KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agents #developer-tools #codex #claude-code #mcp #rust #deepseek-harness #typescript #ai-agent #cli

maintenant

★ 447 Open GitHub ↗

Drop a container. Your stack is monitored.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<h1 align="center">maintenant</h1>

Monitor everything. Manage nothing. 
 Drop a single container. Your entire stack is monitored in seconds.

<a href="https://docs.maintenant.dev/">Documentation</a>&nbsp;&nbsp;&bull;&nbsp;&nbsp;<a href="#quick-start">Quick Start</a>&nbsp;&nbsp;&bull;&nbsp;&nbsp;<a href="#features">Features</a>&nbsp;&nbsp;&bull;&nbsp;&nbsp;<a href="https://maintenant.dev/pricing/">Pricing</a>&nbsp;&nbsp;&bull;&nbsp;&nbsp;<a href="#configuration">Configuration</a>&nbsp;&nbsp;&bull;&nbsp;&nbsp;<a href="#api">API</a>

---

<table align="center" width="100%">
 <tr>
 <td align="center" width="100%">
 <h3>Keep maintenant alive: <a href="https://maintenant.dev/pricing/">Personal, €149 once</a> · <a href="https://maintenant.dev/pricing/">Pro, €29/mo</a></h3>
 Built in the open by one developer in Bordeaux, France. No VC, no tracking, no dark patterns. Running your own infrastructure? Personal lifts every cap for a single payment, for life. Running it for others? Pro adds team channels, escalation and the right to do so. 
 <a href="https://maintenant.dev/pricing/">Buy Personal →</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="https://maintenant.dev/pricing/">Start Pro trial →</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="https://github.com/sponsors/kolapsis">Sponsor on GitHub</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="https://github.com/kolapsis/maintenant">Star the repo</a>
 </td>
 </tr>
</table>

---

## Why maintenant?

Most self-hosters juggle 3-5 tools to monitor their stack: one for containers, one for uptime, one for certs, one for metrics, and yet another for a status page. maintenant replaces all of them.

|                              | maintenant | Uptime Kuma | Portainer  | Dozzle     |
| ---------------------------- |:----------:|:-----------:|:----------:|:----------:|
| Container auto-discovery     | **Yes**    | No          | Yes        | Yes        |
| HTTP/TCP endpoint checks     | **Yes**    | Yes         | No         | No         |
| Cron/heartbeat monitoring    | **Yes**    | Yes         | No         | No         |
| SSL certificate tracking     | **Yes**    | Yes         | No         | No         |
| CPU/memory/network metrics   | **Yes**    | No          | Limited    | No         |
| Image update detection       | **Yes**    | No          | Yes        | No         |
| Network security insights    | **Yes**    | No          | No         | No         |
| Public status page           | **Yes**    | Yes         | No         | No         |
| Alerting (webhook, Discord)  | **Yes**    | Yes         | Limited    | No         |
| Kubernetes native            | **Yes**    | No          | Yes        | No         |
| Single binary, zero deps     | **Yes**    | Node.js     | Docker API | Docker API |
| Container runtime optional   | **Yes**    | No          | No         | No         |

**One container. One dashboard. Everything monitored.**

---

## Screenshots

<table>
 <tr>
 <td colspan="2" align="center">
 <a href="./docs/screen-captures/1-dashboard.png"><img src="./docs/screen-captures/1-dashboard.png" alt="Dashboard" width="680" /></a>
 Dashboard — Uptime, response times, resources, unified monitors
 </td>
 </tr>
 <tr>
 <td align="center" width="50%">
 <a href="./docs/screen-captures/2-containers.png"><img src="./docs/screen-captures/2-containers.png" alt="Containers" width="340" /></a>
 Container auto-discovery
 </td>
 <td align="center" width="50%">
 <a href="./docs/screen-captures/3-endpoints.png"><img src="./docs/screen-captures/3-endpoints.png" alt="Endpoints" width="340" /></a>
 Endpoint monitoring
 </td>
 </tr>
 <tr>
 <td align="center">
 <a href="./docs/screen-captures/4-certificates.png"><img src="./docs/screen-captures/4-certificates.png" alt="Certificates" width="340" /></a>
 TLS certificate tracking
 </td>
 <td align="center">
 <a href="./docs/screen-captures/5-updates.png"><img src="./docs/screen-captures/5-updates.png" alt="Updates" width="340" /></a>
 Update intelligence
 </td>
 </tr>
 <tr>
 <td align="center">
 <a href="./docs/screen-captures/7-status-page-all-ok.png"><img src="./docs/screen-captures/7-status-page-all-ok.png" alt="Status Page — All OK" width="340" /></a>
 Status page — All operational
 </td>
 <td align="center">
 <a href="./docs/screen-captures/8-status-page-degraded.png"><img src="./docs/screen-captures/8-status-page-degraded.png" alt="Status Page — Degraded" width="340" /></a>
 Status page — Degraded state
 </td>
 </tr>
</table>

