RemotePower

The Swiss-army-knife control plane for your Linux fleet — Windows and macOS too — or your homelab. Monitoring, alerting, a CMDB, CVE scanning, patching, compliance, a built-in helpdesk, and remote management, all self-hosted in one place — with optional AI woven through it. Push-based agents that run as a supervised service on every OS, zero inbound ports — and agentless receivers (syslog, NetFlow, SNMP) for the boxes that can't run one. Up and running in five minutes.

Live demo · Install · Wiki · Changelog · Discussions · The story

What is it?

Most teams stitch together a monitor, a CMDB, a wiki, a vulnerability scanner, a patch tool, a ticket system and an SSH jump box. RemotePower is one self-hosted tool that does all of it — monitoring & alerting, an asset CMDB, documentation with RAG search over your own fleet, CVE scanning, patching, compliance reporting, a helpdesk with SLA clocks and email in/out, and remote management — with AI as an entirely optional layer on top (bring your own local or cloud model, or leave it off; when enabled it can also triage an alert through a bounded, read-only investigation loop and write a verdict with its evidence).

Each host runs a small Python agent that polls the server over outbound HTTPS only — nothing opens on the client, ever. Enrolment is a 6-digit PIN, like pairing a controller. It runs supervised on every platform — a systemd service on Linux, a launchd agent on macOS, and a Windows service (services.msc, auto-restarting) on Windows, installed by a single elevated one-liner. See docs/windows-client.md for the Windows specifics.

Deliberately small and readable: nginx + Python (gunicorn/Flask) on the server, plain vanilla JS in the browser — no React/Vue, no build step, no Node.js, no Redis, no Kubernetes. install-server.sh or docker compose up provisions the full stack — PostgreSQL, the app server, a maintenance scheduler, a scanner satellite — with no flags required. A single small box handles a couple hundred devices out of the box, no tuning needed — and the same box carries several thousand agents with just the poll-interval and worker-count knobs turned, before you'd ever reach for load-balanced app nodes, read replicas or relay satellites. See docs/scaling.md for the capacity table and docs/requirements.md for hardware sizing.

Quick start

Server — one command, HTTPS out of the box:

# Docker (recommended). Self-signed HTTPS on first boot; the one-time admin
# password is printed to `docker logs remotepower`.
docker compose up -d

# Or bare-metal: one wizard installs nginx + the app + TLS + admin.
git clone https://github.com/tyxak/remotepower && cd remotepower
sudo bash install.sh

Open the printed URL and log in — HTTPS is automatic (self-signed by default, or Let's Encrypt if you give it a public domain). No nginx editing.

On the box, manage the stack with rp (omd/checkmk-style): rp status, the live rp tui dashboard, and sudo rp doctor for a one-shot health check — see docs/cli.md.

Add a device — one line:

Add device → Quick install command in the dashboard, then on the target host:

wget -qO- "https://your-server/install?t=<token>" | sudo sh

The host appears in the dashboard within ~60 seconds. Onboarding many hosts? install.sh agent push user@h1 user@h2 … pushes it over SSH.

Upgrading? git pull origin main && sudo bash install.sh update handles both a plain code update and a legacy pre-6.1.0 conversion. Full paths (Windows/macOS agents, demo vhost, advanced TLS, uninstall) → docs/install.md · docs/upgrading.md.

Try it first: a read-only demo runs at demoremote.tvipper.com, seeded with synthetic devices/alerts/CVEs. Login demo / demo, reset every few hours.

What you can do with it

• Monitor & alert — live metrics, a CheckMK-style Checks page, active monitors (HTTP/DNS/ICMP/TCP) with attachable SLA/SLO objects (availability targets + error budgets), an Alerts inbox with ack/auto-resolve/mute, and one filterable page to tune every alert threshold, grade and score weight.
• See every signal — SMART/hardware health, GPU, power/UPS, disk-fill forecasting, a per-host timeline, log search; agentless syslog, NetFlow/IPFIX/sFlow and SNMP receivers cover the switches, firewalls and printers that can't run an agent.
• Manage remotely — shell + Custom Scripts, a file manager and cron/systemd-timer control with zero inbound ports; plus a browser SSH terminal and VNC riding your existing SSH, and Proxmox/VMware/OpenShift guest lifecycle via the hypervisor's own API.
• Lock it down — passkeys/WebAuthn, SAML/OIDC/LDAP, TOTP, per-role MFA, a tamper-evident audit log, strict CSP.
• Scan for CVEs — OSV.dev-backed, CISA KEV + EPSS prioritized, SBOM export (CycloneDX/SPDX).
• Pentest what you own — authorized nuclei/nikto/nmap/ZAP/wapiti/lynis scans on a hardened scanner satellite.
• CMDB + RAG search — assets, an encrypted credentials vault, a Knowledge Base, and an AI assistant that cites your fleet's own data.
• Stay compliant — OpenSCAP CIS/STIG/PCI scans, PCI/HIPAA/SOC 2 mapping.
• Integrate — 44 connectors (homelab apps, hypervisors, and EDR — Wazuh, CrowdStrike, SentinelOne — cross-referenced to find hosts with no EDR at all) plus a code-free custom-HTTP-probe plugin, Prometheus/Grafana endpoints, webhooks, syslog, and an MCP server.
• Deploy & automate — a one-click app catalog, auto-patch policies, drift detection, ACME, backups, and a Terraform/Ansible provisioning catalog.

