Skip to content

Commit 36b4347

Browse files
mcmikemnEnigmaCurry
mcmikemn
and
EnigmaCurry
authored
Added Glances (#284)
* Added Glances * corrected default image tag * Update README.md * change per discussion in PR#284 * update readme * set default to makefile question as value of env var * Update README.md * corrected warning in readme * Update README.md --------- Co-authored-by: Ryan McGuire <[email protected]> Co-authored-by: Ryan McGuire <[email protected]>
1 parent a904dc2 commit 36b4347

File tree

6 files changed

+287
-0
lines changed

6 files changed

+287
-0
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,7 @@ Install these other services at your leisure/preference:
537537
* [Ejabberd](ejabberd#readme) - an XMPP (Jabber) server
538538
* [Filestash](filestash#readme) - a web based file manager with customizable backend storage providers
539539
* [FreshRSS](freshrss#readme) - an RSS reader / proxy
540+
* [Glances](glances#readme) - a cross-platform system monitoring tool
540541
* [Grocy](grocy#readme) - a grocery & household management/chore solution
541542
* [Icecast](icecast#readme) - a SHOUTcast compatible streaming multimedia server
542543
* [Immich](immich#readme) - a photo gallery

‎glances/.env-dist

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# The docker image to use:
2+
GLANCES_IMAGE=nicolargo/glances:4.1.2.1
3+
4+
# The domain name for the glances service:
5+
GLANCES_TRAEFIK_HOST=glances.example.com
6+
7+
# The name of this instance. If there is only one instance, use 'default'.
8+
GLANCES_INSTANCE=
9+
10+
# Filter access by IP address source range (CIDR):
11+
##Disallow all access: 0.0.0.0/32
12+
##Allow all access: 0.0.0.0/0
13+
GLANCES_IP_SOURCERANGE=0.0.0.0/0
14+
15+
# HTTP Basic Authentication:
16+
# Use `make config` to fill this in properly, or set this to blank to disable.
17+
GLANCES_HTTP_AUTH=
18+
19+
# OAUTH2
20+
# Set to `true` to use OpenID/OAuth2 authentication via the
21+
# traefik-forward-auth service in d.rymcg.tech.
22+
# Using OpenID/OAuth2 will require login to access your app,
23+
# but it will not affect what a successfully logged-in person can do in your
24+
# app. If your app has built-in authentication and can check the user
25+
# header that traefik-forward-auth sends, then your app can limit what the
26+
# logged-in person can do in the app. But if your app can't check the user
27+
# header, or if your app doesn't have built-in authentication at all, then
28+
# any person with an account on your Gitea server can log into your app and
29+
# have full access.
30+
GLANCES_OAUTH2=
31+
# In addition to Oauth2 authentication, you can configure basic authorization
32+
# by entering which authorization group can log into your app. You create
33+
# groups of email addresses in the `traefik` folder by running `make groups`.
34+
GLANCES_OAUTH2_AUTHORIZED_GROUP=
35+
36+
# Mutual TLS (mTLS):
37+
# Set true or false. If true, all clients must present a certificate signed by Step-CA:
38+
GLANCES_MTLS_AUTH=false
39+
# Enter a comma separated list of client domains allowed to connect via mTLS.
40+
# Wildcards are allowed and encouraged on a per-app basis:
41+
GLANCES_MTLS_AUTHORIZED_CERTS=*.clients.glances.example.com
42+
43+
# Timezone (see: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)
44+
GLANCES_TZ=America/New_York
45+
46+
# Nvidia GPU support
47+
GLANCES_GPU=false
48+
49+
# Set to "true" to allow Glances access to the host's Docker socket, which will
50+
# allow Glances to report on metrics for containers. Or set to "false" to
51+
# disallow access to the host's Docker socket. Be aware that allowing access to
52+
# the Docker socket is not safe because it effectively grants full control over
53+
# the Docker daemon, enabling a container or attacker to escalate privileges,
54+
# manipulate containers, and potentially compromise the host system.
55+
GLANCES_CONTAINER_METRICS=false
56+
57+
# Glances server runtime options
58+
# See: https://glances.readthedocs.io/en/develop/cmds.html#command-line-options
59+
GLANCES_OPTIONS="-t 2"

