title: Service Directory & Access
description: One-page launchpad for every infrastructure service — what it does, the URL to reach it, how it's gated, and where the login lives.

Service Directory & Access

Start here. This is the launchpad: every operator surface and external
dashboard in the fleet, with a clickable URL, a one-line description of what it
does, how it's gated, and where the login lives. For the why-it-runs-there
detail (topology, ports, failover), read the
Infrastructure & Monitoring Inventory; this page
is just the door.

How to get in (read this once)

Three gates cover everything below. Get the right one before clicking:

  1. Tailnet (Tailscale). Most self-hosted admin UIs bind to the box's
    100.x tailnet IP and are reachable only over Tailscale — nothing is on
    the public internet. Run tailscale up and you're on. If a 100.x link
    below hangs, you're off the tailnet.
  2. Cloudflare Access. This docs portal (docs.warmlyyours.dev) and the
    staging hostnames are gated to @warmlyyours.com Google accounts (24 h
    session). Production crm/www/api.warmlyyours.com is public — Rails handles
    its own admin auth there.
  3. 1Password vault IT. Every login below resolves to an item in the IT
    vault. The op://IT/… reference in the "Login" column is the exact item.

Fleet shorthand: dal-01 = dal-latitude-heatwave-01 (Dallas,
100.123.47.52) — prod app + DB primary + staging. chi-02 =
chi-latitude-heatwave-02 (Chicago, 100.68.157.49) — DB standby, PITR
backups, the four-guest Incus CI-runner pool, and the Dozzle hub.

Self-hosted operator UIs (tailnet-only)

Get on the tailnet first. None of these are public.

Service URL What it does Login
Netdata — dal-01 (prod primary) http://100.123.47.52:19999 Per-second host + every container + Postgres primary + Valkey ×3 + pgbouncer + HAProxy + systemd metrics none (tailnet)
Netdata — chi-02 (standby) http://100.68.157.49:19999 Standby host + PG replica (recovery state / replication lag) + RO pgbouncer none (tailnet)
Dozzle (log hub) http://100.68.157.49:9999 Read-only live container-log tail + stats for chi-02 and dal-01. CI runner logs are archived by the snapshot-reset watcher instead of using agents inside ephemeral guests. Deliberately not Portainer: no start/stop, so it can't drift against Kamal. op://IT/Dozzle-<you> (one item per dev)
Incus web UI https://100.68.157.49:8443/ui/ Manage the VMs/containers on chi-02 — including the ci-runner-a through ci-runner-d KVM pool that runs CI. Console, config, start/stop, snapshots. TLS client cert — run bin/incus-ui-cert once to enroll your Mac
SFTPGo admin http://100.123.47.52:8080/web/admin SFTP users/sessions for the Switchvox call-records + PBX-backup drop → Cloudflare R2. (Note: use /web/admin, not /web/admin/login.) op://IT/SFTPGo Admin
HAProxy stats http://100.123.47.52:8404/ DB write-VIP backend health — which node is currently the live primary none (tailnet)
Databasus (PITR controller) http://100.68.157.49:4005 Configure/monitor Postgres PITR backups; trigger point-in-time restores op://IT/Databasus (Postgres Backup)
Mailpit — staging http://100.123.47.52:8025 Captured staging outbound mail (staging sends no real mail) none (tailnet)
Mailpit — dev http://localhost:8025 Captured dev outbound mail (local docker-compose) none (local)

Rails admin dashboards (Cloudflare / Rails login)

Mounted inside the app on the crm.* host, behind the Rails admin gate
(is_admin?). Reachable on the public internet — no tailnet needed.

Service URL What it does
PgHero https://crm.warmlyyours.com/pghero Slow queries, table/index bloat, live queries, vacuum, index suggestions
Sidekiq Web UI https://crm.warmlyyours.com/sidekiq Background-job queues, retries, scheduled set
Rails Event Store https://crm.warmlyyours.com/res The RES domain-event stream browser

External dashboards (SaaS)

Off-Latitude control planes. Each has its own login (all in 1Password IT).

Service URL What it does Login
Latitude.sh https://www.latitude.sh/dashboard The bare-metal host provider — the two f4.metal.medium boxes, edge firewall rules, remote console/reinstall, billing op://IT/Latitude.sh
Netdata Cloud https://app.netdata.cloud/spaces/warmlyyours/rooms/all-nodes/home Single pane over both Netdata agents (each streams outbound over ACLK) + centralized alerting. Data stays local on the agents; Cloud is the query router / notifier. Google SSO (@warmlyyours.com)
Cloudflare https://dash.cloudflare.com/79b7f58cf035093b5ad11747df30369a/warmlyyours.com DNS, the cloudflared tunnel, WAF/cache rules, Workers, R2 buckets, Cloudflare Access. Zone rulesets are Terraform-managed — the dashboard is read-only for those. op://IT/Cloudflare
AppSignal https://appsignal.com/warmlyyours APM, exceptions, performance traces (apps Heatwave/production + /staging) op://IT/AppSignal
HCP Terraform https://app.terraform.io/app/warmlyyours All infra-as-code runs/state (Latitude, host-config, Tailscale, Cloudflare zones). Plans reviewed, applies manual. op://IT/Terraform Cloud
GHCR (container images) https://github.com/orgs/warmlyyours/packages ghcr.io/warmlyyours/… images pulled by Kamal. Registry auth is per-dev via the gh CLI gh auth login

Managing the infrastructure — where the how-to lives

The tables above are the doors; these are the runbooks behind them.

Keeping this current

This page mirrors the admin-services and external-dashboard tables in the
Infrastructure & Monitoring Inventory. When a new
operator UI or dashboard appears (usually a new Kamal accessory in
config/deploy.yml or a new SaaS control plane), add a row here and there.