Repository files, collaboration, releases and project activity.
ARCHFORGE HISTORY
Blame · README.md
Branch main · the Commit author is not necessarily a verified ArchForge account.
2109dd33b8archadmin2026-10-12
1 # ArchForge External Status 1.0.8 — Debian 13 ArchForge Edition2109dd33b8archadmin2026-10-12
2 2109dd33b8archadmin2026-10-12
3 **New:** `.archforge` ArchForge migration, see `DEBIAN-13-GIT-URL-MIGRATION.md`.2109dd33b8archadmin2026-10-12
4 2109dd33b8archadmin2026-10-12
5 2109dd33b8archadmin2026-10-12
6 **New:** `.archforge` ArchForge migration, see `DEBIAN-13-GIT-URL-MIGRATION.md`.2109dd33b8archadmin2026-10-12
7 2109dd33b8archadmin2026-10-12
8 2109dd33b8archadmin2026-10-12
9 **New:** `.archforge` ArchForge migration, see `DEBIAN-13-GIT-URL-MIGRATION.md`.2109dd33b8archadmin2026-10-12
10 2109dd33b8archadmin2026-10-12
11 2109dd33b8archadmin2026-10-12
12 Release 1.0.8: consistent ArchForge service naming across the independent public and admin status website.e59b7f7cc6archadmin2026-10-11
13 e59b7f7cc6archadmin2026-10-11
14 Independent uptime monitoring at **https://status.archforge.nl**. This software runs on **a second VPS**, without Docker, Pterodactyl, ArchForge credentials, or any database connection to the main website.e59b7f7cc6archadmin2026-10-11
15 2109dd33b8archadmin2026-10-12
16 **It does not modify the ArchForge main website.** If archforge.nl becomes unreachable, the external service continues monitoring, saving independent history and sending alerts.e59b7f7cc6archadmin2026-10-11
17 299229ecf6archadmin2026-10-12
18 ## Nieuw in 1.0.6: veilige, aantoonbaar geïnstalleerde adminloginfix299229ecf6archadmin2026-10-12
19 299229ecf6archadmin2026-10-12
20 Een browser met privacybescherming kan `Origin` of `Referer` normaliseren of afschermen.299229ecf6archadmin2026-10-12
21 De server verwerkt nu browser-origininformatie met `Sec-Fetch-Site`, terwijl299229ecf6archadmin2026-10-12
22 **cross-site formulierverzoeken nog steeds worden geweigerd** en elk POST-verzoek299229ecf6archadmin2026-10-12
23 een CSRF-token nodig heeft. De bestaande scrypt-wachtwoordcontrole, TOTP-2FA,299229ecf6archadmin2026-10-12
24 Secure cookies en rate limiting blijven actief.299229ecf6archadmin2026-10-12
25 2109dd33b8archadmin2026-10-12
26 **Update via je eigen ArchForge-repository:** pak de 1.0.6-update uit in299229ecf6archadmin2026-10-12
27 de checkout op je pc, commit en push de wijzigingen. Op Debian 13 (als root):299229ecf6archadmin2026-10-12
28 299229ecf6archadmin2026-10-12
29 ```bash299229ecf6archadmin2026-10-12
30 cd ~/archforge-external-status299229ecf6archadmin2026-10-12
31 git pull --ff-only299229ecf6archadmin2026-10-12
32 bash ./repair-admin-login.sh299229ecf6archadmin2026-10-12
33 ```299229ecf6archadmin2026-10-12
34 299229ecf6archadmin2026-10-12
35 De herstelactie maakt een private back-up van `status.env`, corrigeert alleen299229ecf6archadmin2026-10-12
36 `STATUS_PUBLIC_URL` als die afwijkt, deployt de geteste release met een bestaande299229ecf6archadmin2026-10-12
37 databaseback-up en code-rollback, verifieert daarna de **daadwerkelijk draaiende299229ecf6archadmin2026-10-12
38 versie** via `/healthz` én probeert drie onschuldige loginverzoeken zonder echte299229ecf6archadmin2026-10-12
39 wachtwoorden: een gewone same-origin browser, een browser met privacyheader,299229ecf6archadmin2026-10-12
40 en een geweigerd cross-site verzoek. Bij een mislukte controle meldt de tool299229ecf6archadmin2026-10-12
