System Setup (eight tabs) and Logs
Users. Who has an account, what each can do, and what is wrong: the table (names, uids, shells, keys) plus the deep reading (lifetime dates, the exact rule that grants root, the state of every home, who is stale) with findings judged from both — a second uid 0, an empty password, a locked account whose keys still work, a sudoers file visudo refuses. Tabs Overview / People / System accounts / Root / Changes / Backups; a row opens into the account's own page (lifetime, root and how far, groups, how they get in, right now, cron, activity over a window, what they reach and run). Verbs: add (onboarding as one card with the line to hand over), lock/unlock, shut out completely (locked + expired + keys backed up and emptied + sessions ended), sudo given or taken by a Lens-owned allowlist rule, keys added ("one of mine" or "someone else's" with a name that becomes the key's comment), delete with what the account owns counted first, off-boarding as a flow in order. Off limits here and in Go: yourself and root.
Groups. Not who is in what but what each group MEANS and whether the people in it should be: docker is root by another name, adm reads every log, shadow reads the hashes, a %group line in sudoers makes a forgotten group into root; a member locked a year ago still in wheel; a name that belongs to nobody. Overview / Groups / Power / Shared folders / Changes, a group's own page, several members added at once, a folder shared to a group (setgid walk on ask), root scoped by a Lens %group rule, delete with what it owns counted first.
Certificates. What the web servers present, when each dies, whether it renews itself and — the part that goes wrong quietly — whether the box actually serves what is on disk, whether anything reloads the web server after a renewal, whether the name still points here, whether the key matches, whether the chain verifies. Obtain a real one (HTTP, or DNS validation through certbot's provider plugins or a guided TXT record through Lens's own hook — both allow wildcards and boxes closed on 80), request one from a CA (key and CSR made on the box, the CA's answer installed beside the key later), import one you already have (PEM or PFX), a self-signed one for a box nobody outside reaches, renew as a job, auto-renew with the reload hook Lens sets. The VAULT keeps every certificate and key on this computer sealed under the drive's key and carried by the pen-drive backup, so a wiped box or a deleted lineage is a "put back", not a new request to Let's Encrypt.
Auto-updates. Whether the box patches itself and whether it actually STAYS patched: which repositories the automatic run may take from (third-party repos — Docker, a database — left out by default and aging for years), what is held back and why, what is pending with its source, when the timer really fires, whether a reboot or service restart is owed, whether the lists refresh, whether dpkg is stuck, what the last runs did. Settings (schedule, holds, restarts), Pending, Repositories, History, Log; one-shot reboot, undo, changelog, snaps, leftovers. Lens owns its own apt.conf.d files and a timer drop-in; the package's own files are never edited.
Audit. Who did what on this box, three records: BECAME ROOT (every sudo command from the journal, each with a verdict — a root shell, a sensitive file, a download-and-run, a permissions change, an account change, or routine — the short list on top), WHAT WAS TOUCHED (auditd watching the files that matter — passwd, shadow, sudoers, sshd, the firewall, nginx, the certificates — naming who changed them even when it was not Lens, plus every program run inside root shells, and auditd's own health with the verbs that fix it), and LENS' LEDGER (every signed change Lens made here). Logs is the catalogue reader.
Services. What systemd runs: failed first, then running, then enabled-but-stopped, the rest folded. A row opens to the unit's status and its journal; a service page shows the unit file, drop-in, capabilities, hardening, exposure. Start/Stop/Restart through the sudo path, plus per unit: a drop-in written, restart policy and resource limits changed in place, hardening applied, mask, reset-failed; Timers and Boot tabs. sshd under any of its names is protected from every verb. "Run as a service" is a form that writes a systemd unit with the preview as the point: nobody signs a unit they have not read.
Storage. How close each disk is, what is taking the room, and what can be given back without losing anything (Space: the reclaim actions, each saying afterwards what the disk looks like now). Filesystems, Disks as they physically are, LVM (a group made, a volume carved, grown live), partitions, swap, fstab, Health (SMART). Preparing a disk is the one destructive thing here and says so twice.
Network. What the box is called, the addresses it answers on, routes, ports, traffic, kernel guards, /etc/hosts — and what its names actually resolve to, from the box and from here, because a site that will not load is nearly always the service, the firewall or the name. Changing an address arms a revert on the server before anything is touched: if Lens can still reach the box afterwards it disarms it; if not, the box puts the old settings back by itself. Nobody drives to a data centre.
Logs. Every log on the server by service — running units with their journal, files under /var/log and where the configs point, an Unknown group for whatever Lens cannot place — and a reader for any of them.