Beta — actively developed. Report issues and help shape v1.0.
Open Source · Self-Hosted · Go + React

The forensic journal
for your infrastructure.

Know what changed, when it changed, and why things broke — across every node in your homelab.

Read the Docs → View Demo → GitHub →
Go Language
SQLite Storage
Docker-ready Deployment
AGPL-3.0 License
// live event timeline
Timeline — my-homelab · node-01
02:17:04 UTC
docker nginx-proxy container died exit(1)
node-01
02:16:26 UTC
file /etc/nginx/nginx.conf modified — diff available
node-01
02:14:11 UTC
docker watchtower pulled nginx:1.27.4 → 1.27.5
node-01
01:58:03 UTC
systemd fail2ban.service restarted
node-02
01:44:55 UTC
uptime plex.home monitor up — recovered after 4m12s
resolved
// capabilities

Everything your homelab needs to stay forensic.

One timeline. Every node. Zero guesswork when something breaks at 2 AM.

Docker Event Watching

Captures container start, stop, die, create, pull, and delete events per node. Collapses restart loops and attaches crash log tails directly to incidents.

Config File Diffs

inotify-based watching of .yaml, .yml, .conf, .env, .json, and .ini files. Every change includes a text diff with optional secret redaction.

Incident Correlation

Weighted cause scoring ranks likely culprits from recent Docker, file, systemd, and update events using event-specific lookback windows and log-snippet bonuses.

Multi-Node Support

Deploy an agent on every machine. All agents report to a single central server. Per-node metadata, live pulse indicators, and cross-node event correlation.

Systemd Journal Monitoring

Watches configured systemd units for started, stopped, restart, and failed events. OOM kill detection with journal log snippets for fast triage.

Optional AI Analysis

Connect Ollama locally for AI-derived incident summaries and enhanced correlation. AI mode also runs on suspected incidents with full crash log context.

// architecture

Two components. Total clarity.

A lightweight agent runs on each node; a central server correlates everything and hosts the UI.

01 /
Agents watch your nodes

Deploy blackbox-agent on any machine. It monitors Docker, config files, and systemd — then pushes events to the server over a persistent queue that survives network outages.

02 /
Server correlates events

The central server ingests agent events, Uptime Kuma monitors, and Watchtower updates. It runs the incident engine — grouping outages and scoring probable causes automatically.

03 /
You see the full picture

A React timeline UI shows every event across every node — filterable by source, node, or text search. Incidents surface the event chain, scored candidates, and optional AI narrative.

04 /
Secure by default

Non-root distroless containers. JWT + OIDC auth. Rate limiting. Argon2id password hashing. Read-only agent filesystem. No shell in the server image.

┌──────────────────────────────────────┐ │ Blackbox Server │ │ ┌──────────┐ ┌──────┐ ┌────────┐ │ │ │ React UI │ │ API │ │SQLite │ │ │ └──────────┘ └──────┘ └────────┘ │ │ ▲ ▲ ▲ │ └────────┼───────────┼──────────┼──────┘ │ │ │ Browser Agents Webhooks ┌────────────┼────────────┐ │ │ │ ┌────┴────┐ ┌────┴────┐ ┌────┴────┐ │ Agent │ │ Agent │ │ Agent │ │ node-01 │ │ node-02 │ │ node-03 │ │ Docker │ │ Docker │ │ Files │ │ systemd │ │ Files │ │ │ └─────────┘ └─────────┘ └─────────┘
// quick start

Up in minutes.

A single docker compose up -d is all it takes to get going.

docker-compose.yml
loading…
01 /
Create docker-compose.yml

Copy the config and fill in your secrets. Generate strong tokens with openssl rand -hex 32.

02 /
Run docker compose up -d

Both containers start. The agent registers with the server and begins watching Docker events and file changes immediately.

03 /
Open :8080 and complete setup

The bootstrap wizard walks you through creating your admin account. No manual database setup required — schema migrations run on startup.

04 /
Add more nodes or integrations

Deploy more agents, connect Uptime Kuma webhooks, and optionally configure Ollama for AI analysis — all from the Admin panel.

Full Documentation →

Know what broke your lab
before your coffee gets cold.

Open source. Self-hosted. Built for homelabbers.

View Demo → GitHub →