Part 6: Security layer
32. Cockpit: a private monitoring dashboard#
What you'll get: a web page showing CPU, memory, disks, services and logs, opened through an SSH tunnel just like the AI. Time: 15 minutes.
flowchart LR
B["Browser on your Mac / PC<br/>http://127.0.0.1:19090"] --> T["ssh -L tunnel"] --> C["Cockpit<br/>127.0.0.1:9090"]
O["Any other device"] -. "127.0.0.1 only" .-x CCockpit is an admin tool: logged in, it can do what your account can do. That's why it must never be reachable from the network.
Step 1: Tell it to listen on 127.0.0.1 only (before installing)#
sudo mkdir -p /etc/systemd/system/cockpit.socket.d
sudo nano /etc/systemd/system/cockpit.socket.d/listen.conf
[Socket]
ListenStream=
ListenStream=127.0.0.1:9090
The empty ListenStream= line removes the default ("all networks"). The second line sets "this computer only".
Step 2: Install#
sudo systemctl daemon-reload
sudo apt install --no-install-recommends cockpit-ws cockpit-system
sudo systemctl daemon-reload
sudo systemctl enable --now cockpit.socket
sudo systemctl restart cockpit.socket
--no-install-recommends installs only the basic dashboard, without extra modules that change network or disk settings.
Step 3: Check it's private#
sudo ss -ltnp 'sport = :9090'
curl -fsS http://127.0.0.1:9090/ping
The address must be 127.0.0.1:9090, and ping should answer. If you see 0.0.0.0:9090 or [::]:9090, run sudo systemctl stop cockpit.socket cockpit.service and recheck step 1.
Don't add a firewall rule for 9090.
Step 4: Open it#
ssh -N -o ExitOnForwardFailure=yes -L 127.0.0.1:19090:127.0.0.1:9090 homeserver
ssh -N -o ExitOnForwardFailure=yes -L 127.0.0.1:19090:127.0.0.1:9090 homeserver
Leave the window open and go to http://127.0.0.1:19090 in your browser.
Log in with your server username and password (the one you use for sudo, not your key passphrase). At the top, leave Administrative access on Limited for normal viewing.
What to look at#
| Page | Look for |
|---|---|
| Overview | CPU and memory. High CPU with no AI job running is suspicious |
| Services | ssh, fail2ban, ufw; with AI: llama-model, ai-egress-guard |
| Logs | Repeated login failures, crashes, update or disk errors |
| Terminal | A shell in the browser, handy for quick checks |
Some things Cockpit doesn't show, so check them in the Terminal page or over SSH:
sensors
df -h /
systemctl --user status aisystem --no-pager
(The last line only if you have Chapter 25.)
Good to know
Cockpit shows the present, not history, and doesn't send alerts. It helps with the monthly health check; it doesn't replace it.
Done when: you see the dashboard through the tunnel, and ss shows 127.0.0.1:9090 only.