CI cannot write to your server
The deploy artefact is a config image. One tag crosses the SSH connection and root on your box pulls it. A stolen CI token can deploy a tag and set a secret — it cannot read one back, run a container, or get a shell.
Your server. Your keys.
Devops for your health.
CI builds an image and sends one string over SSH. Root on your box pulls it, writes the compose file and brings the stack up. komizo holds no SSH key for any machine you own, and is never in the deploy path.
go install github.com/nicodes/komizo@latest MIT · Alpine hosts · one static binary
os alpine proxy ● running network ● edge bridge komizo 94d5dbd1333d docker Docker version 26.1.3 processor 18% 4 cores memory 49% 1.9G of 3.9G disk 84% 32G of 39G ▍ ● blog a1b2c3d4e5f6 ▆▇▇▇█▆▇▇██▇▇▇█▆▇ ▃▇█ ghcr.io/you/blog-config ● ├ gateway :80 ▆█▇▇█▇▇█▇▇█▇▇█▇▇ blog.example.com ● ├ api :8080 ▆▆▇▇█▆▆▇██▇▇▇█▆▆ ▃▇█ api.blog.example.com ● └ db :5432 ················ ················ pb.blog.example.com ● shop 9f04354ac1de ▃▃▄▄▃▃▄▅▄▄▃▃▄▄▅▄ ghcr.io/you/shop-config
enter monitors stopl logsq quit
Apps cannot reach each other
One Caddy terminates TLS and hands each hostname to the app that claimed it. Every
app fronts itself with its own gateway, so nothing shared holds an app's config —
and two apps can both have a container called api.
Nothing on the screen is invented
Requests come off the proxy's own access log; processor, memory and disk off
/proc and the cgroups. Every value is a measurement or a gap — a
container nobody sampled reads as unknown, never as zero.
Press enter
Then find out what it did.
Requests and failures come off the shared proxy's access log, attributed to the app
by hostname — nothing is asked of the app. Processor, memory and disk come off
/proc and the cgroups, written down once a minute so there is a
yesterday to look at.
The line laid over each chart is how unusual that minute was, against a trailing median of the half hour before it. Green within one deviation, amber to two, red past it — and nothing at all where there is no baseline yet, because "we cannot say" and "exactly normal" must not share a shape.
showing -4h Requests req/min Failures (5xx) 5xx/min 109│ ⣿⡽⢫⣷ 11│ ⢸⣟⣇⡇ │ ⡇ ⡜⣿ │ ⣿⣿⣿⡇ 91│ ⡇⢠⠃⣿ 9│ ⣿⣿⣿⣷ │ ⡇⡜ ⣿ │ ⡇⡇⡿⣿ 73│ ⢀ ⣧⠃ ⣿ ⢀ 7│ ⡇⡳⠃⣿ │⣀⣀⣀⣀⣀⣀⣷⣀⣀⣰⣄⣀⣀⣀⣀⣰⣺⣀⣀⣰⣄⣀⣀⣆⣀⣀⣶⣀⣀⣟⣀⣀⣿⣀⣀⣀⣀⣀⣀⣾⣀⣀⣰⣆⣀⣀⣆ │⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣷⣁⣀⣻⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀ 54│ ⠈⠏ ⠿ ⠹⠁ ⠈⠁ ⠟ ⠉ ⠸⠃ ⡇ ⢸⡄ ⢸ ⠈⠁ ⠟ ⠱ 6│ ⡇ ⢸ ⡴⠁ │ ⢀ ⢀ ⡀ ⡀ ⡇ ⢸⢣ ⣸⡀ ⢀⣠ ⢀⣠ ⢀⣀⡄ │ ⡇ ⢸⣀⣀⡠⠎ 36│⢀⡤⠔⢇⣠⠴⢺⣠⠴⠚⣤⠤⠚⣇⠤⠞⢹⠤⠖⠙⡤⠔⠋⡧⠖⠋⠱⠴⠊⠁ ⢸⠾⡞⢹⠧⠖⠉⠸⠚⠁⠈⠖⠋ ⢧ 4│ ⡇ ⢸ │⠁ ⠈ ⠈⠁ ⢸ ⢣⢸ ⢸ │ ⡇ ⢸ 18│ ⢸ ⠘⣼ ⢸ 2│ ⡇ ⢸ │ ⢸⣀⣀⣻ ⢸ │⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⡇ ⢸⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀ 0└─────────────────────────────────────────────── 0└─────────────────────────────────────────────── 19:40 20:20 21:01 21:42 22:23 23:04 19:40 20:20 21:01 21:42 22:23 23:04 Processor % of the machine Memory MB Storage MB in the volumes it mou… │ ⡏⠉⢹ │ ⡏⠉⢹ │ ⢀⣀⣀⣀⠤⠤⠤⠔⠒⠒⠒⠉ 24│ ⡇ ⢸ 382│ ⢠⠃ ⢸ 778│ ⣀⣀⣀⡠⠤⠤⠤⠒⠒⠒⠊⠉⠉⠉⠁ │ ⡇ ⢸ │⣀⣀⣀⣀⣠⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠼ ⠸⠤⠤⠤⠤⠤⠤⠤⠤ │⠉⠉⠉ 18│ ⢀⠇ ⢸ 287│ 584│ │⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⢺⠒⠒⢺⠒⠒⠒⠒⠒⠒⠒⠒ │⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒ │ 12│ ⢸ ⢸ 191│ 389│ │ ⢸ ⢸ │ │ 6│⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠒⠚ ⠘⠒⠒⠒⠒⠒⠒⠒⠒ 96│ 195│ │ │ │ 0└───────────────────────────── 0└───────────────────────────── 0└───────────────────────────── 19:40 20:46 21:52 22:58 19:40 20:46 21:52 22:58 19:40 20:46 21:52 22:58 Volumes disk 875M in the volumes it mounts blog_data 875M
t ranger refreshesc backq quit
Merge.
It's live.
GITHUB ACTIONSYOUR REGISTRYYOUR SERVER