Skip to main content
Triggers turn a computer into a reactive system. Each trigger pairs a source that produces events with one or more actions that run in response, plus optional dedup to suppress noise. They run continuously inside the VM, managed for you. 
triggers:
  - name: heartbeat
    title: "Minute heartbeat"
    source:
      type: cron
      schedule: "* * * * *"
    actions:
      - type: command
        run: "echo beat >> /var/lib/orgo/heartbeat.log"

​
Sources

A source’s type selects which fields apply.
TypeFires whenKey fields
cronA schedule elapsesschedule (5-field cron)
fileA path is created, modified, or deletedpath, events: [create, modify, delete]
httpPolling a URL returns an unexpected statusurl, method, expect_code, interval
processA process starts or stopsprocess
metricA system metric crosses a thresholdmetric, op, value, duration
logA service log line matchesservice, match, parse: text|json
eventA custom event is emitted in the VMevent
desktopA desktop event occursevent (window_focus, clipboard, idle, …)
Metric sources cover cpu_percent, ram_percent, disk_percent, net_in_mbps, net_out_mbps, and the gpu_* family, compared with >, >=, <, <=, ==, or !=. 
# Restart a service if memory stays high for two minutes
triggers:
  - name: mem-guard
    source:
      type: metric
      metric: ram_percent
      op: ">"
      value: 90
      duration: 2m
    actions:
      - type: service
        op: restart
        target: my-app-server

​
Actions

A trigger runs one or more actions in order. The type selects the fields.
TypeDoesKey fields
webhookHTTP request outurl, method, headers, body
commandRun a shell commandrun, cwd, timeout
serviceControl a serviceop: start|stop|restart, target
notifyIn-VM notificationtitle, level: info|warning|critical
logWrite to the trigger logmessage
apiCall the in-VM desktop APIendpoint
Action body, run, and similar fields support {{...}} templating, so you can include event data in a webhook payload. 
# Post to Slack when a file lands in the inbox
triggers:
  - name: new-upload
    source:
      type: file
      path: /data/inbox
      events: [create]
    actions:
      - type: webhook
        url: https://hooks.slack.com/services/...
        method: POST
        body: '{"text": "new file: {{ event.path }}"}'

​
Dedup

Bursty sources can fire constantly. Add at most one dedup strategy per trigger.
StrategyEffect
debounceCollapse a burst, fire once after it settles.
cooldownEnforce a minimum gap between fires.
rate_limitCap fires, e.g. 10/1m.
triggers:
  - name: config-reload
    source:
      type: file
      path: /etc/my-app/config.yaml
      events: [modify]
    dedup:
      debounce: 2s
    actions:
      - type: service
        op: restart
        target: my-app-server

​
Triggers vs. health checks

They complement each other:
  • A health check is a per-app watchdog — it polls one service and auto-heals it (on_fail: restart_service:…).
  • A trigger is general automation — any source to any action, across the whole VM.
Reach for a health check to keep a service alive; reach for a trigger to react to files, schedules, metrics, or desktop activity.

​
Next steps

Schema reference

Every source and action field.

Examples

Triggers in real templates.