapses that into one version-controlled YAML file — the blueprint — and gives every build the same pipeline: provision, harden with Ansible-Lockdown, scan with OpenSCAP, snapshot, tear down. Your security team gets an A–F grade and a SARIF report; your platform team gets a golden image and a curl one-liner to rebuild it.

How It Works

HardeningBlueprint (YAML)  ──or──  5-Step Guided Wizard
        │
        ▼
  ┌─────────────────────────────────────────────────────┐
  │  BakeX Engine                                      │
  │                                                      │
  │  1. Provision  →  Spin up a temporary VM             │
  │  2. Harden     →  Apply Ansible-Lockdown CIS/STIG    │
  │  3. Scan       →  Run OpenSCAP, assert compliance    │
  │  4. Snapshot   →  Capture as reusable golden image   │
  │  5. Teardown   →  Remove the ephemeral build VM      │
  └─────────────────────────────────────────────────────┘
        │
        ▼
  Golden Image  (AMI · GCP Custom Image · Azure Managed Image · Snapshot · qcow2)
        │
        ▼
  ┌─────────────────────────────────────────────────────┐
  │  Compliance Scanner                                  │
  │                                                      │
  │  Scan any image or running VM at any time            │
  │  A–F grade  ·  SARIF export  ·  Drift analysis       │
  │  CI/CD pipeline gate  ·  Webhook notifications       │
  └─────────────────────────────────────────────────────┘

Quick Start

Docker Compose (recommended — everything preinstalled)

git clone https://github.com/invicton/bakex.git
cd BakeX
docker compose up

Open http://localhost:8001. Log in with any username and your admin token as the password — it's auto-generated on first start and saved to data/.admin_token (set BAKEX_ADMIN_TOKEN and BAKEX_SECRET_KEY in docker-compose.yml for stable logins and credentials that survive rebuilds).

Compose mounts ~/.aws, ~/.config/gcloud, and ~/.ssh read paths plus persistent ./data, ./profiles, and ./plugins/providers automatically.

Published image

docker run -p 8000:8000 rrskris/bakex:latest

PyPI

pip install "bakex[all-providers]"   # or pick extras: aws, gcp, azure, linode, digitalocean, proxmox
bakex serve --port 8000              # or: uvicorn bakex.main:app --port 8000

bakex version prints the build; bakex serve --help lists options.

Built-in blueprint templates and the provider catalog ship inside the package, so this works from any directory; runtime state (data/, profiles/user/) is created where you launch. Ansible and OpenSCAP must be on the host for real builds — see Configuration.

From source (contributors)

git clone https://github.com/invicton/bakex.git && cd BakeX
uv sync --extra all-providers --group dev
cp .env.example .env
uv run uvicorn bakex.main:app --reload --port 8000

No cloud account? The kvm provider builds hardened qcow2/raw images entirely on your machine (QEMU/KVM + cloud-image-utils required). Full first-run walkthrough: Getting Started.

Features

• Declarative blueprints — one YAML file captures OS, provider, compliance tier, per-rule overrides with justifications, filesystem, and users; version-controllable, diffable, reviewable
• Three build paths — 5-step wizard (UI), blueprint file (GitOps), or AI Builder (plain English → the agent writes the blueprint, builds, and iterates until the grade passes; Anthropic/OpenAI/Ollama/Bedrock backends)
• CIS L1, CIS L2, and STIG — via Ansible-Lockdown roles with pinned known-good versions, scanned natively by oscap xccdf eval
• A–F compliance grade — weighted findings, configurable pass threshold, embeddable SVG badge per scan
• Evidence exports — printable HTML, SARIF 2.1.0 (GitHub Advanced Security, Azure DevOps), JSON; drift analysis between any two scans
• Pipeline-first API — API keys (SHA-256 at rest), HMAC-signed webhooks, CI gate examples for GitHub Actions/GitLab/Jenkins in the Pipeline Guide
• 18 ready-to-use templates across 6 OSes and 6 providers, plus a growing community blueprint library

Supported Platforms

Operating Systems

Providers

Cloud onboarding uses reviewable least-privilege templates (CloudFormation / ARM / gcloud scripts) — see Cloud Onboarding.

Screenshots

Cloud onboarding	Compliance evidence

Screenshots are sanitized previews with no customer credentials or account data.

Documentation

Contributing

Bug reports, feature requests, and PRs are welcome — see CONTRIBUTING.md for the dev workflow and good first issue for curated starting points (most are pure-YAML blueprint work with acceptance criteria and a local verify command included). Please follow the Code of Conduct. Found a security issue? See SECURITY.md instead of opening a public issue.

License

Apache 2.0 — see LICENSE.

Built by Vamshi Krishna Santhapuri.