Twenty-one servers, one thing, once.

Pick Servers… opens a sheet with the map in it: tick servers one by one, a whole group with its own box, or load a saved set — a pick with a name, there tomorrow. The pick stands as a column on the right of the screen, a row per server under its group, each with a dot for the only thing that matters before you press anything: can Vigia reach that box right now. Green is a live shell. A spinner is a saved login being tried — a pick opens those by itself. Grey is a saved login waiting, and a click on the dot connects it; red is no login, or one that did not go through, and the click opens the login. Every screen that runs work says how many picked boxes it skipped rather than quietly leaving them out.

What can be done is the sidebar: Ask a question, Run a command, Install, Set up, and one search over all of it — type "user" and every row about users is there, whichever section it lives in. The same pick serves Snippets, Flows, Ask Themis and Overview, so the servers chosen for a question here are the ones a flow runs on next. Close All closes every shell on the pick and empties it.

Type a command, or pick one of the lines an operator types at a fleet most mornings — uptime and load, disk usage, memory, the busiest processes, failed services, the OS and kernel, listening ports, recent logins, who is on, whether a restart is needed, and, with sudo already in the line, recent errors or a package-list refresh. Your own snippets sit beside them. Picking one fills the box; it never runs on its own. What goes out is always in front of you before you press.

Answers land as they finish, one card per server, each with the exit code and how long it took; a box that hangs is cut off after two minutes and holds nobody else up. Rows that failed open by default, because those are the ones you came for. Nothing is merged into a single stream you would then have to untangle — eighteen boxes, eighteen answers, read as eighteen answers. And the line runs exactly as typed, as the login each box was opened with: sudo goes where you put it, and a box whose sudo wants a password says so in its row and runs nothing.

Pick the thing a server ought to have — Fail2Ban, ufw or firewalld, CrowdSec, ModSecurity, unattended upgrades, auditd, AIDE, debsums, the rootkit hunters, the AppArmor or SELinux tools, password quality, nginx, Apache, Caddy, PHP-FPM, certbot, ProFTPD, vsftpd, chrony and the rest — and every picked server is asked whether it already has it. Two lists come back: has it, and does not.

Then one button installs on all thirteen that lack it, or you install a single row. Each one is the same root job the server's own tab would run, watched here, and the box is asked again afterwards — so the row does not say "installed" because Vigia assumes it worked; it says it because the box said so.

This is the one that saves a morning. Add a user on every server, give or take sudo, add an SSH key, lock or unlock, delete, add a group, put someone in one, grant a folder, open or close a firewall port, turn the firewall on, set up Fail2Ban, harden sshd, run something as a service, turn on automatic updates, set the timezone, turn NTP on.

None of it is a second implementation. Each verb goes through the same code path the server's own screen uses, with the same refusals — the firewall never strips your SSH cover, sshd hardening is still proven by a fresh login. Twelve boxes are worked at a time, and a row per server says what happened on it, including the ones that asked for a sudo password.

The onboarding case is the whole point. One form creates the same account on eighteen machines with a shell, sudo, and a key — and if you choose "a key made here", Vigia generates the pair on your computer, gives the servers the public half, and asks you where to save the private one. That file is handed to the person and Vigia keeps no copy of it.

Opening a port on a fleet is where hand-rolled scripts go wrong, because the boxes do not agree: some run ufw, some firewalld, some have neither. Vigia reads each box first and speaks whatever it found — and refuses, on every one of them, to write a rule that would remove your own way in. Closing a port means unreachable, not unlisted: the allow rules go, a deny is added where the box lets everything in by default, and a box with no firewall on is refused in words rather than reported closed. Setting up Fail2Ban across the pick is the same story: one file per box, the package installed where it is missing, and each row reporting for itself.