OurGrove logo OurGrove
⌂ Overview ✦ AI ⊞ Apps ⛂ Backups ▤ Disks ⚙ Settings
👤 - ▾

Operation Progress

Preparing...

OurGrove is preparing the requested operation.

What is happening

Technical details
Waiting for output...

Changelog

Loading…

Install App

Preparing...

Technical recipe Advanced
Loading template...

Configuration

Loading configuration options...

Checking where this app's bulk files can be stored…

Technical install log
Starting install...

Custom Stack

Compose Template

Configuration

Deploy Log


                            
OurGrove logo OurGrove logo

Welcome to OurGrove

One box. Everything already on it.

Initial Setup Required

Create your first WebUI administrator account. This is separate from your Linux host login.

Find the one-time setup token On a preinstalled OEM machine, first complete the Linux account setup at its screen. On the OurGrove server, sign in with your Linux account and run:
sudo ourgrove-bootstrap-token
The command prints only the token and asks compatible terminals to copy it to your clipboard.
One word, 1–32 letters, numbers, dots, underscores, or hyphens.
Use a unique password of at least 8 characters. A longer phrase is better.

Enter your account email. If email recovery is set up, we’ll send a link that lasts 30 minutes.

Your administrator can check delivery under Settings → Notifications. A host administrator can also use sudo ourgrove-reset-password <username> if email is unavailable.

Choose a new password of at least 8 characters. Your authenticator or recovery code will still be needed when you sign in.

Enter a code from your authenticator app or a recovery code. You can also use a passkey if offered below.

Can’t get a code?

If you lost your phone, use one of the recovery codes you saved when you turned on two-step sign-in. Type it in the box above.

No recovery codes either? Ask another administrator to open Settings → People & Access and choose Help with 2FA for your account.

If you are the only administrator, two-step sign-in can be reset on the server itself: connect a keyboard and screen (or SSH) and run sudo ourgrove-reset-2fa followed by your username. You then sign in with your password and set it up again.

Set up two-factor authentication

Your account needs an authenticator before you can use the dashboard. You can also save recovery codes in case you lose your phone.

What is an authenticator?

It is a free app on your phone that shows a new six-digit code every 30 seconds. After this setup, signing in asks for your password and the code the app is showing, so a stolen password alone is not enough.

Install one first if you do not have it: search your phone’s app store for “authenticator” (Aegis, 2FAS, Google Authenticator and Microsoft Authenticator all work). Many password managers can do the same job.

Open your authenticator app, choose to add an account, and scan this picture with the phone’s camera. Then type the six-digit code the app shows.

Authenticator setup QR code

Cannot scan it? Choose “enter a setup key” in the app and type this:

Save your recovery codes

Keep these somewhere safe. Each code works once if your authenticator is unavailable.


                        
                        
                    

YOUR APPS. YOUR SPACE.

Your Grove.

Checking server…
…

Checking your server…

Gathering app, backup, and resource information.

Why this needs attention
Review bot access

Check which assistants still have an MCP key and whether they need app installation access.

Make your server useful.

CURRENT STATE

At a glance.

Checked with your server

Checking apps, backups, disks, internet, and space…

Your apps

Loading your apps…

Strata AI

Checking the local agent backend…

Output speed—tokens per second · checking metrics
Cache hit rate—last request
GPU load—current hardware
Server RAM—current use

Server notifications

The latest server alerts appear here even when email is off.

Loading notifications…

Older notifications Show earlier alerts

Open to load earlier alerts.

Room to grow.

Server resources
Processor—
Current usage
Memory—
Checking capacity…
Storage—
Checking free space…
Temperature—
Processor temperature

Resource history Charts and refresh settings

CPU Usage

-

Tracks active CPU time across the host from kernel scheduler counters.

Memory Usage

-

Shows resident memory pressure using available-vs-total RAM.

Disk Usage

-

Represents root filesystem occupancy using live statfs values.

CPU Temperature

-

Die temperature read from on-die thermal sensors via hwmon/thermal subsystem.

GPU History

-

This server does not have a GPU that we can read sensors from right now. Install or attach a supported card (Intel Arc, AMD, or NVIDIA) and it will appear here on the next poll.

PEACE OF MIND

A point to come back to.

Checking backups…

Recent activity

Advanced diagnostics API checks, recent probes, and detailed system diagnostics Show details

API Health

Service checks

Service Overview

Each card shows what part of OurGrove it supports, the latest response, and a short trend for this session.

warming up...

