Open source · AGPL-3.0 · self-hosted

Infrastructure monitoring and security audit

Sites, servers, Docker, Kubernetes, databases, queues, GPUs and backups in one panel. One command to install, one per node. The agent discovers services on its own, dashboards and alerts work from the first minute.

Install GitHub

Docker Compose PostgreSQL Go agent, amd64 and arm64 Telegram and webhook EN / RU

80alert types with sustain windows and hysteresis

0inbound ports on nodes: the agent only connects out

1command for the panel, one per node, no exporters or configs

2 GBof RAM is enough for the panel, data in your PostgreSQL

kervax.example.comzoom

Home: what is broken and what needs action

Security

A security audit on every server

No separate scanner or security agent: the same nodes, the same panel, the same alerts.

external scanalert on new ports

What is open to the internet

External scan of every node, matched with what listens inside: process and container for each port.
Allowlists respected: a port open only to your own addresses is not reported as exposed.
Cloudflare-only: verifies that an origin answers nobody but Cloudflare.
A new port on the internet raises an alert. An intended one is marked once.
Kubernetes LoadBalancer services are scanned the same way.

/servers/web-02 · portszoom

SSHaccountssudo

SSH and access

SSH: password and root login, brute force in progress, fail2ban or sshguard protection, version banner.
Accounts and keys: who can log in, with which keys, who has sudo and NOPASSWD, weak keys, accounts nobody uses.
Changes: a new key, user or sudo rule, a password login from a new address - alert with a "this is us" button.
Timeline of 90 days: ports, containers, users, sudoers, cron jobs.

/servers/web-02 · accesszoom

CISA KEVUbuntu OVALendoflife.date

Vulnerabilities and end-of-life versions

Packages are matched against the Canonical OVAL feed: critical and already exploited in the wild (CISA KEV) only.
The kernel is checked by its running version, not the installed one: you see who needs a reboot.
End-of-life versions: OS, PostgreSQL, MySQL, Redis, nginx, PHP, Node.js, Python and more, from an endoflife.date snapshot shipped with the panel.
OS updates: pending security updates, automatic updates turned off, a reboot that keeps being postponed.
Containers that are privileged or carry host keys or the Docker socket, ports published past the firewall.

vulnerabilitieszoom

Server card: findings by area — Server card: findings mapped by area, the last 24 hours of changes on top.

5xx errors and their reason — Web: 5xx by site and path, and for 502/504 which upstream failed and why.

Disks and hardware

Failures show up before they happen

Forecasts from history, not thresholds on the current value.

SMARTRAIDNVMe

Disk wear and health

SSD wear forecast: measured rate, the dates of 90% and 100% at the current write rate, alert 60 days ahead.
Who writes to disk: units, containers and pods, per hour, day and week.
Health: degraded RAID, SMART failures, growing reallocated and pending sectors, disks that disappeared, kernel I/O errors.
Disks of virtual machines: RAID and I/O errors are watched even without SMART.

/servers/db-01 · disk healthzoom

forecastinodescleanup

Disk fill and space

Fill forecast from daily minima rather than spikes; inodes separately.
Where the space went: a tree of the largest directories, journal, Docker images and build cache, oversized logs, forgotten dumps.
Safe items are freed with a click, the rest comes with a ready command. Optional auto-cleanup at the threshold.

/servers/db-01 · diskzoom

cgroupsPSINVIDIA

CPU, memory, network, GPU

CPU and memory per container and pod, leaks by steady growth, OOM kills, pressure (PSI).
Services: failed units with the end of their journal, restart loops, units that will not start after reboot.
Network: TCP checks between servers, traffic per container, tariff limit, DNS resolvers, clock drift.
GPU: utilization, memory, temperature, power, processes per card, Xid errors that need a reset, frozen readings.

/servers/gpu-01 · GPUzoom

LLM serving — LLM: vLLM, SGLang, TEI, LiteLLM - queue, KV cache, TTFT and TPOT percentiles.

Site monitors — Sites: HTTP, TCP, DNS, push, checks from several networks, TLS and domain expiry.

Services

Discovered automatically, traced to the cause

The agent detects what runs on the machine. Nothing to configure per service.

