# Homelab Dashboards Three dashboards, one domain, one process, one SQLite file: | Page | What it answers | Source | | ----------- | ------------------------------------------------------------------------------- | -------------------------------------------------- | | `/` | Is anything wrong, and which dashboard do I need? | fleet + alerts in one request (`/api/summary`) | | `/system` | What are my machines doing — CPU, memory, disk, GPU, network, and the history of all of it | `agent/host_agent.py`, our own stdlib agent per host | | `/llm` | Tokens/sec, active sessions, queue depth, KV-cache pressure, latency percentiles | llama.cpp-family (gufo) `/metrics` + `/slots`, vLLM `/metrics` — read-only | | `/ups` | Battery health, runtime left, power events, and battery-test buttons | NUT `upsd`, on whatever port it really listens on (its own wire-protocol client) | No Prometheus, no Grafana, no CDN, no build step. Nothing is fetched from the internet at runtime; every asset is served by this app. Working on this repo? **[`AGENTS.md`](AGENTS.md)** holds the invariants (read-only by construction, never invent a number, unconfigured ≠ broken), the locked decisions, the real fleet facts, and the known gaps. ## Quickstart ```bash uv sync --python 3.14 # deps + the package, editable cp .env.example .env # then edit uv run dashboards # http://127.0.0.1:8090 uv run uvicorn dashboards.app:app --port 8090 # equivalent uv run pytest # unit tests, no network needed ``` Developing against the real fleet from a laptop (agents stay unexposed — ssh forwards them to localhost): ```bash cp .env.dev.example .env.dev # your ssh aliases + which ports python3 - <<'PY' # push the agent to each host (once) import shlex, subprocess, pathlib for host in ("driveripper-ops", "deskwork-ops", "gateway-ops"): subprocess.run(["ssh", host, "mkdir -p ~/lab-agent"], check=True) subprocess.run(["scp", "agent/host_agent.py", f"{host}:~/lab-agent/"], check=True) PY ./scripts/dev-tunnels.sh start # 9121/9122/9123 -> each host's agent, # + DEV_FORWARDS -> upsd on 127.0.0.1:3494 # (the remote port is upsd's real one — 3051 # on driveripper, not the 3493 default) set -a; . ./.env.dev; set +a uv run dashboards # foreground ./scripts/dev-server.sh restart # or backgrounded, with a pidfile + logs ``` `DEV_TUNNELS` starts the agent remotely and forwards it; `DEV_FORWARDS` forwards a service that already listens there (upsd) — that is how the UPS page reads a real battery without 3493 being reachable from anywhere but this laptop. ## The host agent `agent/host_agent.py` is one file, **stdlib only**, Python 3.10+. It reads `/proc`, `/sys/block`, `/sys/class/drm` and `statvfs` and answers `GET /snapshot` (everything, one JSON document; `?top=N` trims the process lists), `GET /info` (slow-changing identity: OS, kernel, CPU model, GPU list), `GET /schema` (the schema version plus this document) and `GET /health` (the one route that never needs the token) as JSON, with a plain HTML status page at `GET /` so a browser pointed at an agent learns what it is looking at. ```bash python3 host_agent.py --once # print one snapshot, exit python3 host_agent.py --host 0.0.0.0 --port 9120 --token-file /etc/dashboards-agent.token sudo deploy/install-agent.sh # systemd unit + user + token deploy/install-agent.sh --status # unit state and /health sudo deploy/install-agent.sh --uninstall ``` It is read-only by construction: there is no code path that writes, and the HTTP server only answers `GET`. Counters are reported as counters — the dashboard computes rates over a labelled window, so the agent never has to remember who polled it last. Binding off-loopback without a token is refused (exit 2) rather than warned about. Prefer `--token-file` over `--token`: argv is world-readable through `ps`, and this token guards hostname, mounts, disk and GPU models, and process names. `deploy/install-agent.sh` creates a system user, generates a token once (re-runs reuse it; `--rotate-token` for a new one), stores it `0600` root-owned, and runs the agent under `ProtectSystem=strict` with no capabilities — enough to read `/proc`, `/sys` and `statvfs()` and nothing else. ## Configuration Everything comes from the environment (see `.env.example` for the annotated list). At startup a `.env` next to the checkout is loaded first if it exists — as a *seed*: a variable the container, systemd unit, or your shell already set always wins. Point `DASH_ENV_FILE` somewhere else to keep several installs on one box. `.env.example` is documentation and is never loaded, and `scripts/dev-server.sh` exports `.env.dev` itself (see the quickstart) because dev