Nodeglow
Self-hosted infrastructure monitoring with log intelligence and
incident correlation: host checks, remote probes, a Rust agent, syslog,
SNMP and 19 integrations in one place, with one consistent answer to "what is
broken right now, and what changed since I last looked".
Nodeglow runs as a small Docker Compose stack (PostgreSQL, ClickHouse, a
FastAPI backend, a Next.js UI and an update sidecar) on a single Linux host.
It is Open Core: the core is AGPL-3.0, a few enterprise features are
source-available under a commercial license (see Editions).
Features
Monitoring
- Host checks — ICMP, TCP and HTTP(S) per host. HTTP checks can set
method, path, expected status, a keyword and redirect handling, and record
why a check failed.
- One host state everywhere —
up, degraded, warning, down,
unknown, maintenance, disabled, computed by one probe-aware rule for
lists, badges, dashboard and topology. No fresh data means unknown, never
a stale green.
- Remote probes — let an enrolled agent run the checks for hosts in
networks the server cannot reach; a silent probe turns its hosts
unknown.
- Agent — Rust agent for Linux and Windows: CPU, memory, disks, network,
processes, Docker, temperatures, journal / Windows Event Log, watched
services (a stopped service raises an incident), signed auto-update.
- Integrations — 19 built-in collectors (table below), one Python file
each.
- SNMP — MIB upload, OID browser, polling with thresholds.
- Certificates — TLS expiry tracking, discovered by the network scanner.
- Discovery and scans — subnet scans with port/service identification and
an inbox of things to review (new ports, certificates).
- Uptime and SLA — 24 h / 7 d / 30 d availability, history heatmaps,
latency thresholds per host or globally.
Logs
- Syslog receiver — UDP/TCP (RFC 3164/5424), stored in ClickHouse, with
host auto-assignment, full-text search, a live tail that filters "severity
N or worse", and an optional sender allowlist.
- Log intelligence — template extraction ("log patterns"), auto-tagging,
noise scoring, burst detection, per-host rate baselines with spike and
silence detection, and precursor patterns learned from past incidents.
- Traffic — interface bandwidth and top talkers.
Alerting and incidents
- Incident correlation — groups related failures (several hosts down,
syslog + ping, integration + host) into one incident with its affected
hosts.
- Alert rules — custom conditions (contains, regex, numeric operators) on
any field.
- Notifications — Telegram, Discord, e-mail, webhook, Microsoft Teams,
Slack and ntfy. Channel secrets are encrypted and write-only.
- Maintenance windows — one-off and recurring; hosts in a window are
shown as
maintenance and do not alert.
Operations
- Overview dashboard — health, open incidents, internet/WAN, topology,
groups, latency, syslog, availability and "since your last visit", from a
single
GET /api/v2/dashboard; a full change feed on /changes.
- Weekly report — scheduled e-mail summary of incidents, availability,
syslog and certificate expiry.
- Self-monitoring — Nodeglow raises ordinary incidents when one of its own
jobs or data sources stops working.
- Users and access — admin / editor / read-only roles, optional LDAP,
API keys with the same roles, audit log.
- Updates and backups — one-click updates with signature verification,
a database dump before every update and a daily scheduled dump, encrypted
JSON export.
- AI (opt-in) — off until an admin enables it; Anthropic, Azure OpenAI or
any OpenAI-compatible endpoint including local models (Ollama, vLLM, LM
Studio); personal data and secrets are redacted before anything is sent.
The AI features themselves are part of the enterprise edition.
- UI — keyboard-driven (command palette,
g … shortcuts), light, dark or
system theme, works on phones; fonts are self-hosted, nothing is loaded from
third-party CDNs.
Integrations
| Integration | What is monitored |
|---|
| Proxmox VE | Nodes, VMs, LXC containers — CPU, RAM, disk, IO rates |
| UniFi | APs, switches, clients, signal strength, PoE ports |
| UniFi NAS | Storage, volumes, RAID |
| Pi-hole | Query stats, blocking %, top domains |
| AdGuard Home | Query stats, blocking %, filter lists |
| Technitium DNS | Queries, blocking, cluster health, available updates |
| Portainer | Docker containers across all endpoints |
| TrueNAS | Pools, datasets, alerts, system info |
| Synology DSM | Volumes, shares, CPU, RAM, SMART |
| pfSense / OPNsense | Interface stats, rules, DHCP leases |
| Home Assistant | Entity states, system info |
| Gitea | Repos, users, issues, system stats |
| phpIPAM | Subnets, address utilisation, import into Hosts |
| Speedtest | Download, upload, latency — Ookla CLI if bundled (BUNDLE_OOKLA=1, own builds only), otherwise speedtest-cli |
| UPS / NUT | Battery charge, on-line / on-battery, runtime |
| Redfish / iDRAC | Server temperatures, fans, power, system info |
| Swisscom Internet-Box | WAN status, connected devices, device info |
| Cloudflare | Zones, DNS records, analytics, security events |
| Nginx Proxy Manager | Proxy hosts, certificates and their expiry, redirections, streams |
Editions
| Community | Enterprise |
|---|
| License | AGPL-3.0-only | AGPL core + Nodeglow Enterprise License (draft) for ee/ |
| Image | nodeglow-backend-community (or NODEGLOW_DISABLE_EE=1) | nodeglow-backend (default) |
| Everything listed above except the AI features | ✓ | ✓ |
| High availability (scheduler leader election across backends) | — | ✓ |
| Glow AI assistant, AI postmortems, AI daily summary | — | ✓ |
The default image contains ee/, but the enterprise features stay inactive
until an offline-verified license key is installed (Settings → License, or
NODEGLOW_LICENSE). Without a key it behaves exactly like the community
edition. Planned enterprise features include multi-tenancy for MSPs
(design, in progress), SSO
and SCIM, custom roles, on-call escalation and per-customer SLA reports.
