vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

corviduo-dev: deploy beszel + dozzle monitoring agents

Browse Source 
Operator-approved fleet monitoring extension. Both agents up + healthy:
- beszel-agent on host port 45876 (KEY-mode, hub at ana-docker:8090
  SSH-polls inbound; seeded with hub's ed25519 pubkey).
- dozzle-agent on host port 7007 (mTLS auto-generated; hub at
  ana-docker:8088 connects inbound).

Compose lives at /home/vh/docker/compose/{beszel,dozzle-agent}/ rather
than the fleet-standard /opt/docker/compose/{...}/ because corviduo-dev's
/opt/ is owned by deploy:deploy (Worldtree team) and vh lacks
passwordless sudo to create the fleet path. Functionally identical;
documented in servers/corviduo-dev/README.md so future infra-ops
sessions find them.

Created an empty traefik-net external docker network on corviduo-dev
as a side effect of dozzle-agent's compose (which declares it external).
Future PFI services landing here can reuse it.

Dozzle hub on ana-docker had 10.250.50.152:7007 appended to
DOZZLE_REMOTE_AGENT (a host-side change to a non-tracked .env, not
canonical). Beszel hub still needs corviduo-dev added via the UI's
"Add System" action — one-time operator step, flagged in the corviduo
README.
This commit is contained in:
vh
2026-05-23 18:13:59 -07:00
parent 92554221be
commit 1cd79e8274
3 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/corviduo-dev/README.md
+25
View File
@@ -38,6 +38,8 @@ to over the LAN.
## Deployments
### Worldtree (Worldtree-team-managed, under `/opt/`)
Three `docker compose` projects under `/opt/`:
| Project dir | Container name | Role |
@@ -54,6 +56,29 @@ The image is pulled from `gitea.phasefinal.com/vh/worldtree`, SHA-pinned
per deploy after Worldtree's CI workflow commit `8ef3801` (health-gated
`:latest` advance — `:latest` only moves on successful `/health` probes).
### PFI monitoring agents (infra-ops-managed, under `/home/vh/`)
Bootstrap 2026-05-24. Live at `/home/vh/docker/compose/{beszel,dozzle-agent}/`,
**not** under `/opt/docker/compose/` — corviduo-dev's `/opt/` is owned by
`deploy:deploy` (Worldtree team) and `vh` lacks passwordless sudo to
create the fleet-standard path. Functionally identical; documented here so
future infra-ops sessions find them.
| Project dir | Container | Role |
|---|---|---|
| `/home/vh/docker/compose/beszel/` | `beszel-agent` (host port 45876, `network_mode: host`) | Agent for the Beszel hub at ana-docker:8090. Hub SSH-polls inbound using the seeded ed25519 pubkey. |
| `/home/vh/docker/compose/dozzle-agent/` | `dozzle-agent` (host port 7007) | Agent for the Dozzle hub at ana-docker:8088. Hub connects inbound over mTLS (auto-generated certs on first run). |
The empty `traefik-net` external docker network was created on this host as
a side effect of dozzle-agent's compose (which declares it external). Future
PFI services landing here can reuse it.
After bootstrap, the dozzle hub's `.env` on ana-docker had `10.250.50.152:7007`
appended to `DOZZLE_REMOTE_AGENT` and was force-recreated. The beszel hub
needs corviduo-dev added via the **"Add System"** UI action (host=10.250.50.152
port=45876) — pure-API equivalent uses pocketbase admin auth which we didn't
script. One-time operator step.
## Permissions model + the docker-as-root pattern
`vh` is the SSH user for ops. **`vh` does NOT have passwordless sudo.**