RemotePower

The Swiss-army-knife control plane for your Linux fleet — Windows and macOS too — or your homelab. Monitoring, alerting, a CMDB, CVE scanning, patching, compliance, a built-in helpdesk, and remote management, all self-hosted in one place — with optional AI woven through it. Push-based agents that run as a supervised service on every OS, zero inbound ports — and agentless receivers (syslog, NetFlow, SNMP) for the boxes that can't run one. Up and running in five minutes.

Live demo · Install · Wiki · Changelog · Discussions · The story

Screenshots

Dashboard	Fleet overview
Monitoring	Device metrics
CVEs	Patches
Compliance	Pentest
CMDB	Settings
AI assistant	Tickets (helpdesk)
Calendar	WG Access (VPN)
Browser SSH terminal	rp — node control (TUI)
Containers	KMIP key server

Most teams stitch together a monitor, a CMDB, a wiki, a vulnerability scanner, a patch tool, a ticket system and an SSH jump box. RemotePower is one self-hosted tool that does all of it — monitoring & alerting, an asset CMDB, documentation with RAG search over your own fleet, CVE scanning, patching, compliance reporting, a helpdesk with SLA clocks and email in/out, and remote management — with AI as an entirely optional layer on top (bring your own local or cloud model, or leave it off; when enabled it can also triage an alert through a bounded, read-only investigation loop and write a verdict with its evidence).

Each host runs a small Python agent that polls the server over outbound HTTPS only — nothing opens on the client, ever. Enrolment is a 6-digit PIN, like pairing a controller. It runs supervised on every platform — a systemd service on Linux, a launchd agent on macOS, and a Windows service (services.msc, auto-restarting) on Windows, installed by a single elevated one-liner. See docs/windows-client.md for the Windows specifics.

Deliberately small and readable: nginx + Python (gunicorn/Flask) on the server, plain vanilla JS in the browser — no React/Vue, no build step, no Node.js, no Redis, no Kubernetes. install-server.sh or docker compose up provisions the full stack — PostgreSQL, the app server, a maintenance scheduler, a scanner satellite — with no flags required. A single small box handles a couple hundred devices out of the box, no tuning needed — and the same box carries several thousand agents with just the poll-interval and worker-count knobs turned, before you'd ever reach for load-balanced app nodes, read replicas or relay satellites. See docs/scaling.md for the capacity table and docs/requirements.md for hardware sizing.

Server — one command, HTTPS out of the box:

# Docker (recommended). Self-signed HTTPS on first boot; the one-time admin
# password is printed to `docker logs remotepower`.
docker compose up -d

# Or bare-metal: one wizard installs nginx + the app + TLS + admin.
git clone https://github.com/tyxak/remotepower && cd remotepower
sudo bash install.sh

Open the printed URL and log in — HTTPS is automatic (self-signed by default, or Let's Encrypt if you give it a public domain). No nginx editing.

On the box, manage the stack with rp (omd/checkmk-style): rp status, the live rp tui dashboard, and sudo rp doctor for a one-shot health check — see docs/cli.md.

Add a device — one line:

Add device → Quick install command in the dashboard, then on the target host:

wget -qO- "https://your-server/install?t=<token>" | sudo sh

The host appears in the dashboard within ~60 seconds. Onboarding many hosts? install.sh agent push user@h1 user@h2 … pushes it over SSH.

Upgrading? git pull origin main && sudo bash install.sh update handles both a plain code update and a legacy pre-6.1.0 conversion. Full paths (Windows/macOS agents, demo vhost, advanced TLS, uninstall) → docs/install.md · docs/upgrading.md.

Try it first: a read-only demo runs at demoremote.tvipper.com, seeded with synthetic devices/alerts/CVEs. Login demo / demo, reset every few hours.

• Monitor & alert — live metrics, a CheckMK-style Checks page, active monitors (HTTP/DNS/ICMP/TCP) with attachable SLA/SLO objects (availability targets + error budgets), an Alerts inbox with ack/auto-resolve/mute, and one filterable page to tune every alert threshold, grade and score weight.
• See every signal — SMART/hardware health, CPU/board temperatures, GPU, power/UPS, disk-fill forecasting, a per-host timeline, log search; agentless syslog, NetFlow/IPFIX/sFlow and SNMP receivers (plus an OID browser to walk any SNMP subtree) cover the switches, firewalls and printers that can't run an agent.
• Manage remotely — shell + Custom Scripts on Linux, Windows and macOS, a file manager and cron/systemd-timer control with zero inbound ports; plus a browser SSH terminal and VNC riding your existing SSH, and Proxmox/VMware/OpenShift guest lifecycle via the hypervisor's own API.
• Lock it down — passkeys/WebAuthn, SAML/OIDC/LDAP, TOTP, per-role MFA, a tamper-evident audit log, strict CSP — and a built-in KMIP key server so NAS/hypervisor encryption keys live off the appliance they unlock.
• Scan for CVEs — OSV.dev-backed, CISA KEV + EPSS prioritized, SBOM export (CycloneDX/SPDX).
• Pentest what you own — authorized nuclei/nikto/nmap/ZAP/wapiti/lynis scans on a hardened scanner satellite.
• CMDB + RAG search — assets, an encrypted credentials vault, a Knowledge Base, and an AI assistant that cites your fleet's own data.
• Stay compliant — OpenSCAP CIS/STIG/PCI scans, PCI/HIPAA/SOC 2 mapping.
• Integrate — 44 connectors (homelab apps, hypervisors, and EDR — Wazuh, CrowdStrike, SentinelOne — cross-referenced to find hosts with no EDR at all) plus a code-free custom-HTTP-probe plugin, Prometheus/Grafana endpoints, webhooks, syslog, and an MCP server.
• Deploy & automate — a one-click app catalog, auto-patch policies, drift detection, ACME, backups, and a Terraform/Ansible provisioning catalog.

