Skip to content
LabTether

Settings

LabTether's settings control enrollment, data retention, remote access, metrics export, and runtime behavior. This page covers the settings you are most likely to touch and when to revisit them.

Enrollment

Settings → Enrollment manages how new agents join your hub.

  • Enrollment tokens — generate tokens that agents use to authenticate during install. Tokens can be time-limited or long-lived. Copy the enrollment command from here (or from Add Device) to get a command with the correct hub URL and token baked in.
  • Auto-enrollment — when a valid token is presented, the agent enrolls automatically. Without a token, agents land in the pending list for manual approval.
  • Connection target selection — choose the hub URL that enrollment commands use. Healthy public-cert targets like https://<host>.<tailnet>.ts.net are preferred automatically. If you pick a direct LabTether TLS target, the generated command switches to the pinned bootstrap installer.

Tip: The console remembers your selected connection target and reuses it in future Add Device commands, so you only need to choose once.

Retention

Settings → Retention controls how long LabTether keeps different data types:

  • Logs — agent and system logs
  • Metrics — telemetry data points
  • Audit records — operator action history
  • Recordings — desktop session recordings

Set retention periods based on your storage capacity and compliance needs. Shorter retention saves disk; longer retention gives you more history for troubleshooting and trend analysis.

Tip: Review retention settings weekly for the first month, then monthly once you have a feel for your storage growth. A 50-node homelab with 30-day metric retention uses meaningfully different storage than the same fleet with 90-day retention.

Remote access

LabTether recommends Tailscale as the default remote access path. No public ingress needed, WireGuard encryption, and identity-based ACLs.

Setting up Tailscale HTTPS (recommended):

  1. Install Tailscale on the hub host:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
  1. Run tailscale serve to expose the console over HTTPS:
tailscale serve --bg http://127.0.0.1:3000

This gives you https://<host>.<tailnet>.ts.net as a trusted HTTPS entry point. LabTether detects this and recommends the tailscale serve command at Settings → Tailscale HTTPS.

  1. Tag the hub for ACL control:
sudo tailscale up --advertise-tags=tag:labtether
  1. Add an ACL rule in your Tailscale policy:
{
  "acls": [
    {
      "action": "accept",
      "src": ["group:admins"],
      "dst": ["tag:labtether:*"]
    }
  ]
}

Remote access preferences are available at both Setup → Remote Access and Settings → Tailscale HTTPS. You can save whether Tailscale should stay recommended, switch to a manual/existing TLS path, or be turned off. These controls save preference only — they do not change host Tailscale state.

When Tailscale HTTPS is healthy, LabTether prefers the ts.net URL for enrollment commands, agent discovery, and interactive browser streams (terminal and desktop WebSocket upgrades). Everything stays on the same trusted origin end-to-end.

Warning: Avoid opening direct public ingress as a fallback. Keep LABTETHER_OWNER_TOKEN secret and rotate it if exposed.

Prometheus

Settings → Prometheus Export configures metrics export for scraping or pushing to external systems.

Scrape endpoint (pull)

Toggle /metrics on. When enabled, LabTether serves approximately 41 metrics in Prometheus exposition format. The endpoint is unauthenticated (standard Prometheus pattern).

Add to your prometheus.yml:

scrape_configs:
  - job_name: 'labtether'
    static_configs:
      - targets: ['hub.local:8080']

Remote write (push)

Push metrics to Grafana Cloud, Mimir, Thanos, or any Prometheus remote_write receiver:

  • URL — remote write endpoint (e.g., https://prometheus-prod.grafana.net/api/prom/push)
  • Username/Password — basic auth credentials (password encrypted at rest)
  • Push interval — 10s, 30s, 1m, or 5m
  • Test Connection — validate credentials before enabling

Push is resilient: Postgres buffers metrics, pushes replay from last_pushed_at after restarts, and failed pushes use exponential backoff capped at 5 minutes.

Process metrics (opt-in)

Enable per-process CPU, memory, and RSS metrics. Configure the Top-N count (10, 20, or 50 processes per asset). Adds labtether_process_cpu_percent, labtether_process_memory_percent, and labtether_process_rss_bytes with process_name and process_pid labels.

For the full metric inventory (host, disk, network, container, Proxmox, PBS, service, and reliability metrics), see the Environment Variables reference for Prometheus-related configuration.

Runtime controls

Other settings worth knowing about:

  • Service discovery defaults — fleet-wide defaults for service discovery sources, polling intervals, and scan behavior. Override per-node at Node → Agent Settings → Service Discovery Policy.
  • SSH Hub Key — view or regenerate the hub's Ed25519 SSH key pair used for agent SSH bootstrap and manual device access.
  • Credentials — manage SSH, Telnet, and RDP credential profiles shared across manual devices.

Tip: Review settings weekly during initial setup — especially retention and alert noise. Once your environment stabilizes, a monthly check is enough. Rotate connector credentials and API tokens on a regular schedule, and always rotate immediately after any security incident.