MoonCrater

Infrastructure Control Plane Patching
A PHP and PostgreSQL portal for correlating Linux inventories from Ivanti, Red Hat Satellite, and Zabbix.

English · Italiano

MoonCrater provides a unified operational view of Linux patching inventories. It highlights missing and unhealthy hosts, tracks RHEL migration progress over time, keeps Satellite and Capsule infrastructure visible, and supports migration planning notes without replacing the source systems.

Current application version: 1.41.

Features

• Unified Ivanti and Red Hat Satellite inventory.
• Host states: active, unhealthy, missing, and excluded.
• Dedicated management for Satellite and Capsule infrastructure hosts.
• RHEL 7, 8, 9, and 10 inventory and kernel statistics.
• Historical Satellite imports with migration charts and per-release differences.
• Dedicated Ivanti/Satellite Diff Inventory View grouped by Linux family and release.
• RHEL anomaly verification report with email copy, CSV, and styled Excel-compatible export.
• Zabbix inventory and migration progress.
• Patching notes and planned migration dates.
• Administrator and read-only user roles.
• Configurable customer name and logo.
• CSRF protection, hardened sessions, authorization checks, and audit events.

Project layout

Apache must expose only the public/ directory.

app/          Application bootstrap, configuration, security, and domain code
bin/          CLI migration, administration, and import commands
docs/         Architecture, installation, and translated documentation
migrations/   Ordered PostgreSQL migrations
public/       PHP web endpoints and static assets — the Apache DocumentRoot
setup/        Installer, preflight checks, and Apache examples
tests/        Static security and domain tests
var/          Local runtime data, ignored by Git

See Architecture for more detail.

Requirements

• Apache HTTP Server
• PHP 8 or later with PDO PostgreSQL support
• PostgreSQL
• psql for installation checks
• HTTPS for production deployments

No container runtime is required.

Installation

Clone the repository and run the installer as root:

git clone https://github.com/markhawks/MoonCrater.git
cd MoonCrater
sudo ./setup/install.sh

The default installation path is /opt/mooncrater. It can be changed with MOONCRATER_INSTALL_DIR.

Create a PostgreSQL database owned by a dedicated application user. Configure the variables shown in .env.example, then run:

php bin/migrate.php
php bin/create-admin.php admin
./setup/check.sh

Install and adapt setup/apache/mooncrater.conf.example, validate the Apache configuration, and reload the service:

apachectl configtest
sudo systemctl reload httpd

For the complete procedure, see Installation.

On a RHEL 10 host installed with the dedicated installer, update from the original Git clone. The updater backs up PostgreSQL and preserves users, application data and credentials:

git pull --ff-only origin main
sudo ./setup/rhel10/update.sh

Configuration

Required environment variables:

Variable	Description
DB_USER	Dedicated PostgreSQL user
DB_PASS	PostgreSQL password

Optional variables:

Variable	Default
DB_HOST	localhost
DB_PORT	5432
DB_NAME	patching
APP_TIMEZONE	Europe/Rome
APP_NAME	MoonCrater
APP_SUBTITLE	Infrastructure Control Plane Patching
CUSTOMER_NAME	Acme Corporation
CUSTOMER_LOGO	assets/img/customer-default.svg

Never commit real credentials, customer inventories, database dumps, or production configuration.

Database migrations

bin/migrate.php applies migrations in filename order and records their SHA-256 checksums in schema_migrations. Migration 000_initial_schema.sql supports installation on an empty database.

Run migrations with a database account that owns the MoonCrater schema:

php bin/migrate.php

Do not edit a migration after it has been published. Add a new numbered migration instead.

Satellite inventory rules

The current Satellite CSV represents the current source state:

• an excluded host remains excluded;
• a present host with a check-in no older than 30 days becomes active;
• a present host with an old, missing, or invalid check-in becomes unhealthy;
• a previously known host absent from the new CSV becomes missing;
• hosts assigned the satellite or capsule role are preserved by normal reconciliation.

Administrators can import the current inventory from the dashboard. CLI usage is also available:

php public/import_satellite.php /path/to/satellite-inventory.csv

Ivanti CSV files can also be imported from the dashboard or CLI. Existing excluded and decommissioned states are preserved, and hosts absent from a new Ivanti file are left unchanged:

php public/import_ivanti.php /path/to/ivanti.csv

Historical CSV files must be imported from the Migration Trends page. Historical imports create snapshots only and never alter the current operational inventory.

Snapshot dates can be inferred from filenames containing DDMMYYYY, YYYY-MM-DD, or YYYYMMDD. The chart positions points proportionally along the real time axis. The page also supports folder upload and an inventory-safe history reset. To rebuild history from a directory already stored on the server, run:

sudo php bin/import-satellite-history-dir.php /path/to/satellite-exports

For unattended operation, Satellite can send timestamped exports by SCP to satellite-import-csv/. MoonCrater checks the inbox every five minutes, imports all new files in timestamp order, uses the newest one for the current inventory, and uses older files for Migration Trends. See Automatic Satellite feed for SSH-key setup, the export script, scheduling, logs, and manual execution.

The RHEL 10 installer and updater automatically create the dedicated mooncrater-import account, its home and protected .ssh directory, the writable inbox, and the systemd timer. The separate Satellite installer generates the source key; only that public key must then be authorized on MoonCrater with configure-satellite-ingest.sh.

Diff Inventory View

The dashboard links to a read-only comparison page that loads the newest timestamped CSV from ivanti-import-csv/ and satellite-import-csv/. It correlates normalized hostnames and groups the result into Red Hat Enterprise Linux, Oracle Linux, SUSE Linux, Ubuntu, CentOS, Retired, and Unknown sections. Each section shows separate Ivanti and Satellite totals, release counters, sortable source hostname/OS columns, and fluorescent-yellow rows for Satellite check-ins older than 30 days relative to the Satellite snapshot date.

Source CSV files remain local and are excluded from Git. If an Ivanti export has no Scan Date column, the view uses the extraction date encoded in its filename. The RHEL 10 updater preserves both CSV inbox directories.

Zabbix import

The Zabbix import is intentionally CLI-only:

php bin/import_zabbix.php /path/to/zabbix-hosts.csv

Backups

The dashboard backup action creates timestamped snapshot tables inside the same PostgreSQL database. These snapshots are convenient for short-term operational recovery, but they are not a complete backup. Use pg_dump and store copies on a separate system for disaster recovery.

Development and verification

Run the complete preflight suite from the repository root:

./setup/check.sh

It validates PHP syntax, required extensions, security invariants, domain helpers, and the expected public web surface.

See Contributing before submitting a change. Security issues should follow the Security Policy.

License

Copyright © 2026 MoonCrater contributors.

MoonCrater is licensed under the GNU Affero General Public License, version 3 or later (AGPL-3.0-or-later). Modified versions distributed or made available to users over a network must comply with the license's copyleft and corresponding-source requirements. See LICENSE and NOTICE for the complete terms and notice.