PostgreSQLMySQLClickHouseRedis

Databases

Inventory: databases and sizes, logins, connections, replication and lag.
What loads the database: top queries by share of time, temporary files, WAL, reads past the buffers.
Problems: long transactions, lock waits, tables never vacuumed, Redis near maxmemory.
Configuration advice with this server's numbers and whether a restart is needed.

/services/db-01 · databaseszoom

RabbitMQsupervisorpm2cron

Queues, workers, cron

Queues: RabbitMQ, Redis, job tables. Alert when a queue grows and nobody drains it.
Workers under supervisor and pm2: crashes apart from planned restarts.
Cron jobs that overlap, hang or discard output. PHP-FPM pools stuck at pm.max_children.
Logs: error spikes in container and pod logs against the usual hour.

/services/app-01zoom

podsCronJobFlux

Kubernetes

Pods: restarts, CrashLoopBackOff, the scheduler's reason, pods without limits or probes.
A failed Job arrives in the alert together with the end of its log.
Expiry: control-plane and kubelet certificates, kubeconfigs, TLS secrets, Flux Git credentials.
Flux delivery that stopped while everything already running keeps running.
Dates are computed on the node: keys and tokens never reach the panel.

/kube · expiryzoom

Kubernetes: certificate and token expiry

Backups and alerts

Wakes you only for what needs a reaction

Telegramwebhookescalation

Alerts

One message per problem, and one when the same failure hits several servers.
Daily routine at the same hour every day is recognized and not alerted.
Telegram buttons: mute, ack, "this is us". Escalation when nobody acks.
Chats per group, maintenance windows with a check afterwards, dependency map.
History with a noise ranking and a period report.

alert historyzoom

resticrest-server

Backups

restic on every node: last snapshot, result, night window, growth per run.
Test restore, stale locks, rotation that silently stopped.
Deployed from the panel: backup server, clients, database dumps.
Credential vault encrypted in the browser: the panel stores only ciphertext.

/backupszoom

Out of the box

Instead of a ten-component stack

Task	Kervax	Typical stack
Metrics from a new server	one command on the node	node_exporter, scrape target, config reload, dashboard
A site from outside	the address, the rest is detected	blackbox_exporter, relabeling, rule, panel
TLS and domain expiry	automatic, 14 / 7 / 1 days ahead	probe and PromQL, a custom exporter for domains
Ports open to the internet	external scan, alert on new	a separate scanner
CVEs and EOL software	per node	separate tooling
SSD wear, SMART, RAID	with a forecast	smartctl_exporter and rules
Containers, pods, databases, queues	discovered by the agent	cAdvisor, kube-state-metrics, an exporter per database
Backups	restic status and test restore	not covered
Incidents and routing	built in	Alertmanager configuration
Access control	roles and groups, enforced in the API	Grafana orgs and Prometheus access

Prometheus remains the tool for application metrics and PromQL, and runs side by side. Kervax covers the infrastructure: host, site, certificate, container, database, backup and their security.

Architecture

Security model

The agent only connects out. It listens on no port, runs no arbitrary commands, works as a separate user in a systemd sandbox. The panel stores a SHA-256 of the token, not the token.
Permissions are enforced in the API. An account limited to a group cannot reach another group's object even with a direct request. A script probes the live panel with temporary accounts of each role.
No root. Backend as uid 10001, unprivileged nginx frontend, containers with no-new-privileges.
Protected sign-in. TOTP, address blocking after failed logins with an allowlist, alert on bogus API requests, audit log. The panel refuses to start with a weak secret.
Agent updates are signed with an offline key. Even a compromised panel cannot push its own binary to the nodes.
You install the root helpers with your own Ansible or by hand. The panel never distributes them.

Install

One command

On a clean Linux server: installs Docker, starts Caddy with a Let's Encrypt certificate, generates secrets, prints the panel address and the admin password.

$ curl -fsSL https://raw.githubusercontent.com/mihsergeev/Kervax/main/ops/quickstart.sh | sudo sh

No domain required

Without a domain the panel runs on <server-ip>.sslip.io with a Let's Encrypt certificate.

A server

"Add server" gives a command for the node. Metrics appear within seconds.

A site

The address of the monitor. Scheme, certificate, domain and history fill in from the first check.

Own domain, allowlist, behind an existing nginx, upgrades: installation guide.