Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Changelog

Release notes are also published on the GitHub releases page. The format follows Keep a Changelog, and version numbers follow Semantic Versioning. The configuration, the API and the database format may change between 0.x releases; read the notes of a release before upgrading.

Unreleased

0.2.0 - 2026-10-01

Added

  • An installation script (install.sh, published on the website and with each release) that verifies the download, installs the binary and a hardened systemd service, and creates the configuration, an SSH key and the first administrator. Running it again upgrades an installation; --uninstall removes it and keeps the data.
  • helmsight hosts bootstrap prints a script that creates the monitoring account on a host, with the public key restricted by restrict,from=.
  • helmsight init accepts its answers as options (--listen, --public-url, --ssh-user, --ssh-key, --admin), runs without questions with --non-interactive, reads the administrator’s password with --password-stdin and creates an ed25519 key with --generate-key.
  • Turkish documentation: README.tr.md, docs/tr/ and a Turkish website and documentation under /tr/, with language links between them.
  • A troubleshooting page in the documentation.
  • More detailed documentation in both languages: requirements, upgrades, backups, reverse proxy setup, example alert rules and notification channels, safe action design and a security checklist.

Fixed

  • The README quick start now changes into the directory unpacked from the release archive before running the binary.

0.1.1 - 2026-10-01

Fixed

  • Sign-in and every other state-changing request were refused as cross-origin when the web UI was served over TLS with HTTP/2.

0.1.0 - 2026-10-01

Added

  • Agentless collection over SSH with one persistent session per host and a single read-only POSIX shell script per tick, tested on Debian, Ubuntu, Rocky, Fedora, openSUSE and Alpine.
  • Local mode (serve --local) that monitors the machine it runs on.
  • Fleet overview with groups, tags, search, sparklines and distinct states for unreachable hosts, authentication failures, host key problems and partial collections.
  • Host detail with live and historical charts, per-core CPU heatmap, top processes, listening ports, services, containers and system information.
  • History in SQLite with 1-minute and 5-minute rollups and configurable retention.
  • Inventory snapshots, change timeline and host-to-host or baseline comparison.
  • Security overview: failed SSH logins, pending and security updates, reboot-required flags, ports not on the baseline and TLS certificate expiry.
  • Alert rules with durations and scopes, built-in rules, acknowledgements, silences, reminders, and webhook, Slack and email notifications.
  • Opt-in actions with confirmation and a hash-chained, append-only audit log.
  • Viewer, operator and admin roles; Argon2id passwords; TOTP; OpenID Connect single sign-on with role mapping.
  • Wall display mode with revocable, group-scoped display tokens.
  • Versioned JSON API with OpenAPI document, server-sent events and a Prometheus endpoint.
  • TLS with provided certificates or a generated self-signed certificate.
  • Secrets encrypted at rest with XChaCha20-Poly1305.
  • CLI: serve, init, user, hosts test, config check, secret, audit verify.