---

## Quick Start

### Docker (30 seconds)

```yaml
# docker-compose.yml
services:
  maintenant:
    image: ghcr.io/kolapsis/maintenant:latest
    ports:
      - "8080:8080"
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:noexec,nosuid,size=64m
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc:/host/proc:ro
      - maintenant-data:/data
    environment:
      MAINTENANT_ADDR: "0.0.0.0:8080"
      MAINTENANT_DB: "/data/maintenant.db"
    restart: unless-stopped

volumes:
  maintenant-data:
```

```bash
docker compose up -d
```

Open **http://localhost:8080** — your containers are already there. No configuration needed.

> **Docker socket access is automatic**
> The entrypoint reads the mounted socket's group and grants the unprivileged user access to it — no `group_add` needed, on plain Compose **and** Docker Swarm (where `docker stack deploy` silently ignores `group_add`). Set `DOCKER_GID` (e.g. `stat -c '%g' /var/run/docker.sock`) only to pin a specific GID for a non-standard socket path or socket proxy.
>
> If containers are not discovered (permission error on the socket), see [Troubleshooting](#troubleshooting).

### Kubernetes

```bash
kubectl apply -f deploy/kubernetes/
```

maintenant auto-detects the in-cluster API. Read-only RBAC, namespace filtering, workload-level monitoring out of the box.

> For detailed setup instructions, advanced configuration, and label reference, see the **[full documentation](https://kolapsis.github.io/maintenant/)**.

---

## Features

### Container Monitoring

Zero-config auto-discovery for Docker and Kubernetes. Every container is tracked the moment it starts — state changes, health checks, restart loops, log streaming with stdout/stderr demux. Compose projects are auto-grouped. Kubernetes workloads (Deployments, DaemonSets, StatefulSets) are first-class citizens.

### Multi-Host Monitoring

Monitor your entire fleet from a single pane of glass. One central **server** receives events from lightweight **agents** running on your remote hosts, over a persistent, mutually-authenticated gRPC stream — no shared database, no message queue.

```bash
# On each remote host — one command, generated for you in the UI
curl -fsSL https://install.maintenant.dev | sudo bash -s -- \
  --mode=agent \
  --server=grpcs://monitoring.example.com \
  --enrollment-token=mnt_enr_XXXXXXXXXXXXXXXX \
  --label="prod-worker-01"
```

- **Agents are read-only and tiny** — they detect the local runtime (Docker, Swarm, or Kubernetes), stream container state, endpoints, certificates and resource metrics, and reconnect on their own with backoff.
- **Per-host resource metrics** — each agent reports its machine's CPU, memory and disk. The dashboard's resource header gets a **host selector** to switch between machines; top consumers can be scoped to a single host.
- **Zero-PKI security** — agents enroll with a one-time token and an Ed25519 keypair generated locally; every stream is challenge-response authenticated. Revoke or delete an agent from the UI at any time.
- Every monitored entity is attributed to its origin host, so containers, alerts and metrics are never mixed across machines.

> **[Personal](https://maintenant.dev/pricing/)** feature, up to 20 remote machines, unlimited on **Pro**. Community Edition runs in single-host (`embedded`) mode. See the [Multi-Host guide](./docs/features/multihost.md) for server setup, enrollment and the streaming protocol.

### Endpoint Monitoring

Define HTTP or TCP checks directly as Docker labels — no config files, no UI clicks. maintenant picks them up automatically when a container starts. Response times, uptime history, 90-day sparklines, configurable failure/recovery thresholds.

```yaml
labels:
  maintenant.endpoint.http: "https://api:3000/health"
  maintenant.endpoint.interval: "15s"
  maintenant.endpoint.failure-threshold: "3"
```

### Heartbeat & Cron Monitoring

Create a monitor, get a unique URL, add one `curl` to your cron job. maintenant tracks start/finish times, durations, exit codes, and alerts you when a job misses its deadline.

```bash
# One-liner for any cron job
curl -fsS -o /dev/null https://now.example.com/ping/{uuid}/$?
```

> Community includes up to 5 heartbeats. **[Personal](https://maintenant.dev/pricing/)** lifts the cap for unlimited jobs.

