lerko 32982228b0
CI / test (push) Successful in 2m34s
CI / lint (push) Successful in 46s
CI / vulncheck (push) Successful in 40s
fix(security): patch Docker Scout CVEs and remove unused openssh-client (#41)
## Summary

- Upgrade `golang.org/x/net` v0.54.0 → v0.55.0 — patches 6 CVEs including critical CVE-2026-41589 (CVSS 9.6)
- Remove `openssh-client` from Docker image — unused (uptop uses pure Go SSH), eliminates 4 CVEs
- Add `apk upgrade` to Dockerfile for remaining Alpine package CVEs

## CVEs Resolved

| CVE | Severity | Package | Fix |
|-----|----------|---------|-----|
| CVE-2026-41589 | 9.6 Critical | golang.org/x/net | upgraded to v0.55.0 |
| CVE-2025-60876 | 6.5 Medium | golang.org/x/net | upgraded to v0.55.0 |
| CVE-2026-42502 | 6.1 Medium | golang.org/x/net | upgraded to v0.55.0 |
| CVE-2026-42506 | 6.1 Medium | golang.org/x/net | upgraded to v0.55.0 |
| CVE-2026-25681 | 6.1 Medium | golang.org/x/net | upgraded to v0.55.0 |
| CVE-2026-35414 | 6.1 Medium | golang.org/x/net | upgraded to v0.55.0 |
| CVE-2026-25680 | 7.5 High | alpine/openssh | removed openssh-client |
| CVE-2026-35386 | 3.6 Low | alpine/openssh | removed openssh-client |
| CVE-2026-35387 | 3.1 Low | alpine/openssh | removed openssh-client |
| CVE-2026-35388 | 2.5 Low | alpine/openssh | removed openssh-client |
| CVE-2026-27136 | 6.5 Medium | alpine/busybox | apk upgrade |

## Not Addressed (not exploitable)

CVE-2026-35385 (charmbracelet/wish v1.4.7, CVSS 9.6) — path traversal in wish's SCP middleware. uptop does not use the SCP middleware, only wish core + bubbletea middleware. Vulnerable code path is never loaded. Migration to wish v2 tracked in #42.

## Test Plan

- [x] `go build ./...` passes
- [x] `go test ./...` passes
- [ ] Rebuild Docker image, re-scan with Docker Scout

Reviewed-on: #41
2026-05-30 00:33:20 +00:00
2026-05-29 15:42:51 -04:00
2026-05-29 15:17:09 -04:00

uptop

Self-hosted uptime monitoring with a TUI over SSH.

No browser. No client install. Just ssh -p 23234 your-server.

CI MIT License Go 1.26 Docker Pulls

uptop monitors view

What is this

An uptime monitor you manage entirely from the terminal. It runs as a server, exposes an SSH endpoint, and drops you into a full TUI — monitors, alerts, logs, nodes, all there.

Built on RDGames/go-upkeep. Rewritten for clustering, config-as-code, and a proper dashboard.

Features

  • 6 check types — HTTP, Push (heartbeat), Ping, Port, DNS, Groups
  • 9 alert providers — Discord, Slack, Email, Ntfy, Webhook, Telegram, PagerDuty, Pushover, Gotify
  • Config as code — define monitors in YAML, apply declaratively, version control your setup
  • HA clustering — leader/follower with automatic failover
  • Prometheus metrics/metrics endpoint, wire it straight to Grafana
  • Public status page — HTML + JSON, toggle with an env var
  • SQLite or Postgres — SQLite for single-node, Postgres for production
  • Uptime Kuma import — migrate from Kuma with one command

Screenshots

detail panel alerts view
logs view cluster nodes
theme selection

Quick start

go run cmd/uptop/main.go
ssh -p 23234 localhost

Want some data to look at first:

go run cmd/uptop/main.go -demo

Install

Docker (recommended)
services:
  uptop:
    image: lerkolabs/uptop:latest
    restart: unless-stopped
    ports:
      - "23234:23234"
      - "8080:8080"
    environment:
      - UPTOP_DB_TYPE=sqlite
      - UPTOP_DB_DSN=/data/uptop.db
      - UPTOP_STATUS_ENABLED=true
      # - UPTOP_ADMIN_KEY=ssh-ed25519 AAAA... you@host
    volumes:
      - ./data:/data

First run: set UPTOP_ADMIN_KEY to your SSH public key, or attach to the container and add it in the Users tab.

Binary

Download from Releases.

From source
go install gitea.lerkolabs.com/lerkolabs/uptop/cmd/uptop@latest

Config as code

Export your current monitors:

uptop export -o monitors.yaml

Apply a config file:

uptop apply -f monitors.yaml
uptop apply -f monitors.yaml --dry-run   # see what would change
uptop apply -f monitors.yaml --prune     # delete anything not in the YAML

Full reference in docs/config-as-code.md.

Environment variables

Variable Default Description
UPTOP_PORT 23234 SSH server port
UPTOP_HTTP_PORT 8080 HTTP server port (status page, push, metrics)
UPTOP_DB_TYPE sqlite sqlite or postgres
UPTOP_DB_DSN uptop.db Database path or connection string
UPTOP_STATUS_ENABLED false Enable public status page
UPTOP_STATUS_TITLE System Status Status page title
UPTOP_CLUSTER_MODE leader leader or follower
UPTOP_PEER_URL Leader URL for follower nodes
UPTOP_CLUSTER_SECRET Shared key for cluster + API auth
UPTOP_INSECURE_SKIP_VERIFY false Skip TLS verification for checks
UPTOP_ADMIN_KEY SSH public key seeded as first admin on startup

Migrating from Uptime Kuma

Export your Kuma backup JSON, then:

curl -X POST http://localhost:8080/api/import/kuma \
  -H "X-Upkeep-Secret: your-secret" \
  -H "Content-Type: application/json" \
  -d @kuma-backup.json

License

MIT — see LICENSE.

S
Description
Live uptime monitoring dashboard for your terminal. SSH-accessible. HTTP, ping, TCP, DNS, push checks with alerts, clustering, and Prometheus metrics.
Readme MIT 2.2 MiB
2026.05.6 Latest
2026-05-30 23:34:56 +00:00
Languages
Go 99.7%
Dockerfile 0.3%