Fleet & Nodes
The Nodes page for connected, provisioned, and provider-discovered machines, with live status, resource use, backup health, origin evidence, and on-box operations.
Fleet & Nodes
The Nodes page (nav: Fleet → Nodes) is your fleet at a glance: every machine running the HostSSH agent, across any provider or physical location (cloud VPS, bare metal, office, GPU rental), in one table. From here you inspect a Node's live resources (including GPU stats when present) and backup posture, reclaim disk, and jump to capture, restore, or its operating surface without leaving the view.
Access needs the fleet.view privilege; without it the page shows a locked state.
On-box cleanup additionally needs images.manage (see On-box actions).
Vocabulary
HostSSH names the fleet consistently. You'll see these terms across the dashboard:
| Term | What it means |
|---|---|
| Node | A single machine running the HostSSH agent (any provider, bare metal, or a box you own). |
| Rack | The Slots-view of a Node — its capacity broken into slots. See Slots. |
| Slot | A unit of capacity on a Node. |
| Mesh | The private overlay network that bonds Nodes together (WireGuard). |
| Fleet | The collective — every Node under your license. |
A Node appears here the moment its agent activates a license and sends its first heartbeat. Use Add node on this page to pick a capacity role (general · inference · automation), copy a one-line installer, and wait for that first heartbeat — the row builds itself from what the agent reports (including role tags).
The summary bar
Four counters sit above the table, computed from real Nodes only (demo/seed rows are counted separately):
| Stat | Meaning |
|---|---|
| Total (real) | Live Nodes in your fleet. A +N demo / seed note shows any sample rows. |
| Online | Nodes that heartbeat in the last 3 minutes. |
| Degraded / offline | Nodes with a stale (3–15 min) or missing (>15 min) heartbeat. |
| Drills overdue | Agent-connected Nodes that have never recorded a verified restore-drill. |
The Nodes table
Each row is one Node. Filter chips (All / Online / Degraded / Offline / Provisioning) narrow the list. Columns:
| Column | What it shows | Source |
|---|---|---|
| Node | Node name, agent version, acquisition origin, provider, and public IP. | agent heartbeat + provisioning ledger |
| Status | online · degraded · offline · provisioning · migrating, derived from heartbeat freshness. | heartbeat age |
| Role | The Node's declared role. | Node metadata |
| CPU / Mem / Disk | Live utilization meters, each self-reported by the agent. | heartbeat sample |
| Backup | Last backup time — or no backups (agent installed, none captured yet) or no agent. | agent backup report |
| Uptime | Reachability percentage. | heartbeat |
The colored dot next to each name is backup health (healthy / warning / critical); a critical dot pulses.
The origin badge is evidence, not a management tier:
| Origin | Meaning |
|---|---|
| Provisioned | The node matches a durable HostSSH provision request. The drawer links to that request and shows its lifecycle state. |
| Connected | The node registered directly through the HostSSH agent, without a matching provision request. |
| Provider only | A provider connection can see the machine, but its HostSSH agent has not registered yet. Agent operations stay disabled. |
Connected and provisioned agent nodes use the same drawer, detail route, and operation set. Origin never grants or removes a capability.
Status is heartbeat-derived
A Node's status is set purely by how recently it last checked in:
| Heartbeat age | Status |
|---|---|
| under 3 minutes | online |
| 3–15 minutes | degraded |
| over 15 minutes | offline |
| never (just added) | provisioning |
Backup health follows the last capture the agent reported: a successful capture reads healthy, a failed one warning, and no capture yet unknown.
The Node drawer
Select a Node name to open a side drawer with its full detail.
Resources — CPU, Memory, and Disk meters, with disk showing total GB.
Disk cleanup — reclaim rebuildable disk safely (see On-box actions).
Connectivity
| Field | Meaning |
|---|---|
| Added through | Provisioned, Connected, or Provider only. |
| Provision request | The durable request ID, linked to the provisioning queue when evidence exists. |
| Provision state | The request's latest durable lifecycle state. |
| Public IP | The IP a DNS cutover would point a domain at. |
| WireGuard | The Node's mesh IP, or — if not on the mesh. |
| Region | Where the Node reports itself. |
| License | The license id this Node is bound to. |
Protection — Backup health, Last backup, Last restore-drill, and Uptime. The restore-drill line is the honest answer to "when was recoverability last proven?" — see Backups & recovery.
The drawer footer offers Capture now, Run restore drill, Operate, Recovery, and Slots. Connected and provisioned agents get the same controls. Machines marked Provider only explain why agent operations are unavailable.
On-box actions
Disk cleanup (prune)
Inside the Node drawer, Disk cleanup turns disk pressure into a safe, previewable reclaim job. It classifies the Node's disk as healthy (under 65%), pressure (65%+), or critical pressure (85%+), and shows exactly what's safe to remove versus what's protected.
| Rebuildable (removable) | Protected (never touched) |
|---|---|
Old hostssh/<app>:<tag> images beyond the newest few | Docker volumes |
| Dangling Docker image layers | Running containers |
| Build cache above the set GB budget | User media / uploads |
The :latest rollback target | |
.hsi backup images |
You set three policy values before running:
| Field | Default | Range |
|---|---|---|
| Keep per app | 3 | 1–100 images kept per app |
| Builder cache GB | 5 | 1–500 GB cache budget |
| Cache age hours | 0 (any) | 0–8760 hours |
Then choose:
- Preview cleanup — a dry run that queues a job and reports what would be reclaimed, with log output. Nothing is deleted.
- Queue reclaim — the real prune. The latest job's state, reclaimed GB, and log tail render in the drawer.
Cleanup is archive-first and never destructive to customer data: user media is
expected to be captured to .hsi/restic in your storage first, and cleanup never
cron-deletes backups — retention policy owns the backup lifecycle. The buttons are
disabled (with a reason) for demo rows, Nodes without an agent fingerprint, or accounts
lacking images.manage.
Firewall harden
Applying the host firewall (default-deny inbound, SSH always preserved agent-side) is not
driven from this table directly today — it's available through the
Fleet Copilot as a confirm-to-run proposal (harden_firewall), which needs
the platform.deploy privilege. See Hardening for the security model.
Adding a Node
Two buttons sit in the page header:
- Provision opens the evidence-backed provider queue. A created VPS becomes ready only after agent registration and protection proof. See Provisioning.
- Add node shows the signed one-line installer only when the configured release mirror is verified. While that release gate is closed, it shows an assisted-onboarding status instead of handing out a dead or unverified command. Full details are in Install on any VPS.
Related
- Getting started — add your first Node end to end.
- Observability — heartbeat telemetry, uptime %, alerts, and per-Node posture.
- Slots — the Rack / Slot capacity view.
- Backups & recovery — capture, restore, and relocate.