### SSL/TLS Certificate Monitoring

Automatic detection from your HTTPS endpoints, plus standalone monitors for any domain. Alerts at 30, 14, 7, 3, and 1 day before expiry. Full chain validation.

### Resource Metrics

Real-time CPU, memory, network I/O, and disk I/O per container. Historical charts from 1 hour to 30 days (Personal). Per-container alert thresholds with debounce to avoid noise. Top consumers view for instant triage. In [multi-host](#multi-host-monitoring) deployments, host-level CPU/memory/disk is reported per machine and the resource header offers a host selector.

### Network Security Insights

Automatic detection of dangerous network configurations across your containers. Flags ports binding to `0.0.0.0`, exposed database ports, host-network mode, privileged containers, and Kubernetes-specific risks (NodePort, LoadBalancer without NetworkPolicy). Each container image is mapped to its software ecosystem via OCI manifest inspection for CVE-relevant context.

### Update Intelligence

Knows when your images have updates available. Scans OCI registries, compares digests. Compose-aware update and rollback commands with the correct `--project-directory` flag. Stop running `docker pull` blindly.

### Alert Engine

Unified alerts across all monitoring sources. Channels are silent by default and routed via **Alert Triggers** (filter by severity / source). Webhook and Discord channels included. Silence rules for planned maintenance, exponential backoff retry on delivery.

> **[Personal](https://maintenant.dev/pricing/)** adds the Email channel and scope/tag trigger filters. **[Pro](https://maintenant.dev/pricing/)** adds Slack and Microsoft Teams channels, multi-level **escalation policies**, per-entity routing, and maintenance windows that pause and resume escalation chains.

### Public Status Page

Give your users a clean, real-time status page. Live SSE updates, severity aggregation across all monitors.

> **[Personal](https://maintenant.dev/pricing/)** adds incident timelines. **[Pro](https://maintenant.dev/pricing/)** adds subscriber notifications (email + webhook) and status page branding, turning outages into trust-building moments.

### MCP Server

Built-in [Model Context Protocol](https://modelcontextprotocol.io/) server. Query your infrastructure, read logs, and check alert status from any MCP-compatible AI assistant. Supports both stdio and Streamable HTTP transports with full OAuth2 authentication for remote clients (Claude web, Claude mobile, Claude Desktop).

---

## Configuration

### Environment Variables

| Variable                            | Default                 | Description                                     |
| ----------------------------------- | ----------------------- | ----------------------------------------------- |
| `MAINTENANT_ADDR`                   | `127.0.0.1:8080`        | HTTP bind address                               |
| `MAINTENANT_DB`                     | `./maintenant.db`       | SQLite database path                            |
| `MAINTENANT_BASE_URL`               | `http://localhost:8080` | Base URL (used for heartbeat ping URLs and as the status page fallback) |
| `MAINTENANT_STATUS_URL`             | —                       | Canonical public URL of the status page (e.g. `https://status.example.com`). Optional — falls back to `{BASE_URL}/status`. |
| `MAINTENANT_ORGANISATION_NAME`      | `Maintenant`            | Organisation name on the status page            |
| `MAINTENANT_CORS_ORIGINS`           | same-origin             | CORS allowed origins (comma-separated)          |
| `MAINTENANT_RUNTIME`                | auto-detect             | Force `docker` or `kubernetes`                  |
| `MAINTENANT_MAX_BODY_SIZE`          | `1048576`               | Max request body size in bytes (1 MB)           |
| `MAINTENANT_UPDATE_INTERVAL`        | `24h`                   | Update intelligence scan interval               |
| `MAINTENANT_LICENSE_KEY`            | —                       | Personal or Pro license key                     |
| `MAINTENANT_MCP`                    | `false`                 | Enable MCP server (Streamable HTTP on `/mcp`)   |
| `MAINTENANT_MCP_CLIENT_ID`          | —                       | OAuth2 client ID for MCP authentication         |
| `MAINTENANT_MCP_CLIENT_SECRET`      | —                       | OAuth2 client secret for MCP authentication     |
| `MAINTENANT_MCP_ALLOWED_REDIRECT_URIS` | —                    | Comma-separated allowlist of OAuth2 `redirect_uri` values. Required when `MAINTENANT_MCP_CLIENT_*` are set. |
| `MAINTENANT_MCP_ALLOW_UNAUTHENTICATED` | `false`              | Serve `/mcp` unauthenticated. Without it, MCP without OAuth credentials refuses to start. |
| `MAINTENANT_K8S_NAMESPACES`         | all                     | Namespace allowlist (comma-separated)           |
| `MAINTENANT_K8S_EXCLUDE_NAMESPACES` | none                    | Namespace blocklist                             |
| `MAINTENANT_DISABLE_TELEMETRY`      | unset (telemetry on)    | Set to `1`/`true`/`yes` to disable telemetry    |

> Full configuration reference in the **[documentation](https://kolapsis.github.io/maintenant/)**.

