docudjeex/content/en/3.serveex/4.monitoring/2.dozzle.md

title, description

title	description
Dozzle	Install Dozzle to monitor Docker container logs in real time from a clean web interface, exposed via SWAG.

:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

Dozzle is a container that lets you access logs from your other containers and display them in real time through a user-friendly interface. It's a simple way to browse logs and retrieve information from the history.

Installation

Folder structure

root
└── docker
    └── dozzle
        └── data

::steps{level="3"}

Deploy the stack

Open Dockge, click on compose, name the stack dozzle, then copy and paste the following:

---
services:
  dozzle:
    container_name: dozzle
    image: amir20/dozzle:latest
    ports:
      - 9135:8080
    env_file:
      - .env
    environment:
      - DOZZLE_HOSTNAME=${DOMAIN}
    volumes:

      - /var/run/docker.sock:/var/run/docker.sock

::tip{icon=""} ✨ Tip: Add the watchtower label to each container to automate updates

```yaml [compose.yaml]
services:
  dozzle:
    #...
    labels:

      - com.centurylinklabs.watchtower.enable=true
```

::

Set your environment variables

Fill in your domain name in the .env file, for example:

DOMAIN=dozzle.mydomain.com

Deploy the container. Go to http://yourserverip:9135. Voilà, your Dozzle web UI is up and running!

Done !

::

Exposing Dozzle with Swag

::warning

Dozzle does not use multi-factor authentication. Exposing Dozzle to the internet could compromise the connected machines. Only do this if you use a multi-factor authentication system like TinyAuth or Authentik. Otherwise, do not expose it with SWAG and instead use a VPN like Wireguard. ::

You may want to access Dozzle remotely and on all your devices. To do so, we’ll expose Dozzle via Swag.

::note{icon=""} 📋 Before you begin:

We assume you have created a subdomain like dozzle.mydomain.com in your DNS zone with a CNAME pointing to mydomain.com and that, unless you're using Cloudflare Zero Trust, you’ve redirected port 443 from your router to port 443 on your server in your NAT rules. ::

::steps{level="3"}

Add Dozzle's network to SWAG

Go to Dockge and edit the SWAG compose file to add Dozzle’s network:

services:
  swag:
     container_name: # ...
      # ... 
     networks:                 # Connects the container to a custom network
      # ...           
      - dozzle                 # Network name declared in the stack
    
networks:                      # Defines the custom network
  # ...
  dozzle:                      # Network name declared in the stack
    name: dozzle_default       # Actual name of the external network
    external: true             # Indicates it's an externally defined network

Redeploy the stack by clicking “Deploy” and wait for SWAG to be fully operational.

::note

We assume the Dozzle network name is dozzle_default. You can verify the connection is working by visiting the SWAG dashboard at http://yourserverip:81. ::

Create the subdomain.conf file

In the Swag folder, create the dozzle.subdomain.conf file.

::tip{icon=""} ✨ Tip: You can use File Browser Quantum to browse and edit files instead of using terminal commands. ::

sudo nano /docker/swag/config/nginx/proxy-confs/dozzle.subdomain.conf

Paste the configuration below:

## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name dozzle.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    #if ($lan-ip = yes) { set $geo-whitelist yes; }
    #if ($geo-whitelist = no) { return 404; }
    if ($geo-blacklist = no) { return 404; }

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app dozzle;
        set $upstream_port 8080;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }
}

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

Done !

::

And there you go, Dozzle is now exposed!

Protecting Dozzle with TinyAuth

Add TinyAuth's forward-auth check directly to dozzle.subdomain.conf, the same way as the TinyAuth guide:

## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name dozzle.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    #if ($lan-ip = yes) { set $geo-whitelist yes; }
    #if ($geo-whitelist = no) { return 404; }
    if ($geo-blacklist = no) { return 404; }

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location /tinyauth {
        internal;
        proxy_pass http://tinyauth:3000/api/auth/nginx;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Uri $request_uri;
    }

    location @tinyauth_login {
        return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri;
    }

    location / {
        auth_request /tinyauth;
        error_page 401 = @tinyauth_login;

        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app dozzle;
        set $upstream_port 8080;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }
}

::note

The location /tinyauth block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (tinyauth here). This should already be set up from exposing TinyAuth itself. If you run into an error, double-check SWAG's compose file still has that network attached. ::

::tip{icon=""} ✨ Tip: You can protect this app with Authentik instead of TinyAuth by opening dozzle.subdomain.conf and removing the # in front of include /config/nginx/authentik-server.conf;{lang=nginx} and include /config/nginx/authentik-location.conf;{lang=nginx}. Don’t forget to create an application and a provider in Authentik. ::