Features
This is everything Nodvard Deck does today. Where it says Beta, that part hasn’t been tested as long as the rest. The interface is in German for now.
Servers and Proxmox
Every server gets its own page with status, load and actions. You add new servers in the interface, even with just a username and password. No terminal needed.
- Live CPU, RAM, disks and uptime
- Operating system, failed services and pending updates over SSH
- Terminal and file manager in the browser
- Proxmox: start and stop nodes, VMs and LXC, console in the browser, snapshots, hardware and storage
- Disk health, ZFS and temperature of Proxmox nodes
You don’t need Proxmox. Deck is just as happy with a Raspberry Pi, a NAS or a few Docker hosts.
What ends up on your servers: no agent and no service of its own, Deck comes in over SSH. For tasks that need root, the setup puts a few small helper scripts into /usr/local/lib/nodvard-deck. Deck calls them via sudo. Each one can only run its fixed commands and checks what it gets by itself. What each helper script may do
Docker
Here you see the containers of all your servers together, with status, logs and console. You handle stacks from Compose files as a whole.
- Start, stop, restart, logs with search, console and details
- Find and apply image updates. Deck keeps the old image as a backup. If the new container doesn’t start, Deck goes back on its own. It only skips that for databases.
- Edit Compose files as text or in a form. Before saving, Docker Compose checks the file on the server.
- Create new stacks, also from templates for Uptime Kuma, Vaultwarden, Nginx Proxy Manager and Gitea
- Update whole stacks and go back to the previous version (rollback), with a backup of the volumes first if you like
- Pull stacks straight from a Git repository. Before that, Deck shows you which files are new or would change. If you like, it backs up the volumes first, and “back to the state before” takes you back to the old state. Credentials for private repositories are stored in the vault.
- Move from Portainer. Deck takes the Compose file and variables along, and your volumes stay where they are
- New in 0.13: create networks, internal only if you like, and connect or disconnect containers
- New in 0.13: pull images by name and tag, private ones with the login under Registries
- New in 0.13: save your own Compose files as templates. Deck refuses fixed passwords and tokens in them
- New in 0.13: check stacks from Git for a new state on a schedule, with a message
- Sort containers by state, status, CPU or RAM
- Clean up images, volumes and networks
Nodvard Shield
Shield keeps an eye on your Linux servers and tells you what it finds. By default, malware goes to quarantine on its own. You can turn that off and decide every time yourself.
- Virus scans with ClamAV as a quick scan, deep scan or on a schedule, with quarantine
- Hardening check with Lynis
- Update center with the pending security updates for each server
- Intrusion checks: unusual SSH logins and open ports. See the addresses Fail2ban has banned on each server, unban them or ban an address by hand
- File watcher for important system files
- Morning briefing with what happened overnight
- Optional error analysis for crashed containers using your own Ollama
ClamAV, Lynis or Fail2ban not installed yet? Shield installs them with a button once you approve. With the helper script or sudo rights on the server, Shield sees the most.
Backups
Deck checks whether your backups really run. And it backs itself up, too.
- All Proxmox backups in one list, with a warning when one is missing or failed
- Create and edit backup jobs
- Restore a VM or LXC from a backup as a copy, the original stays untouched
- Back up the Docker volumes before a stack update if you like
- A copy of its own database before every Deck update, plus a backup to download and restore
Apps
A start page for the services in your network. Every app gets a tile with an address and an icon, and you sort the tiles into folders.
- Deck finds containers with a web interface on your Docker servers on its own
- Add your own apps with an address and an icon
- Change the order by dragging or through the tile’s menu
Integrations
Deck pulls status and numbers from your services and shows them as a tile and on a page of their own. Mostly it only reads and changes nothing. Nextcloud and ntfy have been running for a long time. The rest is beta, so it works, but hasn’t been tested as long.
Extra modules, if you need them
They’re all off by default, so nothing is in the way that you don’t need. You turn them on one by one: scripts for one or many servers, also on a schedule, a place for documents with text recognition and full-text search, an inventory that reminds you before a warranty ends, and game servers (beta).
Vault
Deck keeps the credentials for your servers and services encrypted in its vault.
- For passwords, API tokens and SSH keys
- Deck can create a separate SSH key for each server. The private part stays in the vault.
- Secret values in scripts are taken from the vault only when the script runs
- Each module can only reach the credentials it has been granted
- Encrypted with Fernet (AES-128 in CBC mode with HMAC-SHA256). The key is kept in a file of its own in Deck’s data folder, never in the database.
Notes on running it safely. The short version: don’t put Deck straight on the internet, and turn on two-factor for every account.
Approvals and accounts
Before Deck changes anything, it asks, and every action carries a level that shows how risky it is. What may go through without asking is up to you, for example with a block list or a maintenance window.
- Every action is written to the log
- Users with roles and permissions
- Sign-in with a two-factor code from an app
- A brake against password guessing at sign-in, and one-click updates are only offered for versions released with a signature
- You can change Deck’s name, logo and colors yourself
- New in 0.13: a new version of Deck tells you what it brings, such as a security update or bug fixes
Notifications
The notifications collect everything you should look at, such as a full disk, a failed backup, pending updates or a finding from Shield.
- Push to your phone via ntfy, Telegram, Discord, Gotify, Pushover, Matrix, Slack, Mattermost or your own Apprise API
- A minimum level for each channel
- Deck can be added to your phone’s home screen as an app
- New in 0.13: on your phone, lists show up as cards instead of cut-off tables, for example in Docker, Shield and the notifications
Try it with sample data
Three commands and Deck is running. With the sample data you can look around first, before you add your own servers. The pictures on this page come from there, too.