Open-sourced the monitoring agent we run on Coolify boxes (Apache-2.0, no dependencies)

[vortexpcsltd-afk]

Mods: if this is the wrong category — or unwelcome entirely — please move or close it, no hard feelings.

Disclosure first: this is the client half of Onserva, a paid monitoring service I run (first server free). I'm posting because the agent is now Apache-2.0 and I think it's the part worth reading, not because I want to advertise in your issue tracker.

https://github.com/Onserva/onserva-agent

Why it might interest people here

If you're going to let something run on your Coolify box, you should be able to read it first. It's ~6,000 lines of Go with zero third-party dependencies — everything is standard library, so go mod verify has nothing to verify and there's no supply chain to compromise. It reads /proc directly rather than pulling in a metrics library.

What it deliberately does not do:

• Opens no port. Every connection is outbound, so installing it creates no new way into the machine.
• Needs no privileges. Runs as its own unprivileged user with no shell, no home directory and no capabilities, reading files that are world-readable anyway.
• Holds no database credentials, and can't. The Postgres/MySQL/Redis clients are hand-rolled minimal implementations that are literally incapable of sending a password — peer auth over the local socket or nothing. An engine that demands a password gets reported unreachable rather than worked around.
• Sends nothing about your visitors. It parses the reverse proxy access log on the machine and ships counts plus a fixed histogram. Paths, IPs, user agents and referrers are parsed past and discarded.
• Touches no Docker socket. Per-container memory and CPU come from /proc.

The Coolify-specific bit

Traefik doesn't write an access log by default, and under Coolify it logs to stdout — which Docker captures to a root-only file. The agent doesn't run as root, so rather than loosening permissions the installer adds its own user to that file's group: it reads that one file, and nothing about the proxy setup changes. If the log is root-only it says so and prints the two commands to fix it.

It follows the file across logrotate, re-reads from zero when it's replaced, holds back half-written lines, and starts at the end of an existing log rather than parsing a gigabyte of history on boot.

On Sentinel

Keep it on — it's good, and this isn't a replacement pitch. The difference that motivated the whole thing: Coolify's monitoring runs on the machine it's reporting on, so a box in real trouble struggles to raise its own alarm. Onserva's platform runs elsewhere, which means silence from a server is itself something it can tell you about.

Happy to answer anything about the design, including the parts I'd do differently. The README covers what it can't see and why, which is the more interesting half.