Operations Runbook
Daily
- Check the Dashboard for platform-wide anomalies.
- Review active alerts by severity.
- Review open incidents and owners.
- Check node online/offline drift.
- Validate connector health status.
- Spot-check log and telemetry freshness.
- Review failed or partial update runs.
- Confirm no recurring session errors (terminal/desktop).
Quick health checks from the CLI:
curl -s http://localhost:8080/healthz
curl -s -H "Authorization: Bearer ${LABTETHER_OWNER_TOKEN}" http://localhost:8080/worker/stats
curl -s -H "Authorization: Bearer ${LABTETHER_OWNER_TOKEN}" http://localhost:8080/agents/connected
Weekly
- Review connector sync quality and stale sources.
- Review alert noise and tune rules/silences.
- Validate retention settings against storage trend.
- Validate backup jobs and restore readiness.
- Review pending updates and maintenance plans.
- Review authentication and enrollment anomalies.
Monthly
- Rotate high-risk credentials and integration tokens.
- Review dormant assets and connectors; clean up unused entries.
- Run a disaster-recovery tabletop exercise and restore drill.
- Review unresolved recurring incidents for structural fixes.
- Review docs drift and update runbooks based on findings.
Security review
Periodic internal hardening checks:
- Confirm
LABTETHER_TLS_MODEisautoorexternal(notdisabled). - For
automode, verify the hub CA is installed system-wide or accepted in browser for both:3000and:8443. - Verify the
labtether-caDocker volume is read-only for agent/console containers (CA private key only inlabtether-data). - Confirm access paths are restricted to private network or Tailscale.
- Enforce strong secret/token generation and rotation.
- Use least-privilege connector integration accounts.
- Audit exposed ports and reverse-proxy rules.
- Review auth and session logs for anomalies.
- Validate backup encryption and restore access controls.
- Keep hub and dependencies patched.