AMUD Dashboard encrypts integration secrets at rest with AES-GCM. Plex, Jellyfin, Proxmox API tokens, Home Assistant tokens — encrypted blob in the database, not readable if someone copies amud.db without the key.

The keyfile​

.amud-secrets-key on the host. Derived key material for encryption/decryption at runtime.

Back it up with your database. Restore DB without key = your tokens are toast. You'll re-enter them in settings. Annoying but not catastrophic.

What's not encrypted​

App URLs, card names, layout stuff — none of that's secret. Your Jellyfin URL being http://10.0.0.5:8096 isn't the sensitive part. The API key is.

Password hashes use Argon2id separately. Different layer. Same philosophy: don't store usable secrets in recoverable form.

Threat model (realistic)​

This stops "someone copied my backup drive" from leaking your Proxmox token. It doesn't stop someone with root on your running server — they own the box anyway.

Homelab threat model. Not banking.

Full security writeup: /docs/security

Rotate tokens in integrations settings if you think the DB leaked. Same as any other dashboard.

Because then I'd need to run Postgres.

AMUD Dashboard is a dashboard. Config storage is a few hundred KB of apps, settings, and encrypted tokens. Running a whole separate database server for that is like buying a warehouse to store a shoebox.

SQLite with WAL​

Write-Ahead Logging lets readers (the web UI loading settings) coexist with writers (you saving a new app card) without the lock contention that makes people hate SQLite in web apps from 2010.

For a single-tenant homelab dashboard with one admin clicking settings occasionally? Perfect fit.

Operational wins​

• Zero extra container — amud.db sits next to the binary
• Backup — cp amud.db backup.db
• Restore — swap file, restart
• Inspect — sqlite3 amud.db when debugging

I've done all of these at 1am. Postgres would add connection strings, another service to monitor, another thing to backup separately.

When I'd reach for Postgres​

Multi-tenant SaaS. Hundreds of concurrent writers. Horizontal scaling. AMUD Dashboard is explicitly none of those — see roadmap "won't do SaaS."

Homelab tool. Homelab database. Match the complexity to the problem.

/docs/intro

Switching to AMUD Dashboard wasn't "Homepage bad, AMUD Dashboard good." It was "I'm tired of this specific workflow."

What I lost​

• Git-tracked config — every service change was a commit. That's gone. AMUD Dashboard lives in SQLite, not services.yaml in a repo.
• Community widget YAML — Homepage's widget library is huge. AMUD Dashboard has built-in Plex/Jellyfin/HA/Proxmox stuff but not the long tail of community widgets.
• Docker-only mental model — Homepage fits the "everything in compose" crowd perfectly.

What I gained​

• UI edits at midnight — add a card from my phone browser. No SSH, no git pull on the host.
• Native Proxmox LXC control — not a widget bolted on. First-class CTID binding and power actions.
• RAM — meaningful on a crowded Proxmox node.
• One-file backup — amud.db instead of yaml + env + secrets scattered around.

Who should stay on Homepage​

You like GitOps. You generate configs from Ansible. You want fifty community widgets. YAML doesn't make you twitch.

Who should try AMUD Dashboard​

Proxmox primary. YAML fatigue. Want live LXC status without shell scripts. Okay with "config in a database" as the trade.

Migration tip: screenshot your Homepage layout, recreate cards in AMUD Dashboard while watching TV. Took me about forty minutes for ~25 services. Your mileage varies.

curl -sSL https://raw.githubusercontent.com/boubli/AMUD-Dashboard/main/setup-amud.sh | bash

Because on Proxmox the dashboard server lives in an unprivileged LXC and the thing that talks to /proc, the Docker socket, and the PVE API on port 8006 needs to live on the host.

Different trust boundaries. Different privilege levels.

amud-server​

• Serves HTTP/WebSockets
• Owns SQLite
• Runs as unprivileged amud user in the LXC
• Never needs root

amud-agent​

• Reads host hardware
• Queries Proxmox API
• Optionally reads Docker socket
• Runs on hypervisor host with the permissions that requires

They talk over /opt/amud/run/amud.sock. Bind-mounted into the LXC on Proxmox installs. Shared Docker volume in container deployments.

Challenge-response auth​

The socket isn't world-writable chaos. Agent proves it knows AMUD_AGENT_SECRET before the server accepts telemetry. Stops random local processes from feeding fake metrics.

Could I merge them?​

On single-box Docker or bare-metal where server and agent share a host, they're still separate processes for isolation. Server crash doesn't take down polling. Agent restart doesn't drop active web sessions.

Might be over-engineered for a homelab. I'd rather over-engineer the security boundary than under-engineer it.

/docs/ARCHITECTURE

Fastest help: star the repo​

github.com/boubli/AMUD-Dashboard

Stars help GitHub discovery and lists like awesome-selfhosted. Sounds shallow. Matters anyway.