41 precies welke fase faalde. Hij raakt geen adminwachtwoorden, TOTP of Caddy aan.299229ecf6archadmin2026-10-12
42 299229ecf6archadmin2026-10-12
43 Zie `FIX-ADMIN-LOGIN-1.0.6.md`. Een geslaagde lokale test bewijst nog niet wat299229ecf6archadmin2026-10-12
44 de browser op jouw apparaat verstuurt; als de 403 blijft, vermeld dan of de299229ecf6archadmin2026-10-12
45 melding hetzelfde is en welke foutregel de herstelactie heeft getoond.299229ecf6archadmin2026-10-12
46 b0c4351f2earchadmin2026-10-11
47 ## Nieuw in 1.0.5: adminlogin 403 Invalid origin oplossenb0c4351f2earchadmin2026-10-11
48 b0c4351f2earchadmin2026-10-11
49 Als de browser na het inloggen op `/admin/login` de fout **403 Invalid origin** toont,b0c4351f2earchadmin2026-10-11
50 wordt de POST **voor** de wachtwoord- en 2FA-controle geblokkeerd. De appb0c4351f2earchadmin2026-10-11
51 vergelijkt de herkomst met `STATUS_PUBLIC_URL`; een afwijkende (oude) instelling,b0c4351f2earchadmin2026-10-11
52 of een geldig HTTPS-origin met expliciete standaardpoort 443, kon login blokkeren.b0c4351f2earchadmin2026-10-11
53 2109dd33b8archadmin2026-10-12
54 Pak versie 1.0.5 uit over de bestanden van je **bestaande** ArchForge-repository, commit en push.b0c4351f2earchadmin2026-10-11
55 Start op VPS 2 (als root):b0c4351f2earchadmin2026-10-11
56 b0c4351f2earchadmin2026-10-11
57 ```bashb0c4351f2earchadmin2026-10-11
58 cd ~/archforge-external-statusb0c4351f2earchadmin2026-10-11
59 git pull --ff-onlyb0c4351f2earchadmin2026-10-11
60 bash ./fix-admin-origin.shb0c4351f2earchadmin2026-10-11
61 ```b0c4351f2earchadmin2026-10-11
62 b0c4351f2earchadmin2026-10-11
63 Deze herstelactie controleert de draaiende statusapp en Caddy-domeinconfiguratie,b0c4351f2earchadmin2026-10-11
64 maakt een private back-up van `status.env`, synchroniseert zo nodig alleenb0c4351f2earchadmin2026-10-11
65 `STATUS_PUBLIC_URL`, installeert de bijgewerkte code met de bestaande getesteb0c4351f2earchadmin2026-10-11
66 deployer, en verifieert dat een HTTPS-loginformulier de origincheck passeertb0c4351f2earchadmin2026-10-11
67 maar niet de CSRF-check. Wachtwoorden/2FA worden niet aangeraakt; de bestaandeb0c4351f2earchadmin2026-10-11
68 SQLite-database, incidenten en Caddy-configuratie blijven behouden.b0c4351f2earchadmin2026-10-11
69 Zie `FIX-ADMIN-403-1.0.5.md`.b0c4351f2earchadmin2026-10-11
70 6b0b538dd6archadmin2026-10-11
71 ## Nieuw in 1.0.4: HTTP 302 monitoringfix6b0b538dd6archadmin2026-10-11
72 2109dd33b8archadmin2026-10-12
73 De hoofdwebsite kan een HTTP 302 naar een andere pagina **op hetzelfde HTTPS-domein** teruggeven. Vóór 1.0.4 werd dit ten onrechte als outage beschouwd. De websitecheck volgt nu maximaal 3 veilige redirects en accepteert alleen een uiteindelijke HTTP 200. Dit controleert **bereikbaarheid**, niet alle websitefuncties. API en ArchForge-controles blijven strikt.6b0b538dd6archadmin2026-10-11
74 2109dd33b8archadmin2026-10-12
75 Als je al bent ingelogd als root op VPS 2, voer na commit/push van de 1.0.4-bestanden op je ArchForge-server uit:6b0b538dd6archadmin2026-10-11
76 6b0b538dd6archadmin2026-10-11
77 ```bash6b0b538dd6archadmin2026-10-11
78 cd ~/archforge-external-status6b0b538dd6archadmin2026-10-11
79 git pull --ff-only6b0b538dd6archadmin2026-10-11
80 bash ./apply-monitor-fix.sh6b0b538dd6archadmin2026-10-11
81 ```6b0b538dd6archadmin2026-10-11
82 6b0b538dd6archadmin2026-10-11