settings must not leak into a production process. | Variable | Meaning | | ------------------------------------- | -------------------------------------------------------------- | | `HOST_TARGETS` | `name=url` per host running the agent; a bearer token may ride in the URL userinfo (`http://TOKEN@host:9120`) | | `GUFO_BASE_URL` / `VLLM_BASE_URL` | LLM engines; unset means *not deployed here*, and its half of the page disappears | | `RATE_WINDOW_SECONDS` | the Δ window behind every measured rate — tokens/sec, bytes/sec, jiffies→CPU % (default 10); each value carries the window it actually got, and `/system`'s footnote prints that, not this default | | `DASH_HOST` / `DASH_PORT` | bind address for the dashboard itself (default `127.0.0.1:8090`; the container sets `0.0.0.0`) | | `HOST_INTERVAL_SECONDS` / `LLM_INTERVAL_SECONDS` / `NUT_INTERVAL_SECONDS` | how often each source is polled (10 / 2 / 5 s) | | `HOST_TIMEOUT_SECONDS` / `LLM_TIMEOUT_SECONDS` / `NUT_TIMEOUT_SECONDS` | per-source fetch timeout — one slow source never holds up the others | | `GUFO_API_KEY` / `VLLM_API_KEY` | only if an engine is behind a bearer token; they never leave the server | | `NUT_HOST` / `NUT_PORT` | upsd address — **whatever port it really listens on**, not always 3493. Reads are unauthenticated in stock NUT | | `NUT_USER` / `NUT_PASSWORD` | only needed for instant commands (battery tests) | | `NUT_ALLOW_ACTIONS` | `1` enables the one write endpoint in the app | | `NUT_SIMULATE` | `1` replaces upsd with a **labelled** simulator (development only) | | `DASH_READ_ONLY` | `1` disables every mutating endpoint regardless of other flags | | `DASH_DB` | SQLite path (default `data/dashboards.sqlite3`) | | `POLL_MS_SYSTEM` / `POLL_MS_LLM` / `POLL_MS_UPS` | how often the *browser* refetches each page (10 s / 2 s / 5 s) — shown in the page footer | | `DEBUGPY` / `DEBUGPY_PORT` | `DEBUGPY=1` opens a debugpy listener (default 5678) without blocking startup | | `RETAIN_RAW_HOURS` / `RETAIN_MINUTE_DAYS` / `RETAIN_HOUR_DAYS` | history rollup and pruning | A source that is not configured answers `404 {"configured": false}` **without dialling**, and the page says "not configured" instead of showing a red panel for something you never installed. Nothing that leaves the app carries a credential. A `HOST_TARGETS` userinfo token is parsed into an `Authorization` header, and every URL the browser can see — `/api/config`, a source's error string, the event feed — goes through `config.strip_userinfo` first, because an unreachable host writes its failure message into the event table and `/api/events` serves it. ## Architecture ``` agent/host_agent.py (each host) gufo / vLLM upsd (NUT) │ GET /snapshot │ GET /metrics │ LIST UPS / LIST VAR / LIST CMD │ │ + /slots (gufo) │ ▼ ▼ ▼ src/dashboards/collectors.py ────────────────────────────────────────────┐ │ parse + Δcounter/Δt (rates.py) │ ▼ ▼ sources/host.py · sources/llm.py · sources/nut.py poller.py (one task per source) │ samples events │ ▼ ▼ store.py ── SQLite (WAL): sample(source,host,metric,res,ts) + event ── api.py → web/ ``` * `poller.py` — every source gets its own asyncio task, its own health record, and its own error handling. A dead host keeps its last good values and is labelled stale; it never blanks or blocks another source. And it never quietly *stops*: the task is that source's only poller, so a SQLite write that gets refused is reported (`ok: false`, the real reason, the numbers aging, one line in the event log) instead of freezing the source under a green dot. * `store.py` — raw samples roll up to 1-minute and 1-hour averages and the raw rows are pruned, so a year of history is a few hundred MB rather than a disk emergency. * `severity.py` — the single green/amber/red table (`THRESHOLDS`, plus `INVERTED` for the metrics where lower is worse). Rated values in the API payloads travel with a sibling `severity` (`cpu.severity.usage_pct`, `memory.severity`, `disks.severity`, a UPS card's `severity.charge_pct`, `severity` inside the rated LLM cells such as KV pressure, `/api/summary` rows), computed server-side, so every page colours the same way and a value nobody reported renders `n/a` instead of green. A metric published as a 0-1 ratio is rescaled *for the verdict only* — the number printed stays what the upstream published. There is no `gpu.*` row: these are LLM servers, a busy GPU is the job, so the GPU card (and the fleet GPU column) renders uncoloured at every utilisation — the `gpu.