‎glances/Makefile

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
ROOT_DIR = ..
2+
include ${ROOT_DIR}/_scripts/Makefile.projects
3+
include ${ROOT_DIR}/_scripts/Makefile.instance
4+
5+
.PHONY: config-hook
6+
config-hook:
7+
@${BIN}/reconfigure_ask ${ENV_FILE} GLANCES_TRAEFIK_HOST "Enter the glances domain name" glances${INSTANCE_URL_SUFFIX}.${ROOT_DOMAIN}
8+
@${BIN}/reconfigure ${ENV_FILE} GLANCES_INSTANCE=$${instance:-default}
9+
@${BIN}/reconfigure_auth ${ENV_FILE} GLANCES
10+
@echo
11+
@${BIN}/confirm $$("$$(${BIN}/dotenv -f ${ENV_FILE} get GLANCES_GPU)" == "false" && echo 'yes' || echo 'no') "Do you want to enable Nvidia GPU support" "?" && ${BIN}/reconfigure ${ENV_FILE} GLANCES_GPU=true || ${BIN}/reconfigure ${ENV_FILE} GLANCES_GPU=false
12+
@echo
13+
@echo "Glances can report on container metrics if you allow it access to the host's Docker socket. Be aware that allowing access to the Docker socket is not safe because it effectively grants full control over the Docker daemon, enabling a container or attacker to escalate privileges, manipulate containers, and potentially compromise the host system."
14+
@${BIN}/confirm $$("$$(${BIN}/dotenv -f ${ENV_FILE} get GLANCES_CONTAINER_METRICS)" == "false" && echo 'yes' || echo 'no') "Do you want to enable container metrics" "?" && ${BIN}/reconfigure ${ENV_FILE} GLANCES_CONTAINER_METRICS=true || ${BIN}/reconfigure ${ENV_FILE} GLANCES_CONTAINER_METRICS=false
15+
@echo
16+
17+
.PHONY: override-hook
18+
override-hook:
19+
#### This sets the override template variables for docker-compose.instance.yaml:
20+
#### The template dynamically renders to docker-compose.override_{DOCKER_CONTEXT}_{INSTANCE}.yaml
21+
#### These settings are used to automatically generate the service container labels, and traefik config, inside the template.
22+
#### The variable arguments have three forms: `=` `=:` `=@`
23+
#### name=VARIABLE_NAME # sets the template 'name' field to the value of VARIABLE_NAME found in the .env file
24+
#### # (this hardcodes the value into docker-compose.override.yaml)
25+
#### name=:VARIABLE_NAME # sets the template 'name' field to the literal string 'VARIABLE_NAME'
26+
#### # (this hardcodes the string into docker-compose.override.yaml)
27+
#### name=@VARIABLE_NAME # sets the template 'name' field to the literal string '${VARIABLE_NAME}'
28+
#### # (used for regular docker-compose expansion of env vars by name.)
29+
@${BIN}/docker_compose_override ${ENV_FILE} project=:glances instance=@GLANCES_INSTANCE traefik_host=@GLANCES_TRAEFIK_HOST http_auth=GLANCES_HTTP_AUTH http_auth_var=@GLANCES_HTTP_AUTH ip_sourcerange=@GLANCES_IP_SOURCERANGE oauth2=GLANCES_OAUTH2 authorized_group=GLANCES_OAUTH2_AUTHORIZED_GROUP enable_mtls_auth=GLANCES_MTLS_AUTH mtls_authorized_certs=GLANCES_MTLS_AUTHORIZED_CERTS gpu_support=GLANCES_GPU container_metrics=GLANCES_CONTAINER_METRICS
30+
31+
.PHONY: shell
32+
shell:
33+
@make --no-print-directory docker-compose-shell SERVICE=glances

