# Peace of Mind

A production operations monitor: health checks, TLS certificate tracking, remote test orchestration, peer mesh, and email alerts. Built with Rust, Tokio, Axum, and SQLite.

## Prerequisites

- **Rust** (stable toolchain, 2024 edition)
- **Config file** at `~/.config/pom/pom.toml` (targets, peers, alert settings)

## Usage

PoM operates in three modes: CLI, HTTP daemon, and MCP server.

```sh
# Run all configured health checks once
pom check

# Start the HTTP API daemon (periodic checks, peer heartbeats, pruning)
pom serve

# Start as an MCP server (stdio transport, for Claude integration)
pom

# Show current status of all targets
pom status

# Show what version each target is running, and how far behind local HEAD
pom versions

# Run remote test suites via SSH
pom test

# Show TLS certificate expiry for monitored hosts
pom tls
```

### MCP tools

In MCP mode, five read-only tools answer "what is live right now" without an
ssh: `status_table` (every target on one line, worst first), `target_status`
(one target's full condition list), `versions`, `incidents`, and `trends`. None
of them can promote, deploy, or close anything.

Each takes an optional `instance`. Omitted, it reads this machine's database
directly and works whether or not a daemon is running here. Named, it reads that
configured peer's HTTP API over the tailnet, which is the only way to see checks
local to that host: systemd units and backup freshness on the production box are
not observable from anywhere else.

## Configuration

PoM reads `~/.config/pom/pom.toml`. The config defines:

- **Targets**: HTTP endpoints to monitor, with expected status codes, JSON field checks, body substring matches, and check intervals
- **Peers**: other PoM instances in the mesh (URL, bearer token, heartbeat interval, grace period)
- **Alerts**: Postmark API credentials, recipient addresses, per-target cooldowns (falls back to stdout in dev mode)
- **TLS**: hosts to probe for certificate expiry warnings
- **Tests**: SSH targets and commands for remote test suite execution
- **Repo**: per-target local checkout (`path`, optional `subdir`) that `pom versions` counts the live build against. Optional; without it the commits-behind column is blank
- **SyncKit fleet**: per-target readout of which SyncKit SDK versions are syncing (`base_url`, `window_days`, intervals). Reuses the alerts ingest token; informational, so an old version in the field never degrades a target

## Module Overview

| Module | Role |
|--------|------|
| `main.rs` / `cli.rs` | Binary entry point, CLI argument parsing and dispatch |
| `config.rs` | TOML config loading and validation |
| `types.rs` | Shared domain types |
| `checks/` | HTTP health checks, TLS probes, SSH test runners |
| `peer.rs` | Peer mesh heartbeats, identity verification, grace periods |
| `db.rs` | SQLite persistence (incidents, history, trends) |
| `api.rs` | Axum HTTP API (status, trends, mesh data) |
| `alerts.rs` | Email alerts via Postmark API |
| `tools/` | MCP tool definitions for Claude integration, including the read-only orientation set |
| `versions.rs` | Live version per target and how far it is behind the local checkout |
| `display.rs` | Terminal output formatting |
| `error.rs` | Error types |

## License

PolyForm Noncommercial 1.0.0