# Cockpit Setup

Cockpit is a web-based server administration UI. It runs natively on the host (not in Docker) so it has full access to systemd, storage, networking, and system logs.

Accessible at `https://swave.lol/cockpit/` via nginx reverse proxy.

## Installation

```bash
apt install cockpit cockpit-storaged cockpit-networkmanager
systemctl enable --now cockpit.socket
```

Cockpit listens on port **9090** by default.

## Useful Plugins

```bash
# Storage management
apt install cockpit-storaged

# Network management
apt install cockpit-networkmanager

# Docker/container management (basic)
apt install cockpit-docker
```

## Configure Cockpit for subpath access

Cockpit needs to know it is served from a subpath. Edit `/etc/cockpit/cockpit.conf`:

```ini
[WebService]
Origins = https://swave.lol wss://swave.lol
ProtocolHeader = X-Forwarded-Proto
UrlRoot=/cockpit
```

`UrlRoot` is the key setting — without it Cockpit generates incorrect internal URLs
and the login redirect will not work behind a reverse proxy at a subpath.

Restart Cockpit after editing:

```bash
systemctl restart cockpit
```

## Nginx Reverse Proxy

Nginx reaches Cockpit via `host.docker.internal` (host-gateway), already configured
in `nginx/docker-compose.yaml`.

Add the location blocks from `nginx-cockpit.conf` to the `swave.lol` HTTPS server
block in `/var/nginx/conf/nginx.conf`, then reload nginx:

```bash
docker exec nginx nginx -t && docker exec nginx nginx -s reload
```

### Notes
- `gzip off` is required — Cockpit depends on ETag headers which gzip compression removes
- `proxy_ssl_verify off` is set because Cockpit uses a self-signed certificate by default
- WebSocket support is included (required for the Cockpit terminal and live updates)

## Access

```
https://swave.lol/cockpit/
```

Log in with any system user that has sudo privileges. For a dedicated admin account:

```bash
useradd -m -s /bin/bash admin
passwd admin
usermod -aG sudo admin
```