‎glances/README.md

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# glances
2+
3+
[glances](https://github.com/nicolargo/glances) is an open-source system
4+
cross-platform monitoring tool. It allows real-time monitoring of various
5+
aspects of your system such as CPU, memory, disk, network usage etc. It also
6+
allows monitoring of running processes, logged in users, temperatures,
7+
voltages, fan speeds etc. It also supports container monitoring, it supports
8+
different container management systems such as Docker, LXC. The information
9+
is presented in an easy to read dashboard and can also be used for remote
10+
monitoring of systems via a web interface or command line interface.
11+
12+
## Warning
13+
14+
This container uses the docker flag `network_mode: host`, which gives
15+
unlimited access to your host network. There is also configurable
16+
support for mounting the Docker socket, which provides full root
17+
access to your host. You should not install this unless you completely
18+
trust this service. To enforce the use of Traefik as your entrypoint,
19+
your external firewall should block TCP ports 61208 and 61209.
20+
21+
## Config
22+
23+
```
24+
make config
25+
```
26+
27+
This will ask you to enter the domain name to use.
28+
It automatically saves your responses into the configuration file
29+
`.env_{INSTANCE}`.
30+
31+
It will also ask you if you want Glances to be able to report on container
32+
metrics in addition to the metrics of the host you are installing it on.
33+
In order for Glances to report on container metrics, it requires access to
34+
the host's Docker socket. Be aware that allowing access to the Docker socket
35+
is not safe because it effectively grants full control over the Docker
36+
daemon, enabling a container or attacker to escalate privileges, manipulate
37+
containers, and potentially compromise the host system.
38+
39+
### Authentication and Authorization
40+
41+
Running `make config` will ask whether or not you want to configure
42+
authentication for your app (on top of any authentication your app provides).
43+
You can configure OpenID/OAuth2, mTLS, or HTTP Basic Authentication.
44+
45+
OAuth2 uses traefik-forward-auth to delegate authentication to an external
46+
authority (eg. a self-deployed Gitea instance). Accessing this app will
47+
require all users to login through that external service first. Once
48+
authenticated, they may be authorized access only if their login id matches the
49+
member list of the predefined authorization group configured for the app
50+
(`GLANCES_OAUTH2_AUTHORIZED_GROUP`). Authorization groups are defined in the
51+
Traefik config (`TRAEFIK_HEADER_AUTHORIZATION_GROUPS`) and can be
52+
[created/modified](https://github.com/EnigmaCurry/d.rymcg.tech/blob/master/traefik/README.md#oauth2-authentication)
53+
by running `make groups` in the `traefik` directory.
54+
55+
mTLS (Mutual TLS) is an extension of standard TLS where both the client and
56+
server authenticate each other using certificates. Accessing this app will
57+
require all users to have a client mTLS certificate installed in their browser,
58+
and this app must be configured to accept that certificate. You will be
59+
prompted to enter one or more CN (Common Name) in a comma-separated list (a CN
60+
is a field in a certificate that typically represents the domain name of the
61+
server or the person/organization to which the certificate is issued). Only
62+
certificates matching one of these CNs will be allowed access to the app, and
63+
users with a valid mTLS certificate will be ensured secure, two-way encrypted
64+
communication, providing enhanced security by verifying both parties'
65+
identities.
66+
67+
For HTTP Basic Authentication, you will be prompted to enter username/password
68+
logins which are stored in that app's `.env_{INSTANCE}` file.
69+
70+
## Install
71+
72+
```
73+
make install
74+
```
75+
76+
## Open
77+
78+
```
79+
make open
80+
```
81+
82+
This will automatically open the page in your web browser, and will
83+
prefill the HTTP Basic Authentication password if you enabled it
84+
(and chose to store it in `passwords.json`).
85+
86+
## Destroy
87+
88+
```
89+
make destroy
90+
```
91+
92+
This completely removes the container and all its volumes.

