InfraGuard manual — InfraGuard

Getting Started

Getting started with InfraGuardWhat InfraGuard is, the problems it solves, and how to use this manual — in five minutes.
Searching this manualFind answers instantly with autocomplete search and the ⌘K command palette.
Sign-in & AuthenticationHow console session login works, how the session re-syncs each request, and how the external ingest API authenticates.
Access levels (demo · staff · admin)InfraGuard's single access-control model: compare the user_level integer against each screen's min_req.
Roles, Teams & OwnersRoles and teams are informational labels only — level is the sole access gate — plus the combined user/team Owner picker.
Navigation · Role-First MenuInfraGuard's role-first, DB-driven menu (infr_sitemap + min_req) — the 8 role areas and how the role boundary equals the permission boundary.
Light / Dark ThemeSwitch the console between light and dark — a single data-theme attribute on the root, persisted in localStorage (infr-theme), a header toggle, and all colors as --infr-* CSS variable tokens.
Switching Language · LocalizationHow to change the InfraGuard console display language — 8 locales, the admin-chosen enabled subset, and the session→cookie→profile→site-default resolution rule.
Live updates (Reverb + polling)The two ways screens refresh themselves — instant Reverb WebSocket pushes and lightweight 30-second polling with a cheap rev change-token — and why the console never breaks when WebSockets are off.
Reading the Overview landingThe converged home console that reads availability and security composite scores, KPI cards, a detections donut and full-width live server strips on one screen.
My ProfileView your own account details and change your password yourself — a self-service page.
Public landing, demo requests & analytics tagsThe surfaces that open without login (landing, demo form, user manual), the GA4/GTM tags that measure their visitors, and the admin screen that works the resulting demo requests.

DBA

Service ▸ DatabaseDirectly connects to registered databases and uses SHOW GLOBAL STATUS + information_schema to monitor live load (concurrency, throughput) and schema structure.
DB tuning concepts — locks, cache, index, checkpoint, memorySummarizes the DB performance concepts the educational hover popovers on the Service ▸ Database screen teach (7 row-lock-wait causes, buffer-pool cache hit, index usage, checkpoint/redo pressure, dirty-page flush).
Sessions (Redis)Monitor per-node Redis session/cache health (capacity, throughput, hit rate, memory management, keyspace) read from a collector-fed read-model — no direct Redis connection.
Redis Tuning Concepts (Session education)How to read the Redis metrics on Service ▸ Sessions — the 7 slowlog causes, hit ratio, memory-fragmentation health band, and expiry vs eviction.
Registering a Database CollectorRegister an access=database collector as per-host db@alias rows to drive Service ▸ Database and Alerts, storing the password with Crypt or reusing it via cred_ref=env:PREFIX.

