A self-hosted, mobile-first Linux observability dashboard. Install it on a VPS to inspect CPU, memory, swap, disks, network throughput, active sessions, and processes by system user in real time — without sending telemetry to a third-party SaaS.
Small VPS deployments often need more than htop on a laptop but less than a full Prometheus/Grafana stack. Server Manager gives operators an installable PWA with a three-second Server-Sent Events stream and a deliberately small operational footprint.
- real Linux telemetry through
systeminformation; - Server-Sent Events instead of polling every widget;
- processes grouped by Unix user and ranked by resource use;
- installable responsive PWA;
- HttpOnly, SameSite session cookies with rolling expiration;
- login rate limiting and timing-safe password comparison;
- production fail-closed when
SM_PASSWORDis absent; - process command lines and login IPs removed from the browser payload;
- Nginx, HTTPS, PM2, UFW, and boot persistence automation;
- CI tests, dependency audit, public-boundary gate, and full-history Gitleaks.
Linux host
└─ systeminformation collectors
└─ sanitized telemetry snapshot
└─ Express API + authenticated SSE
└─ dependency-free PWA
The public demo renders clearly marked simulated telemetry. A self-hosted installation uses the same UI with live host metrics.
git clone https://github.com/lippdev/servermanager.git
cd servermanager
npm ci
SM_PASSWORD='use-a-long-random-password' npm startThe development server binds to 127.0.0.1:3000. Set HOST explicitly only when you understand the network exposure.
Download and inspect the installer before executing it as root:
curl -fsSLO https://raw.githubusercontent.com/lippdev/servermanager/main/deploy/install.sh
less install.sh
sudo DOMAIN=panel.example.com SM_PASSWORD='use-a-long-random-password' CERTBOT_EMAIL=ops@example.com bash install.shSee DEPLOY.md for prerequisites, verification, upgrades, and operation.
| Variable | Default | Purpose |
|---|---|---|
HOST | 127.0.0.1 | HTTP bind address |
PORT | 3000 | Internal HTTP port |
SM_PASSWORD | none | Required when NODE_ENV=production |
NODE_ENV | development | Enables fail-closed production behavior and secure cookies |
Server Manager exposes sensitive host telemetry and must stay behind HTTPS. It is intentionally read-only: it does not kill processes, run commands, or mutate the host. Authentication sessions live in memory, expire after 12 hours of inactivity, and reset on process restart. For multi-user organizations or SSO, place an identity-aware proxy in front rather than expanding the built-in single-operator auth.
npm ci
npm test
npm run audit:public
npm audit --omit=dev --audit-level=highTests exercise fail-closed production startup, cookie authentication, anonymous rejection, and telemetry redaction.
Built by Filipe Moreira, full-stack software engineer — GitHub.
MIT