Full feature inventory → docs/features.md. Step-by-step recipes → docs/cookbook.md.

• v6.4.2 "Ver1tyMatters" — a truth-in-reporting release. Per-container alert mutes (silence one container without silencing its host) and a real container log window, then a long correctness pass: an adversarial audit closed a cross-tenant log-content leak, a governance switch a config import could flip, and a webhook credential that shipped in clear text. A data-binding sweep put Linux firewall / SSH / auto-update posture on the Checks page, into fleet-query, and behind PCI 1.2.1, and made Windows/macOS endpoint posture feed the risk score. Security hardening is now opt-in (Settings → Security) — the advisory checks that flag deliberate choices are off by default and alert only when you enable them.
• v6.4.1 "Cust0dyMatters" — key custody: a built-in KMIP key server so a Synology NAS, TrueNAS box or vSphere cluster stops keeping its encryption keys on the same hardware that holds the encrypted data. Off by default, a separate sandboxed sidecar, mutual TLS only, with an encrypted recovery bundle. Plus installer flags for the optional syslog/flow receivers, an INGEST & KEYS view in rp status/rp tui, and two monitor fixes: an actionable rejection message and one stale monitor no longer blocking every other monitor edit.
• v6.4.0 "Sh1eldMatters" — the security-and-protection release. Integrity- guard and baseline checks now behave exactly as expected: disable one and it stops evaluating on the host, not just in the UI, and accept a legitimate change as the new baseline with one click. Backed by a full, public security review and pentest pass (nothing Critical, High or Medium ships). Plus agentic diagnosis used defensively — a bounded, secret- redacted log sweep and read-only alert triage that writes a verdict with its evidence trail — a data-binding sweep so everything the agent collects lands in the UI, RAG and AI context, SLA/SLO objects for remote probes (availability targets with error budgets, exported as Prometheus gauges), a WordPress connector showing the last logins with IP + geo, and a typography / box-overflow / performance polish wave.
• v6.3.0 "Fl0wMatters" — a fourteen-wave UX program: undo instead of "are you sure?" (topbar undo/redo, deferred-commit deletes, optimistic alert ack), a notification center, configuration history with rollback, draft autosave, shift-click range selection, chart crosshairs and a per-host posture radar — plus a native syslog listener for agentless appliances, macOS agent self-update, chassis-aware offline grace for laptops, weekly restore drills, laptop battery health, an "agents outdated" filter, a Postgres migration CLI, app-wide axe-verified accessibility, and deploy/self-update restarting the sidecar daemons.
• v6.2.3 "Un1fyMatters" — a consolidation and tidy-up pass: an optional listen port on Create tunnel, an ACME certificates page that loads on navigation (no manual Refresh), clearer feedback when a package snapshot captures nothing, and a removed duplicate dampening setting — on top of a project-wide sweep that collapsed repeated code idioms, deleted dead code and de-duplicated the docs. Full history, newest first → CHANGELOG.md.

Security-reviewed every release and pentested as hard as we can — the bar is nothing Critical, High or Medium ships, and nothing exploitable. Every release runs SAST (Bandit, gitleaks, and CodeQL — the same advanced-setup scan GitHub runs, reporting clean), adversarial code review, DAST (OWASP ZAP, Nikto, Nuclei, Wapiti, WhatWeb), and live probing of our own instance. bcrypt-hashed passwords behind rate-limited login, TOTP/passkeys/SAML/OIDC/LDAP, a strict CSP with no unsafe-inline (plus HSTS preload, frame-ancestors none, and a locked permissions-policy), an AES-GCM CMDB vault, a tamper-evident audit log, signed agent commands, and mandatory TLS verification with anti-DNS-rebinding on every outbound call. Each release's write-up is public. Full posture, threat model and review history → docs/security.md.

The Wiki is the browsable, topic-organised home for everything — install guides, the full feature reference, architecture, and the changelog. Prefer the source? It's all in docs/ too. Quick links:

• Request a feature — open a Feature request.
• Report a bug — open a Bug report.
• Ask a question or float an idea — head to Discussions.
• Found a security issue? — report it privately per SECURITY.md; don't open a public issue.
• Contributing code or docs? — see CONTRIBUTING.md.

MIT — see LICENSE.