Crow 0.2.0

Crow 0.2.0: from one real server to a real fleet. A terminal per server, fleet-wide actions that are all real, firewalls beyond ufw, and structured, validated editors for the config files ops people touch most.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open). The SLSA provenance file didn't generate for this release; that's being fixed.

Everything in 0.2.0-beta.1 (config history, baselines and drift, the fleet runner, metrics history and alerts, the audit log) is here too. New since the beta:

Terminal

• A real terminal for every server, built on alacritty_terminal and running over the server's own connection (Crow's SSH options, key and jump host; exec into lab containers). The audit log records each session opening and closing, never what was typed.
• Tabs and split panes, kept while you move around the app. Rename tabs, follow the program's title, see the bell.
• Select and copy (drag, double-click a word, triple-click a line; Ctrl+Shift+C / ⌘C), paste with bracketed paste, Shift+PgUp/PgDn through the history, and mouse support for programs that ask for it (htop, vim, tmux, mc).
• Font size, a blinking cursor, clickable links. The Fleet's row button opens a server's terminal.

Config editors

Structured editors for more files, each lossless (comments and formatting survive) and checked on the server before it's written:

• sysctl (sysctl.conf, sysctl.d): shows where the running kernel differs from the file; well-known keys explain themselves, with switches and pickers.
• sudoers (/etc/sudoers, sudoers.d): read as root; saved through visudo and a guard that puts the old file back if your login would lose sudo.
• fstab: refuses dropping /, /boot or /var, and changes that add findmnt --verify errors; flags mounts that can stop a boot.
• logrotate, systemd units, drop-ins and settings files (systemd-analyze verify), nginx (installed, tested with nginx -t, rolled back if it fails), MySQL/MariaDB *.cnf and Samba smb.conf (testparm).
• sshd follows Include, shows the value sshd really uses, and edits Match blocks.

Fleet

• Server groups: create them, move servers between them, filter and group the Fleet by them.
• Rotate SSH host keys across the fleet and re-pin them; revoke all sessions while keeping Crow's own; a host key rotation policy that warns when a key is overdue.
• Certificates about to expire: Let's Encrypt and the files nginx/Apache point at, read every 6 hours; WARN at 14 days, CRIT at 3.
• GeoIP regions for servers without cloud metadata (looked up on your machine, opt-in).

Firewall

• Edit firewalld (runtime and permanent together), with a lock-out guard for ufw and firewalld: a change that would cut off Crow's SSH port asks you to type CONFIRM.
• Read bare nftables and iptables rulesets.
• The Firewall page is rebuilt in the app's table style, with a working search and add-rule form.

Access and connections

• Connection recovery: when a server can't be reached, Crow says why and offers the fix (trust a changed host key after you type its name, install Crow's key, retry).
• Switch servers to a key and rotate keys from the Keys screen; the jump host shows in the server header.
• Approving SSH agents (1Password, Secretive) are kept out of key-file logins, so they no longer prompt or stall Crow.
• Update notice: Crow checks for a newer release once a day and says so in the status bar; installing it is opt-in and verified.

Interface

• Each server tab remembers which page it was on.
• The Danger Zone is its own page (last in the sidebar; a tab on the Fleet), and a status bar shows open alerts, notices and the version.
• A calmer server header: the facts as one line, the distro and kernel read when they weren't known yet, and SNAPSHOT / RECONNECT buttons that work.
• Reverse DNS names for remote peers on the Sockets connection map.