← All Customers

Last report: {{timeAgo .Customer.ReceivedAt}} · Controller {{.Customer.ControllerVersion}} Auto-refresh (paused)

No reports received yet

{{if eq .Flash "created"}}Configuration created successfully. {{else if eq .Flash "updated"}}Configuration updated. {{else if eq .Flash "password_regenerated"}}Retrieval password regenerated. {{else if eq .Flash "offsite_reissued"}}Offsite credentials re-issued — a fresh one-time password is staged; the controller picks it up on its next config refresh. {{else if eq .Flash "pbsdr_reissued"}}PBS DR credentials re-issued — a fresh one-time token secret is staged for the agent. Confirm it actually landed: the host's pvesm status must show the PBS entry active. A converged agent can report applied while the storage still authenticates 401 (R-39). {{else if eq .Flash "offsite_frozen"}}Offsite storage FROZEN (read-only) — new backups and prune will fail until unfrozen. {{else if eq .Flash "offsite_unfrozen"}}Offsite storage unfrozen — read-write restored. {{else if eq .Flash "blocked"}}Customer blocked — hidden from Dashboard. {{else if eq .Flash "unblocked"}}Customer unblocked — visible on Dashboard again. {{else if eq .Flash "log_tail_requested"}}Log tail requested — the controller delivers it on its next report cycle (a few minutes). A customer-visible event line was recorded. {{else if eq .Flash "claim-resent"}}Code re-sent to the registered address. A kód a doboz következő jelentésekor (~15 percen belül) aktiválódik. {{else if eq .Flash "claim-resend-failed"}}Claim code resend FAILED — check the hub log (email delivery / send error). {{else if eq .Flash "selfbind-sent"}}Self-bind link sent to the registered address — valid for 7 days. The customer enters the box's console pairing code + their retrieval passphrase; no operator bind needed. {{else if eq .Flash "selfbind-no-email"}}Self-bind link NOT sent — this customer has no registered email address. Set one first, or bind the appliance manually from the Hosts page. {{else if eq .Flash "selfbind-send-failed"}}Self-bind link send FAILED — the link was invalidated (not left live). Check the hub log (email delivery / send error). {{else if eq .Flash "reset_done"}}Customer RESET complete — every operational trace was destroyed (offsite repo, PBS namespace, DR recipe, claim state, retained escrow custody). Identity and basic config survive; the audit event stream records it. {{end}}

This customer is blocked — reports are accepted but not shown on the Dashboard.

No data since the RESET ({{.ResetAt}}) — „RESET óta nincs adat". Every health figure below predates it and describes a lifecycle that no longer exists. The box repopulates this page on its first report after re-onboarding.

Offsite is enabled but was never provisioned — no descriptor exists for this customer, so nothing is being backed up offsite. Provisioning is Save-triggered: open the Edit tab and press Save once to provision it, then verify on the Offsite page. Re-enrollment will not fix this on its own — the auto-re-issue deliberately skips an unprovisioned target. (R-36)

{{if .CustomerName}}{{.CustomerName}}{{else}}{{.CustomerID}}{{end}} {{.OverallStatus}} {{if .HostCause}}{{.HostCause}}{{end}} {{if .HasReports}} Controller {{.Customer.ControllerVersion}} Last report {{timeAgo .Customer.ReceivedAt}} Containers {{.Customer.ContainerRunning}}/{{.Customer.ContainerTotal}} {{end}}

Waiting for First Report

This customer has been configured but no controller report has been received yet.

Use one of the setup commands below to deploy the controller on the customer node.