DevOps

Infrastructure Health BoardLive availability board showing per-node load, CPU, memory, disk plus nginx/php/mysql/mongo service status on one screen.
Servers (Load Time Series)Per-server load, CPU and memory as ring gauges plus time-series charts on the Infrastructure ▸ Servers screen.
Storage & RAIDRead-only live dashboard for RAID controller health (Optimal/Degraded/Failed), a physical disk map, and per-host data-volume disk usage.
Port Connections (PORT OVERVIEW)Flagship port monitoring screen showing per-port cards with per-server TCP-state distribution, top source IPs, and source counts, live.
IP ConnectionsHost view of remote peer IPs per server as port-strength dots, with an IP investigation popup covering connection breakdown, rollup history, geo/ASN, reputation, and a block deeplink.
Traffic (Network I/O)Surfaces per-server inbound/outbound byte and packet throughput from server_traffic as ECharts line charts — data the legacy console collected but never showed.
AlertsBuild alert-group policies bundling system, web, DB, and security conditions; on breach they notify recipients by SMS and email automatically.
Service Overview — Curated Live BoardA curated live service board where operators pick services (web, database, session, proxy, Docker) into priority cards and watch them via an availability gauge and live time-series.
Web services (nginx-vts)Live per-website nginx-vts monitoring + website management, with 24h uptime from an active synthetic prober and TLS cert expiry.
Visitor & search insightsRead GA4 visitor analytics and Search Console search traffic straight from a website card, using a service account stored per site alongside its property mapping.
Service catalogA 2-tab console that derives daemon services from the version ledger, checks liveness and maps dependencies.
Projects (Service ▸ Projects)A shared project-metadata registry — register source (GitHub), CI/CD (Jenkins), web/db links, backup targets, and secret references (it is not a deployer).
Problem Resolution (Incident Cases)An incident case workflow that tracks outages and errors through register -> investigating -> cause_identified -> resolved -> closed, recording direct/root cause, fix, and preventive action.
Backup schedule boardSee each backup job's schedule, storage location and next run in one place, with KPIs and history.
Backup scriptsThe registry of generated backup scripts and their crontab lines — build one, finish coding, then switch it on.
Backup script builderPrefill a skeleton from the target, finish the script yourself, then switch it on to run on schedule.
Backup vaultsManage backup storage targets — stored size, capacity and offsite (3-2-1) per vault.
Recovery & validationRestore from recovery points and verify integrity — the resilience half of backup.
Backup report integrationA placed backup script POSTs its run result to the report callback, recording it to infr_backup_run.
Inventory ("pocket")A place to keep quick-response resources — Tools, Snippets, guide Docs and team Vault Keys — that SE/security/ops staff reach for during incidents.
Instances — SSH OS-instance CMDBThe CMDB of SSH-accessible OS instances (infr_instance); alias is the canonical join key to live metrics.
Interactive SSH PTY terminalA real browser shell (top/vi/sudo work): xterm.js ⇄ WebSocket ⇄ a Node ssh2 bridge ⇄ the remote sshd.
Software version ledgerA per-instance ledger of installed software versions (infr_software_catalog + infr_instance_software), by manual entry or JSON import.
Per-instance env variablesPer-instance environment variables (Crypt-encrypted) that feed the {{PLACEHOLDER}} mashups of Inventory Tools.
Server parameter snapshotA read-only snapshot of an instance's web/DB/kernel/application/misc settings, used as the grounding for AI tuning queries.
Firewall-rule registry (instance)Collect and catalog per-instance firewall rules (iptables/firewalld/ufw) via a probe, feeding the Security ▸ Firewall attack-surface map.
Remote emulate · probe deploymentDeploy and run probes on remote hosts over the tlx.php HTTP relay (no SSH) and apply results to assets — signature-gated.
Hardware assets (CMDB)A CMDB for server, network and office physical hardware — components, port mapping, topology and rack placement.
Storage & FilesManage the storage-device asset registry and a semantic file-area tree in two tabs — an asset view, not live status.
CollectorsA collector registry abstracted by access method (web·database·agent) — externalizes hardcoded constants and drives Health & Database.
Operations PolicyGlobal decisions stored in infr_setting(group=ops) and read via OpsPolicy — collect mode, thresholds, currency, monitored ports, internal networks, auto-block switch.
API KeysIssue API keys so external apps and hosts can auto-post errors (incidents) and security-scan results, with copy-paste integration code.
Rules & ThresholdsStore the srct_tx/kts_tx detection-collector constants in infr_setting(group=rules), read via RulesPolicy, and inject them into Tools code generation.
Reputation APIRegister multiple AbuseIPDB API keys and consume them round-robin — free-quota pooling plus failover to the next key.
AI AdaptersRegister multiple LLM providers and pick by priority — used by AI doc drafting in Inventory.
Mail AdaptersRegister multiple mail-sending providers — drives the email channel of alert dispatch.
SMS AdaptersRegister multiple SMS providers by home country — drives the SMS channel of alert dispatch.
LocalizationChoose the displayed-language subset from the 8-language catalog and order it to set the site-wide default.
Users & Roles / TeamsCRUD for users and teams in InfraGuard's own auth table (infr_user) plus level management (demo/staff/admin).
Audit logBrowse the immutable audit trail (infr_audit_log) of destructive/security actions with filters, facets and KPIs.
Development · ObservabilityA super_admin-only observability section — Doctor, Pulse/Horizon, Leader/Runtime, slow queries/requests/jobs, exceptions & cache.

Security

Security Overview (Defense Funnel)The security-operations centerpiece: one funnel threading threat to detection to auto-response ruleset to block, telling the story of automated defense.
Threats — IDS Threat TriageTriage Suricata IDS alerts as source-IP entities, with auto-block linkage badges and signature lore that explains what each detection really implies.
Detections + JA3 Sequence RulesetsThe flagship detection screen — narrates the detection engines (Kitsune, srct, nginx, JA3) and derives anomaly rulesets from JA3 sequences with a deterministic heuristic (infr_sec_ruleset).
Detection RulesetsA read-only catalog that normalizes every detection rule InfraGuard observes into 44 rulesets across 11 categories, showing live firing counts and, on click, the recent events each ruleset matched.
Firewall (Attack Surface)An exposure map that cross-references each host's firewall rules against registered services and colors every open port by risk.
Blocklist & ReputationNarrates the blacklist_info (/24 range blocks) that AI/IDS auto-defense fills, and lets operators block, release, and re-block ranges directly.
Whitelist (Block Exemption)Manage IPs/CIDRs to exempt from automatic blocking, with an expiry model (permanent/temporary), consumed by srct_tx just before it blocks.
Security DiagnosticsRun rootkit and hardening scans across many servers at once, score each host A–F, and auto-promote critical failures to Problem Resolution cases.
Security Problem ResolutionA case board that runs security incidents and breaches through an open→investigating→cause→resolved→closed workflow, and auto-tracks critical findings promoted from Security Diagnostics.
IP Reputation Lookup (AbuseIPDB)Click any suspicious IP to look up AbuseIPDB threat intel in an in-app popup — confidence gauge, reports, categories, Tor/whitelist, with a 1-hour cache that protects your free quota.
Auto-block PipelineThe background defense flow where collectors and the scheduler auto-list attacker IPs meeting configurable triggers and enforce them via kernel ipset.