feat: machine metrics (CPU, memory, network) on the status page

The status page answered "are the components running" but said nothing
about the machine underneath them, so a server slowed to a crawl by a
busy processor or one about to have Postfix OOM-killed looked entirely
healthy until the queue backed up.

internal/health/machine.go reads the kernel's counters in /proc: the
aggregate processor times and core count from /proc/stat, the load
average from /proc/loadavg, memory and swap from /proc/meminfo, and
per-interface byte counters from /proc/net/dev.

CPU busy time and network throughput are rates, so a MachineSampler holds
the previous reading and each call reports the difference — one shared
sampler on the Server, since a per-request one would never have anything
to subtract. A window longer than a minute only re-baselines: a page
opened after the panel sat idle would otherwise average that whole
stretch and present it as the current load.

Memory is derived from MemAvailable rather than MemFree, because Linux
spends every spare page on cache and MemFree would report a permanent
emergency. A fully busy processor (>=90%) warns and an exhausted machine
(>=97%) errors, both counting towards the page's headline verdict, since
either delays or kills the mail path. Throughput has no comparable
threshold — what counts as a lot depends on the link — so it is reported
and never graded. Loopback is excluded: that traffic is the container
talking to itself.

Like every other check here, an unreadable counter degrades to "unknown"
with an explanation instead of failing the page, so the panel still runs
outside Linux for development.

The usage bars are <meter> elements. The panel's CSP has no inline-style
exemption, so a bar's length has to travel on an attribute; the element
also grades its own colour from low/high/optimum, and the percentage is
printed beside it for anything that does not render meters.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/web/handlers_status.go

@@ -40,7 +40,7 @@ func (s *Server) handleStatusRecheck(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/status?rechecked=1", http.StatusSeeOther)
 }
 
-// statusBody collects the four local checks the fragment renders. Each one
+// statusBody collects the local checks the fragment renders. Each one
 // reports its own problem rather than failing the page, so a broken component
 // costs one line and not the whole screen.
 func (s *Server) statusBody() map[string]any {
@@ -75,7 +75,13 @@ func (s *Server) statusBody() map[string]any {
 		socketStatus = health.Worst(socketStatus, sock.Status)
 	}
 
-	overall := health.Worst(procStatus, queueStatus, cert.Status, socketStatus)
+	// Resource usage of the machine underneath. It is graded like the rest —
+	// a processor that is fully busy or a machine out of memory delays or
+	// kills the mail path — so it counts towards the headline verdict, and
+	// its rates are measured against the previous poll (internal/health).
+	machine := s.machine.Sample()
+
+	overall := health.Worst(procStatus, queueStatus, cert.Status, socketStatus, machine.Status)
 	return map[string]any{
 		"Processes":      procs,
 		"ProcessError":   procErr != nil,
@@ -83,6 +89,7 @@ func (s *Server) statusBody() map[string]any {
 		"QueueSummary":   queueSummary(queueText),
 		"QueueError":     queueErr,
 		"QueueStatus":    queueStatus,
+		"Machine":        machine,
 		"Cert":           cert,
 		"Sockets":        sockets,
 		"SocketStatus":   socketStatus,

internal/web/static/panel.css

@@ -235,6 +235,20 @@ details form { margin-top: 0.6rem; }
 .st-warn { background: var(--st-warn-bg); color: var(--st-warn-fg); border-color: var(--st-warn-border); }
 .st-error { background: var(--st-error-bg); color: var(--st-error-fg); border-color: var(--st-error-border); }
 .st-unknown { background: var(--st-unknown-bg); color: var(--st-unknown-fg); border-color: var(--st-unknown-border); }
+/* Usage bars on the status page's machine card. <meter> rather than a div sized
+   from the reading, because the CSP forbids inline styles (see the note at the
+   top of this file) and a bar's length has to travel on an attribute. The
+   element grades itself from low/high/optimum, so the colour matches the
+   badges' meaning without this file restating the thresholds — and a browser
+   that does not render meters falls back to the percentage beside it, which is
+   printed either way. */
+meter { width: 5rem; height: 0.7rem; vertical-align: middle; margin-right: 0.4rem; }
+/* The card's own two narrow columns. Cells may break mid word by default (see
+   the th, td rule above), which the detail column needs and these two must not
+   have: the resource names and the readings are short, and the long detail
+   beside them would otherwise win the width and leave "Memory" broken across
+   two lines. */
+.metric { white-space: nowrap; }
 .code-row { display: flex; align-items: flex-start; gap: 0.5rem; }
 .code-row .code { flex: 1; min-width: 0; }
 /* Compact outlined button: same affordance as the filled one but quiet enough