Recent Health Checks

last 8 checks

Waiting for first probe cycle...

healthy auth-gated degraded offline not yet updated

System Diagnostics

Open Advanced diagnostics to check this server.

LOCAL MODELS FOR YOUR AGENTS

AI.

Choose a local AI engine

Choose what new agents will use. Existing agents keep their connection until you change it. OurGrove recommends an engine using this server's hardware.

Checking hardware and installed services…

Strata AI

Checking Strata…

Strata needs help starting

Reset to Automatic clears Strata’s saved model choice and lets it choose again for this hardware. Your downloaded model files and connection key stay in place; restarting may download another model. Blank fields alone can reuse Strata’s last saved choice. To pick a smaller model or context yourself, review model settings.

Preparing Strata

Set up Strata

OurGrove guides setup, keeps model files on this server, and shows when Strata is ready to use.

Want an assistant to help with Strata?

Connect a trusted assistant through MCP to check setup and troubleshoot. Server management access lets it install Strata, change model settings, and recover a failed model choice.

Checking your graphics card…

OurGrove will select a compatible graphics engine when it can identify your card and its runtime.

OurGrove checks the available backend before setup.
OurGrove selects an engine when it can identify your card.

Model choice is automatic. Strata chooses a model pack for this hardware on first start; you can change it later.

Change model choice (optional)
Choose a family to see its model sizes, or leave Automatic for Strata's hardware choice.
Choose a family for model sizes. Automatic lets Strata decide.
Longer conversations use more memory and disk. Contexts above 128K require Custom. Hermes may need at least 64K.
Advanced model options
Setup checks

The first start downloads the Strata engine and model files, which can need tens of GB of free disk space. Download and model loading may take a while. OurGrove keeps progress visible if you leave this page.

Strata checks for updates when you ask. Your model files and settings are kept.

Update history

Connect an AI agent

When Strata has loaded a model, connect OpenClaw or Hermes here. OurGrove fills in their private app-network connection.

Waiting for Strata status…

Installed agents

Connecting an installed agent restarts only that app and changes its model provider. Its account, chats, and workspace stay in place.

Connection details for other agents

The full server LAN IP addresses work for agents on your trusted network or VPN.

Use the connection key as a Bearer token. Only an administrator can reveal it, and it disappears from this page after one minute.

Could not check llama.cpp status.
llama.cpp

Checking local AI…

Model download

The server continues downloading if you leave this page. Return to AI to check progress.

Connect an AI agent

Choose a downloaded model. OurGrove fills in the private app-network connection for built-in agents. The small 1B starter checks chat connectivity with OpenClaw; Hermes needs a model with at least 64K native context and a 64K served window.

Turn on llama.cpp and download a model to connect an agent.

Installed agents

Connecting an installed agent restarts only that app and changes its model provider. Its account, chats, and workspace stay in place.

Set up llama.cpp

Turn on llama.cpp and download a model. Automatic compute chooses from the hardware OurGrove detects; CPU only is always available.

Checking available storage before model downloads.

Compute options

Longer windows use more memory. Hermes needs at least 64K and a model that supports it.

Downloaded llama.cpp models

Turn on local AI above, then save and apply to download a model.

Small starter · about 806 MB

Gemma 3 1B. A good first download for testing a local chat connection.

More capable · about 3.4 GB total

Gemma 3 4B can also look at images and follows long conversations (128K context). The download includes its image part; serving 64K context for Hermes also needs more RAM or VRAM.

Download a different GGUF model

Find a GGUF model on Hugging Face. Paste its llama.cpp name, such as owner/repository:Q4_K_M.

On this server

Turn on local AI to manage models.

Try a downloaded model

Ask a short question to check that a model can answer. This test stays on your server and does not save a conversation.

Download a model first to try it here.

Connect another app

Existing agents configured for llama.cpp can continue using the OpenAI-compatible address http://ourgrove-llama:8080/v1 and a connection key. This internal address does not work from another computer. Keep the key private.

Finish OpenClaw browser access

Open the OpenClaw Control UI, enter the token from Apps → Your apps → Show credentials, and leave that browser tab open if it asks for approval. Review the waiting browser below before granting access.

Manage existing Ollama service

Existing apps and Ollama model files are kept. Reconnect an app to Strata before turning its older service off.

