The chairs
One dropdown, every place to work. The head of the sidebar is one control that says where you are — the chair's name and a line under it — and opens to all of them: Server management (the map and every tool on a server), Terminals only, Overview, Actions, Snippets, Flows and NOC, then under a rule Themis and Files. The same list is the Mac menu bar's Features. Setup is not a chair: it is about Vigia itself, and its button sits in the bar at the top.
Terminals only. Just shells: click a server on the left to open one here, split up to four on a page, and one on this computer, side by side. The bolt on a group opens the whole group there. No head, no rail.
The pick. Overview, Actions, Snippets, Flows and Ask Themis work on one shared pick of servers, a column on the right of each. Pick Servers… opens a sheet with the map in it: tick servers one by one, a whole group at once, or load a saved set — a pick with a name, kept for next time. Each row has a dot for the one thing that matters before you press anything, whether Vigia can reach the box: green a shell is open, a spinner while a saved login goes in, grey a saved login waiting (a click on the dot connects it), red no login or one that did not go through (the click opens the login). Close All closes every shell on the pick and empties it; with nothing open it is Clear the Pick.
Overview — the servers at a glance. One kind of reading on every picked Vigia server at once: a row per server, a dot per check, and nothing opened to get it — no tab per server. A server with a shell open is read through that session; any other is logged in to with its saved login, read in one script, and let go. Twenty-four servers are read at a time, each with its own time limit, so a dead box costs its own row and never the sweep; five hundred servers is the size it is built for. Terminals (console servers) are not part of it — Overview reads as root, and root is what a Vigia server is for.
- The kinds, in the rail: Security (the server's own Security reading — firewall, Fail2Ban, SSH, kernel, AppArmor or SELinux, WAF, automatic updates, passwords, integrity, audit, certificates, accounts), Health (load per CPU, memory, swap, failed services, out-of-memory kills, the clock, uptime, zombies), Disk (the fullest filesystem, root, inodes, filesystems the kernel turned read-only, disk errors in the kernel log, SMART, the journal), Backups (Vigia's backup plans: the last run, the newest good copy against the plan's own schedule, whether a copy leaves the server, encrypted, the room for the next), Databases (MongoDB, MariaDB/MySQL, PostgreSQL: running, the role in the set, replication and its lag, connections against the limit, listening to the world, authentication, TLS between members), Updates (security updates first, everything pending, a reboot owed, how fresh the package lists are, automatic updates, whether the release is still supported), Access (root over SSH, passwords, who becomes root, accounts with no password, weak keys), Knocking (fail2ban, its jails and bans, the SSH logins that failed in the last 24 hours — each connection counted once — where they came from, the names they tried, and who got in), Exposure (what is actually reachable from anywhere, the data and admin ports among it, SSH with passwords, the firewall, Docker past it), Certificates (the soonest to expire, expired ones, renewal, self-signed ones handed to visitors) and Drift (the release, the kernel, OpenSSL, OpenSSH, database and web server versions, sshd's settings and the time zone, each server against the rest of its own group in the pick).
- The dots. Green fine, yellow worth a look, red needs you; a faint dot is nothing there to judge, a ring could not be read. Where a number says more than a colour — Knocking's counts, a backup's age, a replica's lag — the cell is the number, coloured the same way. Every column head says what turns it yellow or red. Hover a dot for what the server said; click a yellow or red one, or a number, and a small panel opens on it with the findings behind it — the failed units, the packages waiting, the addresses that knocked — and the rule that coloured it.
- Drift compares instead of judging: green where a server matches most of its group, yellow where it does not, with the group's whole spread a click away. A database or a web server is compared only among the servers of the group that run one.
- Honest rows. A reading cut short — the time limit, sudo refusing, a dropped connection — is that row's error, never a set of dots. Read as the login instead of root, a log only root can read is said to be unread, not "nothing wrong". A saved login a server refuses is not tried again until it changes, so a sweep cannot lock an account or get this computer banned.
- Check Now reads the picked servers; Stop lets go at once, and the rows being read keep what they said before. Auto reads again every 5 or 15 minutes while the chair is kept. Filters by standing (Needs You, Unreachable, Worth a Look, Fine, Not Read Yet), Worst First, and a column's head puts its worst — or its most — first. Beside each kind in the rail, a red count of the picked servers that need you there. Reading only: nothing on a server changes.
Actions. The work done on several servers at once, on the pick. Its sidebar is what can be done — Ask a question, Run a command, Install, Set up — with one search over all of it. Every screen says how many picked servers it skipped rather than quietly working on fewer.
Actions › Run a command. One line, every picked server, the answers side by side. A list of the lines an operator types at a fleet most mornings (uptime and load, disk, memory, the busiest processes, failed services, OS and kernel, listening ports, recent logins, who is on, restart needed, recent errors, refresh the package lists) plus your own snippets — picking one fills the box and never runs it. The line runs exactly as typed, as the login each box was opened with: sudo goes where you put it, and a box whose sudo wants a password says so in its row and runs nothing. Answers land as they finish, one card per server with its exit code and time; a box that hangs is cut off after two minutes; failed rows open by default.