### Docker Labels Reference

<details>
<summary>Container settings</summary>

```yaml
labels:
  maintenant.ignore: "true"                    # Exclude from monitoring
  maintenant.group: "backend"                  # Custom group name
  maintenant.alert.severity: "critical"        # critical | warning | info
  maintenant.alert.restart_threshold: "5"      # Restart loop threshold
  maintenant.alert.channels: "ops-webhook"     # Route to specific channels
```

</details>

<details>
<summary>Endpoint monitoring</summary>

```yaml
labels:
  # Simple — one endpoint per container
  maintenant.endpoint.http: "https://app:8443/health"
  maintenant.endpoint.tcp: "db:5432"

# Indexed — multiple endpoints per container
  maintenant.endpoint.0.http: "https://app:8443/health"
  maintenant.endpoint.1.tcp: "redis:6379"

# Tuning
  maintenant.endpoint.interval: "30s"
  maintenant.endpoint.timeout: "10s"
  maintenant.endpoint.http.method: "POST"
  maintenant.endpoint.http.expected-status: "200,201"
  maintenant.endpoint.http.tls-verify: "false"
  maintenant.endpoint.http.headers: '{"Authorization":"Bearer tok"}'
  maintenant.endpoint.failure-threshold: "3"
  maintenant.endpoint.recovery-threshold: "2"
```

</details>

<details>
<summary>TLS certificate monitoring</summary>

```yaml
labels:
  maintenant.tls.certificates: "example.com:443,api.example.com:443"
```

</details>

<details>
<summary>Full stack example</summary>

```yaml
services:
  maintenant:
    image: ghcr.io/kolapsis/maintenant:latest
    ports:
      - "8080:8080"
    read_only: true
    security_opt:
      - no-new-privileges:true
    group_add:
      - "${DOCKER_GID:-983}"
    tmpfs:
      - /tmp:noexec,nosuid,size=64m
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc:/host/proc:ro
      - maintenant-data:/data
    environment:
      MAINTENANT_ADDR: "0.0.0.0:8080"
      MAINTENANT_DB: "/data/maintenant.db"

api:
    image: myapp:latest
    labels:
      maintenant.group: "production"
      maintenant.endpoint.http: "http://api:3000/health"
      maintenant.endpoint.interval: "15s"
      maintenant.alert.severity: "critical"
      maintenant.alert.channels: "ops-webhook"

postgres:
    image: postgres:16
    labels:
      maintenant.endpoint.tcp: "postgres:5432"
      maintenant.alert.severity: "critical"

redis:
    image: redis:7-alpine
    labels:
      maintenant.endpoint.tcp: "redis:6379"

volumes:
  maintenant-data:
```

</details>

---

## Telemetry

maintenant sends an **anonymous, opt-out** usage snapshot once an hour to `https://metrics.kolapsis.com`. No hostnames, IPs, container names, endpoint URLs, certificates, webhook targets, status-page component names, license keys, or operator-supplied free-form strings of any kind are transmitted.

### What is collected

Each snapshot contains the following fields and **nothing else** (full wire format: [`specs/015-shm-telemetry/contracts/telemetry-payload.md`](./specs/015-shm-telemetry/contracts/telemetry-payload.md)):

**Application fields** (this product owns these):

- `edition` — `community`, `personal` or `pro`
- `containers_total` — count of auto-discovered containers
- `endpoints_total` — count of configured HTTP/TCP endpoints
- `heartbeats_total` — count of configured heartbeat monitors
- `certificates_total` — count of TLS certificate monitors
- `webhooks_total` — count of configured webhooks
- `status_components_total` — count of status-page components

**Runtime context** (collected automatically by the SHM SDK):

- `sys_os`, `sys_arch`, `sys_cpu_cores`, `sys_go_version`, `sys_mode` (`docker` / `kubernetes` / `standalone`)
- `app_mem_alloc_mb`, `app_goroutines`, `app_uptime_h`
- An installation identifier generated by the SDK on first run and reused thereafter

### How to disable it

Set `MAINTENANT_DISABLE_TELEMETRY` to a truthy value before the process starts:

```bash
# Docker
docker run -e MAINTENANT_DISABLE_TELEMETRY=1 ghcr.io/kolapsis/maintenant:latest

# Kubernetes
env:
  - name: MAINTENANT_DISABLE_TELEMETRY
    value: "1"

# systemd / shell
export MAINTENANT_DISABLE_TELEMETRY=1
./maintenant
```

Truthy values (case-insensitive, whitespace-trimmed): `1`, `t`, `true`, `y`, `yes`, `on`. Anything else, including empty or unset, leaves telemetry enabled.

