Not a price war.
A different shape.
Orrery does not go head to head against any one row below. It spans several: conformance for a plain VPS, a value-blind secret-to-consumer graph, governed autonomy enforced in code, and an install that proves itself, held in one instrument for a solo or small operator. Here is where it actually sits next to tools people already trust, stated fairly.
The category, honestly.
None of the five neighbors below are weak tools. Each is genuinely good at what it was built for. The seam between them, a plain box a solo operator actually runs, a secret graph rather than just secret storage, governed autonomy tied to that box's real conformance, is where none of them reach.
Coolify
Good at
Self-hosted app deployment. Push code, get a running service on your own server, with a large library of one-click templates.
The gap
It deploys and manages apps. It is not a conformance engine, does not hold a secret-to-consumer graph, and does not verify its own install stays correct over time.
Puppet / Ansible-style config management
Good at
Powerful, mature convergence: declare a state and it applies changes across a fleet to reach it. Decades of proven use managing real infrastructure.
The gap
Assumes a fleet and a team already running config management, heavier than a solo operator usually wants to stand up. It is imperative-convergent by design, where Orrery is report-only, declared.
Infisical / Doppler
Good at
Secrets management: storing credentials centrally and serving them to apps and CI, priced per identity or seat.
The gap
They store secrets. They do not map the secret-to-consumer graph or reconcile a whole box's declared shape, and the pricing unit scales with the size of your infrastructure, not your team.
Spacelift
Good at
IaC orchestration: running Terraform, OpenTofu, or Pulumi at team and enterprise scale, with policy and run management on top.
The gap
Priced and scoped for team and enterprise IaC workflows. It orchestrates applies to infrastructure you already provision through code; it is not aimed at a solo operator's plain VPS.
The AI-governance lane
Good at
Governed autonomy for AI agents: policy, approvals, and audit for what an agent is allowed to do, aimed at platform teams inside larger organizations.
The gap
Enterprise-priced and built for a platform team, not tied to whether a plain VPS actually still matches what was declared for it.
Six dimensions, side by side.
The same six honest questions, asked of Orrery and each neighbor. Scroll sideways on a small screen; the table stays a real table underneath.
| Tool or category | Unit of pricing | Read-only or convergent | Secret-to-consumer graph | Self-verifying install | Solo-operator fit | Open-core |
|---|---|---|---|---|---|---|
| ESS Orrery | Per operator, and by box band, never per machine identity | Report-only, measures, never changes a box | Yes, value-blind: never reads a secret's value | Yes, orrery doctor confirms the install stands | Built for it: a plain VPS a solo operator runs alone | Yes, AGPL-3.0-or-later, fully auditable |
| Coolify | Free self-hosted; hosted Cloud priced per connected server | Convergent, it deploys and manages the app for you | Not its focus, app deployment is the job | Not part of what it does | Strong, exactly this audience | Yes, Apache-2.0, self-hosted forever, no server cap |
| Puppet / Ansible-style | Typically per managed node on enterprise editions | Convergent, applies changes to reach a declared state | Not built in, secrets handled by separate modules or an external vault | Not typically a shipped feature | Assumes a fleet and a team already running it, heavier than most solo operators want | Varies by tool and edition, community cores exist alongside commercial enterprise tiers |
| Infisical / Doppler | Per seat or per identity | Not applicable, they store and serve secret values | Stores secrets; does not map which consumer references which secret | Not their job | Good for secret storage alone, does not cover conformance | Mixed: Infisical's core is MIT and self-hostable, Doppler is primarily a hosted service |
| Spacelift | Managed resources, runs, and seats; enterprise plans are custom-quoted | Convergent, orchestrates infrastructure-as-code applies | Not its focus, it orchestrates IaC runs | Not applicable, it is a hosted orchestrator | Built for team and enterprise IaC workflows | No, commercial hosted product |
| AI-governance lane | Typically enterprise seat or platform licensing | Varies by product, policy and approval enforcement for agents | Not their focus | Not typically tied to a plain-VPS install | Priced and scoped for platform teams, not a solo operator | Typically closed, enterprise-licensed |
What Orrery actually does differently.
Five choices, held on purpose, that together are the reason no row above is a substitute.
It never changes your box.
The reconciler measures and reports. Every convergent tool above applies changes on your behalf; Orrery tells you where reality diverged and leaves the decision, and the change, to you.
The install proves itself.
orrery doctor confirms the installation actually stands, cold, on a blank box, then the reconciler keeps watching. Almost nothing in this space can prove it is still correctly installed a month later.
Consumers, not just values.
Every secret mapped to the consumers that reference it, and back, confirmed by identity and never by reading a value. That graph is what makes safe rotation possible later.
Per operator and box band.
Never priced per machine identity or agent. The band is a ceiling on how many boxes one plan covers, not a per-server toll that climbs with your infrastructure.
Auditable, because it has to be.
The core holds your secrets and reaches every box, the highest-privilege software you would run, so it ships AGPL-3.0-or-later: free to run, study, and modify, in full.
We may be wrong. Tell us.
This page describes five real, well-built categories of tool as fairly and conservatively as we know how, and it will drift out of date the moment one of them ships something new. If a claim above is stale, wrong, or unfair to how your tool actually works today, say so.
Send a correction and we will fix the page. Measure, do not read applies to our claims about others too.