# Unraid AppOps Gateway

A self-hosted operations dashboard that brings application discovery, connector health, policy-controlled actions and an auditable activity history together. Designed for operators managing Unraid and Portainer installations.

## Capabilities

- Discover services, review inventory and deliberately bring applications under management.
- Configure Portainer, optional Unraid and application-specific connectors through `/setup`.
- Inspect health, notification rules, diagnostics and SQLite-safe backups.
- Apply typed action policies; blocked destructive operations remain blocked.
- Integrate optional Home Assistant voice commands and separately authenticated MCP/n8n clients.
- Use deployment and enrollment control planes with pre-registered identities and immutable revisions.

The gateway does not require direct Docker socket access and exposes no arbitrary shell endpoint. Connector credentials are write-only through the API and encrypted at rest. Optional integrations require their own endpoints and scoped credentials.

## Local evaluation

The public Compose configuration is isolated from the owner's deployment. Requirements: Docker Engine with Compose.

```bash
cp .env.example .env
# Set APPOPS_OPERATOR_TOKEN and APPOPS_SECRET_KEY to independent random values.
docker compose up --build -d
```

Open `http://localhost:1216/setup`. Keep the operator token and encryption key private. The stack binds only to loopback, persists `./data`, enables operator authentication, and disables MCP/n8n until explicitly configured. It has no production host mounts, proxy networks or broker endpoints. Configure Portainer in the setup wizard; missing optional connectors remain visible as partial coverage.

Before production use, put the application behind a trusted authenticated TLS reverse proxy or VPN. Never expose it directly to the internet. Preserve both `/data` and its encryption key, test restore, and review every connector's permissions. See [Security policy](SECURITY.md).

## Development

React 19, TypeScript, Vite, Tailwind and TanStack Query form the frontend. FastAPI provides the backend and serves the built frontend; SQLite persists state. Python dependencies are pinned in `backend/requirements.txt`.

```bash
corepack enable
pnpm install --frozen-lockfile
pnpm dev
pnpm check-types
pnpm lint
pnpm test:frontend
pnpm build
python -m pip install -r backend/requirements.txt
python -m pytest backend/tests -q
```

The current frontend uses the live backend facade; the historical mock-mode setting is no longer an offline demo switch. Evaluate the full local container with an empty data directory and no live connectors to explore setup safely.

## Publication and licensing

`Unraid-AppOps-Gateway-Public` is a curated snapshot maintained from the private canonical repository. Updates are published automatically after changes merge to canonical `main`; private history, operational evidence and internal Actions are excluded. The public source manifest records the exact source revision.

No project-wide license has been selected or included. Public visibility does not grant an open-source license. Third-party dependencies retain their own terms. Contact the owner before redistributing or reusing the project.