--- title: Dozzle description: Install Dozzle to monitor Docker container logs in real time from a clean web interface, exposed via SWAG. --- :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60} [Dozzle](https://dozzle.dev/) is a container that lets you access logs from your other containers and display them in real time through a user-friendly interface. It's a simple way to browse logs and retrieve information from the history. ![Dozzle](https://blog.unixhost.pro/wp-content/uploads/2023/03/image-5.png) ## Installation ::file-tree --- tree: /: - srv: - docker: - dozzle: - compose.yaml - .env - data/ --- :: ::steps{level="3"} ### Deploy the stack Open Dockge, click on `compose`, name the stack `dozzle`, then copy and paste the following: ```yaml [compose.yaml] --- services: dozzle: container_name: dozzle image: amir20/dozzle:latest ports: - 9135:8080 env_file: - .env environment: - DOZZLE_HOSTNAME=${DOMAIN} volumes: - /var/run/docker.sock:/var/run/docker.sock ``` ::tip{icon=""} ✨ __Tip:__ Add the watchtower label to each container to automate updates ```yaml [compose.yaml] services: dozzle: #... labels: - com.centurylinklabs.watchtower.enable=true ``` :: ### Set your environment variables Fill in your domain name in the `.env` file, for example: ```properties [.env] DOMAIN=dozzle.mydomain.com ``` Deploy the container. Go to `http://yourserverip:9135`. Voilà, your Dozzle web UI is up and running! ### Done ! :: ## Exposing Dozzle with Swag ::warning Dozzle does not use multi-factor authentication. Exposing Dozzle to the internet could compromise the connected machines. Only do this if you use a multi-factor authentication system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG and instead use a VPN like [Wireguard](/serveex/core/wireguard). :: You may want to access Dozzle remotely and on all your devices. To do so, we’ll expose Dozzle via Swag. ::note{icon=""} 📋 __Before you begin:__

We assume you have created a subdomain like `dozzle.mydomain.com` in your [DNS zone](/general/networking/dns) with a `CNAME` pointing to `mydomain.com` and that, [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), you’ve redirected port `443` from your router to port `443` on your server in your [NAT rules](/general/networking/nat). :: ::steps{level="3"} ### Add Dozzle's network to SWAG Go to Dockge and edit the SWAG compose file to add Dozzle’s network: ```yaml [compose.yaml] --- services: swag: container_name: # ... # ... networks: # Connects the container to a custom network # ... - dozzle # Network name declared in the stack networks: # Defines the custom network # ... dozzle: # Network name declared in the stack name: dozzle_default # Actual name of the external network external: true # Indicates it's an externally defined network ``` Redeploy the stack by clicking “Deploy” and wait for SWAG to be fully operational. ::note We assume the Dozzle network name is `dozzle_default`. You can verify the connection is working by visiting the SWAG dashboard at `http://yourserverip:81`. :: ### Create the subdomain.conf file In the Swag folder, create the `dozzle.subdomain.conf` file. ::tip{icon="" to="/serveex/files/file-browser-quantum"} ✨ __Tip:__ You can use **File Browser Quantum** to browse and edit files instead of using terminal commands. :: ```bash [Terminal] sudo nano /srv/docker/swag/config/nginx/proxy-confs/dozzle.subdomain.conf ``` Paste the configuration below: ```nginx [dozzle.subdomain.conf] ## Version 2023/12/19 server { listen 443 ssl; listen [::]:443 ssl; server_name dozzle.*; include /config/nginx/ssl.conf; client_max_body_size 0; #if ($lan-ip = yes) { set $geo-whitelist yes; } #if ($geo-whitelist = no) { return 404; } if ($geo-blacklist = no) { return 404; } # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location / { # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app dozzle; set $upstream_port 8080; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; } } ``` Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit. ### Done ! :: And there you go, Dozzle is now exposed! ## Protecting Dozzle with TinyAuth Add [TinyAuth](/serveex/security/tinyauth)'s forward-auth check directly to `dozzle.subdomain.conf`, the same way as [the TinyAuth guide](/serveex/security/tinyauth#protecting-an-app-via-reverse-proxy): ```nginx [dozzle.subdomain.conf]{26-38,41-42} ## Version 2023/12/19 server { listen 443 ssl; listen [::]:443 ssl; server_name dozzle.*; include /config/nginx/ssl.conf; client_max_body_size 0; #if ($lan-ip = yes) { set $geo-whitelist yes; } #if ($geo-whitelist = no) { return 404; } if ($geo-blacklist = no) { return 404; } # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location /tinyauth { internal; proxy_pass http://tinyauth:3000/api/auth/nginx; proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Forwarded-Uri $request_uri; } location @tinyauth_login { return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri; } location / { auth_request /tinyauth; error_page 401 = @tinyauth_login; # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app dozzle; set $upstream_port 8080; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; } } ``` ::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"} The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached. :: ::tip{icon=""} ✨ __Tip:__ You can protect this app with [Authentik](/serveex/advanced/authentik) instead of TinyAuth by opening `dozzle.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and a provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy). ::