geointel/docs/PLATFORM_AUDIT.md

DockDeck platform audit

Updated: 2026-07-15

Executive assessment

DockDeck is now a complete daily-use dashboard rather than a launcher with generic telemetry. Navigation, app management, responsive presentation, widget composition, service-specific data, Unraid host depth, freshness, portability and diagnostics form one coherent read-only product. The P0, P1 and P2 roadmap from the previous audit is implemented.

Current scorecard

Area	Assessment	Evidence
Navigation and search	Complete	Dynamic index follows renames, removals, URLs, categories, favorites and Tower.
Responsive shell	Complete	Mobile, tablet, desktop and ultrawide layouts have no positive horizontal overflow.
App management	Complete	Rename, override, categorize, hide and persistent DockDeck-only removal.
Widget composition	Complete	Order, three sizes, content layers, per-metric visibility/order/style, limits, labels, warnings and edit mode.
Widget data depth	Complete framework	Live audit: 97/97 apps have a specific capability profile, zero generic profiles; 23 native providers.
Unraid host depth	Complete	AppOps plus array/parity/storage/temperature/UPS, selectable stats and configurable server trend charts.
Freshness and trends	Complete	Fresh/stale/unavailable semantics, cadence, stale cache and selectable line/area/bar charts up to sixty samples.
Portability	Complete	Full secret-free backup plus independent layout preset import/export.
Operations	Complete for LAN	Secret-free diagnostics, health endpoint, PWA shell and authenticated reverse-proxy guide.
Security	Strong for trusted LAN	Single socketless container, GET-only integrations, masked secrets and API-excluding service worker.

Delivered roadmap

Personal widget depth

• Persistent Tower name and URL in Settings with port 5000 as the default Unraid WebUI route.
• Capability coverage expanded from a provider shortlist to every discovered app.
• Native Audiobookshelf, Netdata and PeerTube readers added to the existing provider set.
• Domain profiles for the actual live inventory, including app/API/frontend/worker/database/cache, mail, GPU, download, media, document and custom-project workloads.
• Per-app metric visibility and ordering, including dynamically returned labels and preset/export persistence.
• Per-app value/gauge/progress presentation, statistic limits, line/area/bar charts, legends and selectable 10–60 sample windows.
• Warning rules can target any numeric infrastructure or provider metric and trigger above or below the configured value.
• Capability labels remain app-specific before an endpoint is connected; absent values say Connect data instead of showing unrelated generic Docker labels.
• BlockPilot root/runtime/API/web/Minecraft/ViaProxy, LumaOps, Chimera, OpenRGB, Porkfolio and unnamed legacy workloads now have explicit profiles rather than the last generic service profile.
• Tower exposes selectable/ordered server statistics and charts for containers, images, storage, temperature, parity and UPS.
• A constrained custom contract (summary plus at most twelve stats) for apps without a native read API; endpoint and optional bearer token are configured in Widget Studio and remain server-side.

P0

• Independent widget order with keyboard-accessible move controls.
• Native Unraid adapter for array state, parity, disk/pool usage, temperatures and optional UPS data.
• App-specific Gitea adapter and GET-only metrics bridges for Deluge, JDownloader and Tdarr.
• Explicit freshness states with last-successful provider cache.

P1

• Metric order, primary metric, custom labels and numeric provider/infrastructure warning thresholds.
• Saved, applicable, removable and portable layout presets.
• Safe per-widget refresh cadence between 15 seconds and 5 minutes.
• Direct dashboard edit mode with move, resize and hide controls.
• Provider expansion for Jellyfin, Seerr, Prowlarr, Authentik, NPM, Portainer, Grafana, Prometheus and Nextcloud, plus bridges for qBittorrent, Bazarr and Vaultwarden.

P2

• Selectable line, area and bar charts with at most sixty in-memory points and no monitoring database.
• Installable PWA application shell; API responses are never cached.
• Independent preset export/import.
• Secret-free diagnostics and an authenticated external-access guide.

Remaining environment-dependent opportunities

• Fill provider credentials or bridge URLs in Settings only for services whose protected API data is desired. Safe Docker fallback remains available without them.
• Configure UNRAID_UPS_STATUS_PATH only when a stable read-only APC/UPS status file is available on the host.
• Enable external access only behind authenticated HTTPS; DockDeck deliberately has no built-in user system.
• Persistent long-term history, alerts and notifications remain intentionally outside scope. They would turn DockDeck into a monitoring platform and need separate retention and delivery decisions.

Guardrails

• A widget is app-specific only when its metrics describe the real workload of that app.
• Every external request remains GET-only, time-bounded and server-side.
• Provider failure never blocks navigation and always falls back to safe telemetry.
• Compact panels answer one question, standard panels a few, and wide panels may expose deeper context.
• Layout remains fully usable without drag-and-drop and is tested at both mobile and ultrawide sizes.