Checking older Ollama…

Older apps connect to http://ourgrove-ollama:11434.

TOOLS FOR EVERYDAY LIFE AND WORK

Apps.

Find tools for the things you want to do. Each app runs on your OurGrove server. Read what it does, then choose Set up app to review the options before installing.

More options

Loading installed apps...

No installed apps match your search.Try another word or clear the search.
Recent app activity No recent actions

Looking for low-level container details?

Containers are a low-level view

Containers are the technical building blocks behind your apps. Stopping, restarting, removing, or running shell commands inside a container can change how an app works.

If you're trying to update, remove, or check the logs of an app, Your Apps is probably what you want instead.

Containers (advanced)

Runtime Containers

Access Credentials Actions
Loading containers...
0 selected

Container Logs

Loading logs...

Container shell

Run one command at a time inside this running container. Each command starts a fresh shell; it cannot change the current folder for the next command.

Approve an OpenClaw browser

Open the Control UI and enter its token first. If it shows an approval command, paste it below. You can also list pending devices, check which request belongs to your browser, and approve its ID. OpenClaw pairing help

Commands and output appear here.

Container Details

Inspect

Loading inspect data...

Recent Logs

Loading logs...

Help

What this does

Why it matters

What to do

Confirm

Action details

Full technical details

                        

KEEP WHAT MATTERS

Backups.

Create recovery points, keep nightly copies, and restore with confidence.

[ ... ]
Backup health Checking backup safety...

Looking at local recovery points, schedule, and off-server copies.

Local copy Nightly schedule Off-server copy
Shorten local backup history

SAVED ON THIS SERVER

Recovery points

These archives are stored locally. Download or copy important ones before relying on them for disk-loss recovery.

Saved backups

Restore is always an explicit action and creates a pre-restore safety backup first.

Loading backups...

Recover from another location Find backups on USB, S3 storage, or a NAS

Connect your backup storage in “Schedule and destinations” below, then choose where to look. Backups from your previous server appear here too.

Schedule and destinations Automatic backups and copies off this server
Local recovery points - Checking recovery dates…
Automatic backups Checking... No run recorded
NAS copy Checking... No destination configured Coverage not checked
USB recovery drive Checking... No drive configured Coverage not checked
Object storage copy Checking... No destination configured Coverage not checked
Protection plan

Schedule and destinations

Start with nightly local backups, then choose at least one destination that is physically outside this server.

1. Keep Local Backups

Fast recovery points stored on this server.

days (minimum 3)

Fourteen days is recommended when space allows; three days is the minimum for smaller drives. OurGrove keeps the newest verified recovery point if space runs short. Manual backups remain until you delete them.

Backups you chose to keep Checking manual and pre-restore backups…
Where to keep local backups Checking boot drive and additional storage… Moving backups copies and verifies existing archives before switching storage.

OurGrove leaves out AI model downloads only when it can verify how to get the exact file again. Other models and prepared Strata files remain in the backup. A full restore needs internet access for downloads that were left out.

2. Copy to a USB Recovery Drive

Keep a removable, verified copy that can be stored away from this server.

USB recovery drive Checking for a configured drive...

Backups contain account recovery keys, credentials, and application secrets. This first USB release supports existing ext4 and exFAT partitions; their contents are not encrypted by OurGrove. Keep the drive physically secure. A later release will be able to prepare an encrypted drive.

days (14 recommended; minimum 3)

If the drive is absent, the local backup still succeeds. Connect it before the scheduled time or copy the newest recovery point manually later.

Do not unplug while copying. Wait until OurGrove says “Safe to remove.” A permanently connected USB drive is not a substitute for an off-site copy.

3. Copy to a NAS

Save a copy to a shared folder on another device. Samba and Windows shares use SMB.

NAS connection Checking connected backup storage...

Saving with this unticked disconnects the NAS and forgets its address and login on this server. Copies already on the NAS stay there. To pause only the nightly copies, keep this ticked and untick “Copy nightly backups to NAS”.

days (14 recommended; minimum 3)

Manual backups copy to NAS whenever NAS copies are enabled. SMB credentials are stored root-only on this server. NFS access is controlled by the NAS.

Find or connect a NAS share
Find a NAS on this network

Connect a Samba/SMB share on your local network. OurGrove reconnects it after reboot. NFS is also available for devices that use it.

Select a share first. For Samba/SMB, you can then connect with a username and password or explicitly choose guest access. NFS permissions are managed on the storage device.

