Server Monitor Manager

English · Русский · Español · 简体中文 · हिन्दी · العربية · Português · Français · Deutsch · 日本語 · 한국어 · Türkçe

Server Monitor Manager is a lightweight, Windows-first application for monitoring Linux servers, opening direct SSH sessions, and explicitly controlling secure connections between servers. It is designed for personal infrastructure and small fleets where a heavy monitoring platform, Kubernetes, or a public API on every node would be unnecessary.

The current alpha combines a packaged WinUI 3 desktop client, an ASP.NET Core control service, a small outbound Linux agent, SQLite storage, and a WireGuard data plane managed by restrictive nftables policies.

What it does

monitors CPU/load, memory, swap, disks, inodes, network activity, uptime, latency, SSH, and WireGuard;
keeps several server profiles, groups, tags, favorites, alerts, and short local metric history;
generates a dedicated Ed25519 SSH key and stores private material only on the Windows device;
opens direct SSH terminals without sending a private terminal key to the Hub;
joins servers through one Hub with a public IP; secondary servers need outbound access only;
creates directional Links such as AI agent → Home server:22 and disables each Link independently;
limits Links by source, destination /32, TCP/UDP port, policy version, and optional TTL;
uses one-time enrollment tokens, CSR-based certificates, mTLS, role separation, idempotency, and audit records;
runs without Docker or a database on every Node.

Architecture

Windows desktop -- mTLS/HTTPS --> Control Hub (ASP.NET Core + SQLite)
       |                              |
       +-------- direct SSH ----------+
                                      |
                            WireGuard + nftables
                              /       |       \
                      AI-agent     Home      Server 2

The Hub has a public IP and coordinates the fleet. Nodes initiate their own WireGuard and mTLS connections, so a home server behind NAT does not need a white/dedicated IP or an inbound public port. Transit is denied by default. A Link is directional: enabling AI-agent → Home does not enable Home → AI-agent or access to another server.

The control plane and data plane are separated:

Control plane: ASP.NET Core 10, SQLite inventory, metrics, policies, history, audit, enrollment, and an authenticated event stream.
Data plane: WireGuard peers and persistent nftables ACLs on the Hub.
Desktop: packaged WinUI 3 client with DPAPI-protected operator certificate and SSH identity.
Agent: self-contained Linux binary for amd64 and arm64; it only creates outbound mTLS sessions.

See architecture, security model, roadmap, and installer contract.

Repository layout

src/ServerMonitorManager.Desktop/  Windows WinUI 3 client
src/ServerMonitorManager.Core/     Shared contracts and models
src/ServerMonitorManager.Control/  Hub API, SQLite, events, and policy coordination
src/ServerMonitorManager.Agent/    Outbound Linux monitoring agent
tests/                              Control-plane tests
docs/                               Architecture, security, roadmap, translations

The Linux installer is maintained in ochenstarik-ui/lightweight-server as ochenstarik-server-monitor-manager.sh. Release binaries are attached to Server Monitor Manager releases.

Quick start: Hub and two Nodes

Use a fresh Debian or Ubuntu server with a public IP as the Hub. Download and inspect the installer before running it:

curl -fLO https://raw.githubusercontent.com/ochenstarik-ui/lightweight-server/main/ochenstarik-server-monitor-manager.sh
chmod 700 ochenstarik-server-monitor-manager.sh
bash -n ochenstarik-server-monitor-manager.sh
sudo ./ochenstarik-server-monitor-manager.sh hub

Open the selected WireGuard UDP port (default 51820) and Control Hub TCP port 7443. Create enrollment codes on the Hub:

sudo ochenstarik-smm node-code home
sudo ochenstarik-smm node-code ai-agent

On each secondary server, use the same installer and select the Node role. Paste the code for that Node. The private WireGuard key is created locally and never leaves the Node. Then install the persistent control layer:

# Hub
sudo ./ochenstarik-server-monitor-manager.sh install-control-hub
sudo ./ochenstarik-server-monitor-manager.sh control-code home
sudo ./ochenstarik-server-monitor-manager.sh control-device-code windows-pc

# Node: paste the corresponding SMMCTL1 code when prompted
sudo ./ochenstarik-server-monitor-manager.sh install-control-agent

The installer selects the amd64 or arm64 archive and verifies its SHA-256 checksum. The SMMDEV1 code enrolls the Windows application: the app creates its operator key locally, confirms the Hub CA fingerprint, obtains a separate certificate, and protects it with Windows DPAPI.

Windows client

Requirements for building from source:

Windows 10 version 1809 or later / Windows 11;
.NET 10 SDK;
Visual Studio 2022 with Windows App SDK tooling, or compatible CLI workloads;
system OpenSSH client.

dotnet build ServerMonitorManager.slnx --configuration Release
dotnet test tests/ServerMonitorManager.Control.Tests/ServerMonitorManager.Control.Tests.csproj --configuration Release

In the application, generate or copy the monitoring SSH key, add the Hub profile, mark it as the Mesh Hub, and use Control Hub to paste the SMMDEV1 code. The Mesh view then reads inventory and Links from the authenticated Control API and receives live Link/heartbeat events.

Security model

no shared root password and no Node private WireGuard key on the Hub;
separate monitoring, terminal, Agent, Operator, and AI-automation identities;
SSH monitoring uses a root-owned forced command without shell, PTY, or forwarding;
Agent certificates can only submit heartbeat data for their own Node;
Operator certificates are required for inventory, Links, and event streaming;
Link traffic is denied by default and allowed only by explicit nftables rules;
disabling a Link persists the desired state before the firewall rule is removed;
idempotency keys prevent a retry from repeating a policy side effect;
secrets and production configuration must never be committed to Git.

Current status

v0.1.0-alpha.2 is an early testing release, not a production security appliance. Windows and Linux builds, six control-plane tests, Bash syntax checks, self-contained linux-x64/linux-arm64 artifacts, and checksums are automated in GitHub Actions.

Implemented: Windows SSH monitoring, Hub/Node WireGuard installer, directional Links, one-time enrollment, mTLS Agent and Operator identities, SQLite control state, audit, authenticated event stream, and Windows Control API integration.

Still planned: certificate revoke/re-enroll, offline Agent buffering and downsampling, reconnect reconciliation, kill-switch failure tests, a 50–100 Node load test, signed Windows installer, and desktop/mobile clients for additional platforms.

License and project policy

The project is under active alpha development. Review scripts and release checksums before testing, use disposable or backed-up servers, and do not expose the Control port without firewall restrictions.

7.9 KiB Raw Blame History Unescape Escape