Graphical Systemctl -Self Hosted Linux Service Viewer 🚀 reddit / selfhosted ---------------------------------------------------------------------- ishakg · 2023-10-15 20:27 Hello everyone, I'm excited to share with you a simple yet powerful app I've developed. This app seamlessly integrates with **systemctl** and provides a user-friendly interface through a web-based control panel. With this tool, you can easily manage and monitor all the services on your Linux system. As a self-hosted lover, I know the hurdle of constantly checkhing service status and restarting it so what makes it even more convenient is the recent addition of start and stop functionality. No more tedious SSH sessions just to check service statuses or perform basic operations! As someone who frequently works with Linux services, I understand the frustration of constantly connecting to servers for routine tasks. That's why I created this straightforward program. It's worth noting that this app is written in **Go (Golang)**, making it robust and reliable for use in production environments. However, I'd greatly appreciate it if any security experts in the community could provide their insights on the security aspect. I invite you all to take a look at the [GitHub repository](https://github.com/shakg/g-systemctl), give it a try, and provide any feedback or suggestions you may have. Your input would be highly valued. Thank you for taking the time to read this, and I look forward to your contributions and insights! 😊 ---------------------------------------------------------------------- DIBSSB · 2023-10-15 20:59 Need a docker container for this ---------------------------------------------------------------------- Nagashitw · 2023-10-15 21:12 Please. This is the first thing that I look for in any self-hosted software ---------------------------------------------------------------------- ishakg · 2023-10-15 21:13 Is docker necessary? I didn't felt the need for docker while developing this. If you can point why it is a need I can add it. Maybe I am missing something out. Thank you for your comment and feedback <3 ---------------------------------------------------------------------- Nagashitw · 2023-10-15 21:15 I think the UI could be a bit more polished, but that's fine for a first version. Thank you for your great work! ---------------------------------------------------------------------- lilolalu · 2023-10-15 21:18 And a css ---------------------------------------------------------------------- ishakg · 2023-10-15 21:18 Fair enough :) I'll add docker container and update here, thank you for your feedback! ---------------------------------------------------------------------- Professor_Shotgun · 2023-10-15 21:19 Please share why? I personally avoid anything Docker-related for a variety of reasons, mostly security focused reasons. ---------------------------------------------------------------------- ishakg · 2023-10-15 21:19 Yes, It is a vanilla html, js to just get the job done. Will make it more appealing in the near future :) Thank you for reviewing it! ---------------------------------------------------------------------- ishakg · 2023-10-15 21:24 I think a lot of self-hosted enthusiast uses docker and they are used to it, so it'll be easier them to run it with docker. If this is the case for majority of the community, it makes sense to add docker container to repository. But in technical terms, like I said, I didn't feel any need for docker container ---------------------------------------------------------------------- Professor_Shotgun · 2023-10-15 21:31 Yep. I feel like many self-hosting enthusiasts do not appreciate attack surface reduction... avoiding Docker and its layers of built-in unknowns coming from dubious registries is... healthy in my book 😜 For me security > convenience. ---------------------------------------------------------------------- aceton · 2023-10-15 21:34 I mean.. this is solved already pretty well, with couple of other additional features in [https://cockpit-project.org/](https://cockpit- project.org/) ---------------------------------------------------------------------- ishakg · 2023-10-15 21:37 You’ve got good points and personally I am avoiding to use docker too, if installation and building steps are not overwhelming. But users can always decide if they want to build it from source or using docker. As long as there is option for both, I think its okay :) ---------------------------------------------------------------------- DIBSSB · 2023-10-15 21:39 Yes plzz ---------------------------------------------------------------------- clintkev251 · 2023-10-15 21:41 >avoiding Docker and its layers of built-in unknowns coming from dubious registries is I'm not sure I follow your logic here... Basically every docker image maintainer publishes their dockerfiles, so you can read through and see exactly what comes in the container. ---------------------------------------------------------------------- ishakg · 2023-10-15 21:41 Oh, thank you for clarifying. I didn’t know this app and it look awesome. This could be overkill for my daily usage though. But for server admins