MATA

MATA is a self-hosted monitoring dashboard for PHP servers where full observability stacks are impractical. Servers, thresholds and alerts are JSON files, alarm rules are Rego policies, and users live in files, so the whole setup can be diffed, reviewed in git and handed to a coding agent.

Stack

twig

Screenshot

Why I built it

I wanted monitoring that still works on shared hosting, constrained VPSes, and legacy PHP environments where you cannot install agents or extra services. Existing stacks were usually heavier than the problem called for.

Tradeoffs

It is intentionally not a full observability platform. A central dashboard pulls from signed, read-only nodes that never open a connection, run commands or send mail themselves. That fits a handful to around a hundred servers well, but it is not meant for Kubernetes or large-scale observability.

Notes

The useful part is combining uptime checks, PHP logs, server metrics, Composer audits, security advisories and alerts in one place. OPA handles alarm decisions cleanly, and moving every operation into the bin/mata CLI, with JSON output and Nagios exit codes, made the project much easier to script and to operate with coding agents.

What it covers

• Fleet overview: per-server app status, HTTP checks, error counts and sessions, with a summary bar and filter across all servers
• Metrics and logs: CPU, RAM, disk, top processes, latency and recent log lines, with repeated messages grouped
• Vulnerability management: Composer audits per app, plus advisory monitoring across RSS/Atom feeds, GitHub, OSV.dev, CSAF providers and mailing lists, with PDF, Markdown, HTML or JSON reports
• Alarms: OPA policies with a built-in fallback, delivered by email or Telegram, Slack and Discord webhooks
• Resilience: file-based users managed from the CLI; sign-in and live views keep working without the database

What’s new in 0.9.0

Version 0.9.0 is the largest release since the first public one:

• Security advisory monitoring with its own Advisories page, bulk review and scheduled digest reports
• bin/mata operator CLI for servers, config validation, status checks, users, migrations and alarm explanations, most commands with --json
• Read-only data commands for scripts and coding agents, plus bin/mata evidence to bundle events, logs, metrics and processes around an incident
• Local alarm policies in config/policy/, versioned alongside the rest of the configuration
• One-line installer: curl -fsSL https://mata.sh/install.sh | sh sets up the newest release with Docker, or natively with --native
• Fleet summary bar with auto-refreshing server cards, and framework and CMS logos on app cards

Status

Released, current version 0.9.0. More at mata.sh, documentation at docs.mata.sh, and a live demo at demo.mata.sh (user demo, password demo).