Chapter 12 — Sysadmin Tools

The Preview → Sysadmin submenu collects everything aimed at IT operations — Windows management, patch management, configuration management, containers, monitoring, alerting, backup, and disaster recovery. The tools share a feature-tab layout and most can be driven against a single host or a fleet group.

Preview
└── Sysadmin
    ├── Windows Management ▶
    │   ├── WinRM Client
    │   ├── Active Directory
    │   ├── Windows Services
    │   └── Windows Updates
    ├── Patch Manager
    ├── Patch Policies
    ├── Configuration Management ▶
    │   ├── Ansible Runner
    │   ├── Desired State Configuration
    │   ├── Config Drift Detection
    │   └── Template Manager
    ├── Containers ▶
    │   ├── Docker Manager
    │   ├── Docker Compose
    │   ├── Kubernetes Client
    │   └── Registry Client
    ├── Monitoring Dashboard
    ├── Alert Manager
    ├── Metrics Collector
    ├── Backup Manager
    └── Disaster Recovery

Windows management

WinRM Client

Open from Preview → Sysadmin → Windows Management → WinRM Client.

Connects to Windows hosts via WinRM (HTTP 5985, HTTPS 5986). The remote box needs WinRM enabled — on the target, run Enable-PSRemoting -Force in an elevated PowerShell.

Once connected, you get a PowerShell-like terminal. WinRM is the Windows analogue of SSH; commands run as the authenticated user.

Active Directory

Preview → Sysadmin → Windows Management → Active Directory.

Browse and search AD objects:

Users — list, find, view memberOf, disable/enable (WRITE).
Groups — membership view, add/remove members (WRITE).
Computers — list, OS, last logon.
OUs — tree view.

Needs an LDAP bind credential. AD ports: 389 LDAP, 636 LDAPS. Use LDAPS for anything beyond a lab.

Windows Services

Preview → Sysadmin → Windows Management → Windows Services.

Equivalent of services.msc over WinRM. List services, start/stop/restart, change startup type. All WRITE actions confirm.

Windows Updates

Preview → Sysadmin → Windows Management → Windows Updates.

Inventory of pending updates on a remote Windows host. Approve and install via Install-WindowsUpdate (requires the PSWindowsUpdate module on the target — install with Install-Module PSWindowsUpdate).

Patch management

Patch Manager

Preview → Sysadmin → Patch Manager.

Cross-platform patch inventory. Targets a host or a fleet group:

Linux: aggregates apt list --upgradable / dnf check-update / yum check-update output.
Windows: pulls pending updates via WinRM.
Container hosts: image vulnerability counts via Trivy if available.

Per-host findings table: package, current, available, severity (security/normal). Bulk Approve & Apply runs the appropriate package manager command in parallel.

Patch Policies

Preview → Sysadmin → Patch Policies.

Per-group rules: when to auto-approve (e.g. security-only auto-approve, normal patches require human approval), maintenance windows, reboot policy.

Policies are JSON files in ~/.aidaide/patch_policies/. Editable in the UI or directly.

Configuration management

Ansible Runner

Preview → Sysadmin → Configuration Management → Ansible Runner.

A friendly UI on top of ansible-playbook:

Pick or write a playbook (top pane).
Pick an inventory (or use Fleet group as inventory).
Variables (key=value list).
Run.

Output streams below with per-task status. Failures highlighted. ansible and ansible-playbook must be installed locally; AidaIDE shells out to them.

Desired State Configuration

Preview → Sysadmin → Configuration Management → Desired State Configuration.

For Windows: leverages PowerShell DSC. Pick a .ps1 configuration, target hosts, push. Compliance results in a table.

For Linux: a thin wrapper around chosen DSC-style tools (your install) — useful if your team standardised on something other than Ansible.

Config Drift Detection

Preview → Sysadmin → Configuration Management → Config Drift Detection.

Captures a baseline snapshot of a host (selected config files, package set, service states) and periodically re-snapshots to detect drift. Drift summary highlights what changed and when.

Default baseline paths: /etc/, /usr/local/etc/, plus per-service add-ons (nginx, postgres, etc.). Configurable.

Template Manager

Preview → Sysadmin → Configuration Management → Template Manager.

Library of config templates (Jinja2) with per-host variable sets. Render → preview → push.

Containers

Docker Manager

Preview → Sysadmin → Containers → Docker Manager.

Docker desktop UI for a single host (local or remote):

Containers — list, start/stop, logs, exec.
Images — list, pull, build, prune.
Volumes / Networks — basic management.

Connects via the Docker socket. For remote hosts, that means either Docker context (docker context create) or socket-over-SSH (the Docker Manager UI sets it up).

Docker Compose

Preview → Sysadmin → Containers → Docker Compose.

Project-level UI: open a docker-compose.yml, get a graphical view of services and dependencies, up/down/restart per-service or all.

Kubernetes Client

Preview → Sysadmin → Containers → Kubernetes Client.