Actions › Ask a question. A question asked of every picked server, answered as one value per server through the question's own parser — "port 21 open" comes back as yes or no and a list, not ss output — then grouped by answer, the biggest group first: six distinct CPUs is the finding, not thirty-six rows. Nearly three hundred curated questions in sections (network, services, packages and OS, users and access, security, storage and load, hardware, CPU and memory now, kernel and tuning, web and apps, files and time, and those that need root); what a question needs (a port, a package, a threshold) is asked above the button; the raw output is a click away. A group's head carries Keep only these open: the rest of the pick closes and leaves it.
Actions › Install. The plumbing a server should have, put on the ones that lack it: security (Fail2Ban, ufw, firewalld, CrowdSec, ModSecurity, unattended-upgrades, auditd, AIDE, debsums, the rootkit hunters, AppArmor, SELinux, pwquality), web (nginx, Apache, Caddy, PHP-FPM, certbot), FTP (ProFTPD, vsftpd), system (chrony, rngd, the acl and disk tools). Every picked server is asked whether it has it — two lists, has it and does not — with an Install button per row and one for all; the same root job the server's own screen would start, and the box asked again afterwards.
Actions › Set up. One change, the same on every picked server, through the same code the server's own screen uses: add a user (password, a pasted public key, or a key pair made here with the private half saved where you say and never kept), give or take sudo, add an SSH key, lock or unlock, delete, add a group, put a user in one, grant a folder, open or close a firewall port (each box read first: ufw on ufw, firewall-cmd on firewalld, your own SSH cover never removed; closed means unreachable, not unlisted), turn the firewall on, set up Fail2Ban, harden sshd (still proven by a fresh login), run as a service, automatic updates, the timezone, NTP. Twelve at a time, a row per server saying what happened.
Snippets. The commands worth a name: one line or a short && chain, a name and a line about it, kept in collections. A snippet runs exactly as written — sudo in the line where it is wanted. Run from Actions › Run a command, from every terminal's own bar, and from the Broadcast box over the terminals.
Flows — the builder. Steps drawn once on a canvas and run on many. The palette: set values, ask for values, update & upgrade, install or remove packages, install nginx, Apache or Fail2Ban, harden the kernel, set up SSH for my IP, harden SSH, create a user, configure and enable the firewall, open or close a port, block or unblock an address, install a WAF or an FTP server, the security audit tools, integrity checking, AppArmor/SELinux, automatic security updates, the timezone, a service, a swap file, wait, restart the server, log out, log in, a custom action, and End — and conditions that branch Yes/No: a package installed, a service running, a user exists, a port listening, a restart required, SSH answering, a file exists, a custom check read by its exit code. Drag or click to place, configure in the panel, wire port to node. Flows are your own, saved on the map and stamped with your key, holding no secret.
Flows — the run on one server. The flow walked on a real box top to bottom while the canvas lights up node by node, the box's own words beside each step. Actions run as root; conditions are read by exit code; Restart reboots and brings its own way back, drawn under it the moment it lands — SSH answering? → No → Wait 30 s → ask again; Yes → Login — and the run continues on the new session. It pauses for values (Ask for values is asked once, before the start), for a host key to trust, and on a failed step — retry, skip, stop. What the box remembers of past runs is read from /var/lib/lens on it.
Flows — Run on Servers. The same flow on the servers of the pick: the questions asked once, then All at Once, 10 at a Time, 5 at a Time or One at a Time — "One server first", the rest starting only if it finishes, and "If one fails, stop the rest". Each server runs the flow as root on its own session. The run is a table: a row per server, a column per step, and End — reached is reached, whichever way the flow got there. A step waiting on you waits on its row, and Watch opens that server's own run. Quitting Vigia, or closing the session, while a flow runs asks first: stopping in the middle of a step can leave a box half changed.
NOC. The map drawn as boxes with the ports they talk on: a node is a server dropped from the tree (its icon read from what it listens on), a wire is "A talks to B on 27017/tcp", the port a chip. The drawing is a claim and Run Diagram proves it: every wire is tried from the box the traffic starts at — reach (the source opened a TCP connection), listen (something on the destination listens on that port on an address the source dials), allow (the destination's firewall lets the source in) — green, amber or red with the failing fact in words; nothing is checked from this computer. A diagram need not be drawn: Discover asks every box's firewall (the topology as intended) and its established connections (the topology as it is), and a wire only one of them saw is said so. A run opens the busiest port and the others are chips with their counts; Broken Only and Selected Only thin the canvas; a lit box shows its Inbound, Outbound and Mutual wires. A box's right-click menu has a Terminal and Ask Themis, each in a window over the diagram. Diagrams are saved on the map, stamped with your key, holding no secret; one opens for drawing, and nothing is connected or proven until you run it. The whole tool on its own page: The NOC, end to end.