Running the house behind the door.

Two readings feed this screen — the table of names, uids, shells and keys, and the deep one: lifetime dates, the exact rule that grants root, the state of every home, who is stale — and the findings are judged from both. A second uid 0. An empty password. A locked account whose keys still work. A sudoers file visudo refuses. A home that belongs to somebody else. Nothing wrong is also a finding, and the screen says so plainly.

Overview, People, System accounts, Root, Changes, Backups. A row opens into the account's own page: its lifetime, how it gets in, how far its root reaches, its groups, what it is running right now, its cron, its activity over a window. Adding somebody is one card — identity, the login, a key of theirs or one made here, the sudo rule — ending with the line you hand over. Off-boarding is a flow in order, with what the account owns counted before anything is deleted. Two things are off limits here and refused again in Go: yourself, and root.

getent group already says who is in what. The question nobody answers is whether they should be: docker is root by another name, adm reads every log, shadow reads the hashes, and a %group line in sudoers turns a group nobody looks at into root. A member locked a year ago is still in wheel. A name in a members list belongs to nobody at all.

Overview, Groups, Power — the ones that grant something real — Shared folders, Changes. A row opens the group's own page. Several members added at once; a folder shared to a group with the setgid walk done on ask; root scoped to a group by a Vigia-owned rule; delete with what the group owns counted first. The one line you cannot cross, here and in Go: your own root.

Anyone can read an expiry date. This screen reads the things that actually break a site at 3 am: whether the box serves what is on disk, whether anything reloads the web server after a renewal, whether the name still points here, whether the key matches the certificate, whether the chain verifies.

Obtain a real one from Let's Encrypt over HTTP, or over DNS through a provider plugin or a guided TXT record with Vigia's own hook — both good for wildcards and for boxes closed on 80. Request one from a CA with the key and CSR made on the box, and install the answer beside the key later. Import a PEM or a PFX. Self-sign for a box nobody outside reaches. Renewal runs as a job you watch, and a finished obtain or renew copies into the vault at once, so the vault is never older than the box.

The vault keeps every certificate and key on your computer, sealed under your key and carried by the encrypted backup. A wiped box, or a lineage deleted by accident, is a put back — not a new request to Let's Encrypt against a rate limit.

The switch is the easy part. This screen answers the rest: which repositories the automatic run may take from — a third-party repo, Docker or a database, is left out by default and ages for years without anyone noticing — what is held back and why, what is pending right now with its source, when the timer really fires, whether a reboot or a service restart is owed since the last upgrade, whether the package lists even refresh, whether dpkg is stuck half-configured, and what the last runs actually did.

Settings, Pending, Repositories, History, Log; a one-shot reboot, an undo, the changelog, snaps and leftovers. Vigia owns its own files in apt.conf.d and a timer drop-in; the package's own files are never edited.

What systemd runs on this box, in the order you care about: failed first — that is what you came to see — then running, then enabled-but-stopped, then everything else folded away. A row opens to the unit's status and the last lines of its journal, which is where "why" lives. Start, Stop and Restart go through the same root path everything else does. Exposure, Timers and Boot are their own tabs.

A unit's page shows the file, its drop-in, its capabilities, its hardening and what it exposes — and Run as a service writes a new unit with the preview as the point: nobody should sign a unit file they have not read. One service is protected from every verb on this screen, under any of its names: sshd. This window exists because of it.

Nothing crashes; everything just stops. So this screen says how close each disk is, what is taking the room, and what can be given back without losing anything — each reclaim action saying afterwards what the disk looks like now.

Then the work reading a disk was only half of: an attached volume that needs to become a folder, a volume grown at the provider that the filesystem has not noticed, an LVM volume with room beside it, a box with no swap. LVM earns its extra layer for one reason — a filesystem stops being tied to a disk, so when room runs out you add a disk to the group and grow the volume live, with nothing copied and nothing unmounted. Filesystems, Disks, Health (SMART), Space, fstab. Preparing a disk is the one destructive thing here, and it says so twice.

Scheduled. Everything the box runs on its own: cron in all of its places, systemd timers, at jobs, with who runs each one and from where. Persistence is where an intruder lives after the first day, so the shapes it takes are called out by name; this is the list a responder asks for first. Your own entries go in /etc/cron.d/lens. An entry in /etc/crontab or cron.d is switched off by commenting it with Vigia's mark, a copy of the file kept beside it the first time, and switched back on the same way; a timer is disabled, an at job removed.

Time. Is the clock right and who keeps it so — chrony, systemd-timesyncd or ntpd, whichever the box runs — because an hour of drift breaks certificates, one-time codes and every log correlation you will ever do. And whether the box has a real source of randomness, with rng-tools where it does not. Both are read by the Security Overview too, and a finding there lands on these tabs.