Add Cockpit & Netdata to setup guide and update nginx config

- Document Cockpit and Netdata setup in section 8 of setup guide
- Add monitoring_network to nginx compose with host-gateway for Cockpit
- Update network diagram, startup order, services table and ports summary
- Minor CLAUDE.md Jenkins description improvements

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 files changed, 73 insertions, 8 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index cb9cbbc..b4f1f5e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -56,10 +56,11 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 - Dockerfile extends `jenkins/jenkins:lts` with Docker CLI and `docker-workflow` plugin
 - `--prefix=/jenkins` set via JENKINS_OPTS for path-based access
 - Accessible at `https://jenkins.swave.lol` and `https://swave.lol/jenkins`
-- Ports: 8080 (web UI), 50000 (agent communication)
+- Ports: 8080 (web UI), 50000 (agent communication via JNLP, used by remote build agents)
 - Volume: `/var/jenkins_home`
 - Pipeline durability: set to "Performance-optimized" to prevent flow execution corruption
 - Startup script: `jenkins/init.groovy.d/clear-stuck-builds.groovy` auto-cleans stuck builds on restart
+- Currently runs all builds on the controller via DooD; supports adding permanent SSH agents for scaling (see setup guide 6.6)
 
 ### Nginx (reverse proxy)
 - Dir: `nginx/`
diff --git a/doc/setup-guide.md b/doc/setup-guide.md
index ac277d6..f949c18 100644
--- a/doc/setup-guide.md
+++ b/doc/setup-guide.md
@@ -389,12 +389,63 @@ docker compose -f server.yaml up -d gerrit
 Gerrit shares `/var/git/repos` with git-server for repository access.
 
 
-## 8. Nginx (Reverse Proxy + SSL)
+## 8. Cockpit & Netdata (Monitoring)
+
+See `cockpit/setup.md` for full Cockpit installation and configuration details.
+
+### 8.1 Install Cockpit (native, on the host)
+
+```bash
+apt install cockpit cockpit-storaged cockpit-networkmanager
+systemctl enable --now cockpit.socket
+```
+
+Configure Cockpit for subpath access. Edit `/etc/cockpit/cockpit.conf`:
+
+```ini
+[WebService]
+Origins = https://swave.lol wss://swave.lol
+ProtocolHeader = X-Forwarded-Proto
+UrlRoot=/cockpit
+```
+
+```bash
+systemctl restart cockpit
+```
+
+See `cockpit/setup.md` for full details.
+
+### 8.2 Start Netdata (Docker)
+
+```bash
+cd /root/Projects/bastion/netdata
+docker compose up -d
+```
+
+This creates `monitoring_network` (172.24.0.0/16) with Netdata at 172.24.0.2.
+
+### 8.3 Add location blocks to nginx.conf
+
+Add the contents of `cockpit/nginx-cockpit.conf` and `netdata/nginx-netdata.conf`
+to the `swave.lol` HTTPS server block in `/var/nginx/conf/nginx.conf`.
+
+After updating, reload nginx:
+
+```bash
+docker exec nginx nginx -s reload
+```
+
+Cockpit and Netdata will be available at:
+- `https://swave.lol/cockpit/`
+- `https://swave.lol/netdata/`
+
+
+## 9. Nginx (Reverse Proxy + SSL)
 
 Nginx must be started AFTER Git Server, Ghost, Jenkins, and Gerrit, because it joins
 their networks as external.
 
-### 8.1 Create host directories
+### 9.1 Create host directories
 
 ```bash
 # Nginx config directory
@@ -415,7 +466,7 @@ mkdir -p /var/letsencrypt/lts_site
 cp /root/Projects/bastion/nginx/letsencrypt/index.html /var/letsencrypt/lts_site/
 ```
 
-### 8.2 First run — HTTP only (no SSL yet)
+### 9.2 First run — HTTP only (no SSL yet)
 
 Before we have SSL certificates, we need to temporarily disable the SSL server
 blocks so Nginx can start and serve the ACME challenge for certbot.
@@ -434,7 +485,7 @@ cd /root/Projects/bastion/nginx
 docker compose up -d
 ```
 
-### 8.3 Obtain SSL certificates
+### 9.3 Obtain SSL certificates
 
 ```bash
 cd /root/Projects/bastion/nginx
@@ -450,7 +501,7 @@ This requests certificates for:
 
 IMPORTANT: All DNS records must be pointing to the server before running certbot.
 
-### 8.4 Enable SSL
+### 9.4 Enable SSL
 
 ```bash
 # Restore full nginx.conf with SSL blocks
@@ -461,7 +512,7 @@ cd /root/Projects/bastion/nginx
 docker compose restart
 ```
 
-### 8.5 Verify
+### 9.5 Verify
 
 All services should now be accessible:
 
@@ -475,6 +526,8 @@ All services should now be accessible:
 | `https://cgit.swave.lol` | Cgit (subdomain) |
 | `https://swave.lol/gerrit` | Gerrit (path-based) |
 | `https://gerrit.swave.lol` | Gerrit (subdomain) |
+| `https://swave.lol/cockpit/` | Cockpit (server admin) |
+| `https://swave.lol/netdata/` | Netdata (metrics) |
 | `http://<server-ip>:9000` | Portainer |
 | `ssh://git@<server-ip>/repos/<repo>.git` | Git (SSH) |
 | `git://<server-ip>/<repo>.git` | Git (daemon, read-only) |
@@ -500,6 +553,13 @@ jenkins_network (172.23.0.0/16)
 ├── git-server     (172.23.0.3)
 ├── gerrit         (172.23.0.4)
 └── nginx
+
+monitoring_network (172.24.0.0/16)
+├── netdata        (172.24.0.2)
+└── nginx
+
+Cockpit runs natively on the host (port 9090).
+Nginx reaches it via host.docker.internal (host-gateway).
 ```
 
 Nginx sits on all networks so it can reverse proxy to every service.
@@ -528,7 +588,10 @@ docker compose -f /root/Projects/bastion/jenkins/docker-compose.yaml up -d
 # 5. Gerrit (joins git-network + jenkins_network, both must exist)
 docker compose -f /root/Projects/bastion/git-server/server.yaml up -d gerrit
 
-# 6. Nginx (joins all networks — must be last)
+# 6. Netdata (creates monitoring_network)
+docker compose -f /root/Projects/bastion/netdata/docker-compose.yaml up -d
+
+# 7. Nginx (joins all networks — must be last)
 docker compose -f /root/Projects/bastion/nginx/docker-compose.yaml up -d
 ```
 
@@ -543,5 +606,6 @@ docker compose -f /root/Projects/bastion/nginx/docker-compose.yaml up -d
 | 2368 | Ghost (direct, for testing) | TCP |
 | 8080 | Jenkins (direct, for testing) | TCP |
 | 9000 | Portainer (web UI) | TCP |
+| 9090 | Cockpit (native, host only — proxied via nginx) | TCP |
 | 9418 | Git Server (git daemon) | TCP |
 | 50000 | Jenkins (agent communication) | TCP |