*` history series are still stored and charted. * `alerts.py` — "what is wrong right now", as data. `alerts.build(settings, job_states, host_payloads, engine_payloads, ups_payload, recent_events)` is a pure projection of the state the poller already keeps plus the verdicts `severity.py` and the UPS health checks already reached — no I/O, no thresholds of its own — and `/api/summary` returns it as `alerts`, worst first: `{id, severity, source, message, href, at}`. A configured source that stopped answering is `fail`; one that is stale but still serving its last good value is `warn`; an **unconfigured** source never alerts; a dead source is one line rather than one per stale metric; the list dedupes per (source, metric) and is capped at 12 with a marker that says how many it hid. * `web/` — four static pages, one stylesheet, hand-rolled SVG charts (`charts.js`). No framework, no CDN, no bundler. The overview (`/`) is exactly two panels — a **Warnings & errors** list built from `/api/summary`'s `alerts` (each row links to the dashboard that explains it) and the **Fleet** table — and nothing else: an empty alert list reads as an explicit "all clear", and a live problem moves the panel above the table. A host that is not answering keeps its row — dimmed, every number `n/a` — so the fleet never quietly gets smaller and last good values are never mistaken for live ones. A big colour-coded number is `Dash.hero(el, {...})` on the `.hero` / `.hero-bar` styles, coloured by the `severity` in the payload via `Dash.severityFrom()` — the only colour vocabulary is `ok` / `warn` / `fail`, and a value with no verdict renders `n/a` with no colour at all. A battery is `DashCharts.battery(el, {charge, severity, state, label})`: one inline SVG whose fill *is* the charge — clamped to 0–100, never rounded up, clipped to the plate so 0 % is an empty shell — coloured only by the payload verdict, with a shape per state (solid shell on line, bolt charging, dashed outline on battery, a dash through the body when there is no reading) and a `` / `aria-label` that names it ("apc: Charge 100 percent, on line") unless the number beside it already does. Each `/system` host is one panel led by exactly six of them — CPU %, MEM %, TEMP, DISK % (mount underneath), GPU busy (VRAM, the APU pool and the card's temperature in the footnote — no temperature is printed when the driver exposes no sensor, never `0 °C`; and likewise never coloured and with no bar: a busy GPU is the job on an LLM server), and NET on two lines (↓ in / ↑ out, never coloured: a byte rate has no good/bad). Under the numbers, **each panel charts only its own host** — behind a collapsed **Charts** toggle, because the default view is current stats and a fleet of ten hosts each drawing three plots is noise: the summary reads `▸ Charts` with the window in it (`1h`, `24h` …), and opening it is what builds and paints the charts — instantly, from the response the last refresh already fetched, and repainted on every refresh after that while it stays open. Expanding one panel never stretches its collapsed siblings (`.grid.items-start`). The stack is utilisation (CPU, memory, worst disk), network (↓ in / ↑ out), and GPU busy for a host that reports cards — three 120px SVG charts, each with its own legend and its own `aria-label` naming the host and the plotted metrics (`LineChart`'s `ariaLabel` option), never a second host in sight. The fleet-wide charts, the nine-figure fleet-totals panel and the host/metric detail picker are gone, and so are the per-core charts, while `cpu.usage_pct@coreN` stays in SQLite. Everything else — load, clock, disk I/O, uptime, GPU power and the per-label temp breakdown, filesystems, processes — folds into a collapsed "More detail" disclosure. Each panel pulls its series in **one** `/api/system/history` request (`hosts=<that host>&metrics=…&range=…`) every refresh, stack open or not, and a host that stops reporting takes its panel, its Charts toggle and its charts off the page. `/llm` opens with the **fleet**: one block above the panels — `ALL ENGINES`, an `N of M engines` tag, the note *sums only engines answering now*, then **running / waiting / prompt tok/s / decode tok/s / total tokens** — and every number on it is `fleet_totals()`, so the page sums nothing itself. A dead engine keeps its last-good numbers in its own (stale-labelled) panel but is dropped from a total presented as current: the tag counts what answered, names the missing engine in its tooltip and dims while the sums are partial. Nothing on the block is coloured — `severity.py` rates no throughput and no queue depth, because 0 tok/s on an idle fleet is healthy — the dot is reachability, and `fleet.seams` (how the two engines count prompt tokens differently) is a tooltip on the prompt sum rather