fleet: register vm-esh-nas as 5th Docker host + canonical dockge stack

vm-esh-nas (10.0.50.154) is a NAS-adjacent Docker VM on the esh-pve-nas
hypervisor. Runs filezilla (port 5800), dockge, beszel-agent, dozzle-agent
with /mnt/{share,music,books,media} NFS-mounted from 10.0.50.50.
Use this host when a stack needs direct NFS mounts to the ESH NAS shares.

Canonicalize dockge as stacks/dockge/ — single compose used on all five
Docker hosts with per-host DOCKGE_HOST_LABEL/DOCKGE_HOST_IP in .env so
each card on the homepage points at its own instance. Labeled
homepage.group=Service Networking.

Beszel + Dozzle agent dirs also renamed to beszel-agent-<site> /
dozzle-agent-<site> pattern across the fleet for consistency.

CLAUDE.md

@@ -59,6 +59,7 @@ Observed and standardized across servers:
 | nh3-docker | 10.100.50.40 | NH3 (`10.100.0.0/16`) | General-purpose Docker host (non-GPU VM on nh3-pve) | `servers/nh3-docker/README.md` |
 | nh3-pve | 10.100.250.60 | NH3 | Proxmox VE hypervisor | `servers/nh3-pve/README.md` |
 | esh-docker-vm | 10.0.50.45 | ESH home lab (`esteban.net`, `10.0.50.0/24`) | Home-lab Docker host (VM on esh-pve) | `servers/esh-docker-vm/README.md` |
+| vm-esh-nas | 10.0.50.154 | ESH home lab | NAS-adjacent Docker host (VM on esh-pve-nas) | `servers/vm-esh-nas/README.md` |
 | esh-pve | 10.0.250.35 | ESH home lab | Proxmox VE hypervisor | `servers/esh-pve/README.md` |
 | esh-pve-nas | 10.0.50.55 | ESH home lab | Proxmox VE hypervisor (storage / media) | `servers/esh-pve-nas/README.md` |
 
@@ -66,7 +67,7 @@ Observed and standardized across servers:
 - GPU-required stacks → `ana-ml2`.
 - Anaheim non-GPU services → `ana-docker`.
 - NH-site non-GPU services → `nh3-docker`.
-- ESH home-lab workloads (`esteban.net`) → `esh-docker-vm`. Not part of the PFI colo topology, but shares monitoring/backup tooling.
+- ESH home-lab workloads (`esteban.net`) → `esh-docker-vm` (general) or `vm-esh-nas` (needs direct NFS mounts from 10.0.50.50). Not part of the PFI colo topology, but shares monitoring/backup tooling.
 - Cross-site services (e.g. Beszel hub, Dozzle hub) live on `ana-docker` and pull from agents on the other hosts.
 - **Hypervisors** (`pfi-pve`, `nh3-pve`, `esh-pve`, `esh-pve-nas`) are tracked for inventory / capacity planning. Don't deploy Docker stacks directly on them; new workloads land as VMs. `server_inspect.sh` captures host-level detail only — VM/LXC/ZFS enumeration needs Proxmox-native tooling (`qm list`, `pvesh get …`, `zpool list`).
 

README.md

@@ -14,6 +14,7 @@ See **[CLAUDE.md](CLAUDE.md)** for the full set of conventions and the rules Cla
 | ana-docker | `10.250.50.70` | Anaheim | General-purpose Docker + cross-site hubs (VM on pfi-pve) |
 | nh3-docker | `10.100.50.40` | NH3 (`10.100.0.0/16`) | General-purpose Docker (VM on nh3-pve) |
 | esh-docker-vm | `10.0.50.45` | ESH home lab (`esteban.net`) | Home-lab Docker (VM on esh-pve, non-PFI scope) |
+| vm-esh-nas | `10.0.50.154` | ESH home lab | NAS-adjacent Docker, NFS-mounted shares (VM on esh-pve-nas, non-PFI scope) |
 
 **Proxmox hypervisors** (tracked for inventory; not Docker targets):
 
@@ -34,6 +35,7 @@ Per-host snapshots of the running system live under `servers/<host>/system-detai
 ├── README.md                     # this file
 ├── scripts/                      # workstation tooling
 │   ├── server_inspect.sh         # read-only diagnostic, runs on remote via stdin
+│   ├── proxmox_inspect.sh        # Proxmox-aware probe (VMs, LXCs, storage, backup coverage)
 │   ├── refresh-server-info.sh    # pull fresh system-details.txt for one/all hosts
 │   ├── add-host.sh               # register a new server (writes servers/<name>/ssh-target)
 │   ├── sync-stacks.sh            # pull /opt/docker/{compose,conf}/ → stacks-mirror/
@@ -50,6 +52,7 @@ Per-host snapshots of the running system live under `servers/<host>/system-detai
 │       └── README.md
 ├── stacks-mirror/                # gitignored — live mirror from sync-stacks.sh
 ├── configs/                      # host-level config files that aren't docker-compose
+│   ├── homepage/                 # canonical config for the fleet dashboard (on esh-docker-vm)
 │   └── restic/<host>/            # resticprofile configs + pre-backup hooks
 └── docs/                         # general reference (network, models, proxmox, etc.)
     └── pfi/
@@ -66,6 +69,9 @@ Per-host snapshots of the running system live under `servers/<host>/system-detai
 - Fleet services: `beszel` (metrics hub, port 8090), `dozzle-hub` (log viewer, 8088), `backrest` (restic UI, 9898)
 - Backup target: `rest-server-ana` on port 8000
 
