Juan Denis
f6f08ae9d1
Adds cross-server Fleet Monitor endpoints and models, plus broad security and robustness improvements across agent, backend, and tooling. Key changes: - New fleet monitor API (endpoints for heatmap, comparison, alerts, thresholds, anomalies, forecast, search, exports, and Prometheus) and service skeleton. - New DB models for ServerAlertThreshold and MetricAlert to support metric alerts. - Agent discovery/registration hardening: HMAC-signed discovery requests, signature/timestamp validation, minimal discovery responses, HMAC-based unregister headers, and enforced command timeout cap in agent command handling. - WebSocket and agent client TLS handling gated by SERVERKIT_INSECURE_TLS env var; added auth rate limiting on agent gateway. - Docker-compose: parameterize agent image via AGENT_VERSION and avoid running as root by adding docker group access. - Backend security & policy: tightened CSP script/style sources, request size limit, 2FA pending-token rejection on non-2FA endpoints, registration flow/guards, admin-only SSO admin routes via middleware, rate limits on sensitive endpoints, and logging for auth/2FA events. - Database service hardening: identifier validation, avoid passing passwords on CLI (use env vars), safer subprocess usage, and docker exec handling improvements. - CronService: command validation to prevent shell injection and run commands without shell=True; build_service and other subprocess usages updated similarly. - Misc: .env.example notes clarified for encryption key generation, invitation token generation improved, agent registry timestamp window reduced, various logging and input validations added, frontend FleetMonitor page and styles stubbed in, and Vite/config/style updates. Overall this commit implements fleet monitoring scaffolding and a set of security, validation, and operational improvements to make agent discovery, registration, command execution, and backend services safer and more robust.
ServerKit
Self-hosted infrastructure, made simple.
A lightweight, modern server control panel for managing web apps, databases, Docker containers, and security — without the complexity of Kubernetes or the cost of managed platforms.
English | Español | 中文版 | Português
Features · Quick Start · Screenshots · Architecture · Roadmap · Docs · Contributing · Discord
🎯 Features
🚀 Apps & Deployment
PHP / WordPress — PHP-FPM 8.x with one-click WordPress installation
Python Apps — Deploy Flask and Django with Gunicorn
Node.js — PM2-managed applications with log streaming
Workflow Builder — Node-based visual automation for server tasks, deployments, and CI/CD
Environment Pipeline — Multi-environment management for WordPress (Prod/Staging/Dev) with code/DB promotion
Docker — Full container and Docker Compose management with real-time log streaming and terminal access
Marketplace — Over 60+ one-click templates for popular apps (Immich, Ghost, Authelia, etc.)
🏗️ Infrastructure
Domain Management — Nginx virtual hosts with easy configuration
SSL Certificates — Automatic Let's Encrypt with auto-renewal
Databases — MySQL/MariaDB and PostgreSQL with user management and query interface
Firewall — UFW/firewalld with visual rule management and port presets
Cron Jobs — Schedule tasks with a visual editor
File Manager — Browse, edit, upload, and download files via web interface
FTP Server — Manage vsftpd users and access
Backup & Restore — Automated backups to S3, Backblaze B2, or local storage with scheduling, retention policies, and one-click restore
Email Server — Postfix + Dovecot with DKIM/SPF/DMARC, SpamAssassin, Roundcube webmail, email forwarding rules
🔒 Security
Two-Factor Auth — TOTP-based with backup codes
Malware Scanning — ClamAV integration with quarantine
File Integrity Monitoring — Detect unauthorized file changes
Fail2ban & SSH — Brute force protection, SSH key management, IP allowlist/blocklist
Vulnerability Scanning — Lynis security audits with reports and recommendations
Automatic Updates — unattended-upgrades / dnf-automatic for OS-level patching
🖥️ Multi-Server Management
Agent-Based Architecture — Go agent with HMAC-SHA256 authentication and real-time WebSocket gateway
Fleet Overview — Centralized dashboard with server grouping, tagging, and health monitoring
Remote Docker — Manage containers, images, volumes, networks, and Compose projects across all servers
API Key Rotation — Secure credential rotation with acknowledgment handshake
Cross-Server Metrics — Historical metrics with comparison charts and retention policies
📊 Monitoring & Alerts
Real-time Metrics — CPU, RAM, disk, network monitoring via WebSocket
Uptime Tracking — Historical server uptime data and visualization
Notifications — Discord, Slack, Telegram, email (HTML templates), and generic webhooks
Per-User Preferences — Individual notification channels, severity filters, and quiet hours
👥 Team & Access Control
Multi-User — Admin, developer, and viewer roles with team invitations
RBAC — Granular per-feature permissions (read/write per module)
SSO & OAuth — Google, GitHub, OpenID Connect, and SAML 2.0 with account linking
Audit Logging — Track all user actions with detailed activity dashboard
API Keys — Tiered API keys (standard/elevated/unlimited) with rate limiting, usage analytics, and OpenAPI documentation
Webhook Subscriptions — Event-driven webhooks with HMAC signatures, retry logic, and custom headers
🚀 Quick Start
⏱️ Up and running in under 2 minutes
Option 1: One-Line Install (Recommended)
curl -fsSL https://serverkit.ai/install.sh | bash
Works on Ubuntu 22.04+ and Debian 12+. Sets up everything automatically.