83 Dit hergebruikt de bestaande code-deployer, inclusief back-up en rollback bij een mislukte restart. De eerste geslaagde check start meteen na het herstarten; na standaard 2 succesvolle controles verdwijnt het bestaande automatische incident. **Historische 302-fouten blijven in de uptimehistorie staan**. Zie `FIX-HTTP-302-1.0.4.md`.6b0b538dd6archadmin2026-10-11
84 c50a429023archadmin2026-10-11
85 ## Nieuw in 1.0.3: directe HTTPS-reparatiec50a429023archadmin2026-10-11
86 c50a429023archadmin2026-10-11
87 Wanneer Caddy alleen op `:80` luistert en `status.archforge.nl` een `Connection refused` op `:443` geeft, gebruik op **VPS 2** na `git pull --ff-only`:c50a429023archadmin2026-10-11
88 c50a429023archadmin2026-10-11
89 ```bashc50a429023archadmin2026-10-11
90 bash ./fix-https.shc50a429023archadmin2026-10-11
91 ```c50a429023archadmin2026-10-11
92 c50a429023archadmin2026-10-11
93 Deze root-only herstelactie controleert de lokale statusapp, back-upt `/etc/caddy/Caddyfile`, vervangt **alleen op een dedicated status-VPS** de standaard `:80`-configuratie door een direct HTTPS-domeinblok en herstart Caddy. Wanneer Caddy op `:443` niet kan luisteren, herstelt hij de vorige configuratie en toont de concrete servicefout. Hij raakt `/etc/archforge-status/status.env`, SQLite en je adminaccount niet aan. Hij weigert een Caddy-setup met extra sites in `/etc/caddy/conf.d/`. Zie `FIX-HTTPS-1.0.3.md`.c50a429023archadmin2026-10-11
94 b8619f148earchadmin2026-10-11
95 ## Nieuw in 1.0.2: domein en SSL regelen na de installatieb8619f148earchadmin2026-10-11
96 2109dd33b8archadmin2026-10-12
97 Een **aparte ArchForge-ready wizard** koppelt een statusdomein aan de tweede Debian 13 VPS, controleert A/AAAA-records, configureert Caddy en verifieert de uitgegeven HTTPS-verbinding. De oude SQLite-, admin- en `.env`-instellingen blijven bestaan.b8619f148earchadmin2026-10-11
98 b8619f148earchadmin2026-10-11
99 ```bashb8619f148earchadmin2026-10-11
100 cd ~/archforge-external-statusb8619f148earchadmin2026-10-11
101 git pull --ff-onlyb8619f148earchadmin2026-10-11
102 sudo bash ./configure-domain.shb8619f148earchadmin2026-10-11
103 ```b8619f148earchadmin2026-10-11
104 b8619f148earchadmin2026-10-11
105 Als je al root bent, mag je `bash ./configure-domain.sh` gebruiken. Je hoeft `./install.sh` of `./update.sh` niet opnieuw te starten. **Lees eerst `DOMAIN-SSL-DEBIAN-13.md`.**b8619f148earchadmin2026-10-11
106 f1897d33c0archadmin2026-10-11
107 ## Admin wizard hotfix / interrupted v1.0.0 installationf1897d33c0archadmin2026-10-11
108 2109dd33b8archadmin2026-10-12
109 If the old installer hangs after the admin username, **do not delete the SQLite database or `.env`**. Update your ArchForge checkout to this release (or copy the hotfix `src/cli.js` and `recover-admin.sh` into it), then, on VPS 2:f1897d33c0archadmin2026-10-11
110 f1897d33c0archadmin2026-10-11
111 ```bashf1897d33c0archadmin2026-10-11
112 # If you are logged in as root:f1897d33c0archadmin2026-10-11
113 cd ~/archforge-external-statusf1897d33c0archadmin2026-10-11
114 bash ./recover-admin.shf1897d33c0archadmin2026-10-11
115 f1897d33c0archadmin2026-10-11
116 # Or if logged in as a regular sudo user:f1897d33c0archadmin2026-10-11
117 sudo bash ./recover-admin.shf1897d33c0archadmin2026-10-11
118 ```f1897d33c0archadmin2026-10-11
119 f1897d33c0archadmin2026-10-11
120 This only replaces the CLI wizard and finishes admin creation. It does not reinstall packages, restart the service, modify the config or overwrite an existing admin account. Read `HOTFIX-ADMIN-1.0.1.md` for details. `sudo ./install.sh` on an already running installation also delegates to this recovery script.f1897d33c0archadmin2026-10-11
