winget install --id=sysmanage.sysmanage -e SysManage is the server-side component of an open-source fleet management platform. It accepts inventory from SysManage Agent hosts, dispatches declarative deployment plans (package install, firewall config, antivirus deployment, VM lifecycle), surfaces health and compliance dashboards, and exposes a REST + WebSocket API for orchestration.
A modern, cross-platform system monitoring and management platform with real-time WebSocket communication, built with FastAPI and React.
Complete documentation is available at sysmanage.org
SysManage is a comprehensive system management solution that allows you to monitor and manage remote servers across multiple operating systems (Linux, Windows, macOS, FreeBSD, and OpenBSD). The system consists of:
config_drift alert rules, one-click remediate-to-baseline, and remediation playbooks that repair a single divergence (optionally unattended) instead of re-applying a whole baselineRun the server from a signed native package. The packages bring Python, the built web interface, nginx and OpenBAO, generate this installation's secrets, and install the service, so there is nothing to build. SysManage does not publish container images.
📖 Per-platform instructions (Debian, the RHEL family, openSUSE, Arch Linux, Alpine, Snap, macOS, Windows and the BSDs): sysmanage.org/docs/server/installation.html
# 1. Install the server from the signed Launchpad PPA, with a local PostgreSQL
sudo add-apt-repository ppa:bceverly/sysmanage
sudo apt update
sudo apt install sysmanage postgresql
# 2. Create the database
sudo -u postgres createuser sysmanage
sudo -u postgres createdb sysmanage -O sysmanage
sudo -u postgres psql -c "ALTER USER sysmanage WITH PASSWORD 'choose-a-strong-password';"
# 3. Set the database password and admin_userid (your email address)
sudo vim /etc/sysmanage.yaml
# 4. Create the database schema
sudo sysmanage-migrate
# 5. Install a TLS certificate at /etc/sysmanage/tls/server.crt and server.key
# (or point nginx at yours), then start
sudo systemctl start sysmanage
sudo systemctl restart nginx
Open https://your-server.example.com/ and sign in as admin_userid with the
recovery password the package generated (sudo grep admin_password /etc/sysmanage.yaml). Inbound 443 (and 80 for the redirect) is the only port
the server needs.
Other channels, all signed: the SysManage APT repository for Debian
(https://repo.sysmanage.org/server/deb, key fingerprint
896E ED43 9F5E 9BB1 FCA6 69A5 E033 E691 377F 0AE3), Fedora Copr
bceverly/sysmanage for the RHEL family 9 and 10, the openSUSE Build Service,
the Snap Store (sudo snap install sysmanage), winget
(winget install sysmanage.sysmanage), Homebrew
(brew install --cask bceverly/tap/sysmanage) and the AUR. The Alpine, BSD,
macOS .pkg and Windows .msi downloads are not signed; check the .sha256
published next to each one before installing.
For working on SysManage itself. A source checkout runs the development server (Vite on port 3000, API on 8080); do not use it in production.
Prerequisites:
# 1. Clone and install the development tools and dependencies
git clone https://github.com/bceverly/sysmanage.git
cd sysmanage
make install-dev
# Note: Rust is required for some Python dependencies
# FreeBSD users also need: sudo pkg install py311-sqlite3 jpeg-turbo tiff freetype2 png webp lcms2
# 2. Create a PostgreSQL database and user, then the development config
cp sysmanage-dev.yaml.example sysmanage-dev.yaml # set dev_mode: true and the database
# 3. Initialize the checkout: new secrets, admin user, OpenBAO.
# This DROPS every table in the configured database.
scripts/sysmanage_secure_installation
# 4. Start the application
make start
The secure-installation script is only for source checkouts; package installs do their own setup and must not run it.
# Run all tests
make test
# Backend tests only
python -m pytest tests/ -v
# Frontend tests only
cd frontend && npm test
# End-to-End tests (optional - requires Playwright)
# Note: Playwright may not be available on all platforms (e.g., OpenBSD)
npm run test:e2e
# Linting
make lint
sysmanage/
├── backend/ # FastAPI backend
│ ├── api/ # REST API endpoints
│ ├── auth/ # JWT authentication
│ ├── persistence/ # Database models and ORM
│ └── websocket/ # WebSocket communication
├── frontend/ # React frontend (Vite-based)
│ ├── src/Components/ # React components
│ └── src/Pages/ # Page components
├── tests/ # Backend Python tests
├── alembic/ # Database migrations
└── requirements.txt # Python dependencies
When running the backend server, interactive API documentation is available at:
SysManage supports 14 languages with full localization:
| Language | Code | Status |
|---|---|---|
| English | en | ✅ Complete |
| Spanish | es | ✅ Complete |
| French | fr | ✅ Complete |
| German | de | ✅ Complete |
| Italian | it | ✅ Complete |
| Portuguese | pt | ✅ Complete |
| Dutch | nl | ✅ Complete |
| Japanese | ja | ✅ Complete |
| Simplified Chinese | zh_CN | ✅ Complete |
| Traditional Chinese | zh_TW | ✅ Complete |
| Korean | ko | ✅ Complete |
| Russian | ru | ✅ Complete |
| Arabic | ar | ✅ Complete (RTL) |
| Hindi | hi | ✅ Complete |
SysManage implements enterprise-grade security features:
scripts/sysmanage_secure_installation must be run on new installationsWe test explicitly for the thirteen weakness classes in Steve Christey's
Unforgivable Vulnerabilities
(MITRE, Black Hat USA 2007) -- flaws so well known and so cheap to find that
shipping one is unforgivable. The checks live in tests/lucky13/, every test
names its number and CWE, and CI runs them as their own named step on every
push. The agent, Professional+ and documentation repositories run their own
tests/lucky13 (or equivalent) the same way.