Try it and tell me your stack​

Proxmox version, RAM numbers, screenshot of your dashboard. GitHub Discussions is the place. "Works on my weird ARM NAS" posts are gold.

Bug reports that get fixed fast​

• Steps to reproduce
• journalctl -u amud-agent -n 50 output
• Whether you're Docker or native LXC

Vague "doesn't work" issues sit longer. Fair warning.

PR areas​

Roadmap: /docs/roadmap — ARM64 CI, webhooks, multi-node agents on the list.

Submit a theme​

CSS file + preview screenshot → PR to docs/static/themes/ → shows up in /themes.

That's a contribution normies can do without touching Rust. Please do.

Thanks for reading this series. Go break something and file an issue.

That's systems programming territory. Not "spin up Express and call it a day" territory.

Why not Node​

I've run plenty of Node homelab tools. V8 heap sitting at 80–150MB for a bookmark page hurts when that box also runs Jellyfin and Sonarr. GC pauses during telemetry polling are rare but annoying when you're staring at a graph that stutters.

Why not Go​

Go would've been fine honestly. I picked Rust because I wanted memory safety without a GC, static binaries with embedded assets (include_str! for UI templates), and Tokio's async model for concurrent integration polls.

The stack that stuck​

• Axum — HTTP + WebSockets
• rusqlite — embedded config, WAL mode
• hyper + rustls — Proxmox HTTPS
• hyperlocal — Docker socket
• Argon2id — passwords

Compile once, drop binary on host, run. No runtime install step.

Trade-offs I'll admit​

Rust compile times are slow. Contributor pool is smaller than JS. I occasionally fight the borrow checker at 2am.

For a long-running daemon on a 256MB LXC though? I'd make the same call again.

Architecture: /docs/ARCHITECTURE

Want to hack on it: github.com/boubli/AMUD-Dashboard

AMUD Dashboard deploys as a stack: amud_app + amud_agent + amud_run volume.

Portainer steps​

1. Stacks → Add stack → name it amud
2. Paste the compose from /docs/installation/docker
3. Set AMUD_AGENT_SECRET to something long and random
4. Same secret in both services — write it down
5. Deploy

Agent needs /var/run/docker.sock:ro and AMUD_DOCKER=1.

After deploy​

http://your-host:8000 → login → change password → add cards in UI.

Bind ./data to a host path you snapshot. That's your backup.

Portainer-specific notes: /docs/installation/portainer

Docker path uses a bit more RAM than native Proxmox LXC. Trade-off for convenience.

Appearance settings that matter​

Settings → Appearance

• Grid columns: 4–5 on a landscape tablet
• Glass opacity: lower = cleaner in bright rooms
• Background: grab a 2K wallpaper from /themes
• Custom CSS: Nord or Everforest for low glare

What to put on the board​

• Home Assistant card (lights + temp)
• Plex/Jellyfin with live stream badge
• Host CPU/RAM bars
• Key services with RUNNING status

Skip the admin controls on a shared display. Guest account.

Kiosk browsers​

• Android: Fully Kiosk Browser
• iPad: Guided Access
• Linux SBC: Chromium --kiosk

Point at your HTTPS URL (see the reverse proxy post). WebSockets need to work or the graphs lie.

That's it. Old hardware, new purpose, zero YAML.

AMUD Dashboard has Admin and Guest roles. Guests get links. Admins get the keys to the kingdom.

What guests can do​

• Open app URLs
• See the layout you configured
• Optionally see host CPU/RAM if you enable Guest system telemetry visibility under Settings → Privacy & Access

What guests can't do​

• Edit cards or settings
• Start/stop containers
• See container names/VMIDs on sensitive telemetry
• Mess with integrations

Wall tablet setup​

1. Create a Guest user
2. Enable public telemetry if you want the pretty graphs
3. Log the tablet into Guest
4. Stop worrying

Admins keep full power controls on linked LXCs. Guests just see whether stuff is running without the big red stop button.

/docs/configuration

Welcome to the most common AMUD Dashboard support question. Good news: it's usually one of like four things.

Read the agent logs first​

journalctl -u amud-agent --no-pager -n 20

Look for [LXC] lines:

Fix the token in systemd​

nano /etc/systemd/system/amud-agent.service

Under [Service]:

Environment="PVE_API_TOKEN=PVEAPIToken=amud@pve!amud-token=YOUR-SECRET"

systemctl daemon-reload && systemctl restart amud-agent

Also paste the same token in the UI under Settings → Proxmox VE. Both places. Yes, redundant. Yes, necessary.

Privilege Separation​

When creating the API token in Proxmox, uncheck Privilege Separation. I cannot stress this enough. Spent two hours on this once. Not proud.

