# Homelab Manager

A single dashboard for a homelab: Proxmox, Synology DSM, Semaphore, Tailscale,
Gitea, and Dockhand/Docker status and basic actions, plus DNS record
management, an IP address inventory (IPAM), and a secret-expiry tracker
(ported from [Sloth Manager](../Sloth%20manager)) and scheduled-task tracking
across Debian/Raspbian hosts (ported from
[Schedule Task Manager](../ScheduleTaskManager)). Looks and feels like a
[Tabler](https://tabler.io) admin dashboard. Sign-in is delegated to
Authentik (OIDC), with local admin/operator/viewer roles.

## Status

All modules from the original plan are built:

- Monorepo scaffold, Tabler-themed app shell/navigation
- Authentik OIDC login, roles (first user to sign in becomes admin), audit log
- **Secrets** — expiry tracking for API tokens/certs/passwords
- **IP Addresses (IPAM)** — inventory of IPs across vendors/locations
- **DNS** — zone/record management across Cloudflare, Loopia, Pi-hole, Azure
  DNS, cPanel, and Technitium; providers are configured in-app (not via env
  vars) and their credentials are encrypted at rest
- **Servers & Tasks** — cron/systemd tracking across Debian/Raspbian servers
  via a lightweight push agent (`agent/linux/`), plus manual entries for
  things an agent can't see (Docker jobs, backups)
- **Integrations → Tailscale** — device list with online/authorized status,
  and authorize/deauthorize/remove actions; a live device-count widget.
- **Integrations → Gitea** — repo list with each repo's last CI run status,
  and re-running just the failed jobs in a run; a live repo-count widget
  (with a failing-build warning).
- **Integrations → Dockhand** — container status across every Docker host
  Dockhand manages (one credential covers all of them), with
  start/stop/restart actions; a live running/total widget.
- **Integrations → Semaphore** — Ansible run status per template across
  every project, with a "Run" action to trigger a template; a live
  template-count widget (with a last-failed warning).
- **Integrations → Proxmox** — VM/LXC status across every node in the
  cluster, with start/stop/restart actions; a live running/total widget.
  Supports self-signed certificates (common in homelab Proxmox setups).
- **Integrations → Synology** — volume and disk health (read-only by
  design). Supports self-signed certificates.

All six integrations follow the same config-in-UI + encrypted-credentials
pattern, added through **Integrations → Manage integrations**.

**What's been verified for real** vs. **what still needs your network**:
Authentik login and Gitea were both tested against the user's actual live
services. Tailscale, Dockhand, Semaphore, Proxmox, and Synology were built
against each service's real published API spec/source (not guesswork) and
verified with scripted HTTP tests against a bogus/unreachable config, since
those instances are LAN-only and not reachable from where this was built —
their route wiring, validation, and role gating are confirmed correct, but
real data and the write actions (start/stop/restart, trigger-a-run) haven't
been exercised against the user's actual homelab yet. Worth going through
each one after deploying, per integration.

## Requirements

- Node.js 20+
- An Authentik instance reachable from wherever this app runs

## 1. Set up an Authentik application

1. Create an **OAuth2/OpenID Provider**:
   - Redirect URI: `<APP_BASE_URL>/auth/callback`
   - Scopes: `openid`, `email`, `profile`
2. Create an **Application** using that provider, and assign the users/groups
   who should be able to sign in — Authentik controls who can authenticate;
   the app's own admin/operator/viewer roles control what they can do once in.
3. Copy the provider's issuer URL, client ID, and client secret into `.env`.

## 2. Local development

```bash
cp .env.example .env   # fill in AUTHENTIK_*, SESSION_SECRET, CREDENTIALS_ENCRYPTION_KEY
npm install
npm run dev:server   # http://localhost:3000 (API)
npm run dev:web      # http://localhost:5173 (Vite dev server, proxies /api and /auth to :3000)
```

Visit `http://localhost:5173` during development. Database migrations run
automatically on server start. SQLite data lands in `./data` (gitignored).

Generate `SESSION_SECRET` and `CREDENTIALS_ENCRYPTION_KEY` with:

```bash
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
```

## 3. Run with Docker

```bash
cp .env.example .env
# edit .env
docker compose -f docker-compose.dev.yml up -d --build   # build locally
# or, once an image is published to your registry:
docker compose up -d
```

The app listens on `HOST_PORT` (default `3000`); SQLite data persists in
`./data` on the host.