Backups hold the passwords and keys for everything on this server and are not encrypted. Use a share with its own login that only you can open, not a guest share everyone on the network can read.

Selected share
Already know the share?

If scanning finds nothing (some NAS boxes block share listing but still allow a direct connection), enter it directly using the host above.

4. Copy to Object Storage

Use MinIO, Backblaze, Wasabi, Amazon S3, or another S3-compatible place.

days (14 recommended; minimum 3)

Use object storage outside this server for real recovery. Local MinIO is allowed for testing, but it will not protect you if this machine or disk fails.

Do not include the bucket in the endpoint. Use HTTP only for trusted local testing.

Changes above do not take effect until they are saved.
How recovery works What is included and how to restore
How recovery works

One complete archive, then copies in safer places

OurGrove builds a rebuild-oriented archive. A local copy is fastest to restore, but only a NAS, object-storage, or downloaded copy protects you when this server's disk fails.

1
CaptureAccounts, server settings, installed apps and their files, databases and settings.
2
AutomateRun nightly and keep a predictable number of recent recovery points.
3
Copy off-serverSend each backup to a NAS or S3-compatible provider, or download it yourself.
4
Recover deliberatelyChoose a full restore, settings only, or app data only. A safety backup is created first.
Import is safe: selecting “Import backup file” only validates the archive and adds it to Recovery Points. Nothing is overwritten until you explicitly choose Restore.
What a backup does not include
  • The operating system itself. Recovery starts from a fresh OurGrove install, then puts your settings and apps back.
  • App programs (Docker images). They are downloaded again from the internet during recovery, so recovery needs a connection.
  • Large AI model files that have a verified public download. The backup records where to get them and checks them after download; your own or private models stay in the backup.
  • Files outside OurGrove, such as folders you created on the server by hand, unless an app or file share uses them.

A backup contains passwords and keys for everything on this server. Treat every copy like a house key.

Restore Backup

Choose what to recover from .

Restoring replaces what is on this server now. Anything added or changed after this recovery point was made will be gone from the parts you restore. OurGrove first saves a safety backup of the current state so you can go back. Your apps stop while the restore runs, and the server needs a restart afterwards.

A backup can only be restored on the OurGrove version that made it. If this server has updated since, OurGrove tells you before changing anything; create a new backup after each update to keep one you can restore.

Checking what this recovery point contains…

On a replacement server, set up healthy app pools in Disks and choose where archived app files go if asked. A restore does not reattach physical pools or the previous local backup location. Reconnect NAS, S3, or USB backup destinations in Backups.

OurGrove creates a safety backup before applying the restore. A settings-only restore protects current server settings; restores that change apps also protect current app data. Docker volumes and shared databases are imported only when the selected restore includes app data saved in this recovery point.

ROOM TO GROW

Disks.

Add internal drives for app files and local backups. Your boot drive is protected.

Checking connected disks…

Space at a glance

See what is writable now

Choose a storage location to see its used and free space. Each location is shown separately so a RAID mirror is not counted twice.

Measuring storage…

Measuring storage…

Connected drives and boot protection Drive details

Storage pools

Where app files can live

Checking existing pools…

Add ZFS storageChoose internal drives and review the plan

ZFS checks data as it is read. A mirror or RAIDZ pool can repair damaged data from another drive. Snapshots help recover older files, and regular scrubs check stored data for errors.

1. What matters most?

2. Select additional internal drives

Checking available drives…

Select safe internal drives, including unused drives with existing partitions or filesystems. Review their contents before confirming the erase. Boot, USB, and in-use drives stay protected.

3. Compare your options

Select a drive to see plans.

Review your pool

ZFS protection and space

Snapshots preserve older versions for an administrator to recover. File restore is not yet guided here. They use space on this same pool, so keep a separate backup too.

Deduplication and special log drives are not automatic options: they need workload-specific planning and can cause memory, performance, or reliability problems.

RAID is not a backup. It can help a pool stay available after a disk fails, but it does not undo deletion, corruption, ransomware, or loss of the whole server. Keep another copy on a NAS, offsite service, or removable backup drive.

Where app files live

Choose a pool for larger files

Checking installed apps…

Moving existing app files can take a long time. OurGrove checks the pool again before starting the app.

Which files belong on a pool?
Silo (MinIO)

Put object data on a large pool, and keep a backup elsewhere.

