WolfStack Server Management Platform

Beyond the core server, app, container, terminal, backup, and alert management, WolfStack provides several advanced 'optional power' features. These are primarily accessible via the Apps & Tools drawer (the grid icon at the top of the sidebar) or directly under individual servers.

Advanced Feature Categories

• Virtualization: VMs allow for full virtual machines (e.g., Windows or dedicated firewalls) when containerization is insufficient.
• Networking: WolfNet provides a private, encrypted mesh network to link servers and containers across different locations as if they were on the same LAN.
• Storage Management: Includes Storage / Shares / Storage Array for mounting remote storage (S3, NFS, SMB), sharing storage across a LAN, or building parity disk arrays.
• Automation: WolfFlow offers visual, drag-and-drop automation for tasks like scheduled backups of behavior, cleanups, and update checks across a cluster.
• AI & Intelligence: WolfAgents provides named AI assistants with memory to assist in operating and querying your setup.
• Data Management: Databases allows for browsing and querying MySQL/MariaDB connections directly.
• Security & Fleet Management: Fleet Security provides a centralized view for password rotation, blocked IPs, and exposed ports. Status Pages / Tenants / Cluster Browser handles public uptime pages, multi-customer dashboards, and cluster web app access.
• Application Ecosystem: The App Store contains a full catalogue of hundreds of available applications.

The WolfStack interface is divided into two primary sections: a left sidebar for navigation and a main area for content display.

The Left Sidebar

• Top Icons:
  • Datacenter (house icon): The home screen providing a high-level overview.
  • App Store: A catalogue of ready-to-install applications.
  • Issues: A list of system alerts and items requiring attention.
  • Predictive Inbox: Early warning notifications for potential issues.
  • Apps & Tools (grid icon): A drawer containing advanced management screens.
• Servers List: Located below the top icons, this list displays every machine managed by WolfStack. Clicking a server name opens its specific management view in the main area.
• Bottom Controls:
  • Settings (cog icon)
  • Help & Docs (question mark icon)
  • Getting Started (compass icon): Accesses the introductory course.
  • Add Server (plus icon)
  • Sign Out (door icon)

The Main Area

• This area occupies the right side of the screen and displays the content selected from the sidebar.
• The title at the top-left of the main area indicates your current location within the platform.

When an update is triggered (either automatically or manually), WolfStack follows a safe execution pipeline to minimize downtime and data loss:

1. Pre-flight: Verifies the container exists and has a trackable image (contains RepoDigests).
2. Backup: Executes backup_docker_volumes() to tar volumes/bind mounts and performs a standard container backup.
3. Pull: Downloads the new image via docker pull.
4. Recreate: Uses a rename-based approach:
   • Captures the current container configuration.
   • Stops and renames the old container to {name}_wolfstack_pre_update.
   • Creates and starts a new container using the original configuration but the new image.
5. Health Check: Waits for the specified timeout to verify the container is Running and (optionally) responding to HTTP requests.
6. Verify/Rollback:
   • Success: If healthy, the old container is removed.
   • Failure (with auto_rollback): If unhealthy, the new container is stopped, the old container is renamed back to its original name, and it is restarted.
   • Failure (no rollback): If unhealthy and rollback is disabled, both containers are kept, and an alert is sent to the user.

When a WolfStack node uses an Enterprise license, it periodically sends a heartbeat to the Wolf licensing server (https://wolfscale.org/adminsys/heartbeat.php) to report deployment details for compliance and visibility.

What is reported:

• License key, Node ID, and Hostname
• Cluster name and total node count
• A list of all nodes in the cluster (ID and hostname)
• WolfStack version, OS, and Architecture
• System uptime and a timestamp of the report

What is NOT reported (Privacy Guarantees):

• User data, container names, or VM names
• Application data or configuration files/secrets
• IP addresses
• System metrics (CPU, RAM, or disk usage)

Operational Impact:

• Non-blocking: The reporting process is 'fire and forget'. If the licensing server is unreachable, WolfStack continues to function normally.
• No Kill Switch: The license does not expire or stop working if the heartbeat fails to reach the server.

Security in WolfStack is achieved through Defense in Depth—a layered approach where multiple security controls are implemented so that if one layer fails, others are in place to catch the threat.

To secure your environment, implement these six layers:

1. Reduce the surface: Use firewalls to ensure you only expose necessary services.
2. Keep attackers out: Implement strong logins, 2FA, account lockouts, and blocking of known-bad actors.
3. Catch what gets in: Use malware and intrusion detection on the host machine.
4. Don't hand them the keys: Maintain software hygiene by avoiding default passwords and ensuring all software is patched.
5. See it early: Implement monitoring to detect signs of intrusion before they escalate.
6. Recover cleanly: Maintain a robust recovery and backup plan for when a breach occurs.

Core Principle: Assume Breach. Build your infrastructure assuming a breach will eventually happen. Use segmentation to prevent a single compromised container from affecting your entire fleet, and maintain backups so that incidents like ransomware are mere annoyances rather than catastrophes.

WolfFunctions are cluster-scoped, Lambda-style functions. Definitions replicate to all peers in the cluster, and any node can accept an invocation. The cluster leader manages warm instances and schedules.

Runtimes

• Python 3.12: Use def handler(event, context)
• Node 22: Use exports.handler = async (event, context)

Execution & Sandbox

• Sandbox: Uses gVisor runsc by default (auto-downloaded and verified). A Docker fallback is available via local.json configuration (ExecutionMode set to Docker), though gVisor is the primary isolation method.
• Placement: Controlled by replicas (number of nodes keeping warm copies; default 2) and max_per_node (burst instances per node; default 4). Instances are reaped after 300s of idleness.

Triggers

1. Public URL: Accessible via /fn/{slug} (requires opt-in; rate-limited to 60/min/node).
2. Schedules: Interval-based triggers (minimum 60s interval).
3. Internal Events: Triggered by system events like alert_fired, node_offline, backup_completed, container_failover, etc.

API Semantics

Public /fn/{slug} endpoints use AWS Lambda proxy-integration semantics. The handler should return an object with:

• statusCode
• headers
• body
• isBase64Encoded

If any other value is returned, it is JSON-encoded with a 200 status code. The event object contains {trigger: "http", method, query, body, source_ip}.

// Node 22 Example
exports.handler = async (event, context) => {
  return {
    statusCode: 200,
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ message: 'Hello from WolfFunction!' }),
    isBase64Encoded: false
  };
};