Option 2: Docker
git clone https://github.com/jhd3197/ServerKit.git
cd ServerKit
cp .env.example .env # then edit .env with your secrets
docker compose up -d # access at http://localhost
Option 3: Manual Installation
See the Installation Guide for step-by-step instructions.
Requirements
| Minimum | Recommended | |
|---|---|---|
| OS | Ubuntu 22.04 LTS | Ubuntu 24.04 LTS |
| CPU | 1 vCPU | 2+ vCPU |
| RAM | 1 GB | 2+ GB |
| Disk | 10 GB | 20+ GB |
| Docker | 24.0+ | Latest |
📸 Screenshots
View More Screenshots
🏗️ Architecture
┌──────────────────┐
│ INTERNET │
└────────┬─────────┘
│
▼
┌──────────────────────────────────────────────────────────────────────────┐
│ YOUR SERVER │
│ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ NGINX (Reverse Proxy) │ │
│ │ :80 / :443 │ │
│ │ │ │
│ │ app1.com ──┐ app2.com ──┐ api.app3.com ──┐ │ │
│ └───────────────┼─────────────────┼─────────────────────┼─────────────┘ │
│ │ proxy_pass │ proxy_pass │ proxy_pass │
│ ▼ ▼ ▼ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ DOCKER CONTAINERS │ │
│ │ │ │
│ │ ┌───────────┐ ┌───────────┐ ┌───────────┐ │ │
│ │ │ WordPress │ │ Flask │ │ Node.js │ ... │ │
│ │ │ :8001 │ │ :8002 │ │ :8003 │ │ │
│ │ └─────┬─────┘ └───────────┘ └───────────┘ │ │
│ └──────────┼──────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ DATABASES │ │
│ │ MySQL :3306 PostgreSQL :5432 Redis :6379 │ │
│ └─────────────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────────────┘
View Full Architecture Documentation → — Request flow, template system, port allocation, database linking, and troubleshooting.
🗺️ Roadmap
- Core infrastructure — Flask + React + JWT + WebSocket
- Application management — PHP, Python, Node.js, Docker
- Domain & SSL — Nginx virtual hosts, Let's Encrypt
- Databases — MySQL, PostgreSQL
- File & FTP management
- Monitoring & alerts — Metrics, webhooks, uptime tracking
- Security — 2FA, ClamAV, file integrity, Fail2ban, Lynis
- Firewall — UFW/firewalld integration
- Multi-server management — Go agent, centralized dashboard
- Git deployment — Webhooks, auto-deploy, rollback, zero-downtime
- Backup & restore — S3, Backblaze B2, scheduled backups
- Email server — Postfix, Dovecot, DKIM/SPF/DMARC, Roundcube
- Team & permissions — RBAC, invitations, audit logging
- API enhancements — API keys, rate limiting, OpenAPI docs, webhook subscriptions
- SSO & OAuth — Google, GitHub, OIDC, SAML
- Database migrations — Flask-Migrate/Alembic, versioned schema
- Agent fleet management — Auto-upgrade, bulk ops, offline command queue
- Cross-server monitoring — Fleet dashboard, anomaly detection, alerting
- Agent plugin system — Extensible agent with custom metrics, commands, health checks
- Server templates & config sync — Drift detection, compliance dashboards
- Multi-tenancy — Workspaces, team isolation, per-workspace settings
- DNS zone management — Cloudflare, Route53, DigitalOcean integrations
- Status pages — Public status page, health checks, incident management
Full details: ROADMAP.md
📖 Documentation
| Document | Description |
|---|---|
| Architecture | System design, request flow, diagrams |
| Installation Guide | Complete setup instructions |
| Deployment Guide | CLI commands and production deployment |
| API Reference | REST API endpoints |
| Roadmap | Development roadmap and planned features |
| Contributing | How to contribute |
🧱 Tech Stack
| Layer | Technology |
|---|---|
| Backend | Python 3.11, Flask, SQLAlchemy, Flask-SocketIO, Flask-Migrate |
| Frontend | React 18, Vite, LESS, Recharts |
| Database | SQLite / PostgreSQL |
| Web Server | Nginx, Gunicorn (GeventWebSocket) |
| Containers | Docker, Docker Compose |
| Security | ClamAV, Lynis, Fail2ban, TOTP (pyotp), Fernet encryption |
| Auth | JWT, OAuth 2.0, OIDC, SAML 2.0 |
| Postfix, Dovecot, SpamAssassin, Roundcube | |
| Agent | Go (multi-server), HMAC-SHA256, WebSocket |
🤝 Contributing
Contributions are welcome! Please read CONTRIBUTING.md first.
fork → feature branch → commit → push → pull request
Priority areas: Agent plugin system, fleet management, DNS integrations, status pages, UI/UX improvements, documentation.
💬 Community
Join the Discord to ask questions, share feedback, or get help with your setup.