Nextcloud

Put user files on a large pool. Moving an existing installation needs a guided migration.

WeGotWorkSpace

Put content and uploads on a large pool. Its database still needs a backup.

Local backups

Choose the boot drive or a separate pool for a short local history, then keep another copy off this server.

Local backup archives

Choose where recovery points live

Checking local backup destination…

Local backups can use the boot drive or an additional pool. A separate pool helps if the boot drive fails, but either location can be lost with the server to theft, fire, power damage, or a mistaken deletion. Keep a second copy on a NAS, S3, or a safely stored removable backup drive.

MAKE IT WORK FOR YOU

Settings.

You can manage your own account and bot connection here. Ask an administrator to change server-wide settings.

Server restarted. Now running -. Reload to see the fresh state.

Find a setting

Choose a common task below, or use the categories to find all settings.

Local AI

Choose the model engine shown for this server. None hides the AI tab and its dashboard panel for administrators. It does not uninstall an engine or stop an existing model service.

Select Strata or llama.cpp to open its setup. If you add a GPU later, return here to change your choice.

Storage & cleanupSee what apps use, safely clear old downloads, or restore data from removed apps.

Installed app storage

App files, Docker volumes and downloaded images are shown separately so shared image layers are not mistaken for personal data.

Open this section to measure app storage.

Removed does not have to mean lost.

When you uninstall an app and choose Keep data, OurGrove keeps its server-stored accounts, settings and content, if it has any. Reinstall the same app later to bring that data back. Work saved only in your browser or downloaded to your device is separate.

Full backups made while this data is kept include it. Deleting data here removes the server copy; recovery points already created remain separate until they expire under your backup policy or you delete them.

Data from removed apps

Open this section to check for data from removed apps.

Repair saved settingsCheck that OurGrove can read its own saved settings, and start again with empty ones if a file is damaged.

Use this when a settings page says its saved settings could not be read, or an app cannot be installed because of an earlier interrupted install. Nothing is deleted: a file you set aside is kept on the server under a new name.

Open this section to check.

Appearance

Saved automatically in this browser. These settings only affect the management interface, not your installed apps or other devices.

Use light or dark colours, or switch automatically with your device.

Your device requests reduced motion. Animations and confetti are off while that setting is active; your browser preferences are kept.

Enable interface animations to use confetti.

Time & Region

Loading timezone...

Loading time format...

Security

Checking server storage…

Encryption is best configured while installing the server.

TPM automatic unlock is intended to let encrypted servers install nightly updates and restart unattended. OurGrove only reports readiness for now; it will not change disk-encryption keys from the Web UI until recovery and update behavior is fully validated.

Assistant access

MCP keys, app permissions, bot notifications, and access reviews are together under MCP & Assistants.

AI & integrations / Assistant connections

Connect an assistant (MCP)

Account-scoped, read-only MCP connection. Admin permissions use a separate key.

Checking bot access…

Copy this key now. It is shown only once; leaving MCP settings hides it. Rotating it stops existing bot connections until you update their key.

Client configuration
  1. Choose Streamable HTTP as the MCP transport.
  2. Paste the endpoint above as the server URL.
  3. Add an Authorization header with Bearer, a space, and your access key. Reconnect your assistant after changing keys.

Use HTTPS remotely. The key does not grant dashboard sign-in.

Assistant permissionsApp installation, Strata, and server access

Installation and server management require a separate admin key.

Allow a trusted assistant to install apps

Checking app management…

Installation scope and risks

The admin key can install ordinary catalog apps without another dashboard prompt, downloading third-party software and using storage, memory, CPU, and bandwidth. A faulty or compromised bot could start unintended apps. Apps needing extra host access, a domain, or shared folders still wait for review. Disable access or rotate the key to revoke it.

Copy this admin key now. It is shown only once; leaving MCP settings hides it. Replace the read-only key in your trusted bot's MCP connection with this key, then reconnect the bot. Turning on this switch alone does not change an existing bot connection.

The bot must reconnect with the admin key to receive these tools.


Allow server management

Checking server management…

Server management scope

The admin key can set up Strata, change its model settings, start it, check and install Strata updates, and reconnect configured agents. It can also change Domain & HTTPS settings, run Dynamic DNS updates, and retry certificates. These actions may download large models or interrupt agent requests and public access. Changing this permission rotates the admin key; reconnect the bot. Keys and webhook credentials stay in the dashboard.

