tori is a single go binary that runs on your server, reads host metrics from /proc and /sys, monitors containers via the docker socket (read-only), tails logs, and stores everything in sqlite with a 7 day retention. You define alert rules in a toml config and get notified via email or webhooks. The same binary runs on your local machine and connects over SSH via a TUI, no exposed ports, no HTTP server.
https://github.com/thobiasn/tori-cli
MIT licensed, happy to answer questions about the architecture or design choices :)