Nexus

Nexus is a private operations dashboard for a small fleet of Linux servers. It lives on a workstation, binds to localhost, and is never published: the only thing the outside world can reach is a single push endpoint, described below. It replaced a plain list of links with one place that says what is running where, what has drifted, and what is waiting for a person.

A census that runs when you ask

The data comes from a probe — one standard-library Python file, read-only, every command behind a timeout — that is piped to each server over SSH and prints a single JSON document: load, memory and disk, OS and kernel, the versions of the components worth checking against advisories, running and failed systemd units, listening ports, database names, git checkouts and terminal sessions. A collector writes the results into one SQLite file. There is no schedule: the census runs when someone presses Census, and a page load only ever reads the database. A server that has not been heard from in a week turns grey rather than pretending to be current.

Push, not poll

Live state travels the other way. Long-running work sessions on each server fire small hooks as they start, get busy, go idle, stop to wait for a person, or end, and each hook posts that server's whole snapshot to the dashboard in the background with a five-second timeout. Because every push carries the full snapshot, a missed one heals on the next event. Each server has its own token, so one machine cannot overwrite another's state; bodies are size-capped; nothing about the content of a session is sent — only an event, a working directory, a project name and times. The endpoint is the one path exposed through a tunnel; the dashboard itself is not.

Five views over one file

• Home — what needs attention first: unreachable or stale machines, failed units, renewals coming up, sessions waiting on a person, and an activity feed.
• Map — each machine placed on a world map, its ring coloured by status.
• Nodes — one graph from machine to daemon to domain, repository to database, with links that join the same technology across machines.
• Tables — machines, domains, repositories, databases, services and ports, with filters, grouping, CSV export and a versions matrix for checking advisories.
• Projects — every repository as cards, a table, a file tree and a 3D force graph, plus a Velocity page of commit activity across all of them: this week against a four-week average, a 28-day trend, streaks, lines added and removed, and what has gone cold.

Images without asking anyone

The project cards carry three to eight images each, gathered by a media pass that takes them, best first, from Playwright screenshots of a project's public page (desktop and phone, and dark mode when the site really has one), the page's own social image and icon, and art in the repository. It is deliberately polite: at most two page loads and three small requests per site, a User-Agent that says who it is, once a fortnight at most, never a login and never a click. Images are stored once by content hash, converted to WebP with metadata stripped, and served through routes that check the file name against a pattern and refuse anything outside their folder.

Small on purpose

The server is Python's standard http.server; the probe, the collector and the commit-velocity fetcher are standard library too, and the front end is plain JavaScript with its libraries vendored — Leaflet, Cytoscape.js, Tabulator and a 3D force graph — so the page works with no build step and no network beyond map tiles. Gathering data costs nothing to run: SSH for the census, the GitHub CLI for commit history, and only when someone asks. Tests run against a scratch copy of the database with the network stubbed out.