+**GPU ana-ml2 (non-canonical for now):**
+- `comfyui`, `kokoro`, `parakeet`, `vibevoice` alongside the canonical `llama-swap` + `vllm-qwen3`
+
 **NH3 (nh3-docker):**
 - `adguard`, `dockge`, plus Beszel/Dozzle agents
 
@@ -73,7 +79,10 @@ Per-host snapshots of the running system live under `servers/<host>/system-detai
 - `rest-server-nh3` — restic backup target (port 8000)
 
 **ESH home lab (esh-docker-vm):**
-- `adguard`, `homeassistant` (macvlan), `esphome`, `mosquitto`, `paperless-ngx`, `pgadmin`, `calibre`, `calibre-web`, `drawio`, `traefik`, `homepage`, `uptime-kuma`, plus Beszel/Dozzle agents
+- `adguard`, `homeassistant` (macvlan), `esphome`, `mosquitto`, `paperless-ngx`, `pgadmin`, `calibre-web-automated`, `drawio`, `traefik`, `homepage`, `uptime-kuma`, plus Beszel/Dozzle agents
+
+**ESH home lab (vm-esh-nas):**
+- `filezilla` (web UI on port 5800), `dockge`, plus Beszel/Dozzle agents. Mounts `/mnt/{share,music,books,media}` from the Debian NAS at 10.0.50.50.
 
 ## Common tasks
 

servers/vm-esh-nas/README.md

@@ -0,0 +1,58 @@
+# vm-esh-nas
+
+Docker VM on the `esh-pve-nas` hypervisor (10.0.50.55), at the ESH home
+lab. Runs nas-adjacent containers that need local mounts of the shares
+served by the Debian NAS at `10.0.50.50` — Filezilla, a Beszel agent, a
+Dozzle agent, and Dockge.
+
+## Network
+
+- **LAN IP:** 10.0.50.154
+- **FQDN:** `vm-esh-nas.esteban.net`
+- **SSH:** `lkraven@vm-esh-nas` (key auth; `/etc/hosts` entry on the workstation)
+
+## Hardware (from latest snapshot)
+
+- **OS:** Debian 12 (bookworm), kernel 6.1.0-32-amd64
+- **CPU:** 4 cores, Intel Xeon W-1250 @ 3.30 GHz (shared with the host)
+- **RAM:** 3.8 GB total, ~3.1 GB available
+- **Root disk:** 125 GB at 7% used
+- **NFS mounts (all from `10.0.50.50`):**
+  - `/mnt/share` — 96 TB, 4 TB used (general share)
+  - `/mnt/music` — 92 TB, empty
+  - `/mnt/books` — 92 TB, 96 GB used
+  - `/mnt/media` — 111 TB, 20 TB used
+  - All in `/etc/fstab`, reconnect on boot.
+
+## What runs here
+
+| Container | Image | Role |
+|---|---|---|
+| `beszel-agent` | henrygd/beszel-agent:latest | Metrics agent reporting to the hub on ana-docker |
+| `dozzle-agent` | amir20/dozzle:latest | Log agent (exposed on port 7007) |
+| `dockge-dockge-1` | louislam/dockge:latest | Local compose UI, port 5001 |
+| `filezilla` | jlesage/filezilla | Web Filezilla on port 5800 (referenced in homepage bookmarks.yaml under UltraSeedbox) |
+
+## Refresh state
+
+```bash
+scripts/refresh-server-info.sh vm-esh-nas
+```
+
+## Stack mirror layout
+
+- `stacks-mirror/vm-esh-nas/beszel-agent-esh-nas/` — Beszel agent (canonical in `stacks/beszel/`)
+- Other stacks (`dockge`, `dozzle-agent`, `filezilla`) not yet canonicalized; run `sync-stacks.sh vm-esh-nas` to pull them into the mirror.
+
+## Placement rule
+
+NAS-adjacent Docker host. Good choice for anything that needs direct NFS
+mounts (`/mnt/{share,music,books,media}`) without routing through another
+VM. Low RAM ceiling (3.8 GB) — keep heavy workloads elsewhere.
+
+## Known nits
+
+- `/opt/docker/compose` is world-writable (drwxrwxrwx). Harmless but
+  worth tightening at some point.
+- `/opt/docker/conf` doesn't exist yet; stacks that need bind-mounted
+  config (Traefik, CrowdSec, etc.) would need to create it.

