InfaNeer v0.30

Intelligent automated infrastructure management powered by OpenClaw / Clawdia

Intelligent Monitoring

Receives alerts from Zabbix and analyzes them with AI to determine the best course of action.

Automated Workflows

n8n orchestrates the entire process from alert reception to action execution.

Secure Credentials

All server credentials are securely stored in Vaultwarden with automatic retrieval.

Complete Audit Trail

Every decision and action is logged to Splunk for compliance and review.

What's New in v0.30

Fixed n8n runtime config security — /api/config/n8n now requires X-InfaNeer-Config-Token
Improved OpenClaw token handling — Workflows only send bearer auth when a token is configured, and Settings can clear a saved token
New Action Workflows — All playbook actions (reboot, restart service, kill process, clear disk, etc.) now trigger dedicated n8n workflows for real SSH-based remediation
New Custom Workflow action type — Pick any active n8n workflow directly from the playbook editor
New Simulate Action — Test a matched playbook's workflow from the Trigger Pattern Tester and see what would be executed
New Create Playbook from no-match — One-click playbook creation from unmatched alerts in the Match Activity Log
Fixed Apprise escalation — Channel URLs (Slack, Email, PagerDuty) now correctly returned to n8n escalation workflow
Fixed Dashboard server counts — Linux/Windows counts now show servers with stored credentials (not all Zabbix hosts)
Improved Dashboard timestamps — Recent Activity now shows relative time ("5m ago") with local timestamp on hover

Quick Start

Configure Services
Enter your Zabbix, Splunk, n8n, and Vaultwarden credentials in the Setup Wizard.
Validate Connections
Test all service connections before proceeding with deployment.
Import Workflows
Import the n8n workflows that power alert processing and remediation.
Configure Zabbix
Set up the webhook media type and action in Zabbix to send alerts.

System Architecture

InfaNeer integrates multiple components to provide intelligent infrastructure management

Alert Sources

Zabbix

Manual

API

Scheduled

Processing Engine

n8n Workflow Orchestration

Webhook → Context → Analysis → Dispatch

Integrated Services

OpenClaw / Clawdia

Alert Analysis
Root Cause Detection
Risk Assessment

Vaultwarden

SSH Keys
WinRM Credentials
API Tokens

Splunk

Alert Logs
Decision Logs
Audit Trail

Pushover

Health Alerts
Critical Notifications
Escalations

Target Infrastructure

Linux (SSH)

Windows (WinRM)

Network

Containers

Zabbix

Monitoring

Enterprise-grade monitoring solution for infrastructure and applications.

Trigger-based alerting
Host group management
Webhook integration

n8n

Automation

Powerful workflow automation platform that orchestrates the entire pipeline.

11 pre-configured workflows
Webhook receivers
Custom integrations

OpenClaw / Clawdia

Intelligence

OpenAI-compatible OpenClaw gateway for intelligent alert analysis and recommendations.

Root cause analysis
Remediation recommendations
Confidence scoring

Vaultwarden

Security

Self-hosted password manager for secure credential storage and retrieval.

SSH key storage
WinRM credentials
API key management

Splunk

Logging

Comprehensive logging and analytics for complete audit trail.

Alert history
Decision tracking
Compliance reporting

Pushover

Notifications

Real-time push notifications for critical alerts and health status.

Mobile notifications
Priority levels
Custom sounds

n8n Workflows

Pre-configured workflows that power InfaNeer's automation

Alert Intake

v0.30

Receives webhooks from Zabbix and initiates the alert processing pipeline.

Trigger: POST /webhook/zabbix-alert

Features: Playbook matching, context building, severity routing

Alert Analysis

v0.30

Sends alerts to OpenClaw / Clawdia for intelligent analysis and recommendations.

Model: openclaw/default

Output: Root cause, recommended action, confidence score, risk level

Credential Retrieval

v0.30

Securely retrieves host credentials from Vaultwarden.

Lookup: SSH-{hostname} or WinRM-{hostname}

Cache: 5 minutes (in-memory)

SSH Remediation

v0.30

Executes remediation commands on Linux servers via SSH.

Auth: Ed25519 SSH keys from Vaultwarden

Timeout: 120 seconds per command

WinRM Remediation

v0.30

Executes PowerShell commands on Windows servers via WinRM.