‎glances/docker-compose.instance.yaml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
#! This is a ytt template file for docker-compose.override.yaml
2+
#! References:
3+
#! https://carvel.dev/ytt
4+
#! https://docs.docker.com/compose/extends/#adding-and-overriding-configuration
5+
#! https://github.com/enigmacurry/d.rymcg.tech#overriding-docker-composeyaml-per-instance
6+
7+
#! ### Standard project vars:
8+
#@ load("@ytt:data", "data")
9+
#@ project = data.values.project
10+
#@ instance = data.values.instance
11+
#@ context = data.values.context
12+
#@ traefik_host = data.values.traefik_host
13+
#@ ip_sourcerange = data.values.ip_sourcerange
14+
#@ enable_http_auth = len(data.values.http_auth.strip()) > 0
15+
#@ http_auth = data.values.http_auth_var
16+
#@ enable_oauth2 = data.values.oauth2 == "true"
17+
#@ authorized_group = data.values.authorized_group
18+
#@ enable_mtls_auth = data.values.enable_mtls_auth == "true"
19+
#@ mtls_authorized_certs = data.values.mtls_authorized_certs
20+
#@ enabled_middlewares = []
21+
22+
#! ### Project-specific vars:
23+
#@ gpu_support = data.values.gpu_support == "true"
24+
#@ container_metrics = data.values.container_metrics == "true"
25+
26+
#@yaml/text-templated-strings
27+
services:
28+
glances:
29+
#@ service = "glances"
30+
31+
#@ if gpu_support:
32+
deploy:
33+
resources:
34+
reservations:
35+
devices:
36+
- driver: nvidia
37+
count: 1
38+
capabilities: [gpu]
39+
#@ end
40+
41+
volumes:
42+
#@ if container_metrics:
43+
- /var/run/docker.sock:/var/run/docker.sock:ro
44+
#@ end
45+
#! The following line causes Glances to display host's OS detail instead of container's
46+
- /etc/os-release:/etc/os-release:ro
47+
48+
labels:
49+
#! Services must opt-in to be proxied by Traefik:
50+
- "traefik.enable=true"
51+
52+
#! 'router' is the fully qualified key in traefik for this router/service: project + instance + service
53+
#@ router = "{}-{}-{}".format(project,instance,service)
54+
55+
#! The host matching router rule:
56+
- "traefik.http.routers.(@= router @).rule=Host(`(@= traefik_host @)`)"
57+
- "traefik.http.routers.(@= router @).entrypoints=websecure"
58+
59+
#@ enabled_middlewares.append("{}-ipallowlist".format(router))
60+
- "traefik.http.middlewares.(@= router @)-ipallowlist.ipallowlist.sourcerange=(@= ip_sourcerange @)"
61+
#@ if enable_http_auth:
62+
#@ enabled_middlewares.append("{}-basicauth".format(router))
63+
- "traefik.http.middlewares.(@= router @)-basicauth.basicauth.users=(@= http_auth @)"
64+
- "traefik.http.middlewares.(@= router @)-basicauth.basicauth.headerField=X-Forwarded-User"
65+
#@ end
66+
67+
#@ if enable_oauth2:
68+
#@ enabled_middlewares.append("traefik-forward-auth@docker")
69+
#@ enabled_middlewares.append("header-authorization-group-{}@file".format(authorized_group))
70+
#@ end
71+
72+
#@ if enable_mtls_auth:
73+
- "traefik.http.routers.(@= router @).tls.options=step_ca_mTLS@file"
74+
#@ if len(mtls_authorized_certs):
75+
- "traefik.http.middlewares.mtlsauth-(@= router @).plugin.certauthz.domains=(@= mtls_authorized_certs @)"
76+
#@ enabled_middlewares.append("mtlsauth-{}".format(router))
77+
#@ end
78+
#@ enabled_middlewares.append("mtls-header@file")
79+
#@ end
80+
81+
#! Override the default port that the app binds to:
82+
#! You don't normally need to do this, as long as your image has
83+
#! an EXPOSE directive in it, Traefik will autodetect it, but this is how you can override it:
84+
- "traefik.http.services.(@= router @).loadbalancer.server.port=61208"
85+
86+
#! Apply all middlewares (do this at the end!)
87+
- "traefik.http.routers.(@= router @).middlewares=(@= ','.join(enabled_middlewares) @)"

‎glances/docker-compose.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
services:
2+
glances:
3+
image: ${GLANCES_IMAGE}
4+
restart: unless-stopped
5+
pid: host
6+
security_opt:
7+
- no-new-privileges:true
8+
cap_drop:
9+
- ALL
10+
network_mode: "host"
11+
environment:
12+
- TZ=${GLANCES_TZ}
13+
- "GLANCES_OPT=-w ${GLANCES_OPTIONS}"
14+
labels: []
15+
volumes: []

0 commit comments

Comments
 (0)