NodePulse 🌐🛡️

A lightweight, self-hosted, distributed infrastructure metrics and system log aggregator built in pure Go (standard library only). It enables real-time performance tracking and centralized log stream analysis for multiple dedicated Linux servers with a heavy focus on zero-allocation data piping, strict system security, and defensive memory constraints.

---

🏗️ Architectural Core & Features

1. Zero-Dependency Cryptography & Security

• Zero-Leaking Authentication: Implements a pure standard-library manual implementation of PBKDF2-HMAC-SHA256 with 210,000 iterations for password derivation. Account discovery mitigation is built into VerifyUser to ensure constant-time comparison even for non-existent identities.
• Production Session Lifecycle: Features 32-byte CSPRNG cryptographically secure session tokens managed via HttpOnly, SameSite=Strict, and dynamic Secure cookie configurations alongside concurrent session garbage collection.
• Defensive Web Security: Enforces strict anti-brute-force rate limiting (max 8 attempts per 5 minutes per IP) and strict double-submit validation requiring the X-NP-CSRF request token header across all state-mutating API layers.
• Atomic Persistent Store: Manages identities via declarative local store JSON files featuring 0600 Linux permissions, implementing fully atomic disk writes via temporary files and system-level folder renames (temp + rename).

2. Enrollment-Based Node Cluster Routing

• Cryptographic Access Control: Replaces open self-registration with an explicit tokenized onboarding scheme (<keyId>.<secret>). Secrets are hashed via SHA-256 for instant O(1) constant-time token comparison without roasting host CPU threads.
• Anti-Spoofing Payload Validation: The main server ingestion router automatically overwrites payload NodeID fields with authenticated identities mapped directly from the access token key registry, preventing rogue agent data injections.

3. Asynchronous Linux Log & Error Streaming

• Multi-Source Log Tails (Linux-Only): The agent implements non-blocking stream pipes utilizing direct journalctl -f -o json subprocess pooling (with localized unit-level filters) combined with standard file tail polling (700ms interval).
• Resilient File Rotation Trackers: Dynamically tracks system file rotations via low-level os.SameFile pointer validation and auto-recovers truncation anomalies while handling partially written bytes.
• Batching Optimization & Ring Memory Caps: Telemetry logs and error spikes are buffered using bounded 4096 channels and pushed down the wire in micro-batches every 2000ms, detached completely from the standard metric payload. The main hub restricts state bloating using bounded in-memory Ring Buffers (capped at 500 rows per node), ensuring predictable heap dimensions.

4. Consolidated Real-Time Web Dashboard

• Embedded Monolithic Binary: Incorporates the reactive frontend direct into the compilation process via Go's native //go:embed directive.
• Single-Page Analytics UI: Implements a custom low-overhead UI architecture powered by Tailwind CSS, AlpineJS, and ChartJS, updating continuously via persistent WebSockets with adaptive data-delta polling and auto-reconnect failbacks.

---

🚀 Production Cross-Compilation & Systemd Deployment

1. Cross-Compile for Linux (AMD64) from Windows

Since the core codebase does not rely on CGO, you can instantly cross-compile static binaries via PowerShell:

env:GOOS="linux"; env:GOARCH="amd64"
go build -o nodepulse-server ./cmd/server
go build -o nodepulse-agent ./cmd/agent

2. Central Hub Server Hardening (Systemd)

Move the compiled server binary to /usr/local/bin/ and configure a hardened, sandboxed Systemd unit profile:

# /etc/systemd/system/nodepulse.service
[Unit]
Description=NodePulse Central Hub
After=network-online.target

[Service]
ExecStart=/usr/local/bin/nodepulse-server -addr 127.0.0.1:8080 -data /var/lib/nodepulse/nodepulse.json -secure-cookies
DynamicUser=yes
StateDirectory=nodepulse
Restart=always
NoNewPrivileges=yes
ProtectSystem=strict

[Install]
WantedBy=multi-user.target

Note: Extract the initial secure CSPRNG admin credentials via journalctl -u nodepulse on the first unit startup.

3. Distributed Edge Agent Deployment

Deploy the lightweight metric tracker and system file tails to target hosts:

# /etc/systemd/system/nodepulse-agent.service
[Unit]
Description=NodePulse Metrics Agent
After=network-online.target

[Service]
ExecStart=/usr/local/bin/nodepulse-agent -server https://yourdomain.com -id prod-edge-01 -journal -log-level warn
Environment=NODEPULSE_TOKEN=<YOUR_ENROLLMENT_TOKEN_FROM_SERVER_UI>
Restart=always
RestartSec=5
NoNewPrivileges=yes
ProtectSystem=strict
# Required to grant the isolated agent full access to system systemd-journal streams:
SupplementaryGroups=systemd-journal 

[Install]
WantedBy=multi-user.target

---

📊 Infrastructure Architecture Choices

• Log Retention: Kept strictly inside fixed in-memory ring-buffers to guarantee deterministic application behavior. TLS termination and static persistence constraints are deliberately delegated to specialized load-balancers (Nginx/HAProxy) in production.