When disabled, exactly one log line is emitted at startup and nothing else:

```text
INFO  telemetry disabled  reason=opt-out
```

No background goroutine, no DNS lookup of `metrics.kolapsis.com`, no outbound packets toward it.

### Persistent install identity

The SDK persists its identity to `/data/shm/shm_identity.json` on first run. Mount a persistent volume on `/data/shm` so the same installation isn't counted as new on every restart.

The reference Docker Compose template above already mounts `/data` as a volume — `/data/shm` is a subpath, so it's covered by default. For Kubernetes:

```yaml
apiVersion: apps/v1
kind: StatefulSet
spec:
  template:
    spec:
      containers:
        - name: maintenant
          volumeMounts:
            - name: shm-data
              mountPath: /data/shm
  volumeClaimTemplates:
    - metadata:
        name: shm-data
      spec:
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 100Mi
```

Without the volume, every restart is counted as a fresh install. The privacy impact is zero (the identity is opaque), but our fleet stats will be distorted — please keep the volume.

When `/data/shm` is unwritable (read-only mount, permission error), telemetry disables itself silently with a single WARN line:

```text
WARN  telemetry disabled  reason=datadir-unwritable  datadir=/data/shm  error=...
```

We deliberately don't fall back to an in-memory identity — that would inflate fleet-wide install counts.

---

## Security Model

maintenant does not include built-in authentication — by design.

Like Dozzle, Prometheus, and most self-hosted monitoring tools, maintenant is designed to sit behind your existing reverse proxy + auth middleware. No need to manage yet another set of user accounts.

```
Internet  ->  Reverse Proxy (Traefik / Caddy / nginx)
          ->  Auth (Authelia / Authentik / OAuth2 Proxy)
          ->  maintenant
```

<details>
<summary>Example: Traefik + Authelia</summary>

```yaml
services:
  maintenant:
    image: ghcr.io/kolapsis/maintenant:latest
    read_only: true
    security_opt:
      - no-new-privileges:true
    group_add:
      - "${DOCKER_GID:-983}"
    tmpfs:
      - /tmp:noexec,nosuid,size=64m
    labels:
      traefik.enable: "true"
      traefik.http.routers.maintenant.rule: "Host(`now.example.com`)"
      traefik.http.routers.maintenant.middlewares: "authelia@docker"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /proc:/host/proc:ro
      - maintenant-data:/data
    environment:
      MAINTENANT_ADDR: "0.0.0.0:8080"
      MAINTENANT_DB: "/data/maintenant.db"
      MAINTENANT_BASE_URL: "https://now.example.com"
```

</details>

> **Note:** `/ping/{uuid}` (heartbeat pings) and `/status/` (public status page) are meant to be publicly accessible. Configure your proxy rules accordingly.

---

## Troubleshooting

### Permission denied on /var/run/docker.sock

**Symptom:** maintenant starts but shows no containers, and the logs contain something like:

```text
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock
```

**Why it happens:** maintenant runs as `nobody` (uid 65534) by design. The Docker socket on the host is owned by `root:docker`, so the process needs membership in the socket's group — without it the kernel rejects the open call even with a read-only mount.

**Normally automatic:** the entrypoint detects the mounted socket's group and grants the unprivileged user access to it — on plain Compose **and** Swarm (where `docker stack deploy` silently ignores `group_add`). Mounting `/var/run/docker.sock` is enough.

