Introduction

fleetd is a self-hosted tool for looking after a small fleet of Linux servers and routers. A single server collects metrics, raises alerts and offers a web admin page; every managed machine runs a small agent.

What makes it different

Remote management tools usually trust their control panel completely: whoever controls the panel can run anything as root on every machine. fleetd is built so that a compromised server cannot run commands:

• Commands are signed in your browser with an Ed25519 key that cannot be exported and never reaches the server.
• Each agent keeps its own list of trusted keys and its own permission level. The server cannot change either.
• Agent updates must be signed with a release key that stays offline on your computer.

The server only relays signed messages and stores metrics. See the design document for the full threat model.

How it works

browser ──HTTPS──▶ fleetd-server ──▶ PostgreSQL
                      ▲
                      │ WebSocket + Noise (agents dial out)
      ┌───────────────┼────────────────┐
 fleetd-agent    fleetd-agent     fleetd-agent

1. You run fleetd-server with PostgreSQL, behind an HTTPS reverse proxy.
2. Each machine runs one command from the admin page to install the agent. It connects out to the server and waits for your approval.
3. Once approved it reports metrics every 10 seconds. You can run signed commands on it and open a terminal, within the permission level you gave it.

Requirements

Next steps

• Quick start: try it locally with Docker in two minutes.
• Server setup: run it for real.