Customer Info

{{/* v0.48.0 edit-a: Edit/Block/Delete moved to the Edit tab (form + danger zone); only the config-less bootstrap action stays in the header. */}} {{if not .HasConfig}} {{end}}

Customer ID {{.CustomerID}}

Name {{if .CustomerName}}{{.CustomerName}}{{else}}—{{end}}

Domain {{if .Domain}}{{.Domain}}{{else}}—{{end}}

Email {{if .Email}}{{.Email}}{{else}}—{{end}}

Config {{if .HasConfig}} MANAGED {{else}} MANUAL {{end}} {{if .IsBlocked}}BLOCKED{{end}}

Config Created {{timeAgo .Config.CreatedAt}}

Health

Reporting has been disabled on this node

Enable it in the controller's controller.yaml: hub.enabled: true

Customer is blocked

Status: {{index . "status"}}

Issues

{{.}}

Warnings

{{.}}

System

Hostname {{index . "hostname"}}

OS {{index . "os"}}

Kernel {{index . "kernel"}}

CPU {{index . "cpu_model"}} ({{index . "cpu_cores"}} cores)

CPU {{formatFloat .Customer.CPUPercent}}%

Memory {{formatFloat .Customer.MemoryPercent}}%

Storage

{{with index . "label"}}{{.}}{{else}}{{index . "mount"}}{{end}} {{printf "%.0f" (index . "percent")}}%

{{printf "%.1f" (index . "used_gb")}} / {{printf "%.1f" (index . "total_gb")}} GB

Backup

Enabled {{if index . "enabled"}}Yes{{else}}No{{end}}

Snapshots {{index . "snapshot_count"}}

Repo Size {{index . "repo_size_mb"}} MB

Integrity {{if index . "integrity_ok"}}OK{{else}}Unknown{{end}}

Containers ({{.Customer.ContainerRunning}}/{{.Customer.ContainerTotal}})

Name	State	CPU	Memory
{{index . "name"}}	{{index . "state"}}	{{printf "%.1f" (index . "cpu_percent")}}%	{{printf "%.0f" (index . "memory_mb")}} MB

Name

State

CPU

Memory

{{printf "%.1f" (index . "cpu_percent")}}%

{{printf "%.0f" (index . "memory_mb")}} MB

App Telemetry (last 7 days)

App	Memory (current)	Memory (avg 7d)	Memory (peak 7d)	Catalog Limit	Errors	Warnings	Logs
{{if .DisplayName}}{{.DisplayName}}{{else}}{{.AppName}}{{end}}	{{formatFloat .MemoryCurrentMB}} MB	{{formatFloat .MemoryAvgMB}} MB	{{formatFloat .MemoryPeakMB}} MB	{{if .CatalogLimit}}{{.CatalogLimit}}{{else}}—{{end}}	{{if gt .LogErrors 0}}{{.LogErrors}}{{else}}0{{end}}	{{if gt .LogWarnings 0}}{{.LogWarnings}}{{else}}0{{end}}	{{if index $.PendingTails .AppName}} tail pending {{else}} {{end}}

App Log Tails (on-demand, last 2 per app kept)

App	Collected	Received	Lines
{{.AppName}}	{{.CollectedAt.Format "2006-01-02 15:04:05"}} ({{timeAgo .CollectedAt}})	{{timeAgo .ReceivedAt}}	{{len .Lines}}	View Download .log

Container and app data appear once the first report arrives.

Credentials

Retrieval Password

••••••••••••••••

The per-customer secret that fetches the whole config — masked by default; never place it on a command line (the installer reads it at a no-echo prompt).

API Key

{{.Config.APIKey}}

Used by the controller for ongoing hub communication (reports, notifications, backups)

Dashboard access — customer claim

Claim status

{{if .Claim}} {{if .Claim.ClaimedAt}} Claimed {{timeAgoPtr .Claim.ClaimedAt}} {{else if .Claim.EmailedAt}} Nyitott — kód kiküldve {{timeAgoPtr .Claim.EmailedAt}} {{else}} Nyitott — a kód e-mail NEM ment ki (resend!) {{end}} generation {{.Claim.Generation}} · issued {{timeAgo .Claim.IssuedAt}} {{else}} no code issued yet issued automatically at the first config pull or report {{end}}

The customer sets + owns the dashboard password (claim code → own password). The code goes ONLY to the registered address ({{.Email}}); the hub stores a hash — no plaintext code exists to display.

