feat: Added glances services

readme.md

@@ -102,7 +102,8 @@ Each of `services/dev`, `services/prod`, `services/vpn` follows the same convent
 - **DNS is provisioned, not just documented.** `module.dns` creates a Hetzner zone and every A/MX/TXT/CNAME record in `infra/main.tf` — see [Managing DNS](#managing-dns).
 - **Hosts are discovered dynamically** from the Hetzner API by role label, not a static inventory file — nothing in Ansible reads Terraform state.
 - **Gitea Actions runners are disposable.** Their `/data` is a local cache; runner identity re-registers with Gitea on every `spinup.sh`, so they're excluded from backup.
-- **The `home` dashboard only gets Docker container widgets for `prod`.** It links to every service on all three hosts, but container-level widgets (CPU/memory) are wired up only for containers on `prod` itself (`services/prod/home/config/docker.yaml`) — reaching into `dev`'s or `vpn`'s Docker socket would mean opening a path across hosts, which cuts against `vpn`'s deliberate isolation above. The Traefik widgets for `dev`/`vpn` are the one exception: they hit those hosts' public, unauthenticated dashboard URLs (same as any browser could), not their Docker sockets, so they need no network changes.
+- **The `home` dashboard only gets Docker container widgets for `prod`.** It links to every service on all three hosts, but container-level widgets (CPU/memory) are wired up only for containers on `prod` itself (`services/prod/home/config/docker.yaml`) — reaching into `dev`'s or `vpn`'s Docker socket would mean opening a path across hosts, which cuts against `vpn`'s deliberate isolation above. The Traefik and Glances widgets for `dev`/`vpn` are the exception: they hit those hosts' public, unauthenticated dashboard/panel URLs (same as any browser could), not their Docker sockets, so they need no network changes.
+- **Each host runs its own Glances instance** (`glances-docker-compose.yml`) for performance monitoring (CPU/memory/disk/network/process), fronted by that host's own Traefik like everything else. `home`'s Glances widgets (`services/prod/home/config/services.yaml`) read all three over HTTPS, the same pattern as the Traefik widgets above.
 
 ## Prerequisites
 
@@ -221,6 +222,7 @@ All three hosts run [Watchtower](https://containrrr.dev/watchtower/), polling ev
 | Service | Compose file | Domain(s) |
 |---|---|---|
 | Traefik | `traefik-docker-compose.yml` | `traefik.cicd.luke-else.co.uk` |
+| Glances | `glances-docker-compose.yml` | `glances.cicd.luke-else.co.uk` |
 | Gitea | `gitea-docker-compose.yml` | `git.luke-else.co.uk` (HTTP), SSH on `222` |
 | Gitea Actions runner(s) | `Runners/docker-compose.yml` (generated, 3 by default) | N/A |
 | Watchtower | `watchtower-docker-compose.yml` | — |
@@ -236,6 +238,7 @@ All three hosts run [Watchtower](https://containrrr.dev/watchtower/), polling ev
 | Bitwarden (Vaultwarden) | `bitwarden-docker-compose.yml` | `bitwarden.luke-else.co.uk` |
 | RustDesk relay (hbbs/hbbr) | `rd-docker-compose.yml` | `rd.luke-else.co.uk`, ports `21115-21119` |
 | Home dashboard (Homepage) | `home-docker-compose.yml` | `home.luke-else.co.uk` |
+| Glances | `glances-docker-compose.yml` | `glances.luke-else.co.uk` |
 | Watchtower | `watchtower-docker-compose.yml` | — |
 | Backup/restore | `backup-docker-compose.yml` | — |
 
@@ -244,6 +247,7 @@ All three hosts run [Watchtower](https://containrrr.dev/watchtower/), polling ev
 | Service | Compose file | Domain(s) |
 |---|---|---|
 | Traefik | `traefik-docker-compose.yml` | `traefik.vpn.luke-else.co.uk` |
+| Glances | `glances-docker-compose.yml` | `glances.vpn.luke-else.co.uk` |
 | WireGuard (wg-easy) | `vpn-docker-compose.yml` | `vpn.luke-else.co.uk`, UDP `51820` |
 | Watchtower | `watchtower-docker-compose.yml` | — |
 | Backup/restore | `backup-docker-compose.yml` | — |