etc. cockpit project seems fantastic ---------------------------------------------------------------------- DIBSSB · 2023-10-15 21:41 Yes absolutely as all selfhosters apps are run containerised either in a vm or docker depends on use case most of us have more than 20 containers running its very easy to manage ---------------------------------------------------------------------- Professor_Shotgun · 2023-10-15 21:42 Yes... and how many *actually* review the content before installing? ---------------------------------------------------------------------- clintkev251 · 2023-10-15 21:47 How many people review the content of the random binaries that they install? How is that any different? ---------------------------------------------------------------------- joecool42069 · 2023-10-15 21:48 Are you reviewing all the code from the open source projects you consume from? Or are you just running their binaries? ---------------------------------------------------------------------- aceton · 2023-10-15 21:48 Glad I've been helpful. It's plugin based, and without any plugin installed, it can be pretty bare bone (ie, no support for networking or storage) Also, it's available as a package in most linux distributions, feel free to check it out. ---------------------------------------------------------------------- Professor_Shotgun · 2023-10-15 21:49 Not different. There's just less to review when you don't use another hosting layer such as docker. ---------------------------------------------------------------------- Professor_Shotgun · 2023-10-15 21:53 As a baremetal Linux user, I basically only trust a small set of OS distributions and associated toolsets. I only inspect the code of project dependencies, if and when I need them, which I avoid like the plague. I write everything else myself, in Go due to its solid std lib. ---------------------------------------------------------------------- clintkev251 · 2023-10-15 21:53 I don't think there's really any more to review if that's something that you want to do. You take a look through the dockerfile which is you implicit documentation for exactly what's included in the image, which would generally just be the application itself as well as any dependencies. Much like if you installed something directly ---------------------------------------------------------------------- joecool42069 · 2023-10-15 21:56 So from the projects/products you do choose to trust... if the maintainers of the code supplied a docker file, you still wouldn't use docker? ---------------------------------------------------------------------- Professor_Shotgun · 2023-10-15 21:57 Right. Above and beyond configuration, for me, running less code of any kind reduce the potential for vulnerabities. So, I'd rather go baremetal. ---------------------------------------------------------------------- Professor_Shotgun · 2023-10-15 22:00 Correct. Less code, less potential for vulnerabities. ---------------------------------------------------------------------- [deleted] · 2023-10-15 22:05 [deleted] ---------------------------------------------------------------------- clintkev251 · 2023-10-15 22:18 Fair enough, but realistically this is not how most people operate their systems, so docker is a better choice for the isolation that it provides. Obviously bare metal should always be a choice where possible, but realistically for most people docker tends to be a better choice ---------------------------------------------------------------------- Professor_Shotgun · 2023-10-15 22:25 I agree with you and I am aware of my extreme views on computing hygiene, but it has served me well. ---------------------------------------------------------------------- Trolann · 2023-10-15 22:31 This is a prime example of a power user expecting everyone to act like them, and if you don't have the same attack surface, use cases and requirements as them, you're wrong and they're going to tell you about it pompously. Don't be this kind of person, everyone. ---------------------------------------------------------------------- Trolann · 2023-10-15 22:33 For me it's not necessary but makes trial usage much much easier. I'm fairly familiar with Docker so if I need to spin up my own Ubuntu VM and then install locally to demo, so be it. But many users won't or can't do it themselves and don't have the know how to run it otherwise. If your target is mid range sys admin and above, you're probably good as is. ---------------------------------------------------------------------- Nagashitw · 2023-10-15 22:59 Couldn't have said it better myself. ---------------------------------------------------------------------- Nagashitw · 2023-10-15 23:02 I have the OS just as a baseline, without actually installing any self hosted software in it and manage everything in kubernetes, so I was thinking about using this software in a kubernetes node, each node with its own UI to inspect how the systemd in the nodes are doing without going into each node, of course I need to mount the required directories but that is fine. Hope that sharing my usecase helps ---------------------------------------------------------------------- audero · 2023-10-15 23:25 Docker is just plain stupid to simply run a compiled binary. I don't understand why self-hosters insist on docker for things that don't need it. ---------------------------------------------------------------------- Professor_Shotgun · 2023-10-15 23:27 No, don't expect anyone to act like me. Neither do I think anyone's wrong here. Why do you feel the need to squash alternative viewpoints when there are valid reasons for different approaches? ---------------------------------------------------------------------- onejdc · 2023-10-15 23:53 Well, there are a lot of answers to that question lol. Any binary, I suppose, *could* be packaged up: * docker * lxc * bubblewrap * full VM * gVisor * unshare * flatpak * snap * etc As for Docker specifically, I think there is some validity in managing the _same_ binary across your systems. Especially if you've written custom docker script controls. There's also familiarity with the ecosystem, and perhaps the best use would be to spawn multiple instances of it across your hosts. I agree that there should be discernment around what gets a docker container vs what gets simply installed, but I think the discretion there falls to the user. If you really want, you can containerize your entire OS ... Qubes OS is brilliant but that's for a very specific audience. ---------------------------------------------------------------------- onejdc · 2023-10-15 23:58 I think dockerized applications can provide a *more* secure installation, if you follow the right steps. Running a rootless container that doesn't map to any critical files on the host can really help provide a lower attack surface. this is probably why you're being downvoted. The security risks from running docker containers are (up front, anyway), on the user setting things up -- **you** need to read the dockerfile. **you** need to configure the container correctly. **you** need to ensure you aren't running mounts with bad permissions etc. The idea that Docker is less secure than pretty much anything comes from people who accept defaults and follow a random guide they found on medium.com but don't know what they're doing. It isn't quite the same as completely vetting a single open-source binary/project, nor is it the same as completely hardening an operating system, but it is definitely somewhere in between and you need to be careful with what you do. ---------------------------------------------------------------------- zachfive87 · 2023-10-16 00:02 Apparently this sub doubles as the docker fanboy club. In another post, I merely mentioned I run things bare metal and avoid docker... got down voted into oblivion. I wasn't even bashing docker, just said I avoided it, and still got a lot of flack. ---------------------------------------------------------------------- NikStalwart · 2023-10-16 00:12 But why, though? If you need to run something in docker, you can write your own dockerfile. As a matter of fact, I almost never use the official docker page of anything, I just clone git, build from source and run my own Dockerfile, because most images are full of unnecessary bloat. If it is a simple binary, you can containerize it in 4 lines of Dockerfile. ---------------------------------------------------------------------- NikStalwart · 2023-10-16 00:18 > Please share why? Because people like an "it just works" button, and docker is the ultimate "it just works" button. Nothing like copy-pasting a single command from a dodgy blog and having something "run" and then feeling like a l33t dúd3 h4ck3r because you see ~~logs scroll by on your terminal~~ *what am I saying, most people use portainer and not a terminal*. > I personally avoid anything Docker-related for a variety of reasons, mostly security focused reasons. And those are good reasons, too. I don't avoid docker, but I prefer to write my own containers rather than using the ones other people make. I have had a loathing for PPAs from Ubuntu 14.04 days. > Edit: if you downvote, at least explain your POV? Ze Hivemind has spoken. Ze hivemind does not need to explain itself. ---------------------------------------------------------------------- Trolann · 2023-10-16 00:20 Your valid viewpoint wasn't about docker, it was how much smarter you see yourself than others. ---------------------------------------------------------------------- audero · 2023-10-16 00:26 Don't get me wrong, Docker gives you management tools like Portainer and lazydocker for easy troubleshooting. It's also great for easy deployment of complex services that have multiple moving parts. But I agree not everything requires it. I used to use Docker for Python microservices I had coded myself, but it was just overkill and added unnecessary complexity. ---------------------------------------------------------------------- NikStalwart · 2023-10-16 00:26 You are 90 per cent correct. However, you are assuming that the (average?) user is going to be reading the dockerfile and not reading "a random guide they found on medium.com". Sadly, that's not the case. A person who can *read* (and understand) a dockerfile, can probably write one as well — at