What runs on your server

Everything vpsFocus puts on your server or runs on it is in the public repository github.com/zaevlad/vpsfocus-server. The promise "it reads, it does not change, your data stays with you" is something you can check rather than take on trust.

Servers currently get version 0.33.0; its code is the bundle-0.33.0 tag in the repository.

What is there

• The installer files of every version — exactly as your server receives them: install, update and rollback scripts, templates, the signed inventory and its signature.
• Every script the app runs over SSH — finding sites and certificates, backups, the security check and the rest. Each has a line in the inventory SERVER-SIDE.md: when it runs, what it reads, what it changes.
• Source of the monitoring agent and of our Caddy build.

Analytics is Umami and the database is PostgreSQL — their official images, pinned by digest.

What is not there

The desktop app itself is closed source. The scripts inside it are compiled from these very files, and our automated tests fail if the app runs a script that is not in the inventory; on your side, the sudo or auditd log of your server shows every command that was run. Our website is not there either: it never runs on your server.

How to check that your server got exactly that

1. The install screen of the app names the version of the installer files and links to its tag in the repository.
2. One command checks the signature of the version and each of its files: go run ./tools/verify -version <version>. With -archive it compares the archive the app downloads with the tag, file by file.
3. Images in the template are pinned by digest; on your server docker inspect shows the same ones.

Exact commands are in the repository README.

The release key

Every version is signed with the key whose fingerprint is 337F561861A23810 (minisign key id). The same key signs updates of the app, and the app refuses to install a version without a valid signature. The same fingerprint is in the README and SECURITY.md of the repository; if the key ever changes, it changes in all three places with the date and the reason.

License

Business Source License 1.1: you may read, check, modify and run this code on your servers and your clients' servers, including commercially; you may not build a competing monitoring or analytics product on it. Four years after each version is released, it becomes Apache 2.0.

Found a vulnerability

Please report it privately through Report a vulnerability in the repository. We answer within 7 days.