Host signals, organized for operators.

IronGargoyle brings host condition, storage health, authentication-abuse activity, TCP pressure, events, terminal access, and protection posture into one focused console.

Focused views for day-to-day host operations.

Host condition

Overview / Services / Events

Host identity, protection posture, active service issues, recent activity, and module summaries.

Storage visibility

HDoracle / SMART / RAID / JBOD

Filesystem usage, SMART context, RAID virtual drives, member drives, and storage issues.

Access pressure

Warder / Auth abuse / Firewall backend

Authentication-abuse signals, manual blocks, ASN preview, allow-list protection, and backend verification.

Connection pressure

StormWatch / TCP states / History

TCP pressure, source concentration, service focus, trend history, handoff review, and adaptive state.

Operator control

Settings / Terminal / Audit

Protection modes, staged settings, trusted shell access, service controls, and audit-friendly workflows.

Current WebUI surfaces.

StormWatch pressure history chart — Connection-pressure samples and trend context.

HDoracle disk usage view — Filesystem usage and storage context.

IronGargoyle Events page — Detections, policy gates, action outcomes, and summaries.

Protected Services settings — Service monitoring and guarded configuration controls.

StormWatch signals page — TCP state, source pressure, and service focus.

IronGargoyle terminal showing df -h output — Trusted operator validation from the authenticated console.

Native Linux components, exposed through a local-first console.

IronGargoyle reads operating-system signals and presents them through a focused web console.

Target platformAlmaLinux 9 / EL9 family

RuntimePython 3.11+, FastAPI, Uvicorn

Service modelsystemd agent and console services

Access modeslocal-only or public-management

Storage visibilitySMART, RAID, StorCLI where available

Firewall backendsnft, firewalld, iptables