◉Self-hosted · open source · no account
It inventories, watches, files incidents for, investigates, patches and pages you about what you run — and tells you plainly which parts it cannot see, because a dashboard that is green by default is worse than no dashboard.
Every tool in this space has an inventory and a dashboard. The difference is what happens when the tool does not know something — and these rules are enforced by the test suite, not by good intentions.
A check nothing has observed reads unknown, not up. An agent that stopped reporting reads stale, not fine. A failed collection keeps what it knew and marks it stale rather than quietly erasing it.
Most dashboards are green partly because they cannot tell the difference.
An ambiguous match is reported as ambiguous. An endpoint it cannot parse yields nothing instead of a plausible-looking wrong answer.
Fewer confident statements, more true ones.
Every write surface is off by default and named. Nothing is auto-applied. There is no arbitrary command endpoint and no remote shell.
There is no PUT or DELETE anywhere in the API, and a test asserts it.
Self-hosted, single tenant, SQLite on your disk. No telemetry, no phone-home, no account, no licence check.
It binds to localhost until you deliberately put it behind something.
Three surfaces worth seeing at full size. A 1440px console shrunk into a column proves nothing, so these are shown whole.
Hosts, services, containers, deployments and repositories, connected only where a real relationship was recorded. Degraded provenance is shown and labelled, never quietly promoted to fact.
One command installs a probe agent on any Linux box. It checks HTTPS, TCP, ICMP and DNS, reports back, and holds no state of its own — nothing to expose, no inbound port, no separate monitoring server to babysit.
Model your policies and copies, record restore tests, and get a readiness answer derived from evidence. Overseer never runs your backups — it tells you whether the ones you run would get you back.
Overseer follows ITIL where ITIL is right and stops where it turns into paperwork. Eight things it does that a severity dropdown cannot.
Impact is how much is affected; urgency is how fast it has to be fixed. They are genuinely independent — a marketing page down for everyone is high impact and low urgency, a payroll run due Friday is the reverse — and collapsing them into one number makes those two incidents look identical.
Priority comes from the pair by a matrix you edit in the interface, and every derivation names the evidence it used. An operator override always wins and is recorded beside the derived value.
Response and resolution targets are yours to declare. Where the timestamp a measure needs is missing, it reads unmeasurable — never a green “within target” inferred from data that was never recorded.
Resolving needs a category and a closure code from closed lists, so “what keeps breaking” has an answer instead of a folder of free text. Four of those codes mean the symptom is gone and the fault is not, and the page says so.
A P1 comes out of the matrix. Declaring is somebody judging the ordinary response is not enough, and it is recorded as the act it is, with a reason.
A service failing from outside while its container is demonstrably alive is not a dead service — it is a dead route to a working one. The incident opens saying so. Your services stay innocent of your ISP’s crimes.
Once the same subject has produced three incidents in a day, the next episode continues the same incident instead of filing a fresh one — its timeline becomes the flap log.
An incident closed on a workaround is finished; the fault is not. A problem record survives it and refuses to be called resolved without a permanent fix.
Declare, and Overseer starts expecting updates on the cadence you named. Updates are recorded rather than sent — it has no channel to your customers and does not pretend to — and an operator who declared no cadence reads “no cadence”, not “on time”.
Overseer notices when incidents keep naming the same thing and proposes a problem. It never asserts one: a host that has had a full disk, a bad cable and an OOM kill has had three problems, not one, so every proposal shows its reasons and says outright that a shared entity is a pattern and not a shared cause. You name the fault; it records who did and why.
Categories and closure codes are closed lists, so the report groups on something stable. Every distribution carries the bucket for what nobody filled in, and the headline is how many incidents ended with the fault still in place.
A sample-data recreation of the incident workspace. The record, the evidence and the agent’s findings are fictional; the state machine is the real one. Accept or reject the proposal, or let the condition clear on its own, and watch what the record does. Nothing here reaches a real estate — the page makes no network request at all.
Every screenshot here is the project’s own end-to-end test fixture, not somebody’s estate. Page through them.
Detecting an outage is the easy half. Everything below runs unattended, without anybody watching a screen.
A condition that holds for five minutes becomes an incident, ranked at the moment it opens rather than when somebody first looks at it, and dated from the first observation.
The attention queue is the only transport, so nothing can be notified that is not also on the board. Open incidents go to chat at a severity that matches their rank, carrying an Acknowledge button and a link to the record.
Each incident becomes its own post, and everything that happens to it lands inside: status changes, the condition returning, the investigating agent’s conclusion, and the resolution with its closure code.
A condition that clears and stays clear resolves the incident and backdates it to the recovery, with the closure code “self-resolved” — because the symptom stopping is not the same as somebody fixing it.
Detection, attribution and investigation run unattended. What remains is the decision, and the decision comes to you: a button on the message that told you, gated twice, and honest about its limits.
The incident’s opening post carries an Acknowledge button. Pressing it records the acknowledgement under your name and quietens the paging — one tap, back to sleep.
When an agent’s investigation queues a proposal, Accept and Reject appear on the very post that states its conclusion. The decision is still one deliberate human click; the click just happens where you read.
