JL
Cambiar a español
Back to projects
Independent/portfolio experience

Metrics Control System

A modular system and GPU monitoring setup with secure host-level package-update orchestration.

Evidence status: Repository-verified implementationGo · Prometheus · Grafana · Ed25519 · SHA-256
FIG. 02 · CRYPTOGRAPHIC AUTH → AGENT → OBSERVABILITY

METRICS CONTROL / HOMELAB AGENT BENCH

METRICS CONTROL / HOMELAB AGENT BENCHIllustrative homelab agent bench: Ed25519 signing gateway, request rail, 9-check verifier gate, isolated sudoers root helper, three inspection bays, and Prometheus scrape terminal.sudoAPTGITDOCKER5m TTL
AUTH
0/9
CACHE
FRESH (5m)
APT
3 pkg
GIT
1 behind
DOCKER
2 img
EXECUTOR
IDLE

StatusPUBLIC TELEMETRY (/metrics)

Illustrative operating cycle: the gateway signs requests using Ed25519 before dispatching them to the local agent. The verifier enforces nine sequential checks (signature, issuer, node ID, lifetime ≤ 60s, method, path, SHA-256 body hash, and replay nonce). Status queries are served from a 5-minute TTL cache; when applying updates, an exclusive TryLock latch restricts execution to one task while the unprivileged agent routes privileged actions through a single whitelisted sudoers helper binary.

Illustrative demo values. Counters and statuses reflect the verification and execution model without representing production server metrics.

01

Custom Go agents expose system and GPU telemetry to Prometheus and Grafana while secure request checks support host-level update orchestration.

02

Operational visibility and host maintenance need to work without exposing root credentials or collapsing trust boundaries.

An operator maintaining systems, GPU workloads, and isolated services.

03

Independent/portfolio work: built the monitoring agents and the supporting operational setup.

04

  1. Collect system and GPU telemetry with modular Go agents
  2. Expose Prometheus metrics
  3. Visualize operational signals in Grafana
  4. Verify update requests with Ed25519
  5. Check request-body integrity with SHA-256
  6. Check status through a five-minute cache: APT runs update plus a dry-run upgrade, Git fetches and counts commits behind, and Docker compares each Compose image’s local and registry digests
  7. Apply one update task at a time on whitelisted paths: APT repairs dpkg and upgrades packages, Git pulls with hooks disabled, and Docker pulls images then recreates the Compose stack
  8. Send privileged commands through one sudo-allowed root helper that revalidates the path whitelist; the Go agent never holds root credentials

05

  • Used modular Go agents for system and GPU monitoring.
  • Separated request verification from body-integrity checks.
  • Isolated untrusted web extractors from internal inference systems.