CTID wrong​

pct list

Make sure the app card ID matches reality.

Full troubleshooting bible: /docs/troubleshooting

AMUD Dashboard backup:

cp /opt/amud/data/amud.db ~/backups/amud-$(date +%F).db

Done. Apps, tabs, settings, users, encrypted creds (encrypted blob in DB).

Restore​

1. Stop amud-server
2. Replace amud.db
3. Start amud-server

Your dashboard is exactly as it was. I've used this to clone a test setup to prod. Worked first try.

Don't forget the keyfile​

Integrations use .amud-secrets-key for AES-GCM. Backup it with the database. Restore DB without key = encrypted tokens become useless noise.

Cron it and forget it​

0 3 * * * cp /opt/amud/data/amud.db /mnt/nas/backups/amud-$(date +\%F).db

Keep a week of dailies. Homelab disasters always happen on the day you skipped backups.

More: /docs/troubleshooting

Docker on that box is overhead you don't need.

Directory layout​

/opt/amud/run   → Unix socket
/opt/amud/data  → amud.db
/opt/amud/ui    → templates

Don't run as root​

sudo groupadd --system amud
sudo useradd --system -g amud -s /sbin/nologin amud
sudo mkdir -p /opt/amud/run /opt/amud/data /opt/amud/ui
sudo chown -R amud:amud /opt/amud

Server runs as amud. Agent typically needs more privileges for host metrics — see the full guide for the permission model.

Binaries​

Grab latest from GitHub Releases. Drop amud-server and amud-agent in /usr/local/bin/, set up systemd units, go.

Works on Debian, Ubuntu, Fedora, Arch — anything with systemd.

Full walkthrough: /docs/installation/linux

When I'd pick this over Proxmox LXC: dedicated dashboard hardware, no hypervisor, absolute minimum RAM.

Pick Heimdall if​

You want simple bookmarks and PHP on your server doesn't bother you. No live telemetry needed.

Pick Homepage if​

You live in Git, love YAML, want the widget ecosystem. You're good at debugging indent errors. Respect.

Pick Homarr if​

You want the polished drag-drop UI and don't care about RAM. *arr integration out of the box matters to you.

Pick AMUD Dashboard if​

• Proxmox is your hypervisor and you want native LXC status + power controls
• You refuse to maintain YAML for a link portal
• You want Plex/Jellyfin/HA/host metrics without gluing shell scripts
• ~26MB idle on Proxmox sounds nice

What AMUD Dashboard won't become​

SaaS. YAML-first config. Node/PHP dependency. It's a homelab tool. Stays that way.

curl -sSL https://raw.githubusercontent.com/boubli/AMUD-Dashboard/main/setup-amud.sh | bash

GitHub · Themes

AMUD Dashboard streams telemetry over WebSockets. Your reverse proxy must forward upgrade headers or you get a pretty but useless dashboard.

Nginx snippet that actually works​

location / {
    proxy_pass http://127.0.0.1:8000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

HTTPS cookies​

Once you're on HTTPS:

AMUD_SECURE_COOKIES=1

Restart the server. Forget this and you'll chase phantom login bugs.

Caddy​

amud.homelab.local {
    reverse_proxy localhost:8000
}

Usually just works. Caddy's the easy mode.

Full configs: /docs/installation/reverse-proxy

After setup: login works, graphs move, LXC badges update. If not, browser console first. Always browser console first.

Passwords​

Argon2id hashes in SQLite. Not SHA-256 alone, not md5 (please). Older installs with legacy SHA-256 get transparently re-hashed on next login.

Sessions​

32-byte random tokens, 24h lifetime, HttpOnly, SameSite=Strict. Behind HTTPS set AMUD_SECURE_COOKIES=1 or you're leaving cookies exposed on misconfigured proxies.

Brute force​

5 failed logins per username in 5 minutes. Enough to stop dumb scripts, not enough to lock you out forever if you typo once.

Integration secrets​

Plex tokens, Jellyfin keys, Proxmox API tokens, HA tokens — AES-GCM encrypted at rest with a host keyfile (.amud-secrets-key). Backup that file with your database or restores get awkward.

CSRF + CSP​

State-changing requests need CSRF tokens. CSP with per-request nonces on scripts. Boring security stuff that matters when your dashboard is internet-facing behind a reverse proxy.

Production checklist​

• Change admin / password (seriously)
• HTTPS + AMUD_SECURE_COOKIES=1
• Restricted Proxmox API user, not root
• Backup amud.db and .amud-secrets-key

Full doc: /docs/security

So I built a theme gallery with twelve ready-made CSS themes and actual dashboard preview screenshots so you can pick before you paste.

