Skip to content

Dashboard

The dashboard shows what Nops is doing and is where you approve, reject, retry, pause, and resume deployments. Every page needs a login.

Pages

  • Overview (/): what needs you (approvals, blocked jobs, recent failures, meta errors, paused jobs, orphans), what is deploying, the latest completed deployments, the head and last poll of the repository (with several, how many there are and each one whose last poll failed), and detection. Fetch now, or Fetch all with several repositories, polls every repository without waiting for the interval. Pause pauses every job.
  • Repositories (/repositories): the head and last poll of each repository. The Overview links it when Nops reads more than one.
  • Jobs (/jobs): every managed job with its sync state, policy and last deployment, filterable by state.
  • Job (/jobs/{namespace}/{job}): the job's drift, hooks, sync window, Nomad panel, meta issues, and deployments. Pause and resume the job, deploy it outside its sync window, and retry its failed deployments, from here.
  • Deployment (/deployments/{id}): the plan diff, the hook runs, the timeline and, while it waits for you, what approving does and the Approve and Reject buttons. Promote appears when Nomad waits for you to promote canaries.
  • Activity (/history): every deployment, newest first, grouped by day.
  • Administration (/admin): your token and, with a management token, a page each for tokens, ACL policies, binding rules and the latest changes to them, with the backups taken. With the backup capability, a Backup page downloads a backup of the database. Create and revoke tokens, revoke every session of a person or every token someone created after seeing which ones go, and edit ACL policies and binding rules here. Copy your session token to use it from the command line.

Pages refresh themselves. Approving checks the spec hash you reviewed: if the diff changed since you loaded the page, Nops refuses and shows the new one.

/healthz and /metrics need no login, and the /api/ takes a token instead.

Sync state of a job

Where a job stands against git. The first state that applies wins.

State Meaning
Invalid meta A nops_* key has an error: Nops ignores the job's policy and hooks.
Paused Someone paused the job: Nops starts no deployment for it.
Blocked A failed or rejected deployment holds the drift back until a retry or a new commit.
Not in git An orphan: deployed by Nops, removed from git, still running.
Awaiting approval Its latest deployment waits for a person.
Deploying Its latest deployment is in progress.
Held It drifts and its sync window is closed.
Drift The cluster differs from git and nothing is deploying it.
In sync The cluster matches git.

The Nomad panel

A read-only box on the Job page, and on a Deployment page while it applies, with what Nomad reports about the job: status, allocations per task group, and the latest Nomad deployment with its canaries and health. Use it to see why a deployment stays in applying without opening Nomad's UI.

Set -nomad-ui-url and the Job and Deployment pages link to the job in Nomad's UI, and to its deployments when canaries wait for promotion. Unset, there are no links.

Authentication

Nops checks who you are itself; it never trusts a header from a reverse proxy. -auth-mode picks one of two backends (options in configuration):

  • oidc: log in through your OpenID Connect provider (Authentik, Authelia, Keycloak). With the ACL off, everyone the provider lets in has full control; with it on, binding rules decide what a login gets. Nops contacts the provider only at login, so a provider outage doesn't stop deployments.
  • basic: local users from a file.

A login gives you a session token that lasts 12 hours, restarts included. Logging out revokes it. The login page also takes a token you paste, such as the bootstrap token: the browser keeps it until it closes, and logging out forgets it without revoking it. Changes to the binding rules, the users file or the groups file take effect at the next login.

Local users (-auth-mode=basic)

-users-file holds one username:bcrypt-hash line per user. Generate a line with:

htpasswd -nB alice

-groups-file, optional, holds one group: user1 user2 line per group, in Apache's AuthGroupFile format, for binding rules on list.groups. Each member must be in the users file.

Nops reads both files at startup: restart it after you change a user or a group. There is no rate limit on failed logins, so put a rate-limiting proxy in front if the dashboard is reachable from untrusted networks.

Secret redaction

Nops redacts the plan diff before saving or showing it: a secret value becomes <redacted>, and you still see which field changed. It redacts:

  • every environment variable (Env[...]);
  • template bodies, artifact headers and service check headers;
  • any field whose name contains password, token, secret, auth, credential, privatekey or apikey;
  • the user:password@ part of a URL.

A secret in a field with a harmless name, like args = ["--db-password=..."], stays visible. Keep secrets in env or in a template. Nomad Variables and Vault are better still. The rules live in internal/redact.