Pending app requests

Review requests from any administrator's assistant here, including when your own MCP key is off. Approving starts that app installation; declining tells the assistant it was not approved.

Checking for app requests…

Access reviewConnected accounts and key review

Accounts with assistant access

Review who has connected an assistant. Keys stay private to each account. Disable your own connection above. For another account, Turn off deletes its assistant keys; that person can create new ones later.

Checking connected accounts…

After checking your connected bots, keys, and pending requests, record the review to restart the reminder clock.

Dashboard two-factor policy

Checking policy…

Save policy change

Confirm with your password and a fresh authenticator code or recovery code. Your own 2FA and recovery codes must already be set up.

User Management

Help with 2FA resets two-step sign-in for someone who lost their phone. It needs 2FA on your own account too; manage yours in Account Settings → Security.

Username Email Role Actions
Loading users...

One word; no spaces.

SSH Access

SSH access opens an OS account on this server. Accounts with sudo can administer the whole server. Only add keys you trust.

OS Account Type Comment Fingerprint Actions
Loading SSH access...

Recent Security Events

Sign-in attempts and account changes, with timestamps and source IPs.

TimeActionResourceIP
Open this section to load events.

SMB File Sharing

Checking file sharing... Looking for SMB users and app-created shares.

Use a named SMB user for private folders. Guest access is easier for trusted home networks, but anyone who can reach this server on your home network can open, change and delete files in guest shares, without a password.

SMB user Use Actions
Loading SMB users...

App Shares

Apps can keep local folders without sharing them on the network. To share or stop sharing an installed app’s folders, open Apps → Your apps → Manage app → Manage shared folders. Turning sharing off keeps the files.

Share Folder Access Connection help
Loading shares...

Server IP Address

Choose the connection whose server address you want to change.

Loading network connection…

24 is common for home networks.
Separate up to three addresses with commas.
Address planning

Use an unused LAN address outside the DHCP pool or reserve it in the router. After changing the address, update router forwards and saved connections.

Checking the new connection…

Open the new server address

Changes revert after three minutes unless confirmed at the new address.

Phone pairing QR code and connection address

Scan with the OurGrove Android app. If you opened this dashboard over HTTPS, the code signs the phone in as your web account. On HTTP, the app asks for your credentials. Keep the one-use code private; it refreshes while this section is open.

Loading appliance address…

Open larger
OurGrove phone pairing QR code

Domain & HTTPS

Your domain's DNS records and your router's forwards for ports 80 and 443 must lead to this server. OurGrove then gets and renews the HTTPS certificates for you.

Turning this off stops new public app addresses. Existing public apps and the public dashboard can still be reached through their saved addresses. To stop outside access immediately, remove your router forwards for ports 80 and 443. Dynamic DNS keeps updating while its provider is configured below.

DNS records

DNS records to create

A DNS record tells the internet which address a name leads to. Create these where you manage your domain (the company you bought it from, or your DNS provider). An A record points a name at an IPv4 address such as 203.0.113.10.

Wildcard app subdomains

Create this at your DNS provider so apps can use addresses like nextcloud.example.com.

*.example.com A your public internet address
Base domain

Optional, but useful if you also want the root domain to reach this box.

example.com A your public internet address
Dynamic DNS (advanced: only if your internet address changes and your DNS provider gave you an update address)

Paste the update address your Dynamic DNS provider gave you. OurGrove calls it after saving and every 30 minutes. You can use these placeholders in it: {hostname}, {domain}, {public_ip}.

Not checked
Not configured
Checking...
Automatic (free certificates from Let's Encrypt)
Certificate and DNS diagnostics

These checks see this server and public DNS. They cannot prove that your router forwards outside traffic correctly. Test an app address from a phone with Wi-Fi off before sharing it.

Public dashboard access

Reach this dashboard at an HTTPS address under your domain. Your existing local address stays available.

After enabling it, keep this local page open. On a phone with Wi-Fi off, open the HTTPS address below and sign in with your existing OurGrove account. If the browser warns about its certificate, return here and run HTTPS Checks. The local and public addresses may ask you to sign in separately.

Checking public dashboard access…

DNS and router forwarding must reach this server. OurGrove will set up the HTTPS route.

Bot notification feedPublishing and review reminders

Publish new server alerts to administrator MCP keys. Older alerts remain private.

