docudjeex/content/en/3.serveex/4.monitoring/4.beszel.md

title, description

title	description
Beszel	Install Beszel to monitor server CPU, RAM, disk, and network metrics, including remote servers, with a lightweight web dashboard.

:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

Beszel is a container that gives you real-time access to hardware information from your servers and allows historical tracking. CPU activity, disk usage, temperatures, RAM: nothing escapes your monitoring. Beszel also lets you configure notifications and alerts when your predefined thresholds are exceeded.

Beszel includes a hub with a web UI and an agent that collects data from your server or a remote server.

Installation

::file-tree

tree: /: - docker: - beszel: - compose.yaml - .env - data/ - socket/

::

::steps{level="3"}

Deploy the stack

Open Dockge, click compose, name the stack beszel, and paste the following:

---
services:
  beszel:
    image: henrygd/beszel:latest
    container_name: beszel
    restart: unless-stopped
    ports:
      - ${PORT}:8090
    volumes:
      - ./data:/beszel_data
      - ./socket:/beszel_socket

  beszel-agent:
    image: henrygd/beszel-agent:latest
    container_name: beszel-agent
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./socket:/beszel_socket
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      LISTEN: /beszel_socket/beszel.sock
      # Do not remove quotes around the key
      KEY: ${KEY}

::tip{icon=""} ✨ Tip: Add the Watchtower label to each container to automate updates.

---
services:
  beszel:
    #...
    labels:
      - com.centurylinklabs.watchtower.enable=true

::

Set your environment variables

Fill out the .env file, for example:

PORT=8090 # web UI port
KEY= # private key to retrieve from Beszel when adding a system

For the KEY value, you'll need to launch Beszel once to get it.

Deploy the container and go to http://yourserverip:8090. Your Beszel web UI is now accessible!

Done !

::

::caution

If it fails: check your firewall rules. ::

Add local server information

Now that the web UI is accessible, you need to push local server information into it. Just add a machine via the web UI and configure it like this:

Note the private key and confirm. Enter the key in your .env file in Dockge and redeploy the stack. Once done, your server will appear in the web UI:

Add a remote server

You can also monitor a remote server. To do so, run the agent on the remote server. Add a new machine in Beszel and fill in:

• The name displayed for your remote server
• The IP address or domain name of the remote server
• The listening port (e.g., 45876)

Beszel will suggest a compose.yaml to deploy on the remote server, or you can use:

---
services:
  beszel-agent:
    image: henrygd/beszel-agent
    container_name: beszel-agent
    restart: unless-stopped
    network_mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      LISTEN: ${PORT}
      KEY: ${KEY}

And in .env:

PORT=45876 # communication port between hub and remote agent
KEY= # private key from Beszel when adding the system

Deploy the stack on the remote server. Data will begin flowing into the web UI after a few seconds.

::caution

If it fails: check your firewall rules. ::

Expose Beszel with Swag

::warning

Beszel does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Only do this if you're using a system like TinyAuth or Authentik. Otherwise, do not expose with SWAG. Use a VPN like Wireguard instead. ::

If you want to access Beszel remotely from all your devices, expose it using Swag.

::note{icon=""} 📋 Prerequisite:

You must have created a DNS subdomain like beszel.mydomain.com with a CNAME pointing to mydomain.com. Unless you're using Cloudflare Zero Trust, you must also have forwarded port 443 on your router to your server’s 443 port via NAT rules. ::

::steps{level="3"}

Add Beszel's network to SWAG

In Dockge, edit Swag's compose file and add Beszel’s network:

---
services:
  swag:
     container_name: # ...
      # ...
     networks:
      # ...
      - beszel            # network declared in the stack

networks:
  # ...
  beszel:
    name: beszel_default  # actual external network name
    external: true

Redeploy the stack and wait for Swag to become fully operational.

::note

We assume the network name is beszel_default. You can check connectivity by visiting Swag's dashboard at http://yourserverip:81. ::

Create the subdomain.conf file

In Swag’s config folders, create beszel.subdomain.conf.

::tip{icon=""} ✨ Tip: Use File Browser Quantum to browse and edit files instead of terminal commands. ::

sudo nano /docker/swag/config/nginx/proxy-confs/beszel.subdomain.conf

Paste:

## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name beszel.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    #if ($lan-ip = yes) { set $geo-whitelist yes; }
    #if ($geo-whitelist = no) { return 404; }
    if ($geo-blacklist = no) { return 404; }

    # enable for ldap auth
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik
    #include /config/nginx/authentik-server.conf;

    location / {
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        #include /config/nginx/ldap-location.conf;
        #include /config/nginx/authelia-location.conf;
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app beszel;
        set $upstream_port 8090;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

Done !

::

That’s it! Beszel is now exposed!

Protecting Beszel with TinyAuth

Add TinyAuth's forward-auth check directly to beszel.subdomain.conf, the same way as the TinyAuth guide:

## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name beszel.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    #if ($lan-ip = yes) { set $geo-whitelist yes; }
    #if ($geo-whitelist = no) { return 404; }
    if ($geo-blacklist = no) { return 404; }

    # enable for ldap auth
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik
    #include /config/nginx/authentik-server.conf;

    location /tinyauth {
        internal;
        proxy_pass http://tinyauth:3000/api/auth/nginx;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Uri $request_uri;
    }

    location @tinyauth_login {
        return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri;
    }

    location / {
        auth_request /tinyauth;
        error_page 401 = @tinyauth_login;

        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        #include /config/nginx/ldap-location.conf;
        #include /config/nginx/authelia-location.conf;
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app beszel;
        set $upstream_port 8090;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

::note

The location /tinyauth block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (tinyauth here). This should already be set up from exposing TinyAuth itself. If you run into an error, double-check SWAG's compose file still has that network attached. ::

::tip{icon=""} ✨ You can protect this app with Authentik instead of TinyAuth by opening beszel.subdomain.conf and removing the # in front of include /config/nginx/authentik-server.conf; and include /config/nginx/authentik-location.conf;. Don’t forget to create an application and provider in Authentik. ::