ccnet-homepage-swarm: internal-only Homepage dashboard (Phase 1) #67
No reviewers
Labels
No labels
blocked
borg-backup
ceph
forgejo
in-progress
infra
netdata
nextcloud
p:high
p:low
p:medium
searxng
service-onboard
swarm-nodes
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
copper/ccnet-prod-devops!67
Loading…
Reference in a new issue
No description provided.
Delete branch "ccnet-homepage-swarm"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
What
New Swarm stack for
dash.coppercore.net— a Homepagelauncher + status board for the whole homelab: grouped links to every service
plus API-backed health widgets for the ~13 that ship one. Seeded from
docs/ccnet-infra-snapshot-2026-09-10.md(PR #66). Plan:~/.claude/plans/now-with-that-set-cryptic-milner.md.Docs + stack only — the deploy is the user's to run (every credential is
theirs to mint). This PR is the authoring half.
Contents
homepage-swarm-stack.yml— image pinnedv2.3.0; 14 Docker secretssurfaced via Homepage's native
HOMEPAGE_FILE_*mechanism (no entrypointwrapper, unlike SearXNG); port
8092→3000;replicas: 2,max_replicas_per_node: 1, no role constraint (stateless web tier).config/—settings/services(grouped tiles + widgets) /widgets/bookmarks, checked in with{{HOMEPAGE_FILE_*}}placeholdersand non-sensitive identifiers only, no secret values.
README.md— full runbook: mint 13 dedicated least-privilege credentialidentities, create the secrets, CephFS dir, deploy, onboard + hand-issue the
cert (per
ccnet-swarmpit-swarm/README.md§5), verify. Plus a Phase 2appendix (manager-pinned
docker-socket-proxyfor live container/Swarmdiscovery — a deliberate separate follow-up).
CLAUDE.md— design deviations.Repo-wide
CLAUDE.md: stack map entry + a new cross-cutting convention —every service onboarded from now on gets a Homepage tile in
config/services.yaml, same step as theservice_onboard.pyDNS/Caddywiring.
dash.coppercore.netis the canonical index of running services.ccnet-service-onboard/README.md+docs/homelab-architecture.mdnote thesame.
Not in this PR / follow-ups
<viewer-username>/<site-name>placeholders inservices.yamlarefilled in by hand during Step 1 (identifiers, not secrets).
10.10.10.150perccnet-mosquitto-swarm/README.md.Side change (user-requested, already applied live)
Added Unbound overrides
node07.pve.coppercore.net→10.10.10.207andnode07-ceph.pve.coppercore.net→10.10.35.207(the one cluster node withno DNS entry).
bookmarks.yamluses the hostname.🤖 Generated with Claude Code
New Swarm stack for dash.coppercore.net — a launcher + status board for the whole homelab: grouped links to every service plus API-backed health widgets for the ~13 that ship one. Seeded from the 2026-09-10 infra snapshot. Pattern follows ccnet-searxng-swarm/ (stateless web tier, replicas 2, CephFS config bind-mount, internal-only via OPNsense Caddy + hand-issued cert). - homepage-swarm-stack.yml: image pinned v2.3.0, 14 Docker secrets via Homepage's native HOMEPAGE_FILE_* mechanism (no entrypoint wrapper), port 8092 -> 3000, replicas 2 / max 1 per node, no role constraint. - config/: settings, services (grouped tiles + widgets), widgets, bookmarks — checked in with {{HOMEPAGE_FILE_*}} placeholders, no secret values. - README.md: full runbook (mint 13 credential identities, create secrets, CephFS dir, deploy, onboard + ACME cert per swarmpit runbook, verify) plus a Phase 2 appendix (docker-socket-proxy for live discovery). - CLAUDE.md: design deviations. - Live Docker/Swarm discovery is a deliberate Phase 2 follow-up PR. Repo-wide: root CLAUDE.md gains the stack entry and a new cross-cutting convention — every service onboarded from now on gets a Homepage tile, same step as the service_onboard.py DNS/Caddy wiring. Noted in ccnet-service-onboard/README.md and docs/homelab-architecture.md. Deploy is the user's to run (all credentials are theirs to mint). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011Z5XpoqyYLm8W8DXKmskcUccnet-homepage-swarm: internal-only Homepage dashboard (Phase 1)to WIP: ccnet-homepage-swarm: internal-only Homepage dashboard (Phase 1)I will be re-revewing this and deploying this today,
WIP: ccnet-homepage-swarm: internal-only Homepage dashboard (Phase 1)to ccnet-homepage-swarm: internal-only Homepage dashboard (Phase 1)Rebased onto current
main(was 7 days behind — commits #73–#83) and pushed. Only real conflict wasCLAUDE.md's conventions list (adjacent edits: this PR's "every service gets a Homepage tile" bullet vs. main's "never push through Swarmpit'supdate_stack" bullet +dvrcert-list entry) — resolved keeping both sides, nothing dropped.mergeableshould recompute totruenow thatmerge_base==maintip.Pre-flight checks run live before re-review, per the plan's Step 6/7b:
8092— confirmed free on all 5 swarm nodes (.211/.212/.213/.221/.222).v2.3.0— still fine to ship;v2.4.0released today (2026-09-17), too fresh to jump on same-day.10.10.50.10:443resets the TLS handshake (Connection reset by peer), not a timeout. This is an active reject, not silent drop — a firewall pass rule will be needed for themailcowwidget to work, contrary to the "probably not needed" guess in the plan. Left as-is per the plan (user decision, tracked in #68) — no OPNsense change made.{{HOMEPAGE_FILE_x}}vs{{HOMEPAGE_VAR_x}}token form in Step 8 — settle it on the first widget before wiring all 14, since a mismatch there reads as "Unauthorized" everywhere and is easy to chase in the wrong place.No stack/config edits made — Steps 1–8 (mint 14 credentials → secrets → CephFS dir → deploy → onboard/cert → verify) are unchanged from
README.mdand still yours to run.