30s
Dashboard Refresh
4
Lambda Scalar Servers
Out-of-band
No OS Dependency
HTTPS + Auth
Redfish Compliant
Context
The customer lab operates four Lambda Scalar GPU servers, each equipped with a Supermicro AST2600 BMC chip. The BMC runs on a dedicated network port, independent of the main OS - providing hardware telemetry even when the server is powered off. It exposes a modern REST API (Redfish) over HTTPS, returning structured JSON for power, temperature, and fan metrics.
The target: all four servers' hardware health visible on a live dashboard, updating every 30 seconds, sourced directly from the BMC - not from software agents on the main OS.
Technical Problem Identified
The platform's existing HTTP metric executor had three blocking defects when used against a Redfish BMC:
| Bug # | What Was Happening | What Was Required |
|---|---|---|
| 1 - Protocol | URL built as http:// - Redfish only runs on HTTPS (port 443) | Build URL as https:// by default for BMC connections |
| 2 - Auth | No Authorization header - BMC returns HTTP 401 on every request | Base64-encode credentials and send as Authorization: Basic header |
| 3 - TLS | BMC uses self-signed certificate - Node.js fetch() throws UNABLE_TO_VERIFY_LEAF_SIGNATURE | Bypass SSL verification scoped to BMC requests via undici Agent (not process-wide) |
Solution Architecture
HTTP Executor Rewrite
The executeHTTPCommand function was rewritten to handle HTTPS by default, inject Basic Auth credentials from the device's stored connection profile (following the same pattern as the existing SSH executor), and apply per-request SSL bypass via undici Agent for BMC devices - preserving SSL verification for all other HTTPS requests made by the platform.
Why undici, not NODE_TLS_REJECT_UNAUTHORIZED
Setting NODE_TLS_REJECT_UNAUTHORIZED = '0' is process-wide - it disables SSL verification for every HTTPS request in the Electron process, including connections to Anthropic API, update servers, and any other services. The undici Agent approach scopes the SSL bypass to a single request. This is the correct architecture for a production platform.
JSON Path Parser Hardening
- Null guard added - prevents crashes when an intermediate key is undefined (common in varying Redfish firmware versions)
- Bracket notation normalization - converts PowerControl[0].PowerConsumedWatts to PowerControl.0.PowerConsumedWatts for consistent path traversal
New MetricName Types & Supermicro BMC Device Configuration
Two new metric type identifiers added:
- fan-speed (unit: RPM) - for BMC fan RPM readings
- gpu-slot-power (unit: W) - for per-GPU-slot power draw readings
New device type supermicro-bmc covering four metric streams:
- Total system power - /redfish/v1/Chassis/1/Power → PowerControl[0].PowerConsumedWatts (every 30s)
- CPU temperature - /redfish/v1/Chassis/1/Thermal → Temperatures[n].ReadingCelsius
- Fan speed - /redfish/v1/Chassis/1/Thermal → Fans[n].Reading in RPM (every 60s)
- GPU slot power - /redfish/v1/Chassis/1/Power → PowerControl[n].PowerConsumedWatts (where available)
Testing Approach
The implementation was validated at four levels before hardware deployment:
- Unit tests (vitest): 30+ tests covering Auth encoding, URL construction, JSON path parsing, mock fetch behavior, and error handling - no hardware required
- Node.js one-liners: rapid sanity checks on JSON path traversal and Base64 encoding
- curl verification against real BMC: confirmed Redfish URL structure and verified array indices for Temperatures, Fans, and PowerControl entries on actual AST2600 hardware
- End-to-end Cosmic test: confirmed live watts values appearing on dashboard with 30-second refresh
Technologies Used
Outcome – Infrastructure Visibility Delivered
Four Lambda Scalar GPU servers now surface real-time hardware health data - total system power in watts, CPU and GPU temperatures, and fan RPM - on a live dashboard updating every 30 seconds. The monitoring runs out-of-band through the dedicated BMC management port, with no software agents required on the main OS and no dependency on the server's operational state.