Skip to content
Heatwave Docs

Service Directory & Access

Start here. This is the launchpad: every operator surface and external dashboard in the fleet, with a clickable URL, a one-line description of what it does, how it’s gated, and where the login lives. For the why-it-runs-there detail (topology, ports, failover), read the Infrastructure & Monitoring Inventory; this page is just the door.

How to get in (read this once)

Section titled “How to get in (read this once)”

Three gates cover everything below. Get the right one before clicking:

  1. Tailnet (Tailscale). Most self-hosted admin UIs bind to the box’s 100.x tailnet IP and are reachable only over Tailscale — nothing is on the public internet. Run tailscale up and you’re on. If a 100.x link below hangs, you’re off the tailnet.
  2. Cloudflare Access. This docs portal (docs.warmlyyours.dev) and the staging hostnames are gated to @warmlyyours.com Google accounts (24 h session). Production crm/www/api.warmlyyours.com is public — Rails handles its own admin auth there.
  3. 1Password vault IT. Every login below resolves to an item in the IT vault. The op://IT/… reference in the “Login” column is the exact item.

Fleet shorthand: dal-01 = dal-latitude-heatwave-01 (Dallas, 100.123.47.52) — prod app + DB primary + staging. chi-02 = chi-latitude-heatwave-02 (Chicago, 100.68.157.49) — DB standby, PITR backups, the four-guest Incus CI-runner pool, and the Dozzle hub.

Self-hosted operator UIs (tailnet-only)

Section titled “Self-hosted operator UIs (tailnet-only)”

Get on the tailnet first. None of these are public.

Service URL What it does Login
Netdata — dal-01 (prod primary) http://100.123.47.52:19999 Per-second host + every container + Postgres primary + Valkey ×3 + pgbouncer + HAProxy + systemd metrics none (tailnet)
Netdata — chi-02 (standby) http://100.68.157.49:19999 Standby host + PG replica (recovery state / replication lag) + RO pgbouncer none (tailnet)
Dozzle (log hub) http://100.68.157.49:9999 Read-only live container-log tail + stats for chi-02 and dal-01. CI runner logs are archived by the snapshot-reset watcher instead of using agents inside ephemeral guests. Deliberately not Portainer: no start/stop, so it can’t drift against Kamal. op://IT/Dozzle-<you> (one item per dev)
Incus web UI https://100.68.157.49:8443/ui/ Manage the VMs/containers on chi-02 — including the ci-runner-a through ci-runner-d KVM pool that runs CI. Console, config, start/stop, snapshots. TLS client cert — run bin/incus-ui-cert once to enroll your Mac
SFTPGo admin http://100.123.47.52:8080/web/admin SFTP users/sessions for the Switchvox call-records + PBX-backup drop → Cloudflare R2. (Note: use /web/admin, not /web/admin/login.) op://IT/SFTPGo Admin
HAProxy stats http://100.123.47.52:8404/ DB write-VIP backend health — which node is currently the live primary none (tailnet)
Databasus (PITR controller) http://100.68.157.49:4005 Configure/monitor Postgres PITR backups; trigger point-in-time restores op://IT/Databasus (Postgres Backup)
Mailpit — staging http://100.123.47.52:8025 Captured staging outbound mail (staging sends no real mail) none (tailnet)
Mailpit — dev http://localhost:8025 Captured dev outbound mail (local docker-compose) none (local)

Rails admin dashboards (Cloudflare / Rails login)

Section titled “Rails admin dashboards (Cloudflare / Rails login)”

Mounted inside the app on the crm.* host, behind the Rails admin gate (is_admin?). Reachable on the public internet — no tailnet needed.

Service URL What it does
PgHero https://crm.warmlyyours.com/pghero Slow queries, table/index bloat, live queries, vacuum, index suggestions
Sidekiq Web UI https://crm.warmlyyours.com/sidekiq Background-job queues, retries, scheduled set
Rails Event Store https://crm.warmlyyours.com/res The RES domain-event stream browser

External dashboards (SaaS)

Section titled “External dashboards (SaaS)”

Off-Latitude control planes. Each has its own login (all in 1Password IT).

Service URL What it does Login
Latitude.sh https://www.latitude.sh/dashboard The bare-metal host provider — the two f4.metal.medium boxes, edge firewall rules, remote console/reinstall, billing op://IT/Latitude.sh
Netdata Cloud https://app.netdata.cloud/spaces/warmlyyours/rooms/all-nodes/home Single pane over both Netdata agents (each streams outbound over ACLK) + centralized alerting. Data stays local on the agents; Cloud is the query router / notifier. Google SSO (@warmlyyours.com)
Cloudflare https://dash.cloudflare.com/79b7f58cf035093b5ad11747df30369a/warmlyyours.com DNS, the cloudflared tunnel, WAF/cache rules, Workers, R2 buckets, Cloudflare Access. Zone rulesets are Terraform-managed — the dashboard is read-only for those. op://IT/Cloudflare
AppSignal https://appsignal.com/warmlyyours APM, exceptions, performance traces (apps Heatwave/production + /staging) op://IT/AppSignal
HCP Terraform https://app.terraform.io/app/warmlyyours All infra-as-code runs/state (Latitude, host-config, Tailscale, Cloudflare zones). Plans reviewed, applies manual. op://IT/Terraform Cloud
GHCR (container images) https://github.com/orgs/warmlyyours/packages ghcr.io/warmlyyours/… images pulled by Kamal. Registry auth is per-dev via the gh CLI gh auth login

Managing the infrastructure — where the how-to lives

Section titled “Managing the infrastructure — where the how-to lives”

The tables above are the doors; these are the runbooks behind them.

Keeping this current

Section titled “Keeping this current”

This page mirrors the admin-services and external-dashboard tables in the Infrastructure & Monitoring Inventory. When a new operator UI or dashboard appears (usually a new Kamal accessory in config/deploy.yml or a new SaaS control plane), add a row here and there.