SikamikanikoBG/homelab-monitor v0.38.0

v0.38.0 — your homelab gets an AI agent, and a lock on the door

on GitHub

Added

• An optional AI agent that knows your lab — chat with it, let it act where you allow, and switch on automations. Turn it on with AGENT_ENABLED=1, a dashboard password and the Enable switch; until then nothing changes. Ask from the new Agent tab or the floating Ask button on every page (it knows which page and host you're on) and get answers built from the same read tools the MCP server has, with each tool call shown as a chip. It works with the models already on your lab — Ollama, vLLM, llama.cpp, LM Studio, LocalAI — found for you and tested with one click (badges say whether a model can call tools and follow up), or with your own key for OpenAI, Anthropic, Gemini (experimental), Azure OpenAI, Groq, Mistral, DeepSeek, xAI, OpenRouter or Together. Keys are write-only and never leave the hub. You decide what it may do: each host is Off, Passive (read only — every host starts here) or Active, and each action is Deny, Ask or Allow (Deny until you change it), from a fixed catalogue — restart/stop containers, restart services, prune dangling images and build cache, shrink the journal, unload or delete Ollama models — with no shell anywhere. The server checks the policy when the agent proposes and again when it runs; Ask means a confirm card, and nothing runs until you approve. Unattended runs only do low-risk things on their own, never more than 3 times a day per target; everything else waits for you. The monitor's own container and whatever serves the model are always off-limits. Automations: ten templates (Docker cleanup, model housekeeping, disk-space watch, system maintenance, data & log cleanup, GPU health, update report, cost report, container health, backup freshness) or your own prompt, on a schedule, in Report, Propose or Act-within-policy mode, with reports to your alert channels and proposals waiting under Approvals. Activity shows every run step by step — what it read, what policy decided and why, who approved — exportable as JSON/CSV, with a copy of every action in docker logs. (#354, docs: AI agent)
• An optional dashboard login. Settings → Security sets a password (or ADMIN_PASSWORD at boot); without one everything works exactly as before. With one, browsers log in, changes need the session's CSRF token, and API keys get a scope — push (what every existing key stays), read (Grafana, MCP clients) or admin. /healthz, /metrics and the public status page stay open. The built-in MCP port asks for a read key too. Forgot it: docker exec homelab-monitor python -m backend.auth.cli reset-password. (#327)

Changed

• The AI agent sets itself up in about a minute, and the Overview says it's there. One setup — a password, a model found on your network and tested while you watch, and how much it may do (Look only / Ask me first / Handle the small stuff, for every machine including ones you add later) — ends in a chat with suggestions. The Overview gets an Ask your lab card: ask straight from the home page, see approvals waiting for you and one line per routine that ran lately. Answers render tables, the steps behind an answer fold into one line ("Checked 4 machines · 1 look-up · 6 s"), conversations get a short title and up to two follow-up suggestions, and the Agent tab is down to Chat, Routines, Approvals, Activity and Settings. When it runs out of steps or tokens it now still answers from what it gathered, a follow-up like "summarise" works from what it just read, and it starts from the fleet overview instead of scanning disk by disk.
• Backups no longer contain secrets. The downloaded database has the alert channels' webhook URLs, tokens and passwords, AI provider keys, the password hash and all sessions blanked. After a restore, enter them again.
• /api/hosts/<name>/run is off by default. It runs any shell command on a host, nothing in the dashboard uses it, and it was reachable by anyone on the LAN. Set ENABLE_HOST_RUN=1 if a script of yours needs it; every use is logged.
• Every pull request now runs the whole test suite in CI, not just the snapshot and smoke checks.

Fixed

• Names with quotes could break out of HTML attributes. The dashboard's HTML escaper skipped " and '; a container or model name with a quote in it could add its own attribute to a tooltip.
• Two threads opening a brand-new database at once could fail with "database is locked".
• A remote host's container RAM now matches the hub's calculation method. The probe was reading docker stats' MemUsage, which still counts reclaimable file cache and inflated mmap-heavy (AI model) containers; it now reads anon+shmem straight from the container's cgroup, exactly like the hub. A container's remote-reported RAM may read lower than before — that's the correction, not a regression.

Pinned image: sikamikaniko123/homelab-monitor:0.38.0