than another line of ink. Below two configured engines the block is hidden: a cross-engine sum of one engine duplicates that engine's panel. Below the fleet block sits the **stats strip**: one card per configured engine — reachability dot, name, age stamp, the **KV-cache bar** (the one rated cell: the fill and a breach's text take their colour from the payload's `severity` and nothing else), then `prompt tok/s` and `decode tok/s` with their provenance tag (`Δ10.0s`, scraped, estimated), `total tokens`, the sessions this engine reports (`slots busy` counted from gufo's `/slots`, or `running`/`waiting` for vLLM, plus `waiting`), `prefix cache hit`, `spec accept` (gufo), `queue time` with its `p95 …` foot (vLLM) — and red alarm chips for preemptions / GPU-context losses that exist only while non-zero. Then the engine panels hold the detail the strip does not print: two big throughput numbers (decode, prompt — uncoloured, because 0 tok/s on an idle server is healthy) with their provenance tag, and the latency rows (TTFT, TPOT) each with a `p95 …` foot line and its own sparkline over the selected window. Under the gufo panel's **`sessions (GET /slots)`** label sits the **slot grid**: one card per parallel slot, keyed by the slot's own id, created once and patched in place so a busy slot never flickers — request id, prompt tokens (with `processed …` while prefill runs), cache hit and its share of the prompt, generated tokens, remaining, context, and the model beside the slot number. A busy card is a border, a glyph and the word `processing`, never a green/amber/red verdict (a slot generating tokens is the job). Every cell reads exactly one key of the captured `/slots` shape — no `a ?? b` fallback chains — so a field rename fails a contract test instead of printing dashes, and `-1` sentinels print `idle`/`n/a`, never a negative countdown. When `/slots` does not answer, the panel says so with the API's own sentence rather than rendering a card of nothing, and vLLM's panel carries one line (*exposes no per-slot JSON*) and no grid. No row appears in both places — one value, one home — and there is no peak-context cell, because this page prints a number the upstream published or `n/a`. The four trend charts sit below the panels at half height, and one `/api/llm/history` request per refresh feeds all of it. With a single engine configured the page is one clean card in the strip and one clean panel — never a red half for a server you do not run. Each UPS card (`/ups`) opens with its battery glyph and three big numbers — **charge %**, **load %**, **runtime left** — coloured from the card's `severity` dict, with the electrical readings (line in, output, battery volts and amps, battery °C) kept below them in smaller muted type because they are what you read *while* the UPS is on battery. Health checks, the battery-test buttons (with their `DANGER` confirmation) and the NUT variable dump are unchanged, just second. ## Testing ```bash uv run pytest # unit + API tests, fully mocked, no network uv run pytest --cov # coverage gate set -a; . ./.env.dev; set +a # the live suite reads the same env as the app uv run pytest -m live --live # optional: real fleet / engines / upsd uv run ruff check src tests agent && uv run pyright # lint + types ./scripts/capture-fixtures.sh # re-record ground truth: host agents, UPS replies, gufo /slots ./scripts/capture-fixtures.sh --with-llm # ... and the engines' /metrics while they are up bash .agents/validate.sh # all of the above + `node --check` on every page # script + repo hygiene, with the 94% coverage floor ``` Test philosophy: **real captures as fixtures, mocks for behaviour.** Anything that must match an upstream (`/proc` layouts, vLLM metric names, NUT protocol framing) is asserted against a verbatim capture in `tests/fixtures/`; behaviour that needs a failure — upsd refusing a command, an engine returning 500, a host rebooting — is a fake. The `live` tests (`tests/test_live_fleet.py`) are the bridge: they SKIP unless you pass `--live`, each one also skips when its source is unset (**source `.env.dev` first** — run bare and they all skip quietly, which reads exactly like a pass), they drive the production code paths (`collectors.