When exactly one predeclared action fits — restart this container — its button appears on the post. The first tap answers with precisely what would run; the second executes it; the verification lands back in the thread.
A user-id allowlist decides WHO may act from chat, checked against the id the platform supplies. Your own grants decide WHAT that press may do. Chat adds reach, never permission.
The same bot polls Overseer every thirty seconds from outside it. If Overseer stops answering, the bot says so — including the honest sentence that nothing is watching the estate while that is true.
The gap between a fix existing and a fix applied is the exposure. Overseer reads what is pending on every host, lets you consent to a window, runs it under cover, and believes only the patch monitor about what changed.
Pending and security updates per host, the reboot that is waiting, and how old that evidence is — read from a patch monitor, never inferred from uptime or inventory. A host nobody has reported on says so instead of showing zeros.
You plan a host, a scope (security-only or everything), a time box and a reason; approving it is a second, separate signature. A window nobody approved expires. A start the server slept through past its end expires too — applying updates at the wrong time is worse than not applying them.
One click per host schedules security updates every night. The schedule is the standing consent: each night mints an approved window, and a host nobody allowlisted, or nobody has evidence for, is skipped with a reason rather than failed at 03:30.
Firing opens a maintenance cover so the churn is downgraded rather than paged, and an incident that follows the run start to finish — resolved with the before-and-after counts, or left open for a human when it failed.
A run completes only when evidence collected after it shows the counts fall. The first live run proved why: the command exited 0, the agent had not re-reported, and the honest answer at that moment was “unknown”.
The host end is a forced-command wrapper that maps “security” or “full” to one fixed command. No package name, no path, no shell ever leaves Overseer — and a transport refusal never counts as a change.
A check pointed at a reverse proxy, an auth gate, or a port nothing listens on reports coverage while watching nothing. It is not a weak signal — it is the absence of one wearing a signal’s clothes.
A check that has never once succeeded is not monitoring anything — it reads red forever, so a real outage looks exactly like its normal state. Overseer reports the check rather than leaving the service looking covered.
Disabling an integration is a statement that it is gone. Nothing derived from it appears in the queue or the impact graph, so a decommissioned monitoring plane cannot go on feeding stale evidence to a diagnosis.
A check pointed at the wrong port stays green forever. When fresh inventory shows nothing running behind a passing check, that check is struck from the evidence before it can spend itself.
A probe agent that stops reporting is a loss of sight, not a loss of service, and is reported as such. If every agent goes quiet the estate says so plainly.
A disk that leaves the machine keeps arriving from the SMART collector with its last failed result. Overseer asks the host’s own inventory whether the drive is still attached before it calls anything critical.
A collection that dies inside Overseer — its database busy during a deploy — is filed against Overseer, not against the tool that was never reached.
Investigating an outage is mostly reading — the queue, the incident, what changed. That is work a model is genuinely good at and nobody enjoys. The industry is racing to let models act; Overseer lets them read, and makes everything they write a draft you approve.
Everybody reading this already has something in each of these slots. This is the swap, stated plainly.
Inventory collected from what is actually running and reconciled against what you documented. Where the two disagree it says so instead of picking one.
Probe agents you install with one command, reporting where your inventory already lives. They listen on no port and hold no history.
A public page for your customers, built from checks you already have and publishing only the hostnames you list. Planned maintenance shows there while it runs.
An on-call rota with escalation steps, pages that record whether they were delivered, and an Acknowledge that works from the chat message itself.
Nightly security windows per host, approved once, measured every time, tracked by an incident that closes itself with the delta.
Runbooks attached to the incident that needs them, with the reason they were attached recorded.
A problem record that outlives the incidents that produced it and cannot be marked resolved until a permanent fix is written down.
Policies, copies and restore tests modelled, with a readiness answer derived from evidence rather than from the last job exiting zero.
Docker Compose on a machine you own. State is a SQLite file on your disk; backing it up is copying it.
Probe agents pull their assignments and push results outbound. They listen on no port and store no history.
20 connectors gather evidence over SSH, Docker, Prometheus and the rest. None of them writes to your systems.
If one of the right-hand columns is a dealbreaker, better to find out here than after you have installed it.
Built for
Not for you if
Overseergit clone https://git.coolhole.net/aestheticjmack/Overseer
cd Overseer
cp .env.example .env # set the session secret + first admin
docker compose up -d # migrations apply on startIt binds to localhost. Putting it on a network, and putting a reverse proxy in front of it, is a decision you make deliberately — it is not the default.
Nothing. It is AGPL-3.0 open source and there is no paid tier, no hosted plan and no per-host pricing.
One person, in the open. The repository is public, the commit history is the record. There is no SLA — if you need a supported product, this is not one yet.
You open an issue on the forge, and you keep running. Overseer never sits in the path of anything serving traffic. An Overseer outage costs you visibility, not availability.
It is a SQLite file on your disk. Copy it.
No telemetry, no analytics, no account, no licence check. It binds to localhost until you deliberately put it behind something.
It is sized for exactly you. One container, one file, ten minutes to install — and then it does the part you do not have headcount for.
Then you will have spent nothing and can leave with your data. It is not built to become a platform, and it will not pretend otherwise to keep you.