Documentation · System
System
Structured administration for common Linux services, using typed state and bounded actions instead of arbitrary shell fragments.
Available surfaces
Certificates
Inspect common TLS certificate paths and managed certificate state.
Cron
Read system/user schedules and perform validated user-crontab changes.
Docker
Read the local Docker socket and perform bounded container actions.
Fail2ban
Inspect jails and use validated jail/IP actions.
Firewall
Read UFW state and apply constrained allow/delete operations.
Services
List systemd units at system or user scope and run validated actions.
SSH
Surface selected sshd settings and supported configuration operations.
Users
Inspect account information and run validated supported user actions.
Availability and privilege
Individual surfaces depend on host software and the permissions of the Warden process. A missing Docker socket or unavailable system tool should make that capability unavailable rather than silently widening behavior through a generic command runner.
Command boundary
Typed actions select a fixed executable from standard system binary directories and pass validated values as an argument array, never through a shell parser. Commands run with a minimal locale and PATH environment, operation-specific deadlines, at most 1 MiB of input and at most 1 MiB of combined output. Errors are truncated before entering API or audit responses.
Successful service, firewall, user, SSH and certificate actions still have the operating-system authority of the Warden process. Run Warden with only the host privileges its intended operators should exercise.