Customer self-bind (R-27) Let the customer bind their own freshly-installed appliance — no operator bind needed. Sends a 7-day capability link to the registered address ({{.Email}}); the customer opens it and enters the box's console pairing code + their retrieval passphrase. Wrong entries lock the link after 5 attempts. If the link expires, bind the appliance manually from the Hosts page.

Setup Command

Day-0 host bootstrap. The command always fetches the current felhom-host-install.sh from felhom.eu — there is no version to pick here. Run it on a freshly-PVE-installed Proxmox host as root (create the customer in the hub first). It enrolls the host, installs + verifies the agent, and provisions the guest; the in-guest controller then pulls its own controller.yaml. The retrieval passphrase is entered at the no-echo prompt — never on the command line.

Mode *

appliance (Felhom-owned box) byo (a host you do not own)

Cores byo: required — a conservative slice of the host

Memory (MiB) byo: required — MiB (32 GB → 32768)

VMID (optional) pick from pct list+qm list; blank = default/auto

Node (optional) required only on a multi-node cluster

ACL storages (optional) grant the token write access on exactly these storages

Operator pubkey file (optional) arm self-update from day-0

Preserve state from (optional) reinstall keeping the leaf pin stable

--dry-run print, don't execute --preflight-only checks + verdict, no install --skip-provision agent only, no guest --allow-new-leaf

Option 1: Online install (recommended)

Download-then-run (not curl | sudo bash) so you can inspect the script first — the right default for a sovereignty product. The passphrase is entered at the no-echo prompt.

curl -fsSL https://felhom.eu/scripts/felhom-host-install.sh -o felhom-host-install.sh \
  && sudo bash felhom-host-install.sh --customer-id {{.CustomerID}} --mode <appliance|byo>

Option 2: Local install (script already on host)

sudo ./felhom-host-install.sh --customer-id {{.CustomerID}} --mode <appliance|byo>

Option 3: Manual config fetch (debug only)

The same payload the controller pulls itself — for inspection, not normal provisioning. Replace the placeholder with the Retrieval Password above (Reveal to see it) — it is intentionally NOT baked into this command.

curl -fsSL https://hub.felhom.eu/api/v1/config/{{.CustomerID}} -H "X-Retrieval-Password: <YOUR-RETRIEVAL-PASSWORD>" -o controller.yaml

YAML Preview

Loading preview...

No managed config yet — create one from the Overview tab to get setup commands.

No managed config yet — create one with the Create Config button above.

Controller Update

Controller version {{.Customer.ControllerVersion}}

Registry latest v{{.LatestVersion}} {{if .UpdateAvailable}} ● update available {{else}} — up to date {{end}}

Controller URL {{.ControllerURL}}

Effective floor (min. version) {{if .EffectiveFloor}}v{{.EffectiveFloor}} {{if .BelowFloor}}● below floor — will auto-update {{else}}— at/above floor{{end}} {{else}}none (Phase 2 inert){{end}}

Global floor {{if .GlobalFloor}}v{{.GlobalFloor}}{{else}}unset{{end}}

Controller updates are agent-driven (the version floor above) and config is delivered by the box pulling it on a config change — the hub never connects into the box. Edit the config in the form above; the controller re-pulls and restarts on its next report.

Geo-korlátozás

Állapot {{if index . "enabled"}} Aktív {{else}} Inaktív {{end}}

Engedélyezett országok {{$countries := index . "allowed_countries"}} {{if $countries}} {{range $i, $c := $countries}}{{if $i}}, {{end}}{{$c}}{{end}} {{else}} — {{end}}

Utolsó szinkron {{index . "last_sync"}}

Szinkron hiba {{index . "last_sync_error"}}

Alkalmazás felülírások

Alkalmazás	Engedélyezett országok
{{$app}}	{{$ac := index $override "allowed_countries"}} {{if $ac}}{{range $i, $c := $ac}}{{if $i}}, {{end}}{{$c}}{{end}}{{else}}—{{end}}

Controller update and geo-restriction settings appear once the first report arrives.

