run-oncall.com · Part of Just Every · MIT licensed

Watch the full demo · 54 seconds

_{Rotations in your own time zone, with coverage previewed before you save.}

_{A calm place to coordinate an incident, with an append-only record.}

Run it locally

Public source: just-every/run-oncall. The latest tag, v0.5.4, includes hosted coordination. See Getting started for complete credentials and deployment instructions.

One line installs the rer command, clones Oncall and starts it:

curl -fsSL https://runeditrun.com/install.sh | sh -s -- dev just-every/run-oncall

Already have Node 22 or later? npx -y @runeditrun/rer dev just-every/run-oncall does the same.

macOS, Linux or Windows with WSL2. git is required; rer brings Node and pnpm.

To start it again later, run cd run-oncall && rer dev. rer dev installs the application dependencies, creates a local development owner and prints a private RER_OPEN link that opens Oncall signed in. On first launch, confirm the read-only owner details at /setup (Finish setup); later launches open the app directly. To choose your own owner mailbox before the first launch, use explicit setup; unattended setup accepts a private answers file.

Open the printed link on this computer. rer dev --as signed-out selects the signed-out persona. The compatibility flag rer dev --login still opens automatic owner entry. Ordinary /signin email sign-in sends only through a configured remote mail provider with real credentials; no sender is configured by default. The app does not capture mail or print sign-in tokens. Stop the background server with rer dev --stop (Ctrl-C also stops a foreground run); stop preview with rer preview --stop before building or verifying.

rer build
rer preview
rer verify
rer export --output exports/installation.rer
rer import --input exports/installation.rer --yes
rer reset --yes
rer deploy --environment production --dry-run
rer describe
rer check

Before the first rer verify, stop dev and preview, then install its browser using the dependencies rer dev (or rer install) already installed:

node node_modules/@playwright/test/cli.js install chromium
rer verify

This command uses Node directly; no global pnpm is needed. On Linux, add --with-deps to the browser install command if system libraries are missing. rer doctor reports a missing verification browser and prints this command. rer check is silent on success (exit 0); rer check --json prints the result.

Export includes supported durable records and the import journal, excluding sessions and dev credentials. Import requires an empty destination and explicit confirmation. If it refuses with target_not_empty, export any data you need to keep, stop dev and preview, then run rer reset --yes before importing into the now-empty installation. Configure a new owner, sign in, then explicitly map an archived administrator identity from the signed-out workspace; credentials never travel. Reset deletes local data and owner settings and keeps your exports; see Export and restore for the in-place restore sequence. A deploy dry run builds and validates locally, then reads target secret bindings with Cloudflare credentials; it makes no provider writes. Release 1 supports hosted incident coordination alongside your existing pager. Paging stays OFF; an independent standby is not required for coordination. Release 2 paging and its independent standby are not built. See hosting instructions for deployment, sign-in and removal. Use describe for flags and doctor for missing local prerequisites.

Oncall keeps rotas, schedules, overrides, incident coordination and recorded alert intake beside your existing pager. The existing pager stays authoritative. No SMS, voice, push or paging email is sent. The delivery adapter refuses plainly. To connect monitoring, see the alert intake JSON and curl example.

Schedules use named IANA zones, calendar-day turns, explicit repeated-time rules and half-open UTC overrides. Inspect who is on call now and at the next hand-off, download a private seven-day ICS feed, and store primary/backup escalation delays as data. Coverage gaps remain visible.

Move in (under Settings) reviews supplied Opsgenie exports first, then PagerDuty. Preview writes nothing; confirmed imports stay paused and grant no access or delivery authority. A durable Base import-kit journal supports resume and guarded undo. Read MOVE-IN.md for documented export shapes and compatibility limits.

Held data upgrades in place through unchanged migrations 0001–0006 and additive migrations. Coordination now stores individual members, services, policies, events, alerts, incidents and audit entries in relational tables. Old password accounts remain usable; Base owner identity never silently takes over an existing workspace. For a held installation, continue using its password accounts until the owner explicitly links identity during a future identity migration. On local and hosted apps, the configured owner uses email links and admin-created team members use their installation-local workspace name and password at /signin/local. Only anonymous first-admin bootstrap remains loopback-only. Do not reset to upgrade.

To look around with realistic sample data, run rer demo after setup: a throwaway, signed-in copy where nothing can page, call, text or email (DEMO.md).

Read CONTRACT.md, ACCEPTANCE.md, OPERATIONS.md and RELEASE.md. The checkout declares its exact command version in package.json and the lockfile. base-copies.json records each Base runtime/module copy and its own revision; src/base comes from Base 6d38b54a6401879989e8d1f7ab4a02ffbdb4c46c. Source locks are generated with Base's edition-authoring command from this checkout. This repository is runnable source, without a composition step.

Update, host and remove

From 0.1.0

Stop the old servers before pulling: 0.1.0 uses the checkout's runner, which the update removes.

node scripts/rer.mjs dev --stop
node scripts/rer.mjs preview --stop

Then, from this checkout on main, update and start it with npx, which needs no separate install of rer:

git pull --ff-only
npx -y @runeditrun/rer dev

The update applies Oncall's additive migrations. Your data, owner and password accounts are kept; people who sign in with a workspace password sign in once more after updating to 0.3.0. Do not reset to upgrade.

Later updates

Update this checkout without resetting its data:

rer dev --stop
rer preview --stop
git pull --ff-only
rer dev

This restarts the updated local app, applies migrations and keeps your owner, schedules and incidents. rer installs a pulled change of its own pin before it runs and provides the pinned Node and pnpm versions.

Host for your team

Hosting is in v0.3.0 and later. Release 1 hosts coordination alongside your existing pager, with paging OFF and no standby requirement. Follow Getting started to prepare a real owner mailbox, obtain Cloudflare and SendGrid credentials with the required permissions, and save them in an owner-only 0600 file outside Git. The Install page includes each provider's menu path, verification steps and expected results.

From the hosting checkout, with the private file prepared as described there:

rer deploy --environment production --env-file "$HOME/.config/oncall/production.env" --dry-run
rer deploy --environment production --env-file "$HOME/.config/oncall/production.env"

Use the same named environment for every later command; it defaults to production if omitted. Deployment creates the hosted installation, applies migrations, verifies deployment identity, claims the configured owner automatically and retires its one-time setup token. Open the returned address and use Email a sign-in link, then open the email on the same device and press Confirm. Finish the owner confirmation at /setup if shown. Local dev entry links do not work there. Admin-created team members use their workspace name and password at /signin/local; Oncall sends no invitations.

The deploying owner can recover access without email from the original checkout:

rer signin --environment production --env-file "$HOME/.config/oncall/production.env"

This prints a private, single-use owner link that expires within 15 minutes. Open it privately and press Confirm; do not record or share the output. It does not test mail delivery.

Deployment uses a separate hosted database; it does not upload local schedules or incidents. Keep this checkout's .rer/deploy/ records. For later hosted updates, pull main and deploy to the same environment:

git pull --ff-only
rer deploy --environment production --env-file "$HOME/.config/oncall/production.env"

Updates keep the hosted owner and data. Existing hosted secrets are retained; Getting started explains explicit mail-key and sender changes.

To remove the hosted installation and its database, keep its deployment records and use the same Cloudflare credentials and environment:

rer deploy --environment production --env-file "$HOME/.config/oncall/production.env" --remove --yes

Removal deletes only recorded resources created by this deployment and verifies each is absent. Your local folder and data stay.