121 f1897d33c0archadmin2026-10-11
122 **Security:** v1.0.0's old `stty`/readline combination could echo the password. Use a fresh unique admin password, especially if the previous one was typed at that prompt.f1897d33c0archadmin2026-10-11
123 e59b7f7cc6archadmin2026-10-11
124 ## Includede59b7f7cc6archadmin2026-10-11
125 2109dd33b8archadmin2026-10-12
126 - Independent checks for main HTTPS website, optional public API, optional public ArchForge HTTPS, ArchForge SSH banner, DNS, and HTTPS TLS certificate.e59b7f7cc6archadmin2026-10-11
127 - Startup and repeating checks (default every 60 seconds). Three failures to confirm an outage; two successes to confirm recovery.e59b7f7cc6archadmin2026-10-11
128 - Responsive dark-blue status website, 7/30/90-day history, incident timeline, per-service details, observed uptime and monitoring coverage.e59b7f7cc6archadmin2026-10-11
129 - Automatic outage incidents and recovery records; manual admin incident updates and scheduled public maintenance notices.e59b7f7cc6archadmin2026-10-11
130 - Discord webhook and email through **the second VPS's own SMTP configuration**. Confirmed subscriptions and unsubscribe links.e59b7f7cc6archadmin2026-10-11
131 - Independent admin credentials, password hashing with scrypt, TOTP authenticator 2FA, session-based CSRF protection.2109dd33b8archadmin2026-10-12
132 - SQLite WAL database outside the ArchForge repository; systemd service; Caddy HTTPS; root-controlled secrets.2109dd33b8archadmin2026-10-12
133 - ArchForge-based manual updates, local release snapshots, `rollback.sh`, daily SQLite backups, `restore.sh` and `uninstall.sh`.e59b7f7cc6archadmin2026-10-11
134 e59b7f7cc6archadmin2026-10-11
135 ## Requirementse59b7f7cc6archadmin2026-10-11
136 e59b7f7cc6archadmin2026-10-11
137 A clean **Debian 13 (Trixie)** VPS with root/sudo access, a network connection for packages, DNS control for `status.archforge.nl`, ports 80/443 inbound, and an SMTP account if email alerts are needed. By default Node.js 24 is installed via a signed NodeSource APT repository. `sudo ./install.sh` makes system-level changes; examine scripts before executing.e59b7f7cc6archadmin2026-10-11
138 2109dd33b8archadmin2026-10-12
139 ## Step 1 — Put the project in ArchForgee59b7f7cc6archadmin2026-10-11
140 e59b7f7cc6archadmin2026-10-11
141 Create a repository, e.g. `archadmin/archforge-external-status`. Unzip this project locally, then run:e59b7f7cc6archadmin2026-10-11
142 e59b7f7cc6archadmin2026-10-11
143 ```bashe59b7f7cc6archadmin2026-10-11
144 git inite59b7f7cc6archadmin2026-10-11
145 git branch -M maine59b7f7cc6archadmin2026-10-11
146 git add .e59b7f7cc6archadmin2026-10-11
147 git commit -m "Initial independent status server"e59b7f7cc6archadmin2026-10-11
148 git remote add origin <ACTUAL_CLONE_URL_FROM_ARCHFORGE>e59b7f7cc6archadmin2026-10-11
149 git push -u origin maine59b7f7cc6archadmin2026-10-11
150 ```e59b7f7cc6archadmin2026-10-11
151 e59b7f7cc6archadmin2026-10-11
152 Do **not** commit a real `.env`, database, backup, SSH key or webhook token. `.gitignore` excludes local secrets. `.env.example` is a harmless template.e59b7f7cc6archadmin2026-10-11
153 e59b7f7cc6archadmin2026-10-11
154 ## Step 2 — DNS (second VPS)e59b7f7cc6archadmin2026-10-11
155 e59b7f7cc6archadmin2026-10-11