Account: svc-aisysadmin

Protocol: WinRM over HTTPS (5986)

Splunk Logger

v0.30

Logs all alerts, decisions, and actions to Splunk indexes.

Indexes: ai_sysadmin_alerts, ai_sysadmin_decisions, ai_sysadmin_actions

Health Check

v0.30 New

Monitors service health and sends Pushover alerts when issues are detected.

Schedule: Every 5 minutes

Services: Setup Wizard, Zabbix, Splunk HEC, Vaultwarden

Alerts: Pushover (siren sound for critical)

Action: Restart Service

v0.30 New

Restarts a Linux systemd service on the target host via SSH.

Params:service_name

Backend:POST /api/actions/ssh-execute

Action: Reboot Host

v0.30 New

Schedules a safe reboot of the target host (1-minute delay for graceful shutdown).

Command:shutdown -r +1

Action: Clear Disk Space

v0.30 New

Removes old log files and rotates journals to free disk space.

Params:path (default: /var/log), days_old

Action: Kill Process

v0.30 New

Terminates a runaway process by name on the target host.

Params:process_name

Action: Restart / Scale Container

v0.30 New

Restarts a Docker container or scales a Docker Swarm service up/down.

Params:container_name or service_name, replicas

Action: Deep Dive / AI Auto-Resolve

v0.30 New

Collects diagnostics and optionally invokes OpenClaw / Clawdia to automatically resolve the issue.

Backend:POST /api/actions/collect-diagnostics, /api/ai/auto-resolve

Alert Processing Flow

Alert Reception

Zabbix webhook triggers n8n

→

Playbook Match

Check for matching playbook

→

AI Analysis

OpenClaw analyzes & recommends

→

Decision

Route based on confidence

→

Execute

SSH/WinRM remediation

→

Verify & Log

Confirm & log to Splunk

API Reference

Complete REST API documentation for InfaNeer Setup Wizard

Configuration

GET /api/config

Get the full configuration (sanitized - secrets masked)

Response:

{
  "services": {
    "zabbix": { "url": "...", "api_token": "••••••••" },
    "splunk": { "hec_url": "...", "hec_token": "••••••••" },
    ...
  },
  "saved_at": "2025-02-09T12:00:00Z"
}

POST /api/config/export

Export configuration with password encryption

Request Body:

{
  "password": "your-secure-password",
  "include_secrets": true
}

POST /api/config/import

Import configuration with password decryption

Request Body:

{
  "encrypted_data": "...",
  "password": "your-secure-password",
  "merge": false
}

Webhooks

GET /api/config/webhooks

Get webhook URLs from n8n workflows

POST /api/webhooks/save

Save production and test webhook URLs

Workflows

GET /api/workflows/compare

Compare local workflow versions with n8n installed versions

Response:

{
  "workflows": [
    {
      "name": "Alert Intake",
      "local_version": "v0.30",
      "n8n_version": "v0.07",
      "status": "update_available"
    }
  ],
  "summary": {
    "total_local": 11,
    "installed": 10,
    "updates_available": 2
  }
}

POST /api/workflows/update

Update workflows without running the full wizard

POST /api/step4/import

Import selected workflows to n8n

Request Body:

{
  "workflows": ["alert-intake.json", "health-check.json"],
  "activate": true
}

Host Inventory

GET /api/hosts

Get hosts from Zabbix

GET /api/inventory/host/{hostname}/credentials

Get credentials for a specific host

POST /api/inventory/host/{hostname}/credentials

Save credentials for a host

POST /api/inventory/host/{hostname}/credentials/generate

Generate new credentials (SSH key or password)

POST /api/inventory/host/{hostname}/credentials/test

Test connection to host using stored credentials

Playbooks

GET /api/playbooks

List all remediation playbooks

POST /api/playbooks

Create a new playbook

GET /api/playbooks/{id}

Get a specific playbook by ID

PUT /api/playbooks/{id}

Update an existing playbook

DELETE /api/playbooks/{id}

Delete a playbook

Vaultwarden Backup

POST /api/vaultwarden/backup

Create an encrypted backup of Vaultwarden data

Request Body:

{
  "password": "backup-encryption-password"
}

POST /api/vaultwarden/restore

Restore Vaultwarden data from an encrypted backup

GET /api/vaultwarden/schedule

Get current backup schedule configuration

POST /api/vaultwarden/schedule

Save backup schedule configuration

Request Body:

{
  "schedule": "daily",
  "destination": "ssh",
  "ssh_host": "backup-server.example.com",
  "ssh_user": "backup",
  "ssh_path": "/backups/vaultwarden",
  "retention_days": 30
}

Health & Monitoring

GET /api/health

Get overall system health status

GET /api/dashboard/stats

Get dashboard statistics (alerts, hosts, uptime)

GET /api/logs

Get audit log entries

Configuration

Detailed configuration guide for all InfaNeer components

Zabbix Configuration

The setup wizard automatically configures Zabbix with a webhook media type and trigger action.

Webhook Payload Format

{
  "event_id": "{EVENT.ID}",
  "host": "{HOST.NAME}",
  "host_ip": "{HOST.IP}",
  "trigger_name": "{TRIGGER.NAME}",
  "trigger_severity": "{TRIGGER.SEVERITY}",
  "trigger_status": "{TRIGGER.STATUS}",
  "item_name": "{ITEM.NAME}",
  "item_value": "{ITEM.LASTVALUE}",
  "event_time": "{EVENT.TIME}"
}

Credential Naming Convention

Type	Naming Pattern	Example
SSH Keys	`SSH-{hostname}`	SSH-web-server-01
WinRM Credentials	`WinRM-{hostname}`	WinRM-dc-01

Decision Matrix

AI confidence and severity determine the action taken:

Confidence	Severity	Action
≥90%	Warning/Average	Auto-remediate
≥80%	High	Auto-remediate + notify
≥70%	Any	Human approval required
<70%	Disaster	Escalate immediately

Splunk Indexes

Index	Contents	Retention
`ai_sysadmin_alerts`	All incoming alerts	90 days
`ai_sysadmin_decisions`	AI analysis and decisions	90 days
`ai_sysadmin_actions`	Executed remediation actions	90 days
`ai_sysadmin_audit`	System audit trail	365 days

Environment Variables

Variable	Description
`ZABBIX_API_URL`	Zabbix server URL
`ZABBIX_API_TOKEN`	Zabbix API token
`SPLUNK_HEC_URL`	Splunk HEC endpoint
`SPLUNK_HEC_TOKEN`	Splunk HEC token
`CLAWDIA_URL`, `CLAWDIA_TOKEN`, `CLAWDIA_MODEL`	OpenClaw / Clawdia gateway settings
`INFANEER_N8N_CONFIG_TOKEN`	Shared secret n8n sends as `X-InfaNeer-Config-Token` when fetching runtime config
`PUSHOVER_APP_TOKEN`	Pushover application token
`PUSHOVER_USER_KEY`	Pushover user key

Troubleshooting

Common issues and solutions

Alerts not being received

Check Zabbix webhook media type is enabled
Verify n8n webhook URL is correct
Check n8n workflow is active
Review Zabbix action conditions
Check network connectivity between Zabbix and n8n

OpenClaw / Clawdia not responding

Verify the optional bearer token is valid if your OpenClaw gateway requires one
Verify the gateway responds to /v1/models
Confirm n8n workflows were re-imported after changing INFANEER_N8N_CONFIG_TOKEN
Review n8n execution logs for errors
Ensure the model name is correct

SSH/WinRM execution failing

Verify credentials exist in Vaultwarden
Check SSH key is deployed to target server
Ensure service account exists on Windows servers
Verify network connectivity and firewall rules
Check WinRM is enabled: winrm quickconfig

Splunk not receiving logs

Verify HEC token is valid
Check HEC is enabled in Splunk
Verify indexes exist and have correct permissions
Review n8n Splunk Logger workflow

Health check alerts not working

Verify Pushover app token and user key
Check Health Check workflow is active in n8n
Verify service URLs are accessible from n8n
Test manually: POST /webhook/health-check

Playbooks not matching

Verify playbook trigger pattern is a valid regex
Check playbook is enabled
Review Alert Intake workflow logs
Test pattern against actual trigger names

Getting Help

If you're still experiencing issues:

Check the Health Dashboard for service status
Review recent activity in the audit log
Export your configuration for support (Settings → Export)