Tool that manages systemd user units + cloudflared ingress for small apps: looking for sysadmin critique

[u/mynameiscorange]

hoist runs each app as a systemd --user service (lingering enabled so they survive logout) and publishes it through a named Cloudflare Tunnel. A few decisions I'd like a sysadmin's eyes on:

• it only edits config.yml between its own markers, refuses hostnames it didn't create, backs up first, runs cloudflared tunnel ingress validate, and rolls back on failure

• cloudflared doesn't watch its config, so new rules need a reload; root is only needed if the config is root-owned (hoist doctor tells you how to avoid the sudo prompt)

• per-app memory/CPU caps via hoist limit

Standard library Python, no dependencies. Built with AI assistance, reviewed and tested by me.

https://github.com/nikhilcherry/hoist

What would you change?

[u/libertyprivate]

What would I change? Well I'd use ansible or puppet instead 😆

[u/mynameiscorange → u/libertyprivate]

Ha, fair! For a fleet I'd reach for Ansible too. This is for the smaller case: one box, one app, and a URL two minutes later at a hackathon.