Add Cockpit server admin setup

Native host install accessed at swave.lol/cockpit/ via nginx reverse proxy.
Requires UrlRoot=/cockpit in /etc/cockpit/cockpit.conf for subpath support.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

3 files changed, 140 insertions, 0 deletions

diff --git a/cockpit/cockpit_choose.md b/cockpit/cockpit_choose.md
new file mode 100644
index 0000000..0e82c84
--- /dev/null
+++ b/cockpit/cockpit_choose.md
@@ -0,0 +1,38 @@
+There is other options beside of cockpit:
+openITCockpit
+
+But claude said:
+● They're actually quite different tools — comparing them depends on your goal.                                                                                                                                                                                                           
+                                                                                                                                                                                                                                                                                          
+  ---                                                                                                                                                                                                                                                                                     
+  Cockpit         
+                                                                                                                                                                                                                                                                                          
+  - Purpose: Administer a single Linux server via web UI
+  - Does: manage processes, storage, networking, logs, users, packages, systemd services
+  - Think of it as: a web-based replacement for SSH for common admin tasks
+  - Complexity: minimal — single package install
+  - Resource use: very light, only active when you're using it
+  - Best for: day-to-day server management
+
+  ---
+  OpenITCockpit
+
+  - Purpose: Full IT monitoring platform (think Nagios/Zabbix)
+  - Does: monitor multiple hosts/services, alerting, dashboards, SLA reports, on-call scheduling
+  - Think of it as: enterprise infrastructure monitoring suite
+  - Complexity: heavy — Docker stack with many services (MySQL, Redis, Grafana, etc.)
+  - Resource use: significant, always running
+  - Best for: teams monitoring many servers/services across infrastructure
+
+
+
+
+
+Also there is:
+https://github.com/tariqbuilds/linux-dash <- very small linux dashboard with less functionality
+
+and other from: https://medevel.com/ubuntu-server-dashboard-and-hosting-panel-for-ubuntu/
+also: https://pysselilivet.blogspot.com/2025/09/lightweight-diy-linux-server-monitoring.html
+https://checkmk.com/guides/linux-server-monitoring
+
+
diff --git a/cockpit/nginx-cockpit.conf b/cockpit/nginx-cockpit.conf
new file mode 100644
index 0000000..6796cf5
--- /dev/null
+++ b/cockpit/nginx-cockpit.conf
@@ -0,0 +1,24 @@
+# Cockpit — path-based proxy
+# Add these location blocks to the existing swave.lol HTTPS server block in nginx.conf
+#
+# Requires UrlRoot=/cockpit in /etc/cockpit/cockpit.conf on the host.
+# The host is reached via host.docker.internal (mapped via extra_hosts in nginx compose).
+# proxy_ssl_verify off because Cockpit uses a self-signed certificate by default.
+# gzip off is required to preserve ETag headers that Cockpit depends on.
+
+location = /cockpit {
+    return 301 /cockpit/;
+}
+
+location /cockpit/ {
+    proxy_pass https://host.docker.internal:9090/cockpit/;
+    proxy_ssl_verify off;
+    proxy_http_version 1.1;
+    proxy_buffering off;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    gzip off;
+}
diff --git a/cockpit/setup.md b/cockpit/setup.md
new file mode 100644
index 0000000..8034474
--- /dev/null
+++ b/cockpit/setup.md
@@ -0,0 +1,78 @@
+# Cockpit Setup
+
+Cockpit is a web-based server administration UI. It runs natively on the host (not in Docker) so it has full access to systemd, storage, networking, and system logs.
+
+Accessible at `https://swave.lol/cockpit/` via nginx reverse proxy.
+
+## Installation
+
+```bash
+apt install cockpit cockpit-storaged cockpit-networkmanager
+systemctl enable --now cockpit.socket
+```
+
+Cockpit listens on port **9090** by default.
+
+## Useful Plugins
+
+```bash
+# Storage management
+apt install cockpit-storaged
+
+# Network management
+apt install cockpit-networkmanager
+
+# Docker/container management (basic)
+apt install cockpit-docker
+```
+
+## Configure Cockpit for subpath access
+
+Cockpit needs to know it is served from a subpath. Edit `/etc/cockpit/cockpit.conf`:
+
+```ini
+[WebService]
+Origins = https://swave.lol wss://swave.lol
+ProtocolHeader = X-Forwarded-Proto
+UrlRoot=/cockpit
+```
+
+`UrlRoot` is the key setting — without it Cockpit generates incorrect internal URLs
+and the login redirect will not work behind a reverse proxy at a subpath.
+
+Restart Cockpit after editing:
+
+```bash
+systemctl restart cockpit
+```
+
+## Nginx Reverse Proxy
+
+Nginx reaches Cockpit via `host.docker.internal` (host-gateway), already configured
+in `nginx/docker-compose.yaml`.
+
+Add the location blocks from `nginx-cockpit.conf` to the `swave.lol` HTTPS server
+block in `/var/nginx/conf/nginx.conf`, then reload nginx:
+
+```bash
+docker exec nginx nginx -t && docker exec nginx nginx -s reload
+```
+
+### Notes
+- `gzip off` is required — Cockpit depends on ETag headers which gzip compression removes
+- `proxy_ssl_verify off` is set because Cockpit uses a self-signed certificate by default
+- WebSocket support is included (required for the Cockpit terminal and live updates)
+
+## Access
+
+```
+https://swave.lol/cockpit/
+```
+
+Log in with any system user that has sudo privileges. For a dedicated admin account:
+
+```bash
+useradd -m -s /bin/bash admin
+passwd admin
+usermod -aG sudo admin
+```