servers/vm-esh-nas/ssh-target

@@ -0,0 +1 @@
+lkraven@10.0.50.154

stacks/dockge/.env.example

@@ -0,0 +1,23 @@
+# Dockge per-host tunables.
+#
+# Copy to .env on each host. Most defaults are fine; the HOST_LABEL and
+# HOST_IP are what the homepage card shows, so they must be set per-host.
+
+# Image pin (blank = latest)
+DOCKGE_VERSION=latest
+
+# Port on the host. Default matches the upstream docs.
+DOCKGE_PORT=5001
+
+# Human-readable host name for the homepage card, e.g.
+#   ana-docker, nh3-docker, esh-docker-vm, vm-esh-nas, ana-ml2
+DOCKGE_HOST_LABEL=
+
+# IP (or hostname) the browser uses to reach this Dockge. Used in
+# homepage.href — must be reachable from wherever you view homepage.
+#   ana-docker     → 10.250.50.70
+#   ana-ml2        → 10.250.50.54
+#   nh3-docker     → 10.100.50.40
+#   esh-docker-vm  → 10.0.50.45
+#   vm-esh-nas     → 10.0.50.154
+DOCKGE_HOST_IP=

stacks/dockge/README.md

@@ -0,0 +1,66 @@
+# dockge
+
+Per-host [Dockge](https://dockge.kuma.pet/) — a lightweight web UI for
+the compose files in `/opt/docker/compose/`. Runs one instance on every
+Docker host in the fleet.
+
+## Layout
+
+- `compose.yaml` — canonical, same file pushed to every host
+- `.env.example` — per-host tunables; `DOCKGE_HOST_LABEL` + `DOCKGE_HOST_IP` vary
+
+## Homepage
+
+Labeled `homepage.group=Service Networking` so all five Dockge instances
+collapse into the toolchain group on the dashboard, each card pointing
+at its own host's web UI.
+
+## Deploy
+
+```bash
+cp stacks/dockge/compose.yaml stacks-mirror/<host>/dockge/
+scripts/deploy-stack.sh <host> dockge --compose
+ssh -t <host> 'cd /opt/docker/compose/dockge && sudo docker compose up -d --force-recreate'
+```
+
+The `.env` with the correct `DOCKGE_HOST_LABEL` / `DOCKGE_HOST_IP` must
+exist on the host before the deploy — otherwise the homepage labels will
+render with empty substitutions. Initial seed per host:
+
+```bash
+# ana-docker
+ssh -t ana-docker 'sudo tee /opt/docker/compose/dockge/.env > /dev/null <<EOF
+DOCKGE_HOST_LABEL=ana-docker
+DOCKGE_HOST_IP=10.250.50.70
+EOF'
+
+# ana-ml2
+ssh -t ana-ml2 'sudo tee /opt/docker/compose/dockge/.env > /dev/null <<EOF
+DOCKGE_HOST_LABEL=ana-ml2
+DOCKGE_HOST_IP=10.250.50.54
+EOF'
+
+# nh3-docker
+ssh -t nh3-docker 'sudo tee /opt/docker/compose/dockge/.env > /dev/null <<EOF
+DOCKGE_HOST_LABEL=nh3-docker
+DOCKGE_HOST_IP=10.100.50.40
+EOF'
+
+# esh-docker-vm
+ssh -t esh-docker-vm 'sudo tee /opt/docker/compose/dockge/.env > /dev/null <<EOF
+DOCKGE_HOST_LABEL=esh-docker-vm
+DOCKGE_HOST_IP=10.0.50.45
+EOF'
+
+# vm-esh-nas
+ssh -t vm-esh-nas 'sudo tee /opt/docker/compose/dockge/.env > /dev/null <<EOF
+DOCKGE_HOST_LABEL=vm-esh-nas
+DOCKGE_HOST_IP=10.0.50.154
+EOF'
+```
+
+## Authoritative vs mirror
+
+Per-host `.env` lives on the server and is gitignored.
+`compose.yaml` is authoritative in `stacks/dockge/` and gets promoted
+into `stacks-mirror/<host>/dockge/` before each deploy.

stacks/dockge/compose.yaml

@@ -0,0 +1,37 @@
+# Dockge — per-host Docker Compose UI (https://dockge.kuma.pet/).
+#
+# One instance runs on every Docker host so the compose dir is manageable
+# from a browser. Each host sets DOCKGE_HOST_LABEL + DOCKGE_HOST_IP in its
+# .env so the homepage card points at the right place.
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  dockge:
+    image: louislam/dockge:${DOCKGE_VERSION:-latest}
+    container_name: dockge
+    restart: unless-stopped
+    ports:
+      - "${DOCKGE_PORT:-5001}:5001"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - dockge_data:/app/data
+      - /opt/docker:/opt/docker
+    environment:
+      - DOCKGE_STACKS_DIR=/opt/docker/compose
+    networks:
+      - tnet
+    labels:
+      - homepage.group=Service Networking
+      - homepage.name=Dockge (${DOCKGE_HOST_LABEL})
+      - homepage.icon=si-portainer
+      - homepage.description=Compose UI on ${DOCKGE_HOST_LABEL}
+      - homepage.href=http://${DOCKGE_HOST_IP}:${DOCKGE_PORT:-5001}
+
+volumes:
+  dockge_data:
+
+networks:
+  tnet:
+    name: traefik-net
+    external: true