david/netwatch
Watch
1
0
Fork
You've already forked netwatch
 0
Code Issues Pull requests 2 Projects Releases 8 Packages Wiki Activity Actions
8 releases 8 tags
  • v1.5.0 f6e6a79105

    netwatch 1.5.0 — Blocklists, fleet bans, pending updates
    All checks were successful
    CI / fmt + clippy + test (push) Successful in 3m53s
    Details
    Release / build and publish (push) Successful in 8m59s
    Details
    Stable

    david released this 2026-10-31 18:11:07 +01:00 | 30 commits to main since this release

    Blocklists, fleet bans and pending updates.

    • The hub downloads Feodo Tracker (recommended), Spamhaus DROP and the Tor exit list daily.
      Feodo and DROP are blocked in both directions on every server that opts in; Tor exits are
      tagged, never blocked. A server that still tries to reach a listed address raises a crit
      alert: the strongest sign netwatch can give that the server is compromised.
    • An SSH auto-ban on one server is copied to every opted-in server, with one push. Unban
      everywhere lifts it on all of them.
    • Each server card shows pending security updates and "reboot required", read hourly by a
      read-only root helper. netwatch never runs apt update or installs anything.
    • Hub bans are opt-in per server: accept_hub_bans = true under [security] in agent.toml.
      The agent's safelist always wins. Turning it off and restarting removes everything the hub
      sent. The README's threat model describes the new worst case.
    • ban_cap defaults to 5000.

    Upgrade the hub first, then each agent, then opt in. Blocklists are tested on Ubuntu 24.04
    (nftables 1.0.9); Debian 12 (nftables 1.0.6) is expected to work but untested.

    netwatch is not affiliated with or endorsed by The Spamhaus Project.

    Downloads
  • v1.4.0 7f059684d7

    netwatch 1.4.0 — Quiet and accountable
    All checks were successful
    CI / fmt + clippy + test (push) Successful in 3m14s
    Details
    Release / build and publish (push) Successful in 8m5s
    Details
    Stable

    david released this 2026-10-28 14:49:47 +01:00 | 52 commits to main since this release

    Quiet and accountable.

    • Any alert can be acknowledged. It dims in the feed and stays there, and acked and muted alerts still count in every counter.
    • A server can be muted for 1-168 hours, for every alert kind or just one. A muted alert is stored and shown, never pushed, and a server-wide mute also holds that server's down and back-online pushes.
    • A 30-day uptime strip on the server page and the fleet cards, built from the 5-minute buckets the hub already keeps.
    • Settings downloads one consistent SQLite copy of the hub database, behind a full session, a fresh two-factor code, a per-IP limit and one download at a time. Every attempt is audited.
    • Schema v12. No agent change, and the protocol stays at version 1.

    Upgrade the hub first, then the agents. Both configs and the database are kept.

    Downloads
  • v1.3.0 dcf99abbe6

    netwatch 1.3.0 — Persistence watch
    All checks were successful
    CI / fmt + clippy + test (push) Successful in 3m40s
    Details
    Release / build and publish (push) Successful in 10m2s
    Details
    Stable

    david released this 2026-10-27 16:38:35 +01:00 | 64 commits to main since this release

    Persistence watch and disk forecast.

    • New crit alerts: a new login account, an account added to an admin group, and any change to an
      authorized_keys file.
    • New root key-watch helper (netwatch-keys.timer) writes digests and paths to
      /run/netwatch-keys/authorized_keys.sha256. It holds only digests and paths, never key text.
    • New disk-full forecast built from the raw sample day, with warn and crit thresholds.
    • Fixes: the Security page prints the helper reason once; the key helper keeps old digests when
      getent returns no rows.

    Upgrade hub first, then agents. Both configs and the database are kept.

    Downloads
  • v1.2.0 c522a2089b

    netwatch 1.2.0 — SSH login alerts
    All checks were successful
    CI / fmt + clippy + test (push) Successful in 3m30s
    Details
    Release / build and publish (push) Successful in 9m8s
    Details
    Stable

    david released this 2026-10-26 21:46:17 +01:00 | 78 commits to main since this release

    SSH login alerts.

