Initial commit: PFI fleet inventory, stacks, tooling, and backup pipeline
Captures the full workspace state built up to this point:
- CLAUDE.md + README.md describing conventions and the four-host fleet
(ana-ml2, ana-docker, nh3-docker, esh-docker-vm).
- Per-host notes under servers/<host>/ with ssh-target fallback files
and latest system-details snapshots (two in-compose credential leaks
scrubbed; the upstream compose files still need to move those to .env).
- scripts/: server_inspect.sh (read-only remote diagnostic),
refresh-server-info.sh (dir-driven discovery + snapshot capture with
validation warnings), add-host.sh, sync-stacks.sh (pull
compose/conf trees), deploy-stack.sh (push with per-file diff + prompt).
- stacks/: canonical compose for backrest, beszel, dozzle, llama-swap,
rest-server-ana, rest-server-nh3, vllm-qwen3, plus the retired
infinity reference. All use the .env-driven + traefik-net + homepage
label pattern.
- configs/restic/ana-docker/: first resticprofile config + pre-backup
hook (Synapse pg_dump, Seafile mysqldump, Vaultwarden SQLite); templates
for the other three hosts to come.
- docs/pfi/: general infrastructure reference carried over.
- .gitignore excludes .env, stacks-mirror/, and assorted secret/state
filenames to prevent re-leaks on later commits.
This commit is contained in:
@@ -0,0 +1,50 @@
|
||||
# dozzle stack tunables. Copy to `.env` on each server before deploying.
|
||||
#
|
||||
# cp .env.example .env
|
||||
# # edit for this host
|
||||
# docker compose up -d
|
||||
#
|
||||
# Same compose.yaml on both servers — COMPOSE_PROFILES picks the role.
|
||||
|
||||
# Image version — pin for reproducibility (`latest` for edge)
|
||||
DOZZLE_VERSION=latest
|
||||
|
||||
# ------------------------------------------------------------------------
|
||||
# On ana-docker (hub):
|
||||
# COMPOSE_PROFILES=hub
|
||||
# DOZZLE_HOSTNAME=ana-docker
|
||||
# DOZZLE_REMOTE_AGENT=10.250.50.54:7007
|
||||
#
|
||||
# On ana-ml2 (agent):
|
||||
# COMPOSE_PROFILES=agent
|
||||
# DOZZLE_HOSTNAME=ana-ml2
|
||||
# ------------------------------------------------------------------------
|
||||
|
||||
COMPOSE_PROFILES=hub
|
||||
|
||||
# Display name for this host in the UI (shown as a tab / section header).
|
||||
DOZZLE_HOSTNAME=ana-docker
|
||||
|
||||
# ---- Hub-only -----------------------------------------------------------
|
||||
|
||||
# Host port for the web UI (container listens on 8080 internally).
|
||||
DOZZLE_PORT=8088
|
||||
|
||||
# Comma-separated list of remote agents the hub should connect to.
|
||||
# Leave blank if this host only views its own containers.
|
||||
DOZZLE_REMOTE_AGENT=10.250.50.54:7007,10.100.50.40:7007
|
||||
|
||||
# Auth — `none` is fine behind the LAN / a reverse proxy with auth.
|
||||
# Switch to `simple` and set USERNAME/PASSWORD to gate the UI itself.
|
||||
DOZZLE_AUTH_PROVIDER=none
|
||||
DOZZLE_USERNAME=
|
||||
DOZZLE_PASSWORD=
|
||||
|
||||
# ---- Agent-only ---------------------------------------------------------
|
||||
|
||||
# Host port the agent listens on (container listens on 7007 internally).
|
||||
DOZZLE_AGENT_PORT=7007
|
||||
|
||||
# Bind address — restrict to the LAN interface if you want belt-and-braces
|
||||
# beyond what the firewall already enforces. Default 0.0.0.0 exposes on all.
|
||||
DOZZLE_AGENT_BIND=0.0.0.0
|
||||
@@ -0,0 +1,74 @@
|
||||
# dozzle
|
||||
|
||||
Container log viewer. One UI on **ana-docker** aggregates logs from every Docker host via remote agents.
|
||||
|
||||
**Deploys to:**
|
||||
- **ana-docker** (hub) — UI at `http://10.250.50.70:8088`
|
||||
- **ana-ml2** (agent) — listens on `10.250.50.54:7007`
|
||||
- **nh3-docker** (agent, cross-site) — listens on `10.100.50.40:7007`
|
||||
|
||||
One compose.yaml lives on each host. The per-host `.env` sets `COMPOSE_PROFILES=hub` or `COMPOSE_PROFILES=agent` so `docker compose up -d` brings up the right service. On the hub, add every agent to `DOZZLE_REMOTE_AGENT` as a comma-separated list (e.g. `10.250.50.54:7007,10.100.50.40:7007`).
|
||||
|
||||
## Auth / TLS note
|
||||
|
||||
Dozzle agents and hub auto-generate mTLS certificates on first run. On the trusted LAN (10.250.0.0/16) the default config is fine. If you ever expose an agent beyond the LAN, generate and pin certificates explicitly per the Dozzle docs (`dozzle generate`). The web UI itself is unauthenticated by default — flip `DOZZLE_AUTH_PROVIDER=simple` and set `DOZZLE_USERNAME`/`DOZZLE_PASSWORD` in the hub `.env` if you want a login gate.
