Vandox

Overview

Vandox monitors a Linux server and keeps what a later root-cause analysis needs. It consists of two programs: a small agent written in Go for the monitored server and a backend written in .NET 10 with a Blazor web UI. Both implement the same data model and wire format.

The first release, v0.1.0, is a forensics release: the backend imports the existing logs of a Plesk server and reconstructs past outages from them, above all memory exhaustion that ends with the OOM killer terminating MariaDB. It runs as one Docker container on any Docker host in the home network, such as a NAS or a mini PC. A step-by-step guide with Synology and QNAP as worked examples is in the repository.

The agent that continuously ships data from the server to the backend is planned for v0.2.0. The runtime frame, several collectors and the sender are already in the repository, and the backend already accepts its batches.

Each program is configured by exactly one strict YAML file. An unknown key, a duplicate entry or an invalid value is an error at start-up, and the message names the file, the line and the key, never the value. Secrets such as the agent token and the password hash come only from the environment or from Docker secrets, never from the file.

Features

Backend vandoxd as a Docker image with web UI and ingest API, runs non-root with a read-only file system

Log import from directories, tar and gzip archives and single files, repeatable and resumable

Understands journal export, rsyslog, MariaDB, Dovecot, Plesk, nginx, Apache and the legacy top/lsof monitoring log

Reconstructs past outages, above all memory exhaustion that ends with the OOM kill of MariaDB

Forensics report as Markdown through vandoxd report

Agent written in Go for the monitored server (planned for v0.2.0)

Strict YAML configuration, secrets only from the environment or Docker secrets

Web UI sign-in with an argon2id password hash

Releases

v0.1.0 · 17/10/2026

[Repo] Go module and monorepo layout
[Docs] Adopt the Squad-Spec-Repository-Template squad and agent rules
Bump SonarSource/sonarqube-scan-action from 8.2.2 to 8.3.0 in the actions group
[Docs] Architecture document and decision records
[Docs] Update the squad from Squad-Spec-Repository-Template
Generalize backend host references from Synology NAS
[Security] Document security areas, guarantees and test doubles
[Tests] Add unit tests for the scaffold and make the entry points testable
[Docs] Update the squad from Squad-Spec-Repository-Template
[CI] Add format check step and Dependabot docker entry
[CI] Add release pipeline for agent binary and Docker image
[Docs] Update the squad from Squad-Spec-Repository-Template

GitHub ↗

All releases on GitHub ↗