Tailnet identity = auth
No password database. Viewer vs admin comes from your Tailscale login; identity headers are only trusted when the request's peer is loopback.
Tailscale-only · Zero inbound ports · No Node.js
Your homelab,
one console.
Observe services, SLOs, backup freshness and container health across up to five rootless Podman nodes — then open the correct shell without exposing a single port.
01 — MONITOR
TELEMETRY & SLOS
The server room, lit
Live CPU, memory, disk, network, load and temperature. Container health and resource usage. TLS certificate observations. Service uptime and backup freshness — all in one glance, with 90-day history.
8 workspaces· 3 static binaries· 0 inbound ports· 50 MB console RSS
02 — ACT
KVM CONSOLE & HOST SHELL
Control from anywhere
Container logs with regex search. Interactive container shells in xterm.js. An explicitly confirmed host Bash — context-linked to the alert or log that sent you there. No tab sprawl.
HARDWARE CONSOLE EMULATION
17" rack-mounted KVM console running live real-time HostDeck sandbox. Click "Expand Fullscreen Demo" above for a full 100vw x 100vh interactive experience!
03 — SECURE
TAILSCALE AUTH PLANE
Zero inbound ports
Your Tailscale identity is the auth plane — no passwords, no exposed admin panel. Local host access runs through a Unix-socket agent. Remote nodes dial out over Tailscale WSS. Nothing to port-forward.
BROWSER
TAILSCALE
HTTPS/WSS
DASHBOARD
loopback only
NODE 1
agent
NODE 2
agent
NODE 3
agent
04 — TOPOLOGY
DEPENDENCY & BLAST RADIUS
Eight workspaces. One loop.
See the state → understand the problem → act on it safely. Everything an operator runs on a 1–5 node lab, in one interface, no tab sprawl between metrics, logs and shells.
05 — AFTERLIGHT
ONE-COMMAND ADOPTION
One command. Zero ports.
Install with a single script, unprivileged, APT/DNF/Pacman aware. Tailscale Serve terminates HTTPS — no host port ever published. Open your *.ts.net URL and start observing.
Go
SQLite
Podman
Tailscale
WebSocket
Vanilla JS
Apache-2.0
BENCHMARK // COMPARISON
How it stacks against the usual homelab stack.
The full feature matrix with honest "we don't do this" trade-offs lives in docs.html.
| Feature | HostDeck | Homepage | Uptime Kuma | Beszel / Netdata | Grafana stack |
|---|---|---|---|---|---|
| Zero inbound ports | Native | — | — | Partial · outbound WS | — |
| SLO error budgets 7/30/90d | First-party | — | Partial · uptime % only | — | Partial · needs plugin |
| Backup freshness monitoring | First-party | — | Partial · diff mechanism | — | Partial · hand-rolled |
| 90-day SQLite history, no TSDB | Native | — | Partial · status pages | Partial · basic ~30d | Yes · but heavy |
| Interactive container shell | Native | — | — | — | — |
| Confirmed host Bash | Native | — | — | — | Partial · Cockpit-like |
| Tailscale identity = sole auth | Native | — | — | — | — |
INTEGRATIONS // WEBHOOKS
Alerts reach you — not just a badge.
Two native delivery channels, no vendor SDKs: ntfy push and an HMAC-signed generic webhook. Point the webhook at anything that speaks HTTP: a Telegram bot, Discord, Slack, Home Assistant, n8n — and alerts land where you already look.
ntfy push
HMAC-SHA256 webhook
Telegram
Discord
Slack
Home Assistant
n8n
Any Webhook Endpoint
Signed payloads with X-Homelab-Signature: sha256=<hex> · per-webhook secrets · in-UI test push & POST · ack and silence rules. Setup details in docs/operations.md.
ARCHITECTURE // SECURITY
Small surface. Explicit actions. No inbound ports.
The host shell is the most trusted feature, so it gets the most guards — and the whole system is designed so there is nothing to port-forward.
Zero inbound ports
Local host access goes through a Unix-socket agent; remote nodes dial out over Tailscale WSS. No SSH, no agent listener, no reverse proxy to secure.
Host shell is guarded
An explicit HOST_SHELL_USERS allowlist plus an in-UI confirmation. Session audit records, 15-minute idle timeout, 1-hour hard cap — never auto-resumed.
Least privilege by build
Dashboard runs read-only with dropped capabilities; host and node agents run as the unprivileged installing account. Three binaries, three privilege boundaries.
OPERATOR FAQ
Fair questions, straight answers.
Do I need Tailscale?
Yes — your tailnet identity is the auth plane, so there is no password database to secure. Tailscale's free tier covers a personal tailnet with 100 devices.
How much does it cost?
Nothing. Apache-2.0, three static Go binaries and one SQLite file. No SaaS, no licence keys, no telemetry.
Does it work with Docker, or only Podman?
Container health, stats, logs and shells are built against the rootless Podman socket. If you run Docker, the container workspaces won't have a socket to talk to.
How is this different from Grafana, Beszel or Uptime Kuma?
Those are point tools: metrics, monitoring or availability. This console closes the loop: see the alert, open the right log, drop into the right shell, all in one place, with zero inbound ports.
Can I get alerts on Telegram, Discord or Slack?
Yes — via the HMAC-signed webhook channel. The dashboard POSTs a versioned JSON payload to any HTTPS endpoint, so you forward it to your own bot, n8n flow or Home Assistant automation. Native ntfy push is also built in.
Where does my data live?
One SQLite file on the dashboard host. History is rolled up in three tiers: 10s samples for 48h, 1-minute for 30 days, 15-minute for 90 days — with a configurable quota.
DOCUMENTATION & ARCHITECTURE
Docs that answer the real questions.
No marketing fluff — operational detail, architecture decisions, honest comparisons and measured numbers, all in the repository.