bnlqn/overlook

What it does

Overlook is a single-page read-only dashboard for a self-hosted homelab. It pulls data from the tools you already run — check engines (Gatus, Uptime Kuma, Grafana, Prometheus/Alertmanager, Checkmate), servers (Proxmox VE, Beszel, Docker, NUT), storage, network gear (UniFi, AdGuard Home, Pi-hole), and media/app services (Radarr, Sonarr, Jellyfin, Emby, Plex via Tautulli, Immich, Seerr, Home Assistant, Paperless-ngx, Nextcloud, and more) — and presents four fixed areas: Servers, Network, Storage, and Apps. Each area shows whether it is up, degraded, or down, the last 30 check results, today's figures, and the week's problems and events.

The design goal is to change nothing and remember nothing: every source is read with GET requests, no database or volume is used, and the page is refreshed on demand (at most every 30 seconds). It also collects "chores" — due to-dos from an iCalendar list, pending GitHub updates, battery changes, devices awaiting adoption, and requests waiting for approval — which are links to where you actually do the work, never problems themselves. See the live demo for an example layout.

Quick start

Overlook ships as one container. Create a folder for the config beside a compose.yaml and .env:

overlook/
  overlook.yaml
compose.yaml
.env

A minimal compose.yaml:

services:
  overlook:
    image: ghcr.io/bnlqn/overlook:0.4
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - ./overlook:/etc/overlook:ro
    env_file: .env
    environment:
      TZ: Europe/Brussels

A minimal overlook/overlook.yaml using Gatus and Proxmox as examples:

sources:
  gatus:
    - url: http://gatus.example.com:8080
  proxmox:
    - url: https://pve.example.com:8006
      token: overlook@pve!overlook
      secret: ${PROXMOX_SECRET}
      ca: /etc/overlook/pve-root-ca.pem

apps:
  - name: Photos
    url: https://photos.example.com
    icon: immich.svg
    check: Photos

Put secrets in .env (permissions 600), for example PROXMOX_SECRET=..., then run docker compose up -d and open port 8080. The log reports which sources Overlook reads, and the page marks any source that did not answer. The full commented config is in overlook.example.yaml; without Docker, release binaries are available from releases.

Configuration and constraints

The YAML is validated once at startup: unknown keys stop the container, so a typo does not go unnoticed. Every ${VAR} in the config is resolved from the environment; an unset variable also stops startup. The config directory is mounted read-only and must be readable by uid 65532. TZ determines when "today" starts for daily figures.

Overlook has no accounts and no login: anyone who can open the page sees all data, hostnames, and problem states. Keep it on your LAN, behind a VPN, or add authentication at a reverse proxy. Requests rely on read-only or least-privilege credentials per source — for example Proxmox VE with the PVEAuditor role, Grafana with a Viewer service-account token, and Beszel with a readonly user. Some sources only offer admin-level keys (Radarr, Sonarr, Jellyfin, and others), so the guarantee rests on Overlook only issuing GET requests and, for Tautulli, a fixed allow-list of read commands. Docker is never read through the host socket directly; a socket proxy is required. NUT readings are unencrypted on the network. Plex is supported only through Tautulli. Sources such as backrest/restic, Caddy, Deluge, Transmission, and Synology DSM are not supported because they cannot be read under these constraints.

If something is not right, check the Adapters section for the exact credentials and endpoint each source needs, and the contributing guide for adding an adapter. The project is MIT-licensed.

HotRepo's take

The repository has 106 stars and 6 forks, with a recent new-project snapshot on 2026-11-02 showing 5 stars gained over a roughly two-hour window; no all-language daily rank is recorded. That is early stage, but the project is not a thin wrapper: the README documents roughly two dozen adapters, each with credential requirements, and explicitly records architectural decisions for read-only access. The most useful signal for readers is the breadth of supported check engines and self-hosted apps in one fixed layout that avoids writing to any source, which matters in homelab setups where an extra dashboard should not become another system to maintain.