bobbanandClaude Sonnet 5.5
447f33fff6
One list of the current problems across servers and integrations, instead of waiting for a notification or visiting each page: servers that stopped reporting, full or nearly full disks and volumes (critical from 95%), Synology volume/disk problems, failed or uncovered Proxmox backups, failed Proxmox Backup Server verifications, container image updates, expired or expiring secrets/domains/Tailscale keys, failed Semaphore and Gitea runs, Uptime Kuma monitors that are down, overdue osTicket tickets, and integrations whose calls keep failing. Visible to every role, with severity and kind filters, search, sorting, CSV export and "Check now". It runs the same checks that send the notifications rather than a second copy of them: the detection in the health, automation, Proxmox backup, PBS, Docker update and Tailscale key checks is pulled out into shared collectors that both the schedulers and the page call, so the two can't disagree about what counts as a problem. Notification behaviour is unchanged, including the scheduled backup checks skipping integrations under a maintenance window. Unlike the notifications the page ignores the on/off toggles, and keeps problems under a maintenance window, marked silenced and counted apart. It reads live, so a result is reused for a minute (and Refresh can't re-run everything more than once every ten seconds), and every source has a 20 s limit so one hung integration can't hang the page. Anything it couldn't read is called out at the top instead of looking like all clear, and server checks pause for the same 20 minutes after a restart as the notifications do, with a note saying so. Also gives the newer integrations (PBS, osTicket, Uptime Kuma, phpIPAM) proper names in "integration down" notifications instead of their ids. Verified through the real routes against a scratch database with fake backends (offline and full-disk servers, secrets and domains, a silenced server, a fake PBS with failed verification, a hanging integration, a refused one, a failing-calls streak, caching, the restart grace period, auth), and by rendering the real page against that data in a browser: filters, search, silenced toggle, sorting, Check now, dark mode. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
4.1 KiB
Roles & menu access
Homelab Manager has three roles, ranked lowest to highest: viewer, operator, admin. The first person to sign in becomes admin; everyone after that starts as viewer until an admin changes their role under Administration → Users.
A role can do everything the roles below it can, plus what's listed for it — operator includes everything viewer has, admin includes everything operator has.
Sidebar menu, by role
✅ = the menu item appears for that role · ❌ = it's hidden entirely (not just disabled) — a group that would end up with zero visible items disappears too, and a group left with exactly one just shows as that page's own top-level link.
| Menu item | Path | Viewer | Operator | Admin |
|---|---|---|---|---|
| Dashboard | / |
✅ | ✅ | ✅ |
| Infrastructure | ||||
| Servers | /servers |
✅ | ✅ | ✅ |
| Proxmox | /proxmox |
✅ | ✅ | ✅ |
| Synology | /synology |
✅ | ✅ | ✅ |
| Proxmox Backup | /pbs |
✅ | ✅ | ✅ |
| Docker | /docker |
✅ | ✅ | ✅ |
| Tailscale | /tailscale |
✅ | ✅ | ✅ |
| Network | ||||
| DNS | /dns |
✅ | ✅ | ✅ |
| Domains | /domains |
✅ | ✅ | ✅ |
| IP Addresses | /ipam |
✅ | ✅ | ✅ |
| Ports | /ports |
✅ | ✅ | ✅ |
| Consistency | /consistency |
✅ | ✅ | ✅ |
| Automation | ||||
| Semaphore | /semaphore |
✅ | ✅ | ✅ |
| Gitea | /gitea |
✅ | ✅ | ✅ |
| Secrets | /secrets |
✅ | ✅ | ✅ |
| Operations | ||||
| Alerts | /alerts |
✅ | ✅ | ✅ |
| Maintenance | /maintenance |
✅ | ✅ | ✅ |
| Uptime Kuma | /uptime-kuma |
✅ | ✅ | ✅ |
| osTicket | /osticket |
✅ | ✅ | ✅ |
| Admin Links | /admin-links |
✅ | ✅ | ✅ |
| Generator | /generator |
✅ | ✅ | ✅ |
| Administration | ||||
| Integrations | /integrations |
✅ | ✅ | ✅ |
| Users | /users |
❌ | ❌ | ✅ |
| Sessions | /sessions |
❌ | ❌ | ✅ |
| Audit Log | /audit-log |
❌ | ✅ | ✅ |
| Diagnostic Log | /diag-log |
❌ | ❌ | ✅ |
| Settings | /settings |
❌ | ❌ | ✅ |
| Privacy (footer link, not in a group) | /privacy |
✅ | ✅ | ✅ |
So in practice: every page is visible to every role except the five under Administration — Users, Sessions, and Diagnostic Log need admin; Audit Log needs operator or admin; Settings needs admin.
Being able to see a page isn't the same as being able to change things
Almost every page above is visible to viewers, but most of the buttons on them aren't — a viewer can look at everything but can't act on anything. Operators can use the page's normal working actions (starting a container, syncing DNS, adding a secret, opening a maintenance window…). Some actions on otherwise-viewer-visible pages are held back even further, to admin only:
- Integrations & DNS providers: any operator can use an integration once it's configured (start/stop a guest, run a template, sync DNS records, etc.), but adding, editing, testing, or deleting an integration or DNS provider is admin-only.
- Servers: registering a new server, rotating its agent token, and editing/deleting a server are admin-only; tagging a server and linking/unlinking it to a Proxmox guest just need operator.
- Tags: creating, renaming, recoloring, or deleting a tag is admin-only (applying an existing tag to a server needs operator).
- Ports: everyone can see both the agent-reported and manual tables; adding, editing, or deleting a manual port opening needs operator.
- Admin Links: everyone can see and open every server's admin bookmarks, from that server's own page or the summary page; adding, editing, or removing one needs operator, from either place.
- Everything under Settings (notification channels, badge colors, display prefs, log retention, backup/restore) is admin-only, matching the page itself being admin-only.
If you need the exact role for one specific button rather than this
summary, check the corresponding route in server/src/routes/ — each
one that needs more than "signed in" calls requireRole("operator") or
requireRole("admin") right where that action is defined.