| # | Class (CWE) | How the server is checked |
|---|---|---|
| 1 | Buffer overflow (120) | 100 KB fields on every sign-in and enrollment form; 8 KB path values on every route: refused cleanly, never a 5xx |
| 2 | Cross-site scripting (79) | No raw HTML sinks in the frontend; every server-built HTML response reviewed |
| 3 | Directory traversal (23) | ../.. and absolute paths in every path parameter |
| 4 | Remote file inclusion (98) | No eval/exec/dynamic import of request data; engines load only after signature verification |
| 5 | SQL injection (89) | ' OR 1=1 in the login and every id parameter: no login, no crash |
| 6 | World-writable files (276) | Code, scripts and installers never create world-writable files |
| 7 | Direct request (425) | Every route needs a login or is on a reviewed public list with its reason; every protected route refuses an anonymous call |
| 8 | Auth bypass via authenticated=1 (472) | Forged cookies, headers, query and form fields on every protected route |
| 9 | Home-grown crypto (327) | No weak or hand-rolled cryptography; security code uses secrets, not random |
| 10 | Privilege escalation via Help (271) | The privileged server never launches a browser, help viewer or shell UI |
| 11 | Symlink following (61) | No predictable temporary paths |
| 12 | Hard-coded / default password (259) | Example configurations may hold only placeholders; installers generate each install's JWT secret, salt and recovery password; a placeholder or well-known password never signs in |
| 13 | Integer overflow (190) | 0xffffffff, 2^63 and negative values in every integer path and query parameter |
Run them locally with make test-lucky13 (also part of make security and
make test).
📖 For complete security documentation, visit sysmanage.org/docs/security/
make start # backend + frontend dev server + OpenBAO
make stop
Install a package (.deb, .rpm, BSD package or port, macOS .pkg,
Windows .msi) rather than running the server by hand; every installer
sets it up the same way:
frontend/dist/, and proxies /api/ and the agent WebSocket to the
backend. That is the whole firewall requirement: inbound 443 on the
server, outbound 443 from each agent.api.host: localhost,
api.port: 8080 in /etc/sysmanage.yaml). It starts as a service
(systemd, rc.d, launchd or a Windows service) running
python -m backend.main from the install's virtual environment, never
a bare uvicorn on a public address.api.workers: auto): CPUs minus
a quarter, at most one per GB of memory beyond 2 GB, at most 16. More
than one worker requires PostgreSQL (the workers elect one leader for
background work and claim queued messages per host); SQLite always
runs one.# What the service runs (Linux path shown):
/opt/sysmanage/.venv/bin/python -m backend.main
📖 For detailed deployment instructions, visit sysmanage.org/docs/server/deployment.html
This project uses a dual conftest architecture for optimal test performance and database isolation:
/tests/conftest.py: Integration tests with full schema (Alembic migrations)/tests/api/conftest.py: Fast API tests with minimal dependencies (manual models)# Run all tests (backend + frontend + UI + performance)
make test
# Run specific test suites
make test-python # Backend tests only
make test-typescript # Frontend tests only
make test-playwright # UI tests only
make test-performance # Performance tests (Artillery + Playwright + regression analysis)
# Individual test files
python -m pytest tests/api/test_packages.py -v
python -m pytest tests/api/ -q --tb=no
SysManage includes comprehensive performance testing with multi-OS support:
# Run performance tests locally
make test-performance
# Performance requirements
npm install -g artillery@latest # For load testing
playwright install # For browser automation
📊 For detailed performance testing documentation, see PERFORMANCE_TESTING.md
CRITICAL: When adding new models, update BOTH conftest files:
alembic revision --autogenerate -m "Add NewModel"SQLite Compatibility Rules:
Integer primary keys (not BigInteger) for auto-incrementString instead of Text for better performanceDateTime columnsSee TESTING.md for detailed guidelines.
make test lint)📖 For detailed contribution guidelines, visit sysmanage.org/docs/
This project is licensed under the GNU Affero General Public License v3.0. See LICENSE for details.