Included themes​

Dracula, Nord, Catppuccin Mocha, Tokyo Night, Gruvbox Dark, Cyberpunk Neon, Solarized Dark, Rose Pine, Everforest, Monokai, One Dark, Sunset Warm.

Apply one in three clicks​

1. Open /themes
2. Hit Copy CSS
3. Settings → Appearance → Custom CSS → paste → save

Instant. No restart. No import-from-URL (that feature got cut on purpose — copy-paste is safer and works offline).

Wallpapers too​

Each theme has a bundled 2K wallpaper. Copy wallpaper URL → paste into background image setting. Makes wall tablets look intentional instead of "sysadmin panel accidentally left on."

Broke the layout with bad CSS? Been there. Recovery guide: /docs/troubleshooting

Want to roll your own? CSS variable reference: /docs/themes

AMUD Dashboard can show on that card:

• How many lights are on
• How many switches are on
• Average home temperature

The one naming rule that trips people up​

Your app card has to be named exactly Home Assistant. Not "HA" or "homeassistant" or "the smart house thing." Exactly that string. Yes, I should make that more flexible someday. For now, that's the deal.

Setup​

1. HA → Profile → Long-Lived Access Tokens → create one
2. AMUD → Settings → Smart Home → URL + token → save

How it polls without being rude to HA​

Prefers the Template API (POST /api/template) so HA computes counts server-side. Falls back to /api/states if templates aren't available. Heavier, but works.

Runs on the same Tokio runtime as everything else — won't block your CPU graphs.

Pair with LXC status: see the HA container is up and you've got four lights on at 2am. Investigate that later.

/docs/configuration

That's the question I wanted answered from the dashboard, not from opening Plex on my phone.

Setup (boring but fast)​

Settings → Integrations

Jellyfin: base URL + API key from Dashboard → Advanced → API Keys.

Plex: base URL + X-Plex-Token. If you've never extracted a Plex token before, welcome to the club — there's a few documented ways and they're all mildly annoying.

What the badge does​

Starts as CHECKING..., then shows the active stream title. Multiple clients? You'll see something like Dune (+2 more).

Missing creds → NOT CONFIGURED. Fixable in thirty seconds once you stop procrastinating.

Why this pairs well with LXC status​

Card shows Jellyfin is RUNNING and someone's watching Blade Runner. Now you know restarting would make someone mad. That's operational awareness, not just bookmarks.

API keys get AES-GCM encrypted in SQLite at rest. Not sitting in plain text in a yaml file on disk.

Details: /docs/configuration

AMUD Dashboard in Docker is two containers:

• amud_app — web server + SQLite
• amud_agent — telemetry, mounts Docker socket read-only

They talk over a shared volume at /var/run/amud/amud.sock. Same IPC model as bare metal, just containerized.

Minimal compose​

services:
  app:
    image: tradmss/amud-dashboard:latest
    ports:
      - "8000:8000"
    environment:
      - AMUD_AGENT_SECRET=use-a-long-random-string-here
      - DB_PATH=/app/data/amud.db
      - AMUD_SOCKET_PATH=/var/run/amud/amud.sock
    volumes:
      - ./data:/app/data
      - amud_run:/var/run/amud

  agent:
    image: tradmss/amud-dashboard:latest
    entrypoint: ["/app/amud-agent"]
    environment:
      - AMUD_AGENT_SECRET=use-a-long-random-string-here
      - AMUD_DOCKER=1
      - AMUD_SOCKET_PATH=/var/run/amud/amud.sock
    volumes:
      - amud_run:/var/run/amud
      - /var/run/docker.sock:/var/run/docker.sock:ro

volumes:
  amud_run:

The secret must match in both containers. I cannot count how many issue reports were just mismatched AMUD_AGENT_SECRET.

Link app cards to container names for running/stopped badges.

Full guide: /docs/installation/docker

RAM lands around 35–100MB depending on host. Still lighter than most PHP/Node dashboards I've run.

AMUD Dashboard app cards can bind to a Proxmox CTID. Badge flips between RUNNING, STOPPED, and the eternal CHECKING... when something's misconfigured.

Setup checklist​

1. amud-agent running on the Proxmox host
2. API token in Settings → Proxmox VE
3. App card has the correct LXC/VM ID field filled in

That's it. If you're stuck on CHECKING..., 90% of the time it's the token. I wrote a whole troubleshooting post for that misery.

Power controls​

If your API role includes VM.PowerMgmt, admins get start/stop/restart on linked containers. Handy when you're on your phone and don't want the Proxmox mobile experience.

Guest users see status only. No accidental pct stop from the kitchen tablet.

Don't use root@pam​

Create a restricted amud@pve user with VM.Audit, Sys.Audit, and optionally VM.PowerMgmt. Paste that token into AMUD. Your dashboard doesn't need god-mode PVE access.

Config details: /docs/configuration