**If it still fails** (non-standard socket path, socket proxy, or to pin the GID), set `DOCKER_GID` explicitly. Find the socket's group on the host:

```bash
stat -c '%g' /var/run/docker.sock
# or: getent group docker | cut -d: -f3
```

Pass it to the container via a `.env` file and the `DOCKER_GID` environment variable, then restart:

```bash
docker compose up -d
```

**SELinux (Fedora / RHEL / Rocky / CentOS):** if setting the GID does not resolve the error, SELinux may be blocking the socket access. Check with:

```bash
ausearch -m AVC -ts recent
```

If you see a denial for `docker.sock`, add the `:z` relabel flag to the socket mount:

```yaml
volumes:
  - /var/run/docker.sock:/var/run/docker.sock:ro,z
```

**Docker rootless:** the socket is not at `/var/run/docker.sock` but at `$XDG_RUNTIME_DIR/docker.sock` (typically `/run/user/1000/docker.sock`). Adjust the bind mount accordingly:

```yaml
volumes:
  - /run/user/1000/docker.sock:/var/run/docker.sock:ro
```

Replace `1000` with the UID of the user running the rootless Docker daemon (`id -u` on the host).

---

## Alert Sources

| Source      | Events                                 | Default Severity  |
| ----------- | -------------------------------------- | ----------------- |
| Container   | `restart_loop`, `health_unhealthy`     | Warning           |
| Endpoint    | `consecutive_failure`                  | Critical          |
| Heartbeat   | `deadline_missed`                      | Critical          |
| Certificate | `expiring`, `expired`, `chain_invalid` | Critical          |
| Resource    | `cpu_threshold`, `memory_threshold`    | Warning           |
| Update      | `available`                            | Info              |

Deliver to Discord or any HTTP webhook. Email comes with Personal, Slack and Teams with Pro.

---

## API

Full REST API under `/api/v1/` for automation and integration.

<details>
<summary>Endpoint reference</summary>

| Resource     | Endpoints                                                                                               |
| ------------ | ------------------------------------------------------------------------------------------------------- |
| Containers   | `GET /containers` `GET /containers/{id}` `GET /containers/{id}/transitions` `GET /containers/{id}/logs` |
| Endpoints    | `GET /endpoints` `GET /endpoints/{id}` `GET /endpoints/{id}/checks` `GET /endpoints/{id}/uptime/daily`  |
| Heartbeats   | `GET POST /heartbeats` `GET PUT DELETE /heartbeats/{id}` `POST /heartbeats/{id}/pause\|resume`          |
| Certificates | `GET POST /certificates` `GET PUT DELETE /certificates/{id}`                                            |
| Resources    | `GET /containers/{id}/resources/current\|history` `GET /resources/summary\|top\|hosts`                  |
| Agents       | `GET /agents` `GET PATCH DELETE /agents/{id}` `POST /agents/{id}/revoke` `GET POST /agents/enrollment-tokens` *(Personal)* |
| Alerts       | `GET /alerts` `GET /alerts/active` `GET POST /channels` `GET POST /alert-triggers` `GET POST /escalation-policies` *(Pro)* `GET POST /silence` |
| Webhooks     | `GET POST /webhooks` `POST /webhooks/{id}/test`                                                         |
| Status Page  | `GET POST /status/components\|incidents\|maintenance`                                                   |
| Updates      | `GET /updates` `POST /updates/scan`                                                                     |
| Security     | `GET /security/insights` `GET /security/summary` `GET /security/insights/{id}`                          |
| Events       | `GET /containers/events` *(SSE stream)*                                                                 |
| Health       | `GET /health`                                                                                           |

</details>

---

## Architecture

```
┌──────────────────────────────────────────────────────┐
│                  Single Go Binary                    │
│                                                      │
│   ┌────────────────────────────────────────────┐     │
│   │  Vue 3 + TypeScript + Tailwind (embed.FS)  │     │
│   │  Real-time SSE  ·  uPlot charts  ·  PWA    │     │
│   └────────────────────────────────────────────┘     │
│                         |                            │
│   ┌────────────────────────────────────────────┐     │
│   │           REST API v1 + SSE Broker         │     │
│   └────────────────────────────────────────────┘     │
│          |                          |                │
│   ┌─────────────┐  ┌──────────────────────┐         │
│   │   Docker     │  │     Kubernetes       │         │
│   │   Runtime    │  │     Runtime          │         │
│   └─────────────┘  └──────────────────────┘         │
│          |                          |                │
│   ┌────────────────────────────────────────────┐     │
│   │  Containers · Endpoints · Heartbeats ·     │     │
│   │  Certificates · Resources · Alerts ·       │     │
│   │  Updates · Security · Status Page ·        │     │
│   │  Webhooks                                  │     │
│   └────────────────────────────────────────────┘     │
│                         |                            │
│   ┌────────────────────────────────────────────┐     │
│   │     SQLite  (WAL · single-writer · zero    │     │
│   │              external dependencies)        │     │
│   └────────────────────────────────────────────┘     │
└──────────────────────────────────────────────────────┘
```

