Run a heinzel housekeeping (health) inspection on a server — disk, memory, load, pending updates, firewall, SSL certs, failed systemd units, logs, kernel reboot status, and service-specific checks. Use when the user asks to "run housekeeping", "housekeeping report", "run a health check on <host>", or "do routine inspection". Do NOT auto-invoke for ambiguous requests like "check server <host>" — that's reserved for quick queries. Covers Linux (Debian, Ubuntu, RHEL, CentOS, Fedora, SUSE) and macOS.
Send an email about a managed server — ad-hoc text and/or file attachments. Use when the user asks to "email me X", "send X by mail", "mail this to <address>", "attach /var/log/foo to an email", or "send a report by email". The first email per host asks where to send from (local workstation vs the server itself). On the remote path, prefers the existing MTA (postfix, sendmail, msmtp, mail/mailx) and asks before installing one. Sends as a non-root user via `runuser`/`su -`. Attachments check sender readability, size, and offer a content preview before sending. **Never run automatically** — only on explicit user request.
Compare key policies across all servers in memory/servers/ to surface silent drift. Makes no configuration changes; writes one audit-trail line to each host's journal. Probes unattended-upgrades, sshd effective config, firewall posture, MTA, time sync, and auto-reboot behaviour. Use when the user asks to "fleet audit", "vergleiche alle server", "policy drift check", "are my servers configured the same?", or after a fix on one host to find which others carry the same bug.
Run a heinzel security audit on a server — SSH hardening (password auth, weak algos, root login), firewall, user account hygiene, listening services, kernel hardening (ASLR, IP forwarding), file permissions, SUID/SGID audit, fail2ban. Use when the user asks for a "security audit", "security review", "hardening check", or to "audit security on <host>". Do NOT auto-invoke on generic phrases like "check server <host>". Covers Linux (Debian, Ubuntu, RHEL, CentOS, Fedora, SUSE) and macOS (SIP, FileVault, Gatekeeper).