Note that development is in very early stages, targeting documentation first. There is no working code here yet.
puca, the Pan-Unix Control Agent, is an
endpoint and configuration management system for Linux, BSD, and other
Unix-like systems. It emphasises simplicity, minimal resource usage, and a
small attack surface.
The agent runs on each node being managed, and connects to a central management system to retrieve instructions and send responses. Agent functionality is intentionally restricted, prioritising predictability and auditability over complex features.
From the central manager, an operator can see the following for all nodes:
- Patching and service status
- Security baseline compliance status
- Scheduled command status and logs
- Operating system and hardware type
- Currently active and pending actions
The operator can group nodes either by name or by dynamic searches that use a simple query language. These criteria can include node characteristics or even installed packages, allowing dynamic groups such as "all systems with under 4GB RAM that have GCC installed".
Operators can queue up actions for nodes to run. Actions are retrieved by
each nodes's puca agent and executed by calls to the external
tools uact,
xyz, and
scw.
This allows the operator to:
- Install, update, and remove packages
- Apply security baseline compliance remediations
- Manage security check exceptions
- Start, stop, enable, and disable services
- Enable, disable, and re-run scheduled tasks under
scw - Delegate specific pre-prepared actions to other operators
Action delegation acts as a kind of multi-system sudo. For example, deployment of internal software to a production cluster could be handed off to a release management team, allowing them to co-ordinate releases without system administrator assistance or even any access to the target cluster.
Configuration management is available in a simple form, where nodes and node groups are configured using a declarative domain-specific language which is translated into appropriate actions.
Both the agent and the central manager produce metrics which can be collected by monitoring tools such as Zabbix, Prometheus, and so on, allowing alerts about node status to be tailored to the local norms.
Node registration policy is flexible — the manager,
pucamgr, can impliticly trust all puca agents,
or require operators to approve new nodes, or require registration with a
pre-shared secret, or restrict by IP address. These can be combined, so for
example operator approval can be required for nodes from one subnet, while
trusting nodes using a pre-shared key from another subnet.
This software is distributed under the terms of the GNU General Public License version 3 or later.
- Git repository (at Codeberg)
- Issue tracker (at Codeberg)
Comments, bug reports, and patches can be sent using the Issue tracker, or through the Contact Form.