|
||||
|
||||
## Deploy — hub (ana-docker)
|
||||
|
||||
```bash
|
||||
ssh ana-docker
|
||||
sudo mkdir -p /opt/docker/compose/dozzle
|
||||
sudo chown $USER /opt/docker/compose/dozzle
|
||||
cd /opt/docker/compose/dozzle
|
||||
|
||||
# scp compose.yaml + .env.example from this workspace, then:
|
||||
cp .env.example .env
|
||||
# Ensure:
|
||||
# COMPOSE_PROFILES=hub
|
||||
# DOZZLE_HOSTNAME=ana-docker
|
||||
# DOZZLE_REMOTE_AGENT=10.250.50.54:7007
|
||||
# DOZZLE_PORT=8088
|
||||
|
||||
docker compose config
|
||||
docker compose up -d
|
||||
docker compose logs -f
|
||||
```
|
||||
|
||||
## Deploy — agent (ana-ml2)
|
||||
|
||||
```bash
|
||||
ssh ana-ml2
|
||||
sudo mkdir -p /opt/docker/compose/dozzle
|
||||
sudo chown $USER /opt/docker/compose/dozzle
|
||||
cd /opt/docker/compose/dozzle
|
||||
|
||||
# scp the same compose.yaml + .env.example, then:
|
||||
cp .env.example .env
|
||||
# Edit to:
|
||||
# COMPOSE_PROFILES=agent
|
||||
# DOZZLE_HOSTNAME=ana-ml2
|
||||
# DOZZLE_AGENT_PORT=7007
|
||||
|
||||
docker compose config
|
||||
docker compose up -d
|
||||
docker compose logs -f
|
||||
```
|
||||
|
||||
## Verify
|
||||
|
||||
```bash
|
||||
# Hub health (from anywhere on LAN)
|
||||
curl -s http://10.250.50.70:8088/healthz
|
||||
|
||||
# Agent reachable from the hub's perspective
|
||||
ssh ana-docker 'nc -zv 10.250.50.54 7007'
|
||||
|
||||
# Open http://10.250.50.70:8088 — you should see two tabs:
|
||||
# "ana-docker" (local containers) and "ana-ml2" (via agent).
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
- **Hub shows only local containers:** agent is unreachable. Check firewall rules on ana-ml2 (port 7007 must be open from 10.250.50.70) and that the agent is actually listening (`ss -tlnp | grep 7007`).
|
||||
- **Agent keeps restarting:** verify the docker.sock bind mount is read-only and the socket exists.
|
||||
- **Certificate mismatch after image upgrade:** delete the `dozzle_data` and `dozzle_agent_data` volumes on both hosts and redeploy to regenerate.
|
||||
@@ -0,0 +1,66 @@
|
||||
# Dozzle — container log viewer.
|
||||
#
|
||||
# Multi-host layout via compose profiles:
|
||||
# COMPOSE_PROFILES=hub → runs the web UI (deploy on ana-docker)
|
||||
# COMPOSE_PROFILES=agent → runs the remote agent (deploy on ana-ml2)
|
||||
#
|
||||
# Same compose.yaml on both servers; per-host `.env` picks the profile.
|
||||
#
|
||||
# All tunables live in .env — edit that, not this file.
|
||||
|
||||
services:
|
||||
dozzle:
|
||||
image: amir20/dozzle:${DOZZLE_VERSION}
|
||||
container_name: dozzle
|
||||
profiles: [hub]
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${DOZZLE_PORT}:8080"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- dozzle_data:/data
|
||||
environment:
|
||||
- DOZZLE_HOSTNAME=${DOZZLE_HOSTNAME}
|
||||
- DOZZLE_REMOTE_AGENT=${DOZZLE_REMOTE_AGENT:-}
|
||||
- DOZZLE_AUTH_PROVIDER=${DOZZLE_AUTH_PROVIDER:-none}
|
||||
- DOZZLE_USERNAME=${DOZZLE_USERNAME:-}
|
||||
- DOZZLE_PASSWORD=${DOZZLE_PASSWORD:-}
|
||||
healthcheck:
|
||||
test: ["CMD", "/dozzle", "healthcheck"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- tnet
|
||||
labels:
|
||||
- homepage.group=PFI-ANA
|
||||
- homepage.name=Dozzle
|
||||
- homepage.icon=mdi-text-box-search
|
||||
- homepage.description=Container logs (ana-docker + ana-ml2)
|
||||
- homepage.href=http://10.250.50.70:${DOZZLE_PORT}
|
||||
|
||||
dozzle-agent:
|
||||
image: amir20/dozzle:${DOZZLE_VERSION}
|
||||
container_name: dozzle-agent
|
||||
profiles: [agent]
|
||||
restart: unless-stopped
|
||||
command: agent
|
||||
ports:
|
||||
- "${DOZZLE_AGENT_BIND:-0.0.0.0}:${DOZZLE_AGENT_PORT}:7007"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- dozzle_agent_data:/data
|
||||
environment:
|
||||
- DOZZLE_HOSTNAME=${DOZZLE_HOSTNAME}
|
||||
networks:
|
||||
- tnet
|
||||
|
||||
volumes:
|
||||
dozzle_data:
|
||||
dozzle_agent_data:
|
||||
|
||||
networks:
|
||||
tnet:
|
||||
name: traefik-net
|
||||
external: true
|
||||
Reference in New Issue
Block a user