vh
1cd79e8274
Operator-approved fleet monitoring extension. Both agents up + healthy:
- beszel-agent on host port 45876 (KEY-mode, hub at ana-docker:8090
SSH-polls inbound; seeded with hub's ed25519 pubkey).
- dozzle-agent on host port 7007 (mTLS auto-generated; hub at
ana-docker:8088 connects inbound).
Compose lives at /home/vh/docker/compose/{beszel,dozzle-agent}/ rather
than the fleet-standard /opt/docker/compose/{...}/ because corviduo-dev's
/opt/ is owned by deploy:deploy (Worldtree team) and vh lacks
passwordless sudo to create the fleet path. Functionally identical;
documented in servers/corviduo-dev/README.md so future infra-ops
sessions find them.
Created an empty traefik-net external docker network on corviduo-dev
as a side effect of dozzle-agent's compose (which declares it external).
Future PFI services landing here can reuse it.
Dozzle hub on ana-docker had 10.250.50.152:7007 appended to
DOZZLE_REMOTE_AGENT (a host-side change to a non-tracked .env, not
canonical). Beszel hub still needs corviduo-dev added via the UI's
"Add System" action — one-time operator step, flagged in the corviduo
README.
76 lines
2.8 KiB
Markdown
76 lines
2.8 KiB
Markdown
# dozzle
|
|
|
|
Container log viewer. One UI on **ana-docker** aggregates logs from every Docker host via remote agents.
|
|
|
|
**Deploys to:**
|
|
- **ana-docker** (hub) — UI at `http://10.250.50.70:8088`
|
|
- **ana-ml2** (agent) — listens on `10.250.50.54:7007`
|
|
- **nh3-docker** (agent, cross-site) — listens on `10.100.50.40:7007`
|
|
- **corviduo-dev** (agent) — listens on `10.250.50.152:7007`. Compose at `/home/vh/docker/compose/dozzle-agent/` (not `/opt/docker/compose/` — see `servers/corviduo-dev/README.md` for why)
|
|
|
|
One compose.yaml lives on each host. The per-host `.env` sets `COMPOSE_PROFILES=hub` or `COMPOSE_PROFILES=agent` so `docker compose up -d` brings up the right service. On the hub, add every agent to `DOZZLE_REMOTE_AGENT` as a comma-separated list (e.g. `10.250.50.54:7007,10.100.50.40:7007`).
|
|
|
|
## Auth / TLS note
|
|
|
|
Dozzle agents and hub auto-generate mTLS certificates on first run. On the trusted LAN (10.250.0.0/16) the default config is fine. If you ever expose an agent beyond the LAN, generate and pin certificates explicitly per the Dozzle docs (`dozzle generate`). The web UI itself is unauthenticated by default — flip `DOZZLE_AUTH_PROVIDER=simple` and set `DOZZLE_USERNAME`/`DOZZLE_PASSWORD` in the hub `.env` if you want a login gate.
|
|
|
|
## Deploy — hub (ana-docker)
|
|
|
|
```bash
|
|
ssh ana-docker
|
|
sudo mkdir -p /opt/docker/compose/dozzle
|
|
sudo chown $USER /opt/docker/compose/dozzle
|
|
cd /opt/docker/compose/dozzle
|
|
|
|
# scp compose.yaml + .env.example from this workspace, then:
|
|
cp .env.example .env
|
|
# Ensure:
|
|
# COMPOSE_PROFILES=hub
|
|
# DOZZLE_HOSTNAME=ana-docker
|
|
# DOZZLE_REMOTE_AGENT=10.250.50.54:7007
|
|
# DOZZLE_PORT=8088
|
|
|
|
docker compose config
|
|
docker compose up -d
|
|
docker compose logs -f
|
|
```
|
|
|
|
## Deploy — agent (ana-ml2)
|
|
|
|
```bash
|
|
ssh ana-ml2
|
|
sudo mkdir -p /opt/docker/compose/dozzle
|
|
sudo chown $USER /opt/docker/compose/dozzle
|
|
cd /opt/docker/compose/dozzle
|
|
|
|
# scp the same compose.yaml + .env.example, then:
|
|
cp .env.example .env
|
|
# Edit to:
|
|
# COMPOSE_PROFILES=agent
|
|
# DOZZLE_HOSTNAME=ana-ml2
|
|
# DOZZLE_AGENT_PORT=7007
|
|
|
|
docker compose config
|
|
docker compose up -d
|
|
docker compose logs -f
|
|
```
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
# Hub health (from anywhere on LAN)
|
|
curl -s http://10.250.50.70:8088/healthz
|
|
|
|
# Agent reachable from the hub's perspective
|
|
ssh ana-docker 'nc -zv 10.250.50.54 7007'
|
|
|
|
# Open http://10.250.50.70:8088 — you should see two tabs:
|
|
# "ana-docker" (local containers) and "ana-ml2" (via agent).
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
- **Hub shows only local containers:** agent is unreachable. Check firewall rules on ana-ml2 (port 7007 must be open from 10.250.50.70) and that the agent is actually listening (`ss -tlnp | grep 7007`).
|
|
- **Agent keeps restarting:** verify the docker.sock bind mount is read-only and the socket exists.
|
|
- **Certificate mismatch after image upgrade:** delete the `dozzle_data` and `dozzle_agent_data` volumes on both hosts and redeploy to regenerate.
|