For the people who keep servers running
What needs you today — and the evidence behind it.
Demerzel reads what your servers already say — metrics, packages, certificates, web and SSH logs — and turns it into a short, ranked list of what requires your attention. When attackers show up, it can block them too.
14-day free trial · No credit card required · One agent, installed in a minute
Thirty seconds, every morning
Three questions, answered before your coffee cools.
Not a wall of graphs to interpret. A list, ranked by severity, where every line says why it is there.
Is anything broken?
A host that stopped reporting is probed from outside, so “the agent is silent” and “the server is down” are never confused. Services, reachability and load are read, not guessed.
What is about to break?
Certificates close to expiry, a disk filling up at today’s rate, an OS past end of life, a kernel waiting for its reboot. The slow problems, flagged while they are still tasks.
Is someone attacking me?
Web and SSH logs are read on the host. Scanners, secret probes and password guessers become incidents with a cause, an impact and a timeline — and, if you allow it, a block.
Evidence, not opinions
Every conclusion shows its work.
Demerzel does not store a truth. It stores the facts your servers reported, never rewritten, and rebuilds the current picture from them.
- Incidents tell a story. Cause, impact and response on one timeline, reconstructed from the logs — nobody has to open one.
- Every Action links to its facts. Which package, which certificate, which requests, seen when.
- History is never overwritten. What was true last Tuesday is still answerable.
- +0 min A scanner starts probing 26 sites on this server/.env, wp-login.php, vendor/phpunit…
- +6 min Hundreds of dynamic requests a minute from one addressevery page a PHP render, none cached
- +11 min Database connections climb, pages slow downimpact on 4 services
- +14 min Load reaches 107 on 8 vCPUserver metrics
- +25 min Traffic back to normal
- With Active Defense on: banned at +0S1-secret-probe fires on the first /.env, in about a second
Active Defense
Blocks attackers. Proves it won’t block your customers first.
It was built after a single scanner swept 26 sites on one server and pushed its load from 1
to 107. Today, the same scanner is cut off at its first /.env, about a second later.
- Shadow first. Every decision is recorded, nothing is blocked until you say so.
- Replay before enforcing. Each rule is checked against your own logs. On two months of real traffic — 763,000 requests — it would have banned 82 attackers and not one customer.
- Your sessions are safe. Addresses you are logged in from via SSH are never blocked.
- Unban everywhere, in one click. From an address’s dossier, across every server.
$ sudo demerzel-warden status demerzel-warden 0.25.0 — mode ENFORCE firewall nftables · 3 ban(s), 0 throttle(s), 2 operator(s) protected caps: 30 new blocks a minute, 10000 per set, 672h0m0s max, no address over 10 % of the hour's traffic Rules: S1-secret-probe ENFORCE S2-cms-probe ENFORCE rate-dynamic shadow (not cleared) ssh-bruteforce ENFORCE
Security checklist
Sixteen checks that matter, on every server.
Not a compliance framework — the handful of things that actually get servers owned. Each one is read from the host, and each failure comes with how to fix it.
- SSH by key only, no password login as root, guessers blocked.
- No database or admin service open to the internet; a firewall that refuses the rest.
- Security updates installed — and installing themselves.
- No
.envor.gitserved; every site on valid HTTPS.
- SSH logins by key only
- SSH guessers get blocked
- Every phpMyAdmin behind a basic auth
- A firewall refuses what is not allowed
- No database or admin service open to the internet
- Security updates installed
- No secret file served
- Every site on valid HTTPS
- Active Defense blocks attackers
A verifiable agent
Don’t trust the agent. Check it.
An agent on your servers should earn its place. Ours opens no port, changes nothing, and shows you every byte it sends.
inspectprints the exact payloads a live run would send — and sends nothing. A test fails our build if the two ever differ.transmissionslists what was actually sent, from a local journal.- Mutual TLS. Each agent has its own certificate; identity never comes from the payload.
# see what would be sent, before enrolling $ demerzel-agent inspect > payload.json # see what was sent $ demerzel-agent transmissions # nothing listens $ sudo ss -ltnp | grep demerzel $
Running in a minute
Two commands. No server to host.
A single static binary, checksum-verified, run as an unprivileged service. Your server shows up on the dashboard within a minute; log access is a separate, explicit grant.
How it works$ curl -fsSL https://get.demerzel.cloud/install.sh | sh $ curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh -s <your-token>
For agencies & MSPs
One organization per client, a click apart.
Roles, public health pages and badges, per-server silences and an audit trail — built for people who run other people’s servers.
Everything in the box
Shipped, running in production, on every plan.
Health Score
One score per server, from six factors: capacity, updates, security, exposure, availability and agent.
Actions
Derived from the evidence, ranked by severity, and gone by themselves once the cause is fixed.
Certificates & domains
Seen from the host and probed from outside, sorted by soonest expiry.
Vulnerabilities
Installed packages matched against OSV advisories, per server.
Security checklist
Sixteen checks per server, from SSH by key only to phpMyAdmin behind a basic auth.
Incidents & IP dossiers
Every attacking address gets a dossier: what it tried, where, when, and what was done.
Metrics
CPU, memory, disk and load, kept 48 hours raw, then downsampled for the long view.
Notifications
Email, Slack or webhook — once per situation, not once per check.
Public share
Share a server’s health with a client as a page, a badge or a card, and revoke it any time.
Organizations & roles
Several organizations per account; owner, admin and read-only roles; a full activity log.
Passkeys
Sign in with Face ID or Touch ID, with an emailed code as the fallback.
Signed updates
Agent releases are signed with Ed25519 and verified before install. Auto-update is opt-in.
FAQ
Questions, answered honestly.
What does the agent actually do on my server?
It reads: metrics, packages, services, certificates, domains, and — if you grant it — web and SSH logs. It sends what it read to Demerzel over mutually authenticated TLS. It opens no port and changes nothing on the host. Run demerzel-agent inspect to see exactly what it would send, before you even enroll it.
Then how can Active Defense block anything?
Through a separate, optional program: the warden. It has no network access, reads a policy only root can write, and does one thing — maintain its own nftables table. It starts in shadow mode, and each rule is enforced only after you replay your own logs against it.
Will it block my customers?
That is what the guardrails are for. Your own SSH sessions are protected automatically, every rule must pass a replay of your real traffic first, blocks are capped per minute and per set, no address carrying more than 10% of the hour’s traffic is ever blocked, and a rule that errs is demoted on its own.
Where is my data hosted?
In Canada, on OVHcloud infrastructure in Beauharnois, Québec; encrypted backups are kept on a separate OVHcloud server in the United Kingdom. Raw facts are kept 30 days; security evidence 30 to 90 days; enforcement records one year. Alert emails are delivered by Mailgun, in the United States.
Is there a free trial?
Yes — a 14-day free trial, no credit card required.
Can I monitor several customers from one account?
Yes. One account can belong to several organizations, each with its own servers, members and roles, and switch between them.
Start monitoring in minutes, not weeks.
No servers to maintain. No painful setup. See your whole infrastructure in one place.
14-day free trial · No credit card required