Details: LICENSING.md, ee/README.md.
Quick start
Install a release (recommended)
Signed multi-arch images from GHCR, no build on your host:
curl -fsSLO https://github.com/jubacCH/Nodeglow/releases/latest/download/install.sh
sudo sh install.sh # → /opt/nodeglow, prints the URL when ready
install.sh checks the prerequisites, generates .env with fresh secrets,
pulls and (with cosign installed) verifies the images, and starts the stack.
Air-gapped: sudo sh install.sh --offline nodeglow-X.Y.Z-offline-amd64.tar.gz.
Then open http://<host>:8000 and finish the setup wizard right away — it
creates the admin account.
Requirements: Linux x86_64 or arm64, Docker Engine 20.10+ with Compose v2,
2 vCPU / 4 GB RAM / 20 GB SSD. Everything else — editions, upgrades, backups,
signature verification — is in docs/INSTALL.md.
Run from source
For development, or if you want to build the images yourself:
git clone https://github.com/jubacCH/Nodeglow.git nodeglow
cd nodeglow
# Required: compose refuses to start without these two secrets.
cp .env.example .env
sed -i "s/^POSTGRES_PASSWORD=.*/POSTGRES_PASSWORD=$(openssl rand -hex 24)/" .env
sed -i "s/^UPDATE_SIDECAR_TOKEN=.*/UPDATE_SIDECAR_TOKEN=$(openssl rand -hex 32)/" .env
# Strongly recommended: the key that encrypts stored credentials.
# Back it up separately — no database backup contains it.
echo "SECRET_KEY=$(openssl rand -hex 32)" >> .env
APP_VERSION=$(head -n1 VERSION) docker compose up -d --build
Open http://localhost:8000. A checkout-based installation updates itself
from main (git mode of the updater); see
OPERATIONS.md → Updating. Frontend development
with hot reload: frontend/README.md.
Install an agent
Create an install token under Infrastructure → Agents & Probes; the page
shows the ready-made command (tokens expire, default 24 h):
# Linux
curl -fsSL 'http://YOUR_SERVER:8000/install/linux?token=<INSTALL_TOKEN>' | sudo bash
# Windows (PowerShell as Administrator)
irm 'http://YOUR_SERVER:8000/install/windows?token=<INSTALL_TOKEN>' | iex
The agent enrolls with its token, creates its host, reports every 30 s,
checks for updates every 5 minutes (SHA-256 plus an Ed25519 release signature
made in CI, see docs/OPERATIONS.md) and can be switched into probe mode from the UI.
Architecture
browser ──► frontend (Next.js 15, :8000) ──► backend (FastAPI, :8000 internal)
agents / probes ──────────────┘ │ API, scheduler, syslog receiver,
syslog senders ──► 514/udp, 1514/tcp ───────────────────┤ collectors, correlation, alerting
├──► PostgreSQL 16 (config, hosts, incidents, patterns)
├──► ClickHouse 24.8 (pings, metrics, syslog — TTL)
└──► updater sidecar (updates, scheduled dumps)
| Part | Directory | Stack |
|---|
| Backend | backend/ | Python 3.12, FastAPI, SQLAlchemy 2 (async), Alembic, APScheduler |
| Enterprise plugin | ee/backend/ | loaded by backend/ee_loader.py through backend/extensions.py |
| Frontend | frontend/ | Next.js 15, React 19, TypeScript, Tailwind, TanStack Query, ECharts; Node 22 |
| Agent | agent/ | Rust (Tokio, reqwest), Linux and Windows |
| Updater | sidecar/ | Python, Docker socket; git mode (build from checkout) or image mode (signed releases) |
| Releases | .github/workflows/release.yml, scripts/ | GHCR images, cosign, install.sh, offline bundle |
The backend is a single process that runs the API, the scheduler, the syslog
receiver and all collectors. Collectors write snapshots to PostgreSQL and time
series to ClickHouse; the correlation engine and alert rules turn them into
incidents; the UI reads everything through the REST API (/api/v1,
/api/v2) and a WebSocket. Design and API details: docs/README.md.
Documentation
| |
|---|
| docs/INSTALL.md | Installing and upgrading a release, editions, offline installs, verifying signatures |
| docs/OPERATIONS.md | Sizing, ports, hardening, updates, backups, the encryption key, license, AI, troubleshooting, configuration reference |
| docs/API.md | REST API: authentication, v1 and v2 endpoints |
| docs/README.md | Index of all documentation, current and historical |
| CHANGELOG.md | Changes per release |
Contributing
Bug reports, fixes, integrations and docs are welcome. Contributions need the
CLA (once) and a DCO sign-off on every commit — see
CONTRIBUTING.md. Security issues: please use GitHub's
private vulnerability reporting, not a public issue.
License
Everything outside ee/ is licensed under the
GNU AGPL-3.0-only. The ee/ directory is source-available under
the Nodeglow Enterprise License (draft): free for development
and testing, production use needs a license. Details and commercial
licensing: LICENSING.md. Third-party licenses:
THIRD_PARTY_NOTICES.md.