Read-friendly kubectl-on-rails:

Namespace + resource tree.
Pods → describe / logs / exec.
Deployments → rolling restart.
Apply YAML from an editor pane.

Uses your ~/.kube/config. Context switcher at the top.

Registry Client

Preview → Sysadmin → Containers → Registry Client.

Browse Docker registries (Docker Hub, GHCR, ECR, GCR, private). Search images, view tags, pull. Push requires login (Docker CLI must be configured on your machine).

Monitoring & alerts

Monitoring Dashboard

Preview → Sysadmin → Monitoring Dashboard.

A grid of host health cards (CPU, memory, disk, load, network). Each card pulls from aida-lite metrics if installed, else from on-demand SSH probes.

Configurable refresh interval. Click a card to drill into a per-host metrics page with line charts.

Metrics Collector

Preview → Sysadmin → Metrics Collector.

Configures what AidaIDE collects from each host: which metrics, what interval. Metrics are stored locally in a TSDB (~/.aidaide/metrics.db) and queried by Monitoring Dashboard.

For larger setups, point AidaIDE at Prometheus or InfluxDB instead of using the local TSDB.

Alert Manager

Preview → Sysadmin → Alert Manager.

Rules engine on top of collected metrics:

IF cpu_load > 90% for 5 min THEN webhook / email / Slack.
IF disk_free < 10% THEN email + open a Fleet Manager flag.

Channels configured in Settings → Network → Notifications. Each rule has a per-channel routing.

Backup & disaster recovery

Backup Manager

Preview → Sysadmin → Backup Manager.

Per-host backup jobs:

Source — paths on the remote host.
Destination — local archive directory, S3-compatible bucket, or rsync target.
Schedule — one-shot, daily, weekly, custom cron.
Retention — keep N days / N copies.

Jobs run on the AidaIDE host (your machine), pulling from remotes over SFTP or running remote tar/rsync as appropriate.

Disaster Recovery

Preview → Sysadmin → Disaster Recovery.

Restoration side of Backup Manager. Pick a backup snapshot, pick a destination host, push the contents. Useful for "the SD card died, here is the replacement Pi, make it look like the old one."

DR also documents your runbooks — a per-host page with notes, contact info, snapshot history.

Workflows

"Patch every Pi in the lab"

Patch Manager.
Target = Fleet group "Lab."
Filter to security updates only.
Approve & Apply. AidaIDE runs apt upgrade <pkg> per host in parallel.
Watch the per-host status table.

"Drift hunt — what changed on prod-web-01 this week?"

Config Drift Detection → prod-web-01.
Snapshot history → last 7 days.
Click a diff row to see file-level changes.

"Spin up a new microservice on my k8s cluster"

Kubernetes Client → Apply YAML.
Paste/import the Deployment + Service.
Apply. Watch pod status in the tree.

"Set up nightly backups of /etc on every Pi"

Backup Manager → New Job.
Source = /etc, destination = local archive directory.
Schedule = daily at 03:00.
Retention = 30 days.
Add all Pis from the fleet group.

Terms & Setup

WinRM

Windows Remote Management. The Microsoft protocol for running PowerShell on remote Windows boxes. Two ports — 5985 (HTTP, lab only) and 5986 (HTTPS). Disabled by default; enable with Enable-PSRemoting -Force on the target.

LDAP / LDAPS

Lightweight Directory Access Protocol. How you talk to Active Directory. LDAPS is LDAP-over-TLS — use it.

DSC (Desired State Configuration)

PowerShell's "make the system look like X" framework. Configurations are PowerShell scripts that compile to MOF files; nodes pull or push their configurations.

Ansible

A Python tool that runs YAML playbooks over SSH. AidaIDE wraps the CLI; the actual Ansible must be installed locally.

Container vs image

An image is a snapshot of a filesystem. A container is a running instance of an image. docker pull fetches an image; docker run creates a container from it.

Kubernetes — quick orientation

Pod — one or more containers running together.
Deployment — declarative spec that maintains N pods.
Service — stable network endpoint in front of pods.
Namespace — logical partition for scoping.

"I do not have any Windows boxes to manage"

The Windows tabs are no-ops without targets. Skip them and use the Linux/container tools.

"I do not have Ansible installed"

Install: pip install ansible (or use your package manager). On Windows, use WSL — Ansible's control machine is Linux-only.

Alert delivery setup

Email — SMTP creds in Settings → Network → Notifications → SMTP.
Slack — a webhook URL from your Slack workspace's "Incoming Webhooks" app.
Generic webhook — a URL AidaIDE will POST a JSON body to. Useful for routing into PagerDuty, Opsgenie, n8n.

"My backup job hangs"

SFTP over slow links is the usual culprit. Use rsync with compression instead (set in the job's transport field).
Some files are unreadable by your SSH user. Check the error log; either skip them in the source spec or switch to a privileged user.