Meet Pantau: Agentless Linux Server Monitoring & Management in a Single Go Binary

The Problem: The Observability Tax for Small and Mid-Sized Fleets

If you manage anywhere from 3 to 50 Linux servers—whether cloud VPS, homelab machines, or edge nodes—you've likely experienced the "observability tax."

Setting up a traditional monitoring stack often looks like this:

Install and configure node_exporter on every remote machine.
Set up Prometheus scrapers, storage rules, and retention policies.
Build or import Grafana dashboards.
Configure Alertmanager.
Keep agent daemons updated across disparate Linux distributions (Ubuntu, Debian, RHEL, CentOS).

And when an alert fires? You still have to alt-tab out of your dashboard, open a terminal, SSH into the box, and manually run journalctl -u <service> -e or docker logs --tail 50 <container> to figure out what actually crashed.

What if server monitoring and management could be a single static binary with zero remote agents?

That is why Pantau was built.

What is Pantau?

Pantau (an Indonesian word meaning to monitor or oversee) is a self-hosted, lightweight, single-binary server monitoring and interactive management system written in Go.

Unlike Prometheus, Zabbix, or Datadog, Pantau operates 100% agentless over standard SSH (port 22).

Your target servers require:

❌ No background agents
❌ No daemon installation
❌ No open telemetry ports
❌ No persistent background CPU/memory scrapers

Just standard POSIX tools (ps, df, free, /proc/diskstats) and native SSH access.

🏛️ Architecture: Boring, Predictable, and Self-Contained

Pantau is engineered with an uncompromising zero-dependency philosophy:

 +--------------------------------------------------+ | Web Browser Client | | (Single-Page App, Fixed Shell, xterm.js) | +------------------------+-------------------------+ | HTTP / WebSocket v +--------------------------------------------------------------------------------------------------------------------+ | PANTAU CONTROL PLANE (Go) | | | | +---------------------+ +---------------------+ +---------------------+ +--------------------------------+ | | | Inspection Loop | | Drift Engine | | Hybrid Alerting | | Cross-Host Transfer Engine | | | | (SSH Collector: 5m) | | (Desired vs Actual) | | (Telegram/Webhooks) | | (Piped FIFO Stream, Zero-Disk) | | | +----------+----------+ +----------+----------+ +----------+----------+ +---------------+----------------+ | | | | | | | | +-------------------------+------------+------------+ | | | | | | | +------------v-------------+ | | | | Embedded SQLite (WAL) | | | | | Encrypted Snapshot/Argon2| | | | +------------+-------------+ | | +----------------------------------------------------|-------------------------------------------|-------------------+ | Native SSH Protocol | Stream Pipe v v +-------------------------------------------+ +-------------------------------------------+ | Remote Linux Host A | | Remote Linux Host B | | (Ubuntu / Debian / RHEL / CentOS 6-9) | | (Ubuntu / Debian / RHEL / CentOS 6-9) | | - POSIX Standard CLI Tools (`ps`, `df`) | | - POSIX Standard CLI Tools (`ps`, `df`) | | - Docker Engine / Containers | | - Docker Engine / Containers | | - No Daemons / No Agents Installed | | - No Daemons / No Agents Installed | +-------------------------------------------+ +-------------------------------------------+

Backend: Pure Go standard library + crypto SSH.
Database: Embedded pure-Go SQLite (modernc.org/sqlite) running in Write-Ahead Logging (WAL) mode.
Frontend: Zero-npm, zero-CDN vanilla SPA embedded directly into the Go executable via go:embed.
Airgapped-First: Works seamlessly inside isolated VPCs and private intranets without internet access.

✨ Standout Features

1. 🔍 Agentless SSH Inspection with 1-Click Key Provisioning

Add a server by IP and port. Pantau can provision its universal RSA-4096 public key into ~/.ssh/authorized_keys in one click (storing root passwords only in volatile RAM during handoff and wiping them immediately).

It even supports legacy cipher fallbacks (aes128-cbc, 3des-cbc, diffie-hellman-group1-sha1) so you can monitor vintage machines (like CentOS 6 or Debian 7 with OpenSSH 5.3+) without touching their sshd configurations.

2. 📋 Desired State Baseline & Drift Detection

Traditional monitoring tells you current usage. Pantau introduces a Desired State Drift Engine:

One-click snapshot of baseline running Docker containers, systemd services (nginx, mysqld, postgres, redis), cron jobs, and mounted disks.
If a container stops, a database service halts, or a cron job vanishes, Pantau triggers immediate drift warnings.

3. 🩺 Automatic Root Cause Excerpt Diagnostics

When a service crashes or drifts, you don't need to guess why. Pantau automatically inspects the crash context:

Captures Docker container exit codes and the OOMKilled memory termination flag.
Pulls the trailing 50 lines of logs from journalctl -u <service> or docker logs <container> directly into the dashboard incident timeline.

4. 🖥️ Global Multi-Tab Web Terminal Dock & SFTP File Manager

Pantau doesn't just show charts; it lets you fix issues right from your browser:

Web Terminal: Powered by xterm.js over WebSocket SSH PTY sessions. Supports split panes (Alt+\), session persistence, and full-viewport maximization.
SFTP Explorer & Code Editor: Browse remote server filesystems, inspect permissions, duplicate files with disk space safety checks, and edit configuration files using an embedded CodeMirror editor with syntax highlighting.

5. 🚀 Memory-Piped Cross-Host File Streaming

Need to move a 10 GB backup directory or database dump from Server A to Server B?
Pantau streams the data directly through memory pipes using SSH streams (tar pipes) without writing anything to Pantau's local disk. It also offers a Verified Mode that calculates SHA-256 checksums end-to-end on both ends.

6. 🔐 Encrypted Snapshots & Disaster Recovery

Export your entire monitoring setup—including encrypted credentials and desired state configurations—into an .enc snapshot protected by Argon2id key derivation and AES-256-GCM encryption.
You can even automate backups to a private GitHub repository and restore an entire cluster in seconds using a one-click Disaster Recovery wizard.

7. 🛡️ Airgapped TOTP Two-Factor Authentication (2FA)

Security out of the box: RFC 6238 TOTP authentication with client-side QR generation, brute-force rate-limiting, single-use recovery codes, and an emergency -disable-2fa flag on the master host console if you ever lock yourself out.

🚀 Getting Started in 30 Seconds

Option 1: Standalone Binary (Simplest)

Download the pre-compiled binary from GitHub Releases:

# Make it executable chmod +x pantau # Launch Pantau on port 8080 ./pantau -port 8080 -db data/pantau.db

Open http://localhost:8080 in your browser.

Log in with the default password: admin (remember to change it in Settings!).

Option 2: Docker Compose

version: "3.8" services: pantau: image: ghcr.io/herliansyah/pantau:latest container_name: pantau restart: unless-stopped ports: - "8080:8080" volumes: - pantau-data:/data environment: - PANTAU_PORT=8080 - PANTAU_DB=/data/pantau.db volumes: pantau-data:

Run:

docker compose up -d

💡 Who is Pantau for?

Sysadmins & DevOps Engineers who want an all-in-one control plane for multiple remote servers without deploying agents.
Homelab Enthusiasts & Indie Hackers running a handful of VPS instances who want lightweight observability without Grafana/Prometheus resource overhead.
Airgapped / Isolated Network Environments where servers cannot reach the public internet or external CDNs.
Legacy Fleet Maintainers who need to monitor older Linux distributions alongside modern distributions.