Feed scope and polling

An administrator's read-only or install key can read alert titles, summaries, and next steps through list_notifications or the HTTPS feed. Non-admin keys cannot. Alerts can reveal app names, security events, and server problems. Publishing is independent of personal email choices. Configure the bot's own schedule; OurGrove does not message it.

For HTTPS polling, send Authorization: Bearer <MCP key>. Save next_after_id and pass it as after_id on the next check.

days

Reminder appears on Overview; opted-in admins also receive email.

Email Notifications

Alert choices are personal.Each administrator independently chooses which messages go to their account email address.
Advanced email settings
Optional. Used only when no eligible administrator is opted in to an alert.
Required for email password recovery. Use the HTTPS address people use to open this dashboard.
Your account email is suggested when available. To check password recovery delivery, send to that inbox. A successful test means the mail server accepted the message, not that the inbox received it.
Save changes first. Send Test uses saved settings and does not save this form.

Loading email settings…

Password recovery emailChecking setup and recent delivery…

Android phone notifications

Get server alerts on your phone through the OurGrove Android app. Each administrator connects their own phone.

Checking phone connections…
  1. Open this dashboard through HTTPS, then go to Network & remote access → Phone pairing and scan the QR code with the OurGrove app.
  2. Install ntfy on the phone, connect it to your ntfy HTTPS service, and choose it as the UnifiedPush distributor.
  3. Open Server alerts in the OurGrove app, enable Phone notifications, then choose Send test push.
Private ntfy service setup

Give a dedicated ntfy user read access to up* topics and allow anonymous write access to up* so OurGrove can publish encrypted wake-ups. Alert details are fetched directly from this server. Android checks for missed alerts when battery scheduling allows.

System Information

-
-
-

Homepage Dashboard

Install Homepage from the app catalog, then open it from its installed app card.

Updates

-
Checking the current update channel…

Current
-
-
Update Available
Update source needs attention

Credentials are optional for public images and are stored root-only for bootc.

OS update downloaded, restart to finish

The new OurGrove image is downloaded and prepared. Reboot when you are ready to start using it; apps will briefly stop while the server restarts.

Update Output

                            
Last update log
Open Maintenance to load the update log.

Network Connection

Small connection checks run once a minute against Cloudflare and Google. Each check opens a fresh connection to catch intermittent failures. Results describe this server's internet access, not the router's internal health or a VPN client's connection.

The longer test runs 12 rounds and can take up to two minutes. Reports include timings and DNS/HTTPS failures, without response contents.

Loading network checks…

Disk Health

Loading disk health…

Loading disk health…

Support & Diagnostics

One bundle for supportIncludes logs, system and Docker state, and limited app and settings summaries.

Logs may contain private details or secrets written by apps. Review the bundle and remove sensitive details before sharing it.

Host Machine Logs
Host logs not loaded yet.
OurGrove Service Logs
Service logs not loaded yet.
Docker Logs
Docker logs not loaded yet.

Network Speed Test

Measure upload, download, and ping from this appliance to the public internet.Uses the speedtest-cli package; results measure the path from the host's outbound interface, not from your browser.
Click Run Speedtest to measure your connection.

Machine deploy key

Give this public key to your repository maintainer if your OurGrove machine needs access to a private Git repository. Ask them to add it as a read-only deploy key. This key does not let someone sign in to your machine.

Server public key
Loading...

Auto-update schedule

When off, new images are downloaded and staged automatically. Reboot when you are ready to use one.

Minimum 1, maximum 168 (one week). Used when no maintenance window is set. Without a window, an update can restart the server at any time of day, so set one below if that would interrupt you.

Check for and download updates only in this window. If automatic application is on, the restart also happens here, so pick a time nobody is using the server. The suggested window starts after the nightly backup, which cannot overlap it.

Loading…

Power Management

App Recovery CentreCheck app health, dependencies, resources, and backup readiness when needed.

Review app health, dependencies, resource pressure, saved-setting migrations, and backup readiness.

Open this section to check app recovery readiness.

Help with two-factor authentication

First, verify their identity outside OurGrove. This removes their authenticator and recovery codes and signs out their sessions. You need your own 2FA to confirm. An email notice is attempted if mail is configured.

Account Settings

Loading account settings…

Update the username you sign in with and the email address tied to this account. Administrator accounts can receive opted-in server alerts here.

One word, 1–32 letters, numbers, dots, underscores, or hyphens.

Password

Use a unique password of at least 8 characters. Changing it signs out other sessