Fleet overview
Status, CPU, memory, load, fullest disk, network and alerts for every host. Groups, tags, search and sparklines. "Down", "auth failed", "host key changed" and "partial" are distinct states.
Open source · MIT · Linux
Watch every server from one screen.
Install nothing on them.
helmsight is a single binary that monitors a fleet of Linux servers over plain SSH. It collects metrics and inventory with read-only commands, keeps history locally and serves a fast, calm web dashboard. No agents, no daemons, no files written on your servers.
Early development (0.x). Tested on six Linux distributions, but with little production use and no independent security audit yet; configuration and data formats may change. Try it on non-critical hosts first. Project status
$ helmsight init
$ helmsight hosts test --trust
$ helmsight serve
Everything an operator looks at, nothing they have to install
Host detail
Live and historical charts with a synchronized crosshair, per-core CPU heatmap, top processes, listening ports, services, containers and system information.
History
Every sample for 24 hours, 1-minute rollups for 7 days, 5-minute rollups for 90 days, in an embedded SQLite database.
Drift and changes
Packages, kernel, ports, enabled units and OS are snapshotted. See what changed since yesterday and compare a host with another host or its baseline.
Security overview
Failed SSH logins, pending security updates, ports not on the baseline, reboot flags and TLS certificate expiry, across the fleet.
Alerts
Rules like disk_used_pct > 90 for 10m, scoped to groups or tags. Acknowledgements, silences, and webhook, Slack or email notifications.
Actions, opt-in
Let operators restart a service without shell access: fixed commands, a confirmation dialog and a hash-chained, append-only audit log.
Teams and screens
Viewer, operator and admin roles, TOTP, OpenID Connect single sign-on, and a wall display for NOC screens with revocable tokens.
How it works
- One persistent SSH session per host. Every few seconds helmsight runs a single POSIX shell script on it, sent over standard input.
- Read-only commands only.
/proc,df,ps,ss,systemctl, the package database. Missing tools degrade to "n/a" with a reason. - Parsed and stored centrally. Output is size-limited, parsed in Rust and kept in SQLite with automatic rollups.
- Served from one binary. The web UI is embedded. Deployment is copying one file.
Works on Debian, Ubuntu, RHEL, Rocky, Alma, Fedora, openSUSE and Alpine (BusyBox).
Browserruns only code served by helmsight
HTTPS
helmsightone binary · SQLite · web UI
SSH, read-only
web-1
db-1
edge-1
Secure by default
No arbitrary commands
There is no terminal, file manager or command box. Remote output is never rendered as HTML, and a strict Content-Security-Policy forbids inline code.
Verified host keys
OpenSSH known_hosts semantics: unknown keys need an admin to confirm the fingerprint, changed keys stop collection and raise an alert.
Least privilege
An unprivileged account with a restricted key is enough. The integration tests verify that nothing is written on the monitored hosts.
Hardened web app
Loopback by default, automatic TLS elsewhere, Argon2id, TOTP, SSO, CSRF protection, rate limiting and secrets encrypted with XChaCha20-Poly1305.
Try it in one command
On any Linux machine, local mode monitors the machine itself, without SSH or configuration:
$ ./helmsight serve --localTo install it as a service on a server, use the installation script. It verifies the download, asks a few questions and shows what it will do before changing anything:
$ curl -fsSLO https://enderkus.github.io/helmsight/install.sh
$ sudo sh install.shThen follow the quick start to add your servers.