Skip to content

OneUptime

Status: live on infra-services with the race-safe incident adapter and Stage 5 domain rollout accepted (2026-08-01). Tier-1 recovery is verified. Remaining program work is Stages 6–8 (runner remediation, notification cutover, closeout).

OneUptime Community Edition is the incident-state and response layer for the homelab observability platform. It does not evaluate Prometheus alerts or replace Alertmanager, Grafana, Loki, Discord, ntfy, GitHub Actions, or Ansible.

Quick reference

Field Value
Version 12.0.34
URL https://oneuptime.infra.realemail.app
Host infra-services
External access LAN/VPN HTTPS through Traefik and Authentik
Internal ingress OneUptime Nginx on port 7849
Incident state PostgreSQL
Analytics dependency ClickHouse
Queue/cache Redis, intentionally not backed up
Backup tier Tier 1, local restic and B2 verified

Live acceptance requires all seven services healthy, application and ingress status endpoints passing, Probe and Runner readiness/registration passing, and the browser route redirecting through Authentik. /api and /identity stay on OneUptime's own credentials. The first deployment also verified that the application must receive PORT=3002 explicitly and that only the public ClickHouse XML bind mounts need read access through the hardened host checkout.

Recovery acceptance restored 705 PostgreSQL tables and 42 ClickHouse tables into isolated temporary volumes. The tier-1 restic job then saved both logical artifacts locally and copied both snapshots to B2.

Deployment shape

The Compose deployment runs:

  • OneUptime application;
  • OneUptime Nginx ingress;
  • PostgreSQL;
  • Redis;
  • ClickHouse with embedded Keeper;
  • a project-scoped synthetic Probe;
  • an inert project Runner with every execution capability disabled.

Prometheus and Loki remain the telemetry systems, so DISABLE_TELEMETRY_INGESTION=true. Probe owns only explicitly assigned synthetic monitor types. Runner receives no egress, host mount, Docker socket, SSH key, infrastructure credential, runbook capability, code-fix capability, or AI-command capability.

Only the ingress container joins the shared traefik network. Datastores use an internal bridge. No service publishes a host port.

Authentication

Browser pages use authentik@file. /api and /identity are a separate Traefik router with no Authentik middleware so OneUptime On-Call can sign in with OneUptime credentials. Community Edition on this stack does not use OIDC, so browser users still complete Authentik and then OneUptime login.

The initial local administrator and homelab operations project were created on 2026-07-30. User identities and local credentials are not stored in this repository.

Alertmanager delivers allowlisted domains to the private oneuptime-incident-adapter webhook on an internal Docker network. continue: true evaluates later sibling routes, not universal failover: Discord requires notify=page, while direct ntfy requires critical service=os-patching. Allowlisted runner notify=ticket alerts have no direct Discord fallback. Removing their adapter route leaves them at blackhole unless a separate fallback is reviewed; follow the ticket rollback boundary. The browser UI stays behind Authentik; no public machine webhook is published on Traefik.

Secrets

Generated values live only in encrypted services/oneuptime/.env.sops.yaml. The renderer combines those values with the committed non-secret config.env and atomically writes gitignored compose.env mode 0600.

ENCRYPTION_SECRET is backup-critical. Losing it can make encrypted OneUptime records unusable even if PostgreSQL is restored.

Start and validate

After the branch is merged on the host:

cd /opt/homelab/services/oneuptime
bash scripts/render-env.sh
docker compose --env-file compose.env pull
docker compose --env-file compose.env up -d
bash scripts/smoke-test.sh --live

The first application start runs database migrations and can take several minutes. Do not add production Alertmanager delivery until tier-1 backup and isolated restore have passed.