156 Add a DNS `A` record for `status.archforge.nl` pointing to the **public IPv4 of VPS 2**. Add an `AAAA` record only if the VPS has working public IPv6. Allow TCP 80 and 443 through provider firewall and OS firewall. Do not proxy the subdomain through VPS 1.e59b7f7cc6archadmin2026-10-11
157 2109dd33b8archadmin2026-10-12
158 ## Existing install: branding repair (v1.0.9)2109dd33b8archadmin2026-10-12
159 2109dd33b8archadmin2026-10-12
160 If your status page still shows **Git SSH** / **Git Smart HTTP** after upgrades, use the2109dd33b8archadmin2026-10-12
161 [branding repair guide](BRANDING-FIX-V109.md). No clean install is needed.2109dd33b8archadmin2026-10-12
162 The repair script only deploys the new application code and preserves the existing2109dd33b8archadmin2026-10-12
163 SQLite database, admin login, monitoring data and Caddy configuration.2109dd33b8archadmin2026-10-12
164 e59b7f7cc6archadmin2026-10-11
165 ## Step 3 — Install on Debian 13e59b7f7cc6archadmin2026-10-11
166 e59b7f7cc6archadmin2026-10-11
167 On VPS 2:e59b7f7cc6archadmin2026-10-11
168 e59b7f7cc6archadmin2026-10-11
169 ```bashe59b7f7cc6archadmin2026-10-11
170 sudo apt-get updatee59b7f7cc6archadmin2026-10-11
171 sudo apt-get install -y gite59b7f7cc6archadmin2026-10-11
172 # Use the clone URL displayed by YOUR ArchForge repository.e59b7f7cc6archadmin2026-10-11
173 git clone <ACTUAL_CLONE_URL_FROM_ARCHFORGE> archforge-external-statuse59b7f7cc6archadmin2026-10-11
174 cd archforge-external-statuse59b7f7cc6archadmin2026-10-11
175 chmod +x install.she59b7f7cc6archadmin2026-10-11
176 sudo ./install.she59b7f7cc6archadmin2026-10-11
177 ```e59b7f7cc6archadmin2026-10-11
178 2109dd33b8archadmin2026-10-12
179 The interactive wizard checks Debian 13, installs ArchForge, SQLite, Node.js 24, Caddy, msmtp and other requirements, creates a dedicated `archforge-status` service user, asks for domain/targets, Discord webhook and optional SMTP. The wizard generates `/etc/archforge-status/status.env` and an encrypted TOTP secret in SQLite. You must pair an authenticator app and verify a six-digit code during initial admin setup.e59b7f7cc6archadmin2026-10-11
180 e59b7f7cc6archadmin2026-10-11
181 **Do not use `sudo ./install.sh` on the main VPS!** Install it only on VPS 2.e59b7f7cc6archadmin2026-10-11
182 2109dd33b8archadmin2026-10-12
183 ### Secrets and data are not in ArchForgee59b7f7cc6archadmin2026-10-11
184 e59b7f7cc6archadmin2026-10-11
185 | File | Purpose |e59b7f7cc6archadmin2026-10-11
186 | --- | --- |e59b7f7cc6archadmin2026-10-11
187 | `/etc/archforge-status/status.env` | Root-controlled configuration, encryption key, Discord webhook |e59b7f7cc6archadmin2026-10-11
188 | `/etc/archforge-status/msmtprc` | Restricted SMTP client configuration |e59b7f7cc6archadmin2026-10-11
189 | `/var/lib/archforge-status/status.db` | Independent SQLite database and admin credentials |e59b7f7cc6archadmin2026-10-11
190 | `/opt/archforge-status/app` | Running, installed program code |e59b7f7cc6archadmin2026-10-11
191 | `/var/backups/archforge-status/` | Private database and configuration backups |e59b7f7cc6archadmin2026-10-11
192 e59b7f7cc6archadmin2026-10-11
193 Do not lose the environment encryption key or TOTP recovery will fail. **Backups include sensitive credentials** and should be stored on an encrypted disk and ideally copied to a secure location *outside* VPS 2.e59b7f7cc6archadmin2026-10-11
194 e59b7f7cc6archadmin2026-10-11
195 ## Step 4 — Confirm operatione59b7f7cc6archadmin2026-10-11
196 e59b7f7cc6archadmin2026-10-11
197 ```bashe59b7f7cc6archadmin2026-10-11
