Config drift detection

Reflex watches declared server config against live state so you catch silent changes before the 3am incident.

What is scanned

Every ~15 minutes (configurable via REFLEX_DRIFT_SCAN_INTERVAL_MINUTES), online agents with a recent heartbeat run server.drift_scan and compare:

Category	Examples	Default severity
permissions	Deploy paths, /home/reflex, nginx/php/cron parents	critical
ssh	Reflex hardening drop-in + sshd -T (root / privileged only)	critical
php	Installed versions and FPM pools	warning
packages	nginx, redis, mysql/mariadb client, node	warning
systemd	Watched units (nginx, workers, site processes)	warning
cron	/etc/cron.d + user crontab	info

Baselines are seeded from the first successful inventory (packages/PHP/cron) and completed on the first drift scan when empty.

Dashboard

Open Servers → Drift for the report timeline, severity/category filters, old vs new values, and Accept as new baseline (confirm required). Overview still shows the latest report summary.

Alerts

Drifted reports create a Configuration drift detected alert (critical when any item is critical) and follow your existing on-call path.

Ops notes

• Detect-only in Phase 1 — no auto-revert or remediations yet.
• Bundled in the base £29/server tier (no add-on).
• Disable scheduling with REFLEX_DRIFT_ENABLED=false.
• Privileged SSH collectors: REFLEX_DRIFT_PRIVILEGED_COLLECTORS=true or run the agent as root.