    • Every successful SSH login reaches the hub. Unusual ones raise a crit push: an unknown key, a
      key logging in as a new user, a password or keyboard-interactive login, or any login from a
      public address. Repeat pushes are held to one an hour.
    • Trust a key once from the alert (name it, this server or all servers); Settings · Trusted keys
      lists and revokes them. Trusting never changes access on the server.
    • Security · SSH logins shows 30 days of logins per key, user and source.
    • Logins made while the agent was down are caught up from the journal's last 24 h.

    Upgrade the hub before the agents (the protocol is unchanged; a 1.1 hub ignores the new login
    message). Logins are read from journald only.

    Downloads
  • v1.1.2 a3ab44fd68

    netwatch 1.1.2 — Installer fix
    All checks were successful
    CI / fmt + clippy + test (push) Successful in 3m23s
    Details
    Release / build and publish (push) Successful in 8m2s
    Details
    Stable

    david released this 2026-10-26 08:44:50 +01:00 | 89 commits to main since this release

    Installer fix.

    • install.sh now works the way the README says: download it on its own, then run it. It takes
      the systemd unit (and the Caddyfile example) from the release tarball it has just verified,
      and a re-run over an installed host no longer needs them at all. Before this, a lone
      install.sh died at the unit step, for fresh installs and for upgrades.

    No binary behaviour, protocol, API, database or config changes.
    Upgrade: download install.sh from this tag, run it with --version 1.1.2 for each role, then
    restart the unit.

    Downloads
  • v1.1.1 8af310ad91

    netwatch 1.1.1 — Polish release
    All checks were successful
    CI / fmt + clippy + test (push) Successful in 2m55s
    Details
    Release / build and publish (push) Successful in 7m10s
    Details
    Stable

    david released this 2026-10-25 22:48:57 +01:00 | 93 commits to main since this release

    Polish release.

    • Upgrading an agent with install.sh no longer asks for the hub URL or the token: a re-run keeps
      agent.toml and replaces the binary. --force still replaces the config and asks for both.
    • One severity shape across the Security feed and the station log; station log rows now carry
      the severity as a screen-reader word ("Critical: …").
    • Server card footer values no longer split from their unit on narrow cards.

    No protocol, API, database or config changes.
    Upgrade: run install.sh from the extracted release tarball (tools/install.sh, so it finds
    deploy/), then restart the unit. Running a lone downloaded install.sh fails at the unit step; a
    fix is planned.

    Downloads
  • v1.1.0 4a6112ecab

    netwatch 1.1.0 — Fleet v2
    All checks were successful
    CI / fmt + clippy + test (push) Successful in 3m17s
    Details
    Release / build and publish (push) Successful in 8m22s
    Details
    Stable

    david released this 2026-10-25 21:32:19 +01:00 | 103 commits to main since this release

    Fleet v2: the Fleet screen becomes the station's front page.

    • KPI strip: servers online, fleet CPU with a 1-hour sparkline, alerts in 24 h, auto-bans today.
    • Server cards coloured by the hub's own thresholds (DEGRADED), with a CPU sparkline.
    • Fleet radar: servers placed by load pressure, so the closer to the centre, the hotter.
    • Station log: the newest alerts, live, plus "went offline" / "is back online" rows.
    • Jump-to palette on every page: press / or Ctrl+K to reach any server or page.
    • Fix: revoking an agent now deletes all its stored data.

    No protocol, config or database changes: a 1.0.0 agent keeps working with a 1.1.0 hub.
    Upgrade: swap the binaries from these tarballs (verify SHA256SUMS), then restart both units.
    Don't re-run install.sh for an existing agent yet: it asks for the token again (fix planned).

    Downloads
  • v1.0.0 90820bc797

    v1.0.0
    All checks were successful
    CI / fmt + clippy + test (push) Successful in 3m15s
    Details
    Release / build and publish (push) Successful in 8m19s
    Details
    Stable

    david released this 2026-10-25 18:06:06 +01:00 | 112 commits to main since this release

    Downloads