198 sudo systemctl status archforge-status --no-pagere59b7f7cc6archadmin2026-10-11
199 sudo journalctl -u archforge-status -n 80 --no-pagere59b7f7cc6archadmin2026-10-11
200 curl -fsS http://127.0.0.1:3000/healthze59b7f7cc6archadmin2026-10-11
201 curl -I https://status.archforge.nle59b7f7cc6archadmin2026-10-11
202 ```e59b7f7cc6archadmin2026-10-11
203 e59b7f7cc6archadmin2026-10-11
204 Open `https://status.archforge.nl`, and log in at `/admin/login` with the separate admin credentials and TOTP. First-time uptime history starts empty; days without measurements are shown as **Unknown**, not as successful uptime.e59b7f7cc6archadmin2026-10-11
205 e59b7f7cc6archadmin2026-10-11
206 If HTTPS is not issuing, verify DNS points to VPS 2, ports 80/443, `sudo systemctl status caddy`, and `sudo journalctl -u caddy -n 80`. The installer does not modify `archforge.nl` or its reverse proxy.e59b7f7cc6archadmin2026-10-11
207 e59b7f7cc6archadmin2026-10-11
208 ## Operationse59b7f7cc6archadmin2026-10-11
209 e59b7f7cc6archadmin2026-10-11
210 ```bashe59b7f7cc6archadmin2026-10-11
211 sudo systemctl restart archforge-statuse59b7f7cc6archadmin2026-10-11
212 sudo systemctl status archforge-statuse59b7f7cc6archadmin2026-10-11
213 sudo journalctl -u archforge-status -f2109dd33b8archadmin2026-10-12
214 ./update.sh # run as the ArchForge checkout owner, NOT with sudoe59b7f7cc6archadmin2026-10-11
215 ./backup.sh # invokes sudoe59b7f7cc6archadmin2026-10-11
216 ./rollback.sh # restores previous installed application codee59b7f7cc6archadmin2026-10-11
217 ./restore.sh /var/backups/archforge-status/backup-YYYYMMDD-HHMMSS.tar.gze59b7f7cc6archadmin2026-10-11
218 sudo bash scripts/uninstall.she59b7f7cc6archadmin2026-10-11
219 ```e59b7f7cc6archadmin2026-10-11
220 2109dd33b8archadmin2026-10-12
221 `./update.sh` fetches from the configured ArchForge remote using `git pull --ff-only`, confirms the intended deployment, tests the staged release and backs up SQLite before changing the installed application. ArchForge connectivity is required **only for fetching new code**. A primary VPS outage does not affect the running monitoring service.e59b7f7cc6archadmin2026-10-11
222 e59b7f7cc6archadmin2026-10-11
223 `./rollback.sh` returns the prior *code* snapshot; it does not reverse database schema migrations. `restore.sh` restores config and database from a manually selected backup (after explicit confirmation). A daily systemd timer performs a SQLite-consistent backup with 14-day local rotation. This retention period is configurable in `scripts/backup.sh`.e59b7f7cc6archadmin2026-10-11
224 e59b7f7cc6archadmin2026-10-11
225 ## Monitoring targetse59b7f7cc6archadmin2026-10-11
226 e59b7f7cc6archadmin2026-10-11
227 Use `TARGET_WEBSITE=https://archforge.nl`. The default public API target is an **optional, separately monitored service**, not a data source required by the monitor. An inaccessible API is reported as an observed failure while VPS 2 remains operational. Leave `TARGET_API_URL=` blank to disable it.e59b7f7cc6archadmin2026-10-11
228 2109dd33b8archadmin2026-10-12
229 For real public ArchForge HTTPS checking, configure `TARGET_GIT_HTTP_URL` to an existing **public repository** route ending with `/info/refs`. For example: `https://archforge.nl/USER/PUBLIC_REPO.archforge/info/refs` *if that matches your ArchForge-server URL*. The request is read-only and requires a valid ArchForge upload-pack discovery response. Leave empty if your ArchForge HTTPS endpoint is private or unavailable.e59b7f7cc6archadmin2026-10-11