- **Single binary** — Frontend embedded via `embed.FS`. One file to deploy. The same binary runs in three modes: `embedded` (single host, default), `server` (central ingestion), and `agent` (remote host) — see [Multi-Host Monitoring](#multi-host-monitoring).
- **Zero dependencies** — SQLite is the only required datastore. No Redis, no Postgres, no message queue. The container runtime (Docker / Kubernetes) is **optional**: maintenant starts and serves endpoints, SSL, and heartbeat monitors even without a runtime socket — container monitoring resumes automatically when the runtime becomes available.
- **Real-time** — SSE pushes every state change to the browser instantly.
- **Read-only** — maintenant never touches your containers. Observe only.
- **Label-driven** — Configure monitoring through Docker labels. No YAML to maintain.
- **~17 MB RAM** — Lightweight enough to run on any VPS or Raspberry Pi.

---

## Pricing

Three editions, in order: Community, Personal, Pro. 
 Community is free forever. Personal is bought once. Pro is what a team needs. 
 100% of revenue funds full-time development — no investors to pay back, no salespeople to feed.

<table>
 <tr>
 <td width="33%" valign="top" align="left">
 <h3>Community</h3>
 Free · AGPL-3.0 · self-hosted forever
 <ul>
 <li>Container auto-discovery (Docker + Kubernetes)</li>
 <li>Full Swarm and Kubernetes views</li>
 <li>HTTP / TCP endpoint monitoring (up to 10)</li>
 <li>Heartbeat &amp; cron monitoring (up to 5)</li>
 <li>TLS certificate tracking (up to 5)</li>
 <li>Resource metrics (CPU, RAM, net, disk)</li>
 <li>Network security insights</li>
 <li>Update intelligence (digest scan)</li>
 <li>Alert engine + webhook + Discord</li>
 <li>Public status page (up to 3 components)</li>
 <li>REST API + SSE + MCP server</li>
 <li>PWA support</li>
 </ul>
 A single host, no account required.
 </td>
 <td width="33%" valign="top" align="left" style="background:#0B0E13">
 <h3>Personal</h3>
 €149 once, for life
 Everything in Community, plus:
 <ul>
 <li>Every cap lifted — endpoints, heartbeats, certificates, status components</li>
 <li>Multi-host monitoring (up to 20 remote machines)</li>
 <li>Email alerts and advanced trigger filters</li>
 <li>CVE enrichment + risk scoring per container</li>
 <li>Unified security posture dashboard</li>
 <li>Incident management with public timeline</li>
 <li>Changelog, resource history, OCSP stapling</li>
 </ul>
 For one person, on infrastructure they own or run for themselves — freelancers included. It does not cover monitoring someone else's infrastructure or reselling Maintenant as a service, and carries no support commitment.
 Includes one year of product updates, then €59 per extra year. Every version released inside that year stays licensed for life.
 <a href="https://maintenant.dev/pricing/">Buy Personal →</a>
 </td>
 <td width="33%" valign="top" align="left">
 <h3>Pro&nbsp;&nbsp;<code>14-day free trial</code></h3>
 €29/month · or €290/year (save 2 months)
 Everything in Personal, plus:
 <ul>
 <li>Unlimited remote machines</li>
 <li>Slack and Microsoft Teams channels</li>
 <li>Alert escalation — page the right person, not a dead channel</li>
 <li>Per-entity routing</li>
 <li>Maintenance windows — silence cleanly during deploys</li>
 <li>Subscriber notifications (email, webhook)</li>
 <li>Status page branding</li>
 <li>The right to use Maintenant on behalf of others</li>
 <li>Priority email support</li>
 </ul>
 <a href="https://maintenant.dev/pricing/">Start free trial →</a>
 </td>
 </tr>
</table>

### Why pay at all?

- **Lift every limit, once.** Personal removes the caps and adds the security layer for a single payment, and the licence never expires.
- **Prioritize the vulnerabilities that matter.** CVE enrichment and per-container risk scoring surface what's critical in *your* environment — not a generic feed.
- **Sleep through the night.** Pro escalation chains page the on-call engineer, then the backup, then the lead — instead of dying silently in a muted Discord.
- **Turn outages into trust.** Public incident timelines and subscriber notifications keep your users informed automatically.
- **Fund independent software.** maintenant is built in Bordeaux, France — by one developer, with no VC, no tracking, no dark patterns. Your purchase is the roadmap.