Full feature inventory → docs/features.md. Step-by-step recipes → docs/cookbook.md.

Recent releases

• v6.4.0 "Sh1eldMatters" — the security-and-protection release. Integrity- guard and baseline checks now behave exactly as expected: disable one and it stops evaluating on the host, not just in the UI, and accept a legitimate change as the new baseline with one click. Backed by a full, public security review and pentest pass (nothing Critical, High or Medium ships). Plus agentic diagnosis used defensively — a bounded, secret- redacted log sweep and read-only alert triage that writes a verdict with its evidence trail — a data-binding sweep so everything the agent collects lands in the UI, RAG and AI context, SLA/SLO objects for remote probes (availability targets with error budgets, exported as Prometheus gauges), a WordPress connector showing the last logins with IP + geo, and a typography / box-overflow / performance polish wave.
• v6.3.0 "Fl0wMatters" — a fourteen-wave UX program: undo instead of "are you sure?" (topbar undo/redo, deferred-commit deletes, optimistic alert ack), a notification center, configuration history with rollback, draft autosave, shift-click range selection, chart crosshairs and a per-host posture radar — plus a native syslog listener for agentless appliances, macOS agent self-update, chassis-aware offline grace for laptops, weekly restore drills, laptop battery health, an "agents outdated" filter, a Postgres migration CLI, app-wide axe-verified accessibility, and deploy/self-update restarting the sidecar daemons.
• v6.2.3 "Un1fyMatters" — a consolidation and tidy-up pass: an optional listen port on Create tunnel, an ACME certificates page that loads on navigation (no manual Refresh), clearer feedback when a package snapshot captures nothing, and a removed duplicate dampening setting — on top of a project-wide sweep that collapsed repeated code idioms, deleted dead code and de-duplicated the docs.
• v6.2.2 "Pu1seMatters" — a performance and polish pass built around the heartbeat: agents skip re-sending unchanged inventory data (delta sysinfo) and reuse their HTTPS connection instead of a new TLS handshake per beat; a new always-on health check catches an agent whose sandbox hides kernel modules before patch day; re-running the installer now upgrades in place; and the UI gains a keyboard-driven alert inbox, device hover cards, tab-level device deep links and faster large-fleet tables.
• v6.2.1 "In1tMatters" — a critical fix for Linux hosts using initramfs (Debian/Ubuntu): systemd unit hardening could make upgrades run through RemotePower rebuild the initramfs without kernel modules, leaving the host unbootable at its next reboot. The unit is fixed, the upgrade command now refuses to run in that situation, and patch-window reboots verify the initrd (and a clean upgrade) before firing. Full history, newest first → CHANGELOG.md.

Security

Security-reviewed every release and pentested as hard as we can — the bar is nothing Critical, High or Medium ships, and nothing exploitable. Every release runs SAST (Bandit, gitleaks, and CodeQL — the same advanced-setup scan GitHub runs, reporting clean), adversarial code review, DAST (OWASP ZAP, Nikto, Nuclei, Wapiti, WhatWeb), and live probing of our own instance. bcrypt-hashed passwords behind rate-limited login, TOTP/passkeys/SAML/OIDC/LDAP, a strict CSP with no unsafe-inline (plus HSTS preload, frame-ancestors none, and a locked permissions-policy), an AES-GCM CMDB vault, a tamper-evident audit log, signed agent commands, and mandatory TLS verification with anti-DNS-rebinding on every outbound call. Each release's write-up is public. Full posture, threat model and review history → docs/security.md.

Documentation

The Wiki is the browsable, topic-organised home for everything — install guides, the full feature reference, architecture, and the changelog. Prefer the source? It's all in docs/ too. Quick links:

Contributing & community

• Request a feature — open a Feature request.
• Report a bug — open a Bug report.
• Ask a question or float an idea — head to Discussions.
• Found a security issue? — report it privately per SECURITY.md; don't open a public issue.
• Contributing code or docs? — see CONTRIBUTING.md.

License

MIT — see LICENSE.