53 lines
3.2 KiB
Markdown
53 lines
3.2 KiB
Markdown
# Unraid AppOps Gateway
|
|
|
|
A self-hosted operations dashboard that brings application discovery, connector health, policy-controlled actions and an auditable activity history together. Designed for operators managing Unraid and Portainer installations.
|
|
|
|
## Capabilities
|
|
|
|
- Discover services, review inventory and deliberately bring applications under management.
|
|
- Configure Portainer, optional Unraid and application-specific connectors through `/setup`.
|
|
- Inspect health, notification rules, diagnostics and SQLite-safe backups.
|
|
- Apply typed action policies; blocked destructive operations remain blocked.
|
|
- Integrate optional Home Assistant voice commands and separately authenticated MCP/n8n clients.
|
|
- Use deployment and enrollment control planes with pre-registered identities and immutable revisions.
|
|
|
|
The gateway does not require direct Docker socket access and exposes no arbitrary shell endpoint. Connector credentials are write-only through the API and encrypted at rest. Optional integrations require their own endpoints and scoped credentials.
|
|
|
|
## Local evaluation
|
|
|
|
The public Compose configuration is isolated from the owner's deployment. Requirements: Docker Engine with Compose.
|
|
|
|
```bash
|
|
cp .env.example .env
|
|
# Set APPOPS_OPERATOR_TOKEN and APPOPS_SECRET_KEY to independent random values.
|
|
docker compose up --build -d
|
|
```
|
|
|
|
Open `http://localhost:1216/setup`. Keep the operator token and encryption key private. The stack binds only to loopback, persists `./data`, enables operator authentication, and disables MCP/n8n until explicitly configured. It has no production host mounts, proxy networks or broker endpoints. Configure Portainer in the setup wizard; missing optional connectors remain visible as partial coverage.
|
|
|
|
Before production use, put the application behind a trusted authenticated TLS reverse proxy or VPN. Never expose it directly to the internet. Preserve both `/data` and its encryption key, test restore, and review every connector's permissions. See [Security policy](SECURITY.md).
|
|
|
|
## Development
|
|
|
|
React 19, TypeScript, Vite, Tailwind and TanStack Query form the frontend. FastAPI provides the backend and serves the built frontend; SQLite persists state. Python dependencies are pinned in `backend/requirements.txt`.
|
|
|
|
```bash
|
|
corepack enable
|
|
pnpm install --frozen-lockfile
|
|
pnpm dev
|
|
pnpm check-types
|
|
pnpm lint
|
|
pnpm test:frontend
|
|
pnpm build
|
|
python -m pip install -r backend/requirements.txt
|
|
python -m pytest backend/tests -q
|
|
```
|
|
|
|
The current frontend uses the live backend facade; the historical mock-mode setting is no longer an offline demo switch. Evaluate the full local container with an empty data directory and no live connectors to explore setup safely.
|
|
|
|
## Publication and licensing
|
|
|
|
`Unraid-AppOps-Gateway-Public` is a curated snapshot maintained from the private canonical repository. Updates are published automatically after changes merge to canonical `main`; private history, operational evidence and internal Actions are excluded. The public source manifest records the exact source revision.
|
|
|
|
No project-wide license has been selected or included. Public visibility does not grant an open-source license. Third-party dependencies retain their own terms. Contact the owner before redistributing or reusing the project.
|