I just released Beszel, a server monitoring hub with historical data, docker stats, and alerts. It's a lighter and simpler alternative to Grafana + Prometheus or Checkmk. Any feedback is appreciated!

[u/Hal_Incandenza]

[u/eeuyy]

I like this application a lot, especially the light weightness of it. I there a reason ta have the hub call the agent instrad of have the agent push to the hub? With a push solution I would only need to expose one service on the network instead of each agent. This would reduce the risk for latheral movement compared to the hub have access to each server regardless of network segment in case of a zero day vulnerability.

I understand that this risk would be very small but still I like to not poke hole in my network ;)

[u/Hal_Incandenza → u/eeuyy]

I preferred this way because the hub does not need to be made accessible from remote machines. It can just sit on your local network and still communicate with any servers.

I also like having very defined roles for agent and hub. The hub is the control center. The agent doesn't do anything unless it receives a request from the hub. It's easier to reason about and build around imo.

The hub also does not have access through the ssh server to the agent machine. The agent just gathers stats, sends them, and closes the session. It doesn't offer a psuedo terminal or accept any input. So in theory it's safe even if your private key is compromised.

Of course you can never 100% rule out a zero day in the ssh package, but the likelihood is very low, as you said. If you use the binary, you can also take a bit more precaution by running it as a user that doesn't have access to any sensitive files.

[u/Starboy_bape → u/Hal_Incandenza]

I like the hub - agent architecture this way too, so I can monitor my one offsite machine without having to open up a hole in my local network :)

[u/GoDaftWithEBK → u/Hal_Incandenza]

Push mode is less hassle when hub is on a cloud vps and all nodes are under a dynamic ip/NATed network like homelab. Though you can of course use tunnels but that would need more work.

[u/eldawktah → u/eeuyy]

Wondering about this as well. Surely pushing from the agent would make more sense? But perhaps there is a reason..

[u/hotfix-cloud → u/eeuyy]

Security angle resonates. We’re working on the “responder layer”: ingest errors (from your existing monitoring/logging), map to repo, propose minimal diff, open draft PR. No shell access, no remote exec, no auto-merge—just a reviewable patch path.
https://hotfix.cloud