least for simple services. The parent comment here is "This [the existence of a docker container] is the first thing that I look for in any self-hosted software". This suggests to me, and possibly to the person you are replying to, a certain lackadaisical attitude to security. After all, the first thing *I* look for in a self-hosted project is not the existence of a docker file, but the existence of a cryptominer. ---------------------------------------------------------------------- schroedingerskoala · 2023-10-16 00:27 Very nice! ---------------------------------------------------------------------- TerminalFoo · 2023-10-16 00:36 Like someone else said, this is a problem that has already been solved. However, that doesn't mean that you can't another solution. Good job! It could use more polish. You had something in mind that you wanted to solve and it's a good first pass. ---------------------------------------------------------------------- EndlessHiway · 2023-10-16 01:14 People are to lazy to learn how to install software. ---------------------------------------------------------------------- EndlessHiway · 2023-10-16 01:17 You should expect ever application developer to cater to your laziness, douche bag. ---------------------------------------------------------------------- EndlessHiway · 2023-10-16 01:18 Your comment was about how dumb and lazy you are. ---------------------------------------------------------------------- athornfam2 · 2023-10-16 01:37 Is cockpit better than ansible? Or is cockpit more for management and ansible for deployments? ---------------------------------------------------------------------- allanmeter · 2023-10-16 01:48 Big thank you, not sure why but this never came across my desk at work as we have multiple innovation hub projects. But regardless this looks to be wonderful! Thanks again wonderful reddit stranger! ---------------------------------------------------------------------- Trolann · 2023-10-16 01:53 > You should expect ever application developer to cater to your laziness, douche bag. Should I just fling mud like you? Go touch grass child ---------------------------------------------------------------------- clintkev251 · 2023-10-16 01:58 The latter, they don't really serve the same purpose. Ansible is for host provisioning mostly, Cockpit is more for observability and day- to-day management ---------------------------------------------------------------------- athornfam2 · 2023-10-16 02:08 Got it thanks. Trying to get a better grip on Linux management. I typically use templates in vCenter so I don’t see much advantage if it’s more so for deployment ansible wise ---------------------------------------------------------------------- [deleted] · 2023-10-16 02:08 [deleted] ---------------------------------------------------------------------- onejdc · 2023-10-16 02:17 created a PR to refactor out the css ---------------------------------------------------------------------- onejdc · 2023-10-16 02:19 yeah it can be a bit much. To be fair to you, though, Python has a particularly nasty habit of creating system dependency nightmares so good for you for even trying to manage your microservices :) ---------------------------------------------------------------------- onejdc · 2023-10-16 02:19 PR added. ---------------------------------------------------------------------- onejdc · 2023-10-16 03:12 added css. ---------------------------------------------------------------------- onejdc · 2023-10-16 03:25 ok a few security notes/suggestions: * Please make it very clear that by using this without any authentication, any user with access to this IP can not only list all services on a system, but can also control them. The key point here is "without any authentication." I'm talking about the Front-End here. * The APIs are not protected either and should be. * I don't like using HTTP `GET` methods to trigger actions via an API, if only because it isn't considered 'safe' ([RFC 7231](https://www.rfc-editor.org/rfc/rfc7231#section-4.2.1)). I would recommend using `PUT` or `POST` in this case. ---------------------------------------------------------------------- -rwsr-xr-x · 2023-10-16 04:55 > Need a docker container for this A Docker container... to visualize the status of the host's systemctl units? I can't tell if that was meant to be funny or if you were serious here. ---------------------------------------------------------------------- a7escalona · 2023-10-16 05:15 Woah didn’t know about “safe” methods. Thanks! ---------------------------------------------------------------------- Trolann · 2023-10-16 05:20 🤡 ---------------------------------------------------------------------- Enthane · 2023-10-16 05:41 Cockpit is quite manual clickery while you can also be very hands-on with Ansible, the intention to managing multiple hosts with Ansible is more in making sure all is as intended without jumping through the hoops yourself. Monitor with Prometheus/Grafana and act with Ansible if you have multiple resources to govern ---------------------------------------------------------------------- TBT_TBT · 2023-10-16 08:32 Some reasons for Docker: the application has only access to the host files / data it needs via mounts and is apart from that separated in its container. The application can be integrated into someone’s infrastructure stack, quickly set up on a new machine by running the stack (I use such a stack for my most important tools) without the need of some manual installation. It can be tried out easily without changing the host and removed without trace. It can be updated automatically via Watchtower. It’s security can be increased by enabling ACLs and a LE certificate can be used by putting it behind a reverse proxy without the need for the application creator to configure that. And that is especially true for an application exposing service configuration to everybody with access to the IP of the server. There is probably more, but those are the reasons important to me. ---------------------------------------------------------------------- kid_blaze · 2023-10-16 09:12 There’s also (imo superior) [Webmin](https://webmin.com) with almost too many features. ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-10-16 10:26 Tried cockpit several times, aside from base install, I've never managed to get any plugin working on it.. And yes, I do feel like a moron, but as they day, madness is trying the same thing over and over an expecting different results 😅 ---------------------------------------------------------------------- HumanSimulacra · 2023-10-16 11:11 `GET` and `POST` etc are part of what what is called REST and CRUD: ht tps://en.wikipedia.org/wiki/Create,_read,_update_and_delete#RESTful_AP Is By default an HTML `` tag sends a `POST` request and in Go you can get each form field using `data := request.FormValue("data")` This data is encoded in the `request.Body` which you can also just use to send json data instead of form data if you wish or anything else. I personally only use `POST` and `GET` requests in my web apps I don't often bother with PUT/PATCH/DELETE requests. Also instead of default go routing I can recommend using a dedicated router like [httprouter](https://github.com/julienschmidt/httprouter) which is way more elegant to use. ---------------------------------------------------------------------- EndlessHiway · 2023-10-16 12:09 Dumb ass. ---------------------------------------------------------------------- Trolann · 2023-10-16 13:39 You dropped this: 🔴 ---------------------------------------------------------------------- thisiszeev · 2023-10-16 14:53 I could never get it to install any plugins. Eventually gave up. ---------------------------------------------------------------------- thisiszeev · 2023-10-16 14:55 YASAT (Yet Another Server Admin Tool) I for one will try it out as it sounds useful for something else I am working on. ---------------------------------------------------------------------- phein4242 · 2023-10-16 19:36 Dno, I usually rollout my services with Restart=onfailure, RestartSec=5 combined with functional monitoring :) ---------------------------------------------------------------------- audero · 2023-10-17 07:16 I wish it supported Docker (as well as podman) ---------------------------------------------------------------------- iavael · 2023-10-17 09:54 I don't want to be bearer of bad news, but your service is vulnerable to shell injection by providing "svcname.service; rm -rf /" to your /service api handler I have several advices for you: * don't create network services that run as root if you are not experienced (and better not to do this even if you are experienced system developer) * don't rely on shell to run commands from code, if it's not necessary. Compose command arguments as array/slice and use exec directly (and don't concatenate strings to split them later like you do in listing handler, concatenate slices). * validate user input * better use api instead of shell commands. Systemd has dbus interface that you can call. ---------------------------------------------------------------------- iavael · 2023-10-17 17:24 It’s not like GET is intrinsically unsafe. It just has some properties that can make it unsafe: * it may be cached by user agent so it won’t repeat request when you expect it to do this * on the other hand, GET requestes are ofter considered idempotent and safely to be repeated; if you don’t want specific request to be executed more than once, then it’s better not use GET method * query parameters are not the best place to pass sensitive data because they are often logged on intermediate proxies or user agents; at the same time GET method doesn’t allow body in request, so it’s not a good option to handle sensitive data this way. ---------------------------------------------------------------------- audero · 2023-10-19 09:41 You might be interested to know that I run my microservices with supervisor, and then use an instance of the [multivisor](https://github.com/tiagocoutinho/multivisor) web UI to manage them across multiple devices. It's a huge time-saver, I can click to stop/restart, view stdout and stderr logs, etc. It's less hassle than systemd which I was using before (which coincidently is what OP's project is trying to fix).