internal/web/templates/status_body.html

@@ -25,6 +25,53 @@
     {{end}}
   </div>
 
+  <div class="card">
+    <h2>Machine <span class="st st-{{.Machine.Status}}">{{.Machine.Status}}</span></h2>
+    <p class="muted">Processor, memory and network of the machine this container
+    runs on, read from the kernel's counters. CPU and throughput are rates, so
+    they describe{{if .Machine.WindowText}} the {{.Machine.WindowText}}{{end}}
+    since the previous refresh rather than this instant.</p>
+    <table>
+      <thead><tr><th class="metric">Resource</th><th>Usage</th><th>Detail</th></tr></thead>
+      <tbody>
+        <tr>
+          <td class="metric">CPU</td>
+          <td class="metric">
+            {{if .Machine.CPU.Measured}}
+            <meter value="{{.Machine.CPU.Percent}}" min="0" max="100" low="70" high="90" optimum="10">{{.Machine.CPU.BusyText}}</meter>
+            {{.Machine.CPU.BusyText}}
+            {{else}}<span class="muted">—</span>{{end}}
+          </td>
+          <td class="muted">{{.Machine.CPU.Detail}}</td>
+        </tr>
+        <tr>
+          <td class="metric">Memory</td>
+          <td class="metric">
+            {{if .Machine.Memory.Measured}}
+            <meter value="{{.Machine.Memory.Percent}}" min="0" max="100" low="70" high="90" optimum="10">{{.Machine.Memory.PctText}}</meter>
+            {{.Machine.Memory.PctText}}
+            {{else}}<span class="muted">—</span>{{end}}
+          </td>
+          <td class="muted">{{.Machine.Memory.Detail}}</td>
+        </tr>
+        <tr>
+          <td class="metric">Network</td>
+          <td class="metric">
+            {{if .Machine.Network.Measured}}
+            ↓ {{.Machine.Network.InRateText}}<br>↑ {{.Machine.Network.OutRateText}}
+            {{else}}<span class="muted">—</span>{{end}}
+          </td>
+          <td class="muted">
+            {{range .Machine.Network.Interfaces}}
+            <div>{{.Name}}: {{.InText}} in, {{.OutText}} out{{if .Measured}} (↓ {{.InRateText}} ↑ {{.OutRateText}}){{end}}</div>
+            {{end}}
+            {{if .Machine.Network.Detail}}<div>{{.Machine.Network.Detail}}</div>{{end}}
+          </td>
+        </tr>
+      </tbody>
+    </table>
+  </div>
+
   <div class="card">
     <h2>Mail queue <span class="st st-{{.QueueStatus}}">{{.QueueStatus}}</span></h2>
     {{if .QueueError}}

internal/web/templates_test.go

@@ -211,12 +211,68 @@ func TestLayoutReferencesOnlyEmbeddedAssets(t *testing.T) {
 }
 
