mazenet

Every service, one pane.

Thirteen services across four stacks, read straight from Prometheus and the tunnel edge. No separate inventory to drift.

Sessions are issued by Rauthy at auth.mazenet.org

Sign in

Use your mazenet identity. Local accounts are not issued.

Continue with Rauthy Continue with a passkey
or use a recovery credential
Issued once, at handover. Burned on use.

Locked out? Recovery runs through docs/recovery.md and needs the offline key.

mazenet
Overview Services Hosts Alerts
RG
Estate Overview Services 13 Hosts 7
Operate Alerts 2 Secrets Backups
production converged

Overview

Every stack, last converged 22 Aug at 04:12 UTC.
Services up
12/13
Tunnel uptime 30d
99.97%
Alerts firing
2warning
Last backup
04:00restic → R2
Services View all
ServiceHostStackState
Vaultwardenproduction-vault-01vaultlive
Rauthyproduction-auth-01authlive
ntfyproduction-auth-01authlive
Headscaleproduction-net-01netlive
Infisicallab-infisical-01labdrifted
Kanidm—idmon hold
Recent eventsAlerts
Infisical drifted from state12m
Container image differs from the pinned tag on lab-infisical-01.
Restic snapshot complete04:00
All six prefixes to R2. 1.9 GB, 41s.
Blackbox probe failed03:11
idm.mazenet.org unreachable — expected, phase 6 on hold.
Ansible convergedYest.
SSH baseline verified on the auth host and the observability plane.
Certificate expiry
*.mazenet.org62 days
hm01-rt01 www-ssl28 days
hm01-sw02 www-ssl9 days

Services

13 under management across four stacks.
ServiceEndpointHostManaged byState
Vaultwardenvault.mazenet.orgproduction-vault-01ansiblelive
Rauthyauth.mazenet.orgproduction-auth-01ansiblelive
ntfyntfy.mazenet.orgproduction-auth-01ansiblelive
Headscaleheadscale.mazenet.orgproduction-net-01ansiblelive
Infisicalinfisical.mazenet.orglab-infisical-01ansibledrifted
Prometheus—hmsrv01-observe-01ansiblelive
Grafanaobs.mazenet.orghmsrv01-observe-01ansiblelive
Loki—hmsrv01-observe-01ansiblelive
Alertmanager—hmsrv01-observe-01ansiblelive
RouterOS RESThm01-rt01hm01-rt01opentofulive
Kanidmidm.mazenet.org—opentofuon hold

Hosts

Hetzner, Incus on the home server, and two RouterOS devices.
HostWhereRoleUptimeState
production-vault-01Hetznersecrets61dup
production-auth-01Hetzneridentity, ntfy61dup
production-net-01Hetznerprivate network54dup
lab-infisical-01Hetznersecrets (lab)33ddrifted
hmsrv01-observe-01Incus, VLAN 100observability19dup
hm01-rt01on premisesrouter203dup
hm01-sw02on premisesswitch, CRS328203dup

Alerts

From Alertmanager, routed to ntfy. Every rule ships with its own test.
Firing2 active
InfisicalImageDrift12m
lab-infisical-01 — running image differs from the pinned tag. Converge or repin.
CertExpirySoon6h
hm01-sw02 www-ssl expires in 9 days. Renewal runs on the RouterOS identity.
BlackboxProbeFailedsilenced
idm.mazenet.org — silenced until phase 6 resumes.
Delivery
ntfy pushhealthy
Alert webhookhealthy
Email fallbackunused

Alertmanager reaches ntfy over the tunnel, so a public outage does not take the pager with it.

Secrets

Vaultwarden for people, Infisical for machines. Nothing in the repo.
StoreConsumerRotatedState
Vaultwardenpeople14d agocurrent
InfisicalMakersBrain3d agocurrent
Restic repo keybackup jobs96d agorotate soon
RouterOS APIopentofu41d agocurrent

Backups

restic to a single R2 bucket, one prefix per stack, nightly at 04:00 UTC.
Last run
04:0041s
Repo size
1.9 GB
Last restore test
18ddue
PrefixSnapshotsLastState
vault/6104:00ok
auth/6104:00ok
net/5404:00ok
lab-infisical/3304:00ok
observe/1904:00ok