Your homelab in your pocket
1.9K
Manage your homelab from your pocket. The server behind the PiDash iPhone app: alerts from Alertmanager, incidents, AWX approvals and runbooks, Kubernetes, an SSH terminal and a calendar of scheduled jobs. It also runs as a wall board on a Raspberry Pi screen.
The server holds the API keys, SSH key and kubeconfig, so your phone never does. Login is through your OIDC provider, and every action is logged.
1.0.0, 1.0.1, … one release (pin this)1.0 the newest patch of a minor versionlatest the newest releaseBuilt for linux/amd64 and linux/arm64 (Raspberry Pi 4/5), distroless,
non-root.
groups claim8081# compose.yaml
services:
alertboard:
image: graxo/pidash-server:1.0.0
restart: unless-stopped
user: "1000:1000"
depends_on:
mariadb:
condition: service_healthy
ports:
- "127.0.0.1:8080:8080" # local screen, no login
- "8081:8081" # reverse proxy, with login
volumes:
- ./config.yaml:/config.yaml:ro
- ./secrets:/secrets:ro
- ./data/alertboard:/data
networks: [default, db]
mariadb:
image: mariadb:11.8
restart: unless-stopped
user: "1000:1000"
environment:
MARIADB_DATABASE: alertboard
MARIADB_USER: alertboard
MARIADB_PASSWORD_FILE: /run/secrets/db_password
MARIADB_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
volumes:
- ./data/mariadb:/var/lib/mysql
- ./secrets/db_password:/run/secrets/db_password:ro
- ./secrets/db_root_password:/run/secrets/db_root_password:ro
healthcheck:
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
interval: 10s
networks: [db]
networks:
db:
internal: true
# config.yaml (chmod 600)
public_url: https://board.example.com
database:
host: mariadb
name: alertboard
user: alertboard
password_file: /secrets/db_password
oidc:
issuer: https://login.example.com/application/o/alertboard/
client_id: alertboard
client_secret_file: /secrets/oidc_client_secret
session_key_file: /secrets/session_key
groups:
users: alertboard-users
connections:
alertmanager:
- name: production
url: http://alertmanager.example.lan:9093
mkdir -p secrets data/mariadb data/alertboard && chmod 700 secrets data
openssl rand -hex 24 > secrets/db_password
openssl rand -hex 24 > secrets/db_root_password
openssl rand -hex 32 > secrets/session_key
printf '%s\n' '<oidc client secret>' > secrets/oidc_client_secret
chmod 600 secrets/*
docker compose up -d
The OIDC redirect URI is https://board.example.com/auth/callback. Secret
files must be mode 600, or the server refuses to start. Check the
connections with curl -s http://127.0.0.1:8080/api/connections.
The app's SSH terminal opens a shell on the Proxmox guests that carry a tag. Each admin logs in as the user they already have on those hosts:
oidc:
groups:
admins: admins # who may open a terminal
connections:
proxmox:
url: https://pve.example.com:8006
token_file: /secrets/proxmox_token
terminal_tag: terminal
terminal:
users:
- oidc: alice # the admin's username on the board
user: alice # their user on the hosts
- oidc: bob
user: bob
key_file: /secrets/ssh_bob # optional: a key the hosts already trust
Without key_file the server signs in with its own key
(data/alertboard/ssh_key, made on the first start; its public half is in
the log and in the app), which goes in that user's ~/.ssh/authorized_keys.
With key_file, it uses that copy of the person's key (OpenSSH format, no
passphrase, mode 600) and the hosts need nothing new. The server then
holds that key, so use it only where you would trust the server with it.
Apache License 2.0
Content type
Image
Digest
sha256:305c00381…
Size
6.7 MB
Last updated
about 8 hours ago
docker pull graxo/pidash-server