Ügyfél-visszaállítás (RESET — pre-első-telepítés)

Egyetlen művelettel visszaállítja az ügyfelet az első telepítés előtti állapotba: minden működési állapot törlődik (offsite tároló, PBS névtér, DR-recept, egyszeri jelszó, azonosítási állapot). Az azonosság és az alapkonfiguráció megmarad (ügyfélrekord, előzmények, események). Ez NEM törli a hostokat — ha még van host, előbb azt kell törölni. Kevesebb, mint a Danger zone Delete: az ügyfél megmarad, csak a működési nyomok tűnnek el.

Danger zone

{{if not .HasConfig}}Ghost customer — the configuration record is already gone; Delete is the applicable action. {{end}}Blocking hides the customer from the Dashboard (reports are still accepted). Delete customer is the full offboarding teardown (v0.69.0): it deletes the host(s), then RESETs the customer (offsite repository destroyed, PBS credentials revoked, tunnel and zone removed), then purges the customer record and all escrow ciphertext — including the retained recovery-key custody for this customer's hosts. This is the one true purge point; host deletion only demotes custody, never destroys it. Three acknowledgements and the typed customer-id are required. For identity-preserving re-onboarding use Ügyfél-visszaállítás (RESET) above instead.

{{if .HasConfig}}{{/* v0.70.1: blocking gates dashboard visibility of a CONFIGURED customer — meaningless for a ghost */}} {{if .IsBlocked}} {{else}} {{end}} {{end}}

DR Recipe (secret-free reconstruction plan)

The non-secret re-provision plan — guest sizing, drive inventory (durable-id → role → mount → intent), PVE storage defs, PBS coordinates, and app inventory + storage bindings. It complements escrow (keys) and PBS/restic (bytes): it contains no key, password, or token. Use it to rebuild the host/guest/storage scaffolding before the PBS bytes land.

Storage / guest / PBS half (agent) {{if .DRRecipeHasHost}}present{{else}}awaiting host-report{{end}}

Customer / apps half (controller) {{if .DRRecipeHasApps}}present{{else}}awaiting controller report{{end}}

Last updated {{if .DRRecipeUpdatedAt}}{{.DRRecipeUpdatedAt}}{{else}}—{{end}}

Download recipe (JSON)

No DR recipe yet — it assembles from the host-report and controller report.

Backup and DR data appear once the first report arrives.

Events {{if .EventCounts}} {{with mapGet .EventCounts "critical"}}{{.}} critical{{end}} {{with mapGet .EventCounts "error"}}{{.}} error{{if gt . 1}}s{{end}}{{end}} {{with mapGet .EventCounts "warning"}}{{.}} warning{{if gt . 1}}s{{end}}{{end}} {{end}} (last 24h)

Time	Severity	Type	Message	Source
{{.CreatedAt.Format "Jan 02 15:04"}}	{{.Severity}}	`{{.EventType}}`	{{.Message}}	{{.Source}}

No events recorded yet.

Report History (last 24h)

{{len .History}} reports

Time	Status	CPU	Memory
{{.ReceivedAt.Format "Jan 02 15:04"}}	{{.HealthStatus}}	{{formatFloat .CPUPercent}}%	{{formatFloat .MemoryPercent}}%

Events appear once the first report arrives.

Notifications

Email {{if .NotifPrefs}}{{if .NotifPrefs.Email}}{{.NotifPrefs.Email}}{{else}}Not set{{end}}{{else}}Not configured{{end}}

Events {{if .NotifPrefs.EnabledEvents}}{{joinStrings .NotifPrefs.EnabledEvents ", "}}{{else}}None{{end}}

Recent (last 10)

Time	Channel	Event	Status	Message
{{.CreatedAt.Format "Jan 02 15:04"}}	{{.Channel}}	{{.EventType}}	{{.Status}}	{{.Message}}

Notification data appears once the first report arrives.

Open host page: {{.HostID}} →

No host enrolled yet.

A host appears here once it enrolls via the Day-0 bootstrap.