<a href="./docs/screen-captures/11-security-posture.png"><img src="./docs/screen-captures/11-security-posture.png" alt="Personal — Unified Security Posture" width="680" /></a>
 Personal — Unified security posture with CVE enrichment &amp; risk scoring

### Flexible billing — your choice of processor

Pick the processor that fits where you are:

| Region          | Processor | Methods                                                 |
| --------------- | --------- | ------------------------------------------------------- |
| Global          | **Stripe** | Credit / debit card                                     |
| European Union  | **Mollie** | Card, SEPA Direct Debit, iDEAL, Bancontact, and more    |

- Personal is a single payment, with no subscription to cancel and no expiry
- Pro comes with a 14-day free trial, plenty of time to evaluate against a real stack
- Cancel a Pro subscription anytime from your dashboard
- VAT-compliant invoices issued automatically
- **Self-hosted means self-hosted** — your monitoring data never leaves your infrastructure

### "Why should I pay for open-source?"

Fair question. Here's the honest answer:

<details>
<summary>Is the Community Edition really everything I need?</summary>

Yes. Community is not crippleware — it runs production infrastructure every day. Personal exists for one person who has outgrown the caps or wants the security layer. Pro exists for teams that need escalation routing and premium channels. If you need neither, stay on Community, and consider <a href="https://github.com/sponsors/kolapsis">sponsoring</a> instead.
</details>

<details>
<summary>If I don't pay, does the project die?</summary>

maintenant is AGPL-3.0 and will always be free. But one developer can only sustain this full-time if users pay. Every purchase is a direct vote for "keep shipping" — no investors to please, no enterprise pivot, no acquisition exit.
</details>

<details>
<summary>Can I self-host a paid edition? Does my data leave my infra?</summary>

Yes, self-host Personal and Pro exactly like Community — it's the same binary. The key is checked against the license server and the signed answer is cached, so an outage or a few weeks offline change nothing. Your monitoring data never touches our servers. Ever.
</details>

<details>
<summary>Is there an Enterprise plan for larger teams?</summary>

Yes — for teams needing SSO, audit logs, custom SLAs, or on-prem support contracts. Email <a href="mailto:hello@kolapsis.com">hello@kolapsis.com</a>.
</details>

### Activate a paid edition

Grab a key from [maintenant.dev/pricing/](https://maintenant.dev/pricing/), set it in your environment, restart — done. The same variable carries a Personal or a Pro key.

```bash
MAINTENANT_LICENSE_KEY=your-license-key
```

Personal: one payment, no expiry · Pro: 14-day free trial, cancel anytime · VAT-compliant invoices

---

## Support the project

maintenant is built independently in Bordeaux, France. No VC, no tracking, no telemetry, no data collection, no acquisition exit. The only way this keeps going is if users who benefit from it give back. **Here's how, ranked by impact:**

<table>
 <tr>
 <td width="33%" valign="top" align="center">
 <h3>1. Buy a licence</h3>
 Personal €149 once · Pro €29/mo
 The single most impactful way to support the project. Unlocks advanced features AND funds development. Personal if the infrastructure is yours, Pro if you run it for others.
 <a href="https://maintenant.dev/pricing/">See editions →</a>
 </td>
 <td width="33%" valign="top" align="center">
 <h3>2. Sponsor</h3>
 Any amount · one-off or monthly
 Don't need a paid edition? Sponsor on GitHub. Every sponsor gets credited in the <a href="#backers">Backers</a> wall below.
 <a href="https://github.com/sponsors/kolapsis">Sponsor →</a>
 </td>
 <td width="33%" valign="top" align="center">
 <h3>3. Spread the word</h3>
 Free · 10 seconds
 Star the repo, share on HN / Lobsters / Reddit / LinkedIn. Discoverability is oxygen for indie projects.
 <a href="https://github.com/kolapsis/maintenant">Star repo →</a>
 </td>
 </tr>
</table>

### Backers

Every Personal owner, Pro subscriber and GitHub sponsor keeps this project independent. Thank you.

> Want your company logo here? [Become a corporate sponsor](mailto:hello@kolapsis.com) — visibility for you, runway for the project.

---

## Contributing

Code contributions are welcome. Please open an issue first to discuss bigger changes. Small fixes, typos, docs — just send the PR.

For other ways to contribute (bug reports, feature ideas, feedback), see [Support the project](#support-the-project).

---

## License

Licensed under the [GNU Affero General Public License v3.0](LICENSE) (AGPL-3.0) or a commercial license.

---

Built with care in Bordeaux, France — if maintenant saves you an outage, <a href="https://maintenant.dev/pricing/">buy the developer a coffee (or a year of runway)</a>.

maintenant

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README