f

readme.md

@@ -85,7 +85,7 @@ architecture-beta
 │   └── playbooks/               # bootstrap.yml, deploy.yml, spinup.yml, spindown.yml, site.yml
 ├── services/                 # Docker Compose stacks, grouped by which server they run on
 │   ├── dev/                    # Gitea + CI runners + Traefik + backup/restore
-│   ├── prod/                   # Websites, Bitwarden, RustDesk, status page + Traefik + backup/restore
+│   ├── prod/                   # Websites, Bitwarden, RustDesk, status page, home dashboard + Traefik + backup/restore
 │   └── vpn/                     # WireGuard (wg-easy) + Traefik + backup/restore
 ├── .devcontainer/             # git submodule: shared devcontainer for this repo (OpenTofu tooling)
 └── assets/
@@ -101,6 +101,7 @@ Each of `services/dev`, `services/prod`, `services/vpn` follows the same convent
 - **DNS is provisioned, not just documented.** `module.dns` creates a Hetzner zone and every A/MX/TXT/CNAME record in `infra/main.tf` — see [Managing DNS](#managing-dns).
 - **Hosts are discovered dynamically** from the Hetzner API by role label, not a static inventory file — nothing in Ansible reads Terraform state.
 - **Gitea Actions runners are disposable.** Their `/data` is a local cache; runner identity re-registers with Gitea on every `spinup.sh`, so they're excluded from backup.
+- **The `home` dashboard only gets Docker container widgets for `prod`.** It links to every service on all three hosts, but container-level widgets (CPU/memory) are wired up only for containers on `prod` itself (`services/prod/home/config/docker.yaml`) — reaching into `dev`'s or `vpn`'s Docker socket would mean opening a path across hosts, which cuts against `vpn`'s deliberate isolation above. The Traefik widgets for `dev`/`vpn` are the one exception: they hit those hosts' public, unauthenticated dashboard URLs (same as any browser could), not their Docker sockets, so they need no network changes.
 
 ## Prerequisites
 
@@ -224,6 +225,7 @@ All three hosts run [Watchtower](https://containrrr.dev/watchtower/), polling ev
 | Status page (Uptime Kuma) | `status-docker-compose.yml` | `status.luke-else.co.uk` |
 | Bitwarden (Vaultwarden) | `bitwarden-docker-compose.yml` | `bitwarden.luke-else.co.uk` |
 | RustDesk relay (hbbs/hbbr) | `rd-docker-compose.yml` | `rd.luke-else.co.uk`, ports `21115-21119` |
+| Home dashboard (Homepage) | `home-docker-compose.yml` | `home.luke-else.co.uk` |
 | Watchtower | `watchtower-docker-compose.yml` | — |
 | Backup/restore | `backup-docker-compose.yml` | — |