StackStorm

StackStorm (st2) is an open-source, event-driven automation platform for operations teams: it listens for events from monitoring, ticketing, chat or webhooks and runs actions or multi-step workflows in response. Think of it as “if this, then that” for infrastructure, with auditing and an API. It suits SRE and sysadmin teams that already have scripts and Ansible or Salt states and want them triggered automatically and safely.

StackStorm is free under the Apache-2.0 licence and maintained by its community under the Linux Foundation. The server runs on Linux only; Windows machines can be targets of actions over WinRM, but not hosts for StackStorm itself.

StackStorm at a glance

What it does

• Sensors watch external systems and emit triggers; a built-in webhook trigger accepts JSON from anything that can send HTTP.
• Rules match triggers against criteria and launch actions with parameters taken from the event.
• Actions run local or remote shell commands over SSH, Python scripts, HTTP calls or PowerShell/commands on Windows via WinRM.
• Orquesta workflows chain actions with branching, retries, parallel tasks and approvals (inquiries).
• Packs bundle sensors, actions and rules; hundreds of integration packs are published on StackStorm Exchange.
• Every execution is logged with inputs, outputs and the user or rule that started it, which helps audits.
• A REST API, the st2 CLI and a web UI cover the same functions; ChatOps lets you run actions from Slack or similar chat tools.
• An encrypted key-value datastore holds secrets and state for workflows.

How sysadmins use it

Run ad-hoc commands across servers

1. Log in from the CLI: st2 login st2admin.
2. Test a local action: st2 run core.local cmd="uptime".
3. Run on several hosts over SSH (configure the system user and key in /etc/st2/st2.conf first):

   st2 run core.remote hosts="web01,web02" cmd="df -h /"

4. Review the result later with st2 execution list and st2 execution get <id>.

Auto-remediate an alert from monitoring

1. Create a rule file restart_nginx.yaml:

   ---
   name: restart_nginx_on_alert
   pack: ops
   description: Restart nginx when monitoring posts a critical alert
   enabled: true
   trigger:
     type: core.st2.webhook
     parameters:
       url: nginx-alert
   criteria:
     trigger.body.status:
       type: equals
       pattern: critical
   action:
     ref: core.remote
     parameters:
       hosts: "{{ trigger.body.host }}"
       cmd: "sudo systemctl restart nginx"

2. Load it: st2 rule create restart_nginx.yaml.
3. Create an API key for your monitoring system: st2 apikey create -k.
4. Point the monitoring webhook at https://<st2-host>/api/v1/webhooks/nginx-alert with the St2-Api-Key header and a JSON body containing status and host.

Reuse community integrations

1. Search StackStorm Exchange from the CLI: st2 pack search jira.
2. Install the pack: st2 pack install jira, then fill in its config with st2 pack config jira.
3. Combine its actions with your own scripts in an Orquesta workflow, for example “open ticket, run diagnostics, attach output”.

Touch Windows servers

1. Enable WinRM on the target and allow it through the firewall.
2. Run a PowerShell command through the WinRM runner:

   st2 run core.winrm_ps_cmd host=win01.corp.local username=svc_st2 password=*** cmd="Get-Service Spooler"

3. In workflows, keep credentials in the encrypted datastore (st2 key set winrm_pass "..." --encrypt) rather than in rule files.

Install and first run

Linux (packages). On a clean Ubuntu 20.04/22.04 or RHEL/Rocky 8/9 host, the official one-line installer sets up StackStorm with MongoDB, RabbitMQ, Redis and nginx:

bash <(curl -sSL https://stackstorm.com/packages/install.sh) --user=st2admin --password='YourStrongPassword'

Use a dedicated VM: the script installs and configures shared services that can clash with existing ones.

Docker and Kubernetes. The project maintains a Docker Compose setup for evaluation and a Helm chart for highly available Kubernetes deployments.

Requirements. For testing, a dual-core CPU, 2 GB RAM and 10 GB disk; for production, the docs recommend a quad-core CPU, more than 16 GB RAM and 40 GB disk, with at least 1 GB free in /var and /opt. StackStorm 3.9 runs on Python 3.8 to 3.11.

Ports. nginx serves the UI and API on 80/443; internally MongoDB uses 27017, RabbitMQ 4369/5672/25672, Redis 6379 (or ZooKeeper 2181/2888/3888), and the st2auth/st2api/st2stream services 9100–9102. Expose only 443 to users.

Gotchas. Change the password you pass to the installer, put a real TLS certificate on nginx, and when upgrading to 3.9 migrate any [database] SSL options in st2.conf to the renamed TLS options listed in the release notes.

Limitations

• Slow release cadence: 3.8.1 came out in December 2023 and 3.9.0 in October 2025.
• Linux-only server with several moving parts (MongoDB, RabbitMQ, Redis), which means more to patch and back up.
• The 3.9 docs list Ubuntu 20.04/22.04 and RHEL/Rocky 8/9 only; newer distributions are not on the supported list.
• The web UI is functional but basic; most authoring happens in YAML and the CLI.
• Orquesta and Jinja templating take time to learn, and debugging long workflows can be tedious.
• Many Exchange packs are community-maintained and vary in quality and freshness.

StackStorm vs alternatives

Rundeck is easier for runbook-style jobs that humans start from a web UI; StackStorm is stronger when events, not people, start the work. n8n is a general workflow tool with a visual editor, closer to business integrations than to infrastructure remediation. Salt’s reactor system, used with the Salt minion, also reacts to events but is tied to Salt-managed hosts. Ansible is configuration management; many teams call Ansible playbooks from StackStorm workflows.

FAQ

Is StackStorm free?

Yes. StackStorm is free and open source under the Apache-2.0 licence.

What is the latest StackStorm version?

3.9.0, released on 10 October 2025. It added support for Python 3.10 and 3.11 and dropped Python 3.6.

What is the StackStorm default password?

There is no fixed default: the installer creates the user and password you pass with --user and --password. Docs examples use st2admin; always set your own password.

Can StackStorm run on Windows?

Not as a server. You can run it in Docker or a Linux VM, and manage Windows hosts through the WinRM actions.

StackStorm vs Ansible?

Ansible pushes configuration; StackStorm decides when to act based on events and can run Ansible as one of its actions.

StackStorm vs Rundeck?

Rundeck focuses on operator-run jobs with a polished UI; StackStorm focuses on event-driven automation, rules and ChatOps.

How do I install StackStorm with Docker?

Use the official Docker Compose project for evaluation, or the Helm chart for production on Kubernetes; both are linked from the StackStorm docs.

Last checked against official sources: 1 October 2026 (developer website: stackstorm.com). Versions and licence terms change — confirm on the developer's site before deploying in production.