zorin-node

Linux VPS runtime for Zorin Ops.

Inventory

zorin-node snapshot --json returns bounded infrastructure telemetry: OS/kernel/architecture/CPU count, uptime/load/RAM, filesystems, running/failed systemd services, listening sockets, top processes and Docker containers.

Daemon

sudo zorin-node install copies the binary to /usr/local/sbin/zorin-node, installs zorin-node.service and starts a root-only Unix socket at /run/zorin-node/node.sock. The daemon exposes local /health and /v1/snapshot HTTP endpoints without opening a TCP port.

Zorin SSH CA enrollment

printf '%s\n' 'ssh-ed25519 AAAA... Zorin Trust SSH User CA' | sudo zorin-node ssh-ca install --stdin
zorin-node ssh-ca status
sudo zorin-node ssh-ca remove

Enrollment writes /etc/ssh/zorin-trust-user-ca.pub and /etc/ssh/sshd_config.d/90-zorin-trust-ca.conf. Before reload, Zorin Node runs sshd -t and verifies with sshd -T that TrustedUserCAKeys is actually effective. If validation/effectiveness fails, the previous files are restored.

Docker

zorin-node docker logs [--tail N] <container> is read-only. start|stop|restart remain narrow actions invoked by Ops only after its authorization flow.

Source · MIT