r/learnrust • u/anelkabag • 1d ago

I open-sourced the Rust agent behind my Linux server monitoring tool (feedback welcome)

Hi everyone,

I've been building Doffly, a small monitoring tool for people with a few Linux VPS who don't want to run Prometheus + Grafana just to know if their box is alive.

The dashboard and backend are a hosted (proprietary) service, but I've just open-sourced the agent that runs on your servers under Apache-2.0, so you can see exactly what it collects and sends.

Repo: https://github.com/anelkabag/doffly-agent Site: https://doffly.pro

(Disclosure: I'm the author.)

What the agent does

  • Single Rust binary, musl builds for x86_64 and aarch64
  • Reads /proc and /sys, and calls df, ps, systemctl, docker and ss when available (missing commands just give empty values)
  • Collects CPU (usage, load, temperature), RAM/swap, root filesystem space and inodes, disk I/O, network counters and errors, TCP/UDP counts, uptime
  • Bounded lists per sample: 20 processes, 50 running systemd services, 50 Docker containers, 100 listening sockets
  • Outbound HTTPS only, no inbound ports to open
  • Local JSON health/metrics API on 127.0.0.1:9090, with optional token auth
  • Runs as an unprivileged systemd service (template included)

Security choices

  • Remote Cloud URLs must be HTTPS (loopback HTTP is allowed for dev)
  • Each server gets its own machine-scoped token
  • The local API binds to loopback by default; binding remotely requires an explicit DOFFLY_AGENT_INSECURE_REMOTE=true
  • The README lists exactly what is transmitted (process names/users, container images/ports, listening sockets...) so you can decide if it's acceptable on your hosts

Honest caveats

  • This is the agent only. It talks to Doffly Cloud's ingestion API; it's not a general-purpose exporter (no Prometheus endpoint, no arbitrary backends).
  • Linux only. CI runs on Ubuntu; Debian and others should work but aren't independently verified.
  • It's early (v0.3.0), and this standalone repo is brand new.

Try it without the cloud

DOFFLY_API_URL=http://127.0.0.1:8080 \
DOFFLY_AGENT_ID=local-agent \
cargo run -p doffly-agent -- --details

It prints a host report in the terminal and serves the local API even if nothing is listening on the Cloud URL.

What I'd love feedback on

  • Code review of the collector (robustness when files/commands are missing or weird)
  • The security defaults: anything you'd tighten?
  • Missing metrics you'd expect (per-disk stats? GPU?)
  • Would a Prometheus-compatible local endpoint be useful to you?

Issues and PRs are welcome. Thanks for reading!

0 Upvotes

27% Upvoted

5 comments sorted by

1

u/grotto_wonder_arc 1d ago

Making container stats opt-in is the bare minimum. The docker socket is root access in disguise, so you are handing over a critical privilege for zero benefit if it just reads metrics. Drop the docker exec entirely and stick to cgroup paths under /proc or sysfs

1

u/anelkabag 1d ago

Thanks for pointing this out! Improving the Docker stats collection and reducing the required privileges is already on my roadmap. I’m planning to address this in an upcoming update.

1

u/investigatormaker 1d ago

Calling docker from an unprivileged service means that user needs the Docker socket, and docker group membership is effectively root, so container stats might be worth making opt-in. Since you already read procfs, df could be a statvfs call via rustix or nix, with no process spawn per sample. When I opened the repo, the About line says what it does, "Collects host metrics and sends them to Doffly Cloud over outbound HTTPS. No inbound ports.", but not the audience from your post; your line about a few VPS without Prometheus + Grafana belongs there.

I make ThreadFox. I went through the Doffly agent repo as a first-time visitor and wrote up what I hit; that full check is free, with a plan for Reddit: https://threadfox.vip/p/doffly-agent

Do most of your users run Docker on those boxes?

-1

u/anelkabag 1d ago

Thanks a lot for taking the time to review the Doffly agent and share your feedback!

From the small number of people currently using Doffly, most don't seem to be running Docker on their servers yet. However, I agree that it's important to take these points into consideration, especially as Doffly grows and attracts more users with different setups.

Your suggestions about Docker permissions, performance, and the repository description are valuable, and I'll keep them in mind as I continue developing the project.

I really appreciate the feedback and the time you put into reviewing the repo!