v1.0.74 Single binary · outbound mTLS only · Apache 2.0

hostatlas-agent - one install, the host explains itself.

A single binary that runs on every server in your fleet. Auto-discovers what's running, ships telemetry, drives auto-recovery, gates SSH. Open-source on the agent side; the platform decides what to do with what it sees.

$ curl -sSL https://install.hostatlas.app/install.sh | sudo bash -s -- --key=HOSTATLAS_SERVER_KEY copy

Generate YOUR_INSTALL_KEY in the app under Settings → Install Keys. Each key enrols one host and expires in 1 hour.

service plugins built in

inbound ports required

~1.2s

enrol to first metric

web-prod-04 · enrol · 14:32 UTC

$ sudo hostatlas-agent enrol --token $HA_TOKEN
→ hostatlas-agent v1.0.74
→ ubuntu 22.04 (amd64) · kernel 6.5.0-21-generic
→ dial out to api.hostatlas.app:443 — mTLS handshake… ok

SCANNING FOUND
services 47 units
containers 12 (docker)
certificates 8 (acme · letsencrypt)
listening ports 22 · 80 · 443 · 3306 · 6379
plugins attached mysql · redis · nginx · php-fpm

$ hostatlas-agent status
heartbeat 1.2s ago healthy
last metric 900ms ago cpu 18% · mem 33% · disk 5%
last command 27s ago self-update (no-op, on latest) _

— Why one agent

One socket out. The whole platform follows.

No exporters to install, no sidecars, no inbound port for HostAtlas. The agent dials out; the platform pulls everything else from that single connection.

no exporters

Service plugins ship inside the agent. MySQL, Postgres, Redis, Nginx, Docker — all attach automatically when the agent finds them. No node_exporter zoo.

no inbound port

The agent dials out to the platform over mTLS. Firewalls don't need to open anything for HostAtlas. Same applies to self-hosted: outbound only.

narrow privileges

Inventory + telemetry runs as the hostatlas user. Service control + auto-recovery use a narrow polkit policy you opt into. No "give me root" install script.

— What the agent does

Six verbs, every host.

Once the agent is on the box, this is what runs continuously. Nothing else to wire up.

hostatlas-agent discover

Services, containers, listening ports, certificates, cron, packages, network interfaces — surfaced on enrol, refreshed continuously.

hostatlas-agent meter

CPU, memory, disk, network at sub-second granularity. Service-specific metrics via the built-in plugins above.

hostatlas-agent tail

Live logs across journald + auto-discovered application paths. Server-side regex filter; nothing leaves until you ask.

hostatlas-agent recover

Per-service restart policies with explicit limits. The agent runs the action; the platform records the audit trail.

hostatlas-agent gate

SSH access via short-lived CA-signed certs (JIT). The agent verifies and audits; no static keys sitting on disk.

hostatlas-agent backup

Off-site backups encrypted client-side before they leave. Ransomware-gate inspects entropy on the way out.

— Service plugins built in

It already knows your stack.

The agent watches for these signatures and attaches the matching plugin the moment it sees one. No config file, no opt-in flag.

mysql

tables, slow queries, replication lag, connection pool

postgres

pg_stat_activity, replication, hypertables, locks > 5s

redis

memory, evictions, Horizon queues, keyspace notifications

nginx

request rate, latency p50/p95/p99, error log tail

docker

containers, image manifests, restart events, resource pressure

php-fpm

pool status, slow log, active workers vs queue depth

systemd

unit health, restart loops, journald tail with filters

cron

jobs, last run, failed runs, drift from schedule

— Install

One line, three flavours.

Pick the path that matches how you provision the rest of your fleet.

Curl + pipe

Detects your package manager, drops the binary, installs the systemd unit, enrols with the install key you pass on the command line. Same script for laptops and servers.

$curl -sSL https://install.hostatlas.app/install.sh | sudo bash -s -- --key=HOSTATLAS_SERVER_KEY

Apt / Yum

For repeatable provisioning. Official repos signed with our key, mirrored regionally. Use this when Ansible / Chef / cloud-init owns your bootstrap, then enrol with a key.

$sudo apt install hostatlas-agent && sudo hostatlas-agent enrol --key=HOSTATLAS_SERVER_KEY

Bring-your-own image

A small Docker / OCI base layer for golden-image workflows. Bake it once; every instance enrols itself the first time it boots with an enrol token in the environment.

$FROM hostatlas/agent:latest

Standalone mode

No platform required. The agent prints + ships JSON locally, suitable for ad-hoc ops, air-gapped boxes, or pairing with a self-hosted backend you own.

$hostatlas-agent run --standalone

— Honest answers

Questions that come up before the install.

Which platforms?

Linux (Debian / Ubuntu / RHEL / Rocky / Alma / Alpine / Arch), FreeBSD, macOS (for laptops + dev hosts). Windows agent in beta.

Open source?

Yes — the agent and its plugins are Apache 2.0. The platform that consumes the data is HostAtlas's commercial product.

Does it work without the platform?

Standalone mode prints + ships JSON locally, suitable for ad-hoc ops or pairing with a self-hosted backend.

What does it need to run?

A user account, outbound HTTPS (443), and permission to read what you want monitored. Service control + auto-recovery use a narrow polkit policy you opt into.

How do upgrades work?

The agent watches its own version and self-updates from the official channel by default. You can pin a version, gate on a maintenance window, or roll your own apt/yum mirror.

Discovery & Mapping

For developers