Files

T

vh 2be296ffa0 homepage: function-first layout + fleet label sweep

Reorganize the gethomepage dashboard from site-based (PFI-ANA, ESH, NH3)
to function-first grouping (Monitoring, AI Systems, Apps, Media, Games,
Infra-<site>, Service Networking). Canonical config now tracked in
configs/homepage/ with Plex/Jellyfin widget keys moved to env
substitution.

Label sweep across fleet compose files:
  - beszel, dozzle, backrest -> Monitoring
  - rest-server-ana -> Service Networking

Healthcheck fixes (previous wget/curl paths broke on distroless +
--private-repos 401):
  - beszel hub:    /beszel health --url ...
  - beszel agent:  /agent health (newly added)
  - rest-server:   nc -z localhost 8000 (TCP probe)

Group name originally "Wiring / Plumbing" collapsed to single-word group
on homepage's parser; renamed to "Service Networking" everywhere.

2026-04-20 22:14:00 -07:00

.env.example

Initial commit: PFI fleet inventory, stacks, tooling, and backup pipeline

2026-04-20 14:29:48 -07:00

compose.yaml

homepage: function-first layout + fleet label sweep

2026-04-20 22:14:00 -07:00

README.md

Initial commit: PFI fleet inventory, stacks, tooling, and backup pipeline

2026-04-20 14:29:48 -07:00

README.md

dozzle

Container log viewer. One UI on ana-docker aggregates logs from every Docker host via remote agents.

Deploys to:

ana-docker (hub) — UI at http://10.250.50.70:8088
ana-ml2 (agent) — listens on 10.250.50.54:7007
nh3-docker (agent, cross-site) — listens on 10.100.50.40:7007

One compose.yaml lives on each host. The per-host .env sets COMPOSE_PROFILES=hub or COMPOSE_PROFILES=agent so docker compose up -d brings up the right service. On the hub, add every agent to DOZZLE_REMOTE_AGENT as a comma-separated list (e.g. 10.250.50.54:7007,10.100.50.40:7007).

Auth / TLS note

Dozzle agents and hub auto-generate mTLS certificates on first run. On the trusted LAN (10.250.0.0/16) the default config is fine. If you ever expose an agent beyond the LAN, generate and pin certificates explicitly per the Dozzle docs (dozzle generate). The web UI itself is unauthenticated by default — flip DOZZLE_AUTH_PROVIDER=simple and set DOZZLE_USERNAME/DOZZLE_PASSWORD in the hub .env if you want a login gate.

Deploy — hub (ana-docker)

ssh ana-docker
sudo mkdir -p /opt/docker/compose/dozzle
sudo chown $USER /opt/docker/compose/dozzle
cd /opt/docker/compose/dozzle

# scp compose.yaml + .env.example from this workspace, then:
cp .env.example .env
# Ensure:
#   COMPOSE_PROFILES=hub
#   DOZZLE_HOSTNAME=ana-docker
#   DOZZLE_REMOTE_AGENT=10.250.50.54:7007
#   DOZZLE_PORT=8088

docker compose config
docker compose up -d
docker compose logs -f

Deploy — agent (ana-ml2)

ssh ana-ml2
sudo mkdir -p /opt/docker/compose/dozzle
sudo chown $USER /opt/docker/compose/dozzle
cd /opt/docker/compose/dozzle

# scp the same compose.yaml + .env.example, then:
cp .env.example .env
# Edit to:
#   COMPOSE_PROFILES=agent
#   DOZZLE_HOSTNAME=ana-ml2
#   DOZZLE_AGENT_PORT=7007

docker compose config
docker compose up -d
docker compose logs -f

Verify

# Hub health (from anywhere on LAN)
curl -s http://10.250.50.70:8088/healthz

# Agent reachable from the hub's perspective
ssh ana-docker 'nc -zv 10.250.50.54 7007'

# Open http://10.250.50.70:8088 — you should see two tabs:
# "ana-docker" (local containers) and "ana-ml2" (via agent).

Troubleshooting

Hub shows only local containers: agent is unreachable. Check firewall rules on ana-ml2 (port 7007 must be open from 10.250.50.70) and that the agent is actually listening (ss -tlnp | grep 7007).
Agent keeps restarting: verify the docker.sock bind mount is read-only and the socket exists.
Certificate mismatch after image upgrade: delete the dozzle_data and dozzle_agent_data volumes on both hosts and redeploy to regenerate.