230 2109dd33b8archadmin2026-10-12
231 ArchForge SSH checks only test TCP plus an SSH protocol banner, **not an authenticated ArchForge push**. DNS resolution only verifies DNS lookups. A successful HTTPS check does not mean all website features work. Internal components without external endpoints must not be labeled independently healthy.e59b7f7cc6archadmin2026-10-11
232 e59b7f7cc6archadmin2026-10-11
233 ## Configuratione59b7f7cc6archadmin2026-10-11
234 e59b7f7cc6archadmin2026-10-11
235 All primary options are documented in `.env.example`. Modify the real file with:e59b7f7cc6archadmin2026-10-11
236 e59b7f7cc6archadmin2026-10-11
237 ```bashe59b7f7cc6archadmin2026-10-11
238 sudoedit /etc/archforge-status/status.enve59b7f7cc6archadmin2026-10-11
239 sudo systemctl restart archforge-statuse59b7f7cc6archadmin2026-10-11
240 ```e59b7f7cc6archadmin2026-10-11
241 e59b7f7cc6archadmin2026-10-11
242 For SMTP changes, update `/etc/archforge-status/msmtprc` as well (owned by `archforge-status`, mode `600`). The app sends mail using Debian's `msmtp` binary and never relies on VPS 1 SMTP. Discord messages use the standard Discord channel webhook format `https://discord.com/api/webhooks/ID/TOKEN`, NOT an invite URL such as `https://discord.gg/...`.e59b7f7cc6archadmin2026-10-11
243 e59b7f7cc6archadmin2026-10-11
244 Monitoring runs once per minute by default (30-second minimum). The last ~400 days of raw samples are retained. Use the Admin Control Center to publish incident progress and announce planned maintenance. Scheduled maintenance **informs visitors**, but cannot execute remote maintenance on VPS 1.e59b7f7cc6archadmin2026-10-11
245 e59b7f7cc6archadmin2026-10-11
246 ## Independent security modele59b7f7cc6archadmin2026-10-11
247 e59b7f7cc6archadmin2026-10-11
248 - The status site listens only on `127.0.0.1:3000`; Caddy handles HTTPS.e59b7f7cc6archadmin2026-10-11
249 - No shared login tokens with ArchForge, no database credentials from the main platform, no remote shell, no arbitrary URL checking from the admin dashboard.e59b7f7cc6archadmin2026-10-11
250 - Public subscriptions are confirmed via email and include unsubscribe links; HTTP forms have CSRF protection and simple rate limits.e59b7f7cc6archadmin2026-10-11
251 - Rate limiting is in-process and resets after a service restart; a network-level reverse-proxy limit is recommended for high-traffic installations.e59b7f7cc6archadmin2026-10-11
252 - Systemd hardening and per-file permissions are used. Keep Debian, Caddy, Node.js and the service patched.e59b7f7cc6archadmin2026-10-11
253 - This is **one external monitor on one VPS**. If VPS 2 or its network goes down, it cannot independently report its own outage. Consider a third-party heartbeat for that later.e59b7f7cc6archadmin2026-10-11
254 e59b7f7cc6archadmin2026-10-11
255 ## Testse59b7f7cc6archadmin2026-10-11
256 e59b7f7cc6archadmin2026-10-11
257 ```bashe59b7f7cc6archadmin2026-10-11
258 node --version # supported in production: v24 or latere59b7f7cc6archadmin2026-10-11
259 npm teste59b7f7cc6archadmin2026-10-11
260 npm run checke59b7f7cc6archadmin2026-10-11
261 bash -n install.sh scripts/*.she59b7f7cc6archadmin2026-10-11
262 ```e59b7f7cc6archadmin2026-10-11
263 2109dd33b8archadmin2026-10-12
264 This is a first release. Run the installer and a controlled failure/recovery test on your VPS before relying on it for production alerts. Never upload real secrets or your SQLite database to ArchForge.