 func TestStatusPageRendersEveryCheck(t *testing.T) {
+	out := renderStatusPage(t, statusPageData())
+	for _, want := range []string{
+		"opendkim", "FATAL", "Mail queue is empty", "mail.example.com",
+		"203.0.113.10 → no PTR record", `action="/reload"`,
+		`hx-get="/status/fragment"`, `class="st st-error"`,
+		// The machine card: the bars carry their reading in an attribute
+		// (the CSP rules out sizing them with a style), and the figures are
+		// printed beside them for anything that does not render a meter.
+		`<meter value="12"`, `<meter value="50"`,
+		"load average 0.31, 0.24, 0.19", "2.0 GiB used of 4.0 GiB",
+		"eth0: 1.0 MiB in, 512.0 KiB out",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("status page is missing %q", want)
+		}
+	}
+}
+
+// A machine whose counters could not be read — no /proc, or a first reading
+// with nothing to compare against — must leave the card in place with its rows
+// blank, the same way an unreachable supervisord costs one line and not the
+// page.
+func TestStatusPageWithoutMachineMetrics(t *testing.T) {
+	data := statusPageData()
+	data["Machine"] = health.Machine{
+		CPU:     health.CPU{Status: health.StatusUnknown, Detail: "The kernel's processor counters (/proc/stat) could not be read here."},
+		Memory:  health.Memory{Status: health.StatusUnknown, Detail: "The kernel's memory counters (/proc/meminfo) could not be read here."},
+		Network: health.Network{Status: health.StatusUnknown, Detail: "The kernel's network counters (/proc/net/dev) could not be read here."},
+		Status:  health.StatusUnknown,
+	}
+
+	out := renderStatusPage(t, data)
+	if strings.Contains(out, "<meter") {
+		t.Error("a bar was drawn for a reading that does not exist")
+	}
+	for _, want := range []string{
+		`<h2>Machine <span class="st st-unknown">`,
+		"/proc/stat", "/proc/meminfo", "/proc/net/dev",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("degraded machine card is missing %q", want)
+		}
+	}
+}
+
+func renderStatusPage(t *testing.T, data map[string]any) string {
+	t.Helper()
 	tmpl, err := loadTemplates()
 	if err != nil {
 		t.Fatalf("loadTemplates: %v", err)
 	}
 	var buf bytes.Buffer
-	err = tmpl.pages["status"].ExecuteTemplate(&buf, "layout.html", map[string]any{
+	if err := tmpl.pages["status"].ExecuteTemplate(&buf, "layout.html", data); err != nil {
+		t.Fatalf("execute status page: %v", err)
+	}
+	return buf.String()
+}
+
+// statusPageData is one plausible reading of every check the status page shows,
+// so a test can render the page and vary the one part it is about.
+func statusPageData() map[string]any {
+	return map[string]any{
 		"Title":  "SelfPost — status",
 		"User":   "admin",
 		"Active": "status",
@@ -232,6 +288,26 @@ func TestStatusPageRendersEveryCheck(t *testing.T) {
 			NotAfter: time.Now().Add(30 * 24 * time.Hour), DaysLeft: 30,
 			Status: health.StatusOK, Detail: "Valid for another 30 day(s).",
 		},
+		"Machine": health.Machine{
+			CPU: health.CPU{
+				Measured: true, BusyPct: 12.4, Cores: 4,
+				Load: [3]float64{0.31, 0.24, 0.19}, HasLoad: true,
+				Status: health.StatusOK, Detail: "4 core(s) · load average 0.31, 0.24, 0.19",
+			},
+			Memory: health.Memory{
+				Measured: true, TotalBytes: 4 << 30, UsedBytes: 2 << 30, UsedPct: 50,
+				Status: health.StatusOK, Detail: "2.0 GiB used of 4.0 GiB; 2.0 GiB available to new work.",
+			},
+			Network: health.Network{
+				Measured: true, RxRate: 2048, TxRate: 1024,
+				Interfaces: []health.Interface{
+					{Name: "eth0", RxBytes: 1 << 20, TxBytes: 1 << 19, RxRate: 2048, TxRate: 1024, Measured: true},
+				},
+				Status: health.StatusOK,
+			},
+			Window: 5 * time.Second,
+			Status: health.StatusOK,
+		},
 		"Sockets": []health.Socket{
 			{Name: "OpenDKIM", Path: "/run/opendkim/opendkim.sock", Present: true, Status: health.StatusOK, Detail: "Listening."},
 		},
@@ -244,19 +320,6 @@ func TestStatusPageRendersEveryCheck(t *testing.T) {
 			Detail:  "No address has a reverse record.",
 			Records: []string{"203.0.113.10 → no PTR record"},
 		},
-	})
-	if err != nil {
-		t.Fatalf("execute status page: %v", err)
-	}
-	out := buf.String()
-	for _, want := range []string{
-		"opendkim", "FATAL", "Mail queue is empty", "mail.example.com",
-		"203.0.113.10 → no PTR record", `action="/reload"`,
-		`hx-get="/status/fragment"`, `class="st st-error"`,
-	} {
-		if !strings.Contains(out, want) {
-			t.Errorf("status page is missing %q", want)
-		}
 	}
 }
 

internal/web/web.go

@@ -84,6 +84,11 @@ type Server struct {
 	sessions *sessionStore
 	setup    *setupManager
 	dns      *dnscheck.Checker
+	// machine reads the host's CPU, memory and network counters for the
+	// status page. It has to be one shared sampler for the whole server:
+	// CPU and throughput are differences between successive readings, so a
+	// per-request sampler would never have a previous one to subtract.
+	machine health.MachineSampler
 
 	loginLimiter *rateLimiter
 	setupLimiter *rateLimiter