Technical architecture
Full-path evidence. Separate recovery authority. One operational view.
RecoverNode v3.4 separates observation from disruptive recovery so a broken monitoring path cannot automatically power-cycle a healthy server. The observer compares internal-reference and client-facing resolver paths, UDP/TCP DNS answers and TTLs, delegation, authoritative nameservers, public recursive DNS, TLS, semantic HTTP identity, TCP services, and local infrastructure evidence. Independent public identity checks can detect a wrong website behind HTTP 200, while registry-backed delegation verifies registered nameservers without requiring a particular DNS provider or nameserver count. The RecoverNode Admin Control Panel brings property state, live-refreshing failures and recoveries, alert policy, diagnostics, and classification-aware operator guidance together without exposing SMTP or other monitoring secrets to the browser. The panel is served over HTTPS only, and planned DNS changes can be handled with a maintenance window, a timed per-property mute, or by accepting a reviewed new answer.
Download Technical Overview01RecoverNode Observer
Runs on a separate Ubuntu host and monitors multiple services.
- Local and public DNS expectations
- DNS Path Integrity across named internal-reference and client-facing resolvers, with UDP/TCP and TTL/cache-risk classification
- Effective Netplan and source-file drift classification
- HTTP status, redirects, latency, and content
- Independent public website identity verification, including incorrect HTTP 200 responses
- Registry-backed nameserver delegation through authoritative HTTPS RDAP services
- TLS chain, hostname, expiration, and certificate-specific alert cadence
- TCP services including application ports
- Multi-site observer/network and shared-DNS incident correlation
- Escalating alerts, per-monitor alert policy, and persistent state
- Planned-DNS-change controls: global maintenance window, timed per-property DNS mute, and accept-new-answer review
- Code-verified emergency alert email through a separate mail provider; SMTP logins tested during installation
- HTTPS-only RecoverNode Admin Control Panel for properties, live status, diagnostics, alert policy, and administrator credential rotation
Evidence
not authority
02RecoverNode Guards
Run locally on protected hosts and make decisions from local evidence.
- Nginx-host, application-host, or combined-host role
- Local health and configuration validation
- Service-specific restart and retest behavior
- Exponential backoff, cooldown, and action budgets
- Persistent lockout after unsafe repetition
Decision model
Recovery stops when the system cannot make a sane decision.
Safe automatic recovery is not the same thing as auto-restart. RecoverNode treats recovery as a bounded decision made from local evidence, not as an unconditional response to a failed remote check.
Healthy locallyNo action
Nginx failed locallyValidate, restart, retest
Application failed locallyRecover the application service only
Persistent local failureApply cooldown and recovery budget
Ambiguous configurationFail open, lock out, alert
Observer cannot reach targetAlert only—no remote reboot
Multiple sites share network/DNS symptomsCorrelate into one infrastructure incident
Separate protection layers
Service recovery, DNS resilience, watchdog reset, and power reporting solve different problems.
RecoverNode keeps these functions separate so evidence from one layer does not silently authorize an unsafe action in another. DNS Path Integrity, DNS-resilience, and network-consistency findings produce diagnostic evidence and alerts; they do not automatically rewrite resolver, Netplan, or network configuration. When matching failures appear across multiple monitored sites, the observer can preserve each site's failure state while consolidating the notification into one infrastructure incident.
01Service recovery
Local guards validate and restart an unhealthy Nginx or application service within bounded action budgets.
02Operating-system watchdog
A supported hardware watchdog can reset a powered host after an operating system or userspace freeze.
03Raspberry Pi power health
Supported Raspberry Pi hosts can report current or historical undervoltage and throttling flags. RecoverNode records and alerts on the evidence but does not reboot a host whose power source may be unstable.
Power limitation: software and watchdog services cannot recover a device that lacks enough power to reach firmware, the bootloader, the operating system, or systemd.