*`, `NutMonitor.collect`) against whatever hardware is reachable, and they never write — a battery test on live hardware is not a unit test. One more file is worth knowing about: `tests/card_contract.py` is the table of `/api/system/snapshot` paths the system page's per-host cards are allowed to read. It is checked against all three captured host shapes (discrete GPU, APU, no GPU), over HTTP, and again against the live fleet, so a card can never be "fixed" by inventing a number the agent does not report. `tests/ups_contract.py` does the same job for the UPS page's hero row and battery glyph (`charge %`, `load %`, `runtime left`, `battery_voltage`, the glyph's `charger_status` + `on_battery`, the card header), against the two real UPSes — recorded verbatim as `tests/fixtures/nut_<ups>.vars` by `./scripts/capture-fixtures.sh`, with the device serials scrubbed — and again against live upsd. The captures earn their place: the CyberPower answers `battery.mfr.date: CPS`, the APC's `battery.date` is a factory placeholder, and **neither** publishes `battery.temperature` or `battery.charger.status`, so a hand-written variable table would have tested nobody's memory. `tests/slots_contract.py` pins gufo's `/slots` rows the same way — hermetically from `tests/fixtures/slots_gufo.json` (the verbatim `/slots` reply, captured whenever `GUFO_BASE_URL` is set; the idle-slot rows are the shape the grid must handle) and again against the running engine. It exists because that table was once guessed: the old slot table read field names the server never published and rendered dashes forever. It also picks the **canonical name of each fact** — the live server answers `id_task` *and* `task_id` for one request — and the page renders only the canonical key, so a rename fails a test instead of quietly becoming a fallback chain. A busy slot's `prompt` is the user's in-flight request text, so the capture script blanks it and the page never reads it. ## Battery-test buttons Instant commands are the only mutating endpoint in the application (`POST /api/ups/command`) and they are gated four times: `NUT_ALLOW_ACTIONS=1`, not `DASH_READ_ONLY`, an `upsd.users` account that actually has the command, and a confirmation in the UI — destructive ones (deep test, calibration, `load.off`) require typing `DANGER`. The server re-checks every gate; hiding a button is not a safety control. Commands that would cut power are refused outright while the UPS is already on battery. Give the app a narrowly scoped NUT user instead of a god-mode one — per-command `instcmds`, not `actions = -`: ```ini # /etc/ups/upsd.users [dashboards] password = "..." instcmds = test.battery.start.quick instcmds = test.battery.start.deep instcmds = test.battery.stop ``` One command per `instcmds` line — that is what `man 5 upsd.users` specifies ("to specify multiple commands, use multiple instances of the instcmds field"), and a comma-separated list on one line is not that. `instcmds = all` is the alternative, and the fleet runs that: every command the drivers advertise, including the ones that cut output power. Nothing about the gates changes — the risk tier, the typed `DANGER`, `NUT_ALLOW_ACTIONS` and the on-battery refusal are what prevent a click from becoming an outage, because upsd gives the dashboard no way to ask what an account is allowed to send. upsd authenticates with `USERNAME` + `PASSWORD` (see `HELP` on your own server for the verbs it accepts — `USER`/`PASS` are not among them in 2.8.5); a user needs `instcmds`, never `actions = -`. `deploy/nut-sudoers` is the ruleset that lets the `ops` account read (and scoped-write) those files: `sudo install -m 0440 -o root -g root deploy/nut-sudoers /etc/sudoers.d/dashboards-nut`. Read `upsd.users` before you write it — `upsmon` authenticates from the same file, so overwriting it blind can take the box down at the wrong moment. Bind upsd to loopback (`LISTEN 127.0.0.1` in `upsd.conf`) and reach it with an ssh forward (`DEV_FORWARDS`) or a tailnet address. `NUT_SIMULATE=1` stands in for upsd during development; everything it produces is badged `SIMULATED`, and it is never the default. ## Deployment `Containerfile` is a two-stage build: `uv.lock` is resolved in the builder (exactly the versions the tests ran against) and the runtime stage is slim Python with nothing but the venv in it. The host agent is copied in too, so one image can monitor the box it runs on. In the deployment repo the pattern is the same as every other service: quadlet container + env template + nginx/SNI on the single domain. ```bash podman build -t dashboards . podman run --rm -p 8090:8090 --env-file dashboards.env \ -v dashboards-data:/var/lib/dashboards dashboards ``` It listens on `0.0.0.0:8090` as an unprivileged user, and the SQLite history lives in `/var/lib/dashboards` — put a volume there or every restart forgets the charts. With no sources configured `/api/health` answers `200 {"status": "empty"}`, so the container passes its health probe before its env file is right instead of crash-looping.