OneUptime¶
Status: planned shadow deployment on infra-services.
OneUptime Community Edition is the incident-state and response layer for the homelab observability platform. It does not evaluate Prometheus alerts or replace Alertmanager, Grafana, Loki, Discord, ntfy, GitHub Actions, or Ansible.
Quick reference¶
| Field | Value |
|---|---|
| Version | 11.7.3 |
| URL | https://oneuptime.infra.realemail.app |
| Host | infra-services |
| External access | LAN/VPN HTTPS through Traefik and Authentik |
| Internal ingress | OneUptime Nginx on port 7849 |
| Incident state | PostgreSQL |
| Analytics dependency | ClickHouse |
| Queue/cache | Redis, intentionally not backed up |
| Backup tier | Tier 1 before production alert ingestion |
Deployment shape¶
The incident-only Compose deployment runs:
- OneUptime application;
- OneUptime Nginx ingress;
- PostgreSQL;
- Redis;
- ClickHouse with embedded Keeper.
The OneUptime probe and AI agent are not deployed. Prometheus and Loki remain
the telemetry systems, so DISABLE_TELEMETRY_INGESTION=true.
Only the ingress container joins the shared traefik network. Datastores use an
internal bridge. No service publishes a host port.
Authentication¶
The human route uses authentik@file. OneUptime v11 Community Edition does not
include OIDC, so OneUptime local authentication remains enabled behind
Authentik. Users therefore complete Authentik and OneUptime login.
No machine webhook route is exposed in the shadow-stack stage. Alertmanager integration is added later with its own least-privilege token and exact route.
Secrets¶
Generated values live only in encrypted
services/oneuptime/.env.sops.yaml. The renderer combines those values with
the committed non-secret config.env and atomically writes gitignored
compose.env mode 0600.
ENCRYPTION_SECRET is backup-critical. Losing it can make encrypted OneUptime
records unusable even if PostgreSQL is restored.
Start and validate¶
After the branch is merged on the host:
cd /opt/homelab/services/oneuptime
bash scripts/render-env.sh
docker compose --env-file compose.env pull
docker compose --env-file compose.env up -d
bash scripts/smoke-test.sh --live
The first application start runs database migrations and can take several minutes. Do not add production Alertmanager delivery until tier-1 backup and isolated restore have passed.