Any system can be a source.

#!/usr/bin/env bash
# Server status as an Andon view: load, disk, services. Writes the document to
# stdout; andon-seal.mjs or andon_seal.py seals and sends it. The status is decided HERE.
set -euo pipefail

now=$(date -u +%Y-%m-%dT%H:%M:%SZ)
load=$(awk '{print $1}' /proc/loadavg)
cores=$(nproc)
disk=$(df --output=pcent / | tail -1 | tr -dc '0-9')
pg_status=ok; pg_isready -q || pg_status=critical

# Bands and status belong together: the same threshold for the colour and the verdict.
load_pct=$(awk -v l="$load" -v c="$cores" 'BEGIN{printf "%.0f", l/c*100}')
load_status=ok
[ "$load_pct" -gt 70 ] && load_status=warning
[ "$load_pct" -gt 90 ] && load_status=critical

jq -n --arg now "$now" --arg host "$(hostname -s)" \
  --argjson load_pct "$load_pct" --arg load_status "$load_status" \
  --argjson disk "$disk" --arg pg "$pg_status" '
{
  id: "b7d41f92-3c58-4ad6-9e07-58c1f2a4d130",
  schemaVersion: 1,
  name: $host,
  generatedAt: $now,
  staleAfterSec: 180,
  tiles: [
    { id: "t_pg", view: "label", title: "PostgreSQL", icon: "cylinder", status: $pg,
      value: (if $pg == "ok" then "Online" else "Down" end) },
    { id: "t_load", view: "gauge", title: "Load per core", titleShort: "Load", status: $load_status,
      value: $load_pct, unit: "%", decimals: 0, range: { min: 0, max: 150 },
      bands: [ { to: 70, status: "ok" }, { to: 90, status: "warning" }, { to: 150, status: "critical" } ] },
    { id: "t_disk", view: "progress", title: "Disk /", titleShort: "Disk",
      status: (if $disk >= 90 then "critical" elif $disk >= 80 then "warning" else "ok" end),
      value: $disk, unit: "%", decimals: 0, range: { min: 0, max: 100 } }
  ]
}'

#!/usr/bin/env node
// Reads a view document from stdin, seals it (AES-256-GCM) and uploads it by PUT.
// Configuration from the environment (ANDON_*). Node.js 18 or newer.
import { createCipheriv, createHash, randomBytes } from 'node:crypto'
import { readFileSync, writeFileSync, existsSync } from 'node:fs'

const need = (k) => process.env[k] || (() => { throw new Error(k + ' is not set') })()
const url = need('ANDON_URL').replace(/\/+$/, '')
const view = need('ANDON_VIEW')
const key = Buffer.from(need('ANDON_CONTENT_KEY'), 'base64url')
if (key.length !== 32) throw new Error('ANDON_CONTENT_KEY must decode to 32 bytes')
const kv = Number(process.env.ANDON_KEY_VERSION || 1)
const cache = process.env.ANDON_CACHE || '/tmp/andon-' + view + '.fp'

const doc = JSON.parse(readFileSync(0, 'utf8'))

// Only a changed status wakes the devices: fingerprint of tile id + status.
// ANDON_NOTIFY=always|never overrides it. No cache yet means: wake, to be safe.
const fp = createHash('sha256').update(doc.tiles.map(t => t.id + '=' + (t.status ?? '-')).sort().join('\n')).digest('hex')
const mode = process.env.ANDON_NOTIFY || 'auto'
const notify = mode === 'always' || (mode !== 'never' && (!existsSync(cache) || readFileSync(cache, 'utf8') !== fp))

// Fresh 12-byte nonce, AAD "andon-v1|<view>|<kv>", 16-byte tag appended to the ciphertext.
const nonce = randomBytes(12)
const cipher = createCipheriv('aes-256-gcm', key, nonce, { authTagLength: 16 })
cipher.setAAD(Buffer.from('andon-v1|' + view + '|' + kv))
const ct = Buffer.concat([cipher.update(JSON.stringify(doc), 'utf8'), cipher.final(), cipher.getAuthTag()])

// Field order v, view, kv, nonce, ct, notify; nonce and ct as standard base64 with padding.
const body = JSON.stringify({ v: 1, view, kv, nonce: nonce.toString('base64'), ct: ct.toString('base64'), notify })
if (Buffer.byteLength(body) > 262144) throw new Error('envelope larger than 256 KiB')

const res = await fetch(url + '/v1/views/' + view + '/envelope', {
  method: 'PUT',
  headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + need('ANDON_WRITE_SECRET') },
  body,
})
if (res.status === 204) { writeFileSync(cache, fp); console.log('ok', Buffer.byteLength(body), 'bytes, notify=' + notify) }
else { console.error('relay answered', res.status, await res.text()); process.exit(1) }

$ ./metrics.sh | node andon-seal.mjs
ok 974 bytes, notify=true
$ sleep 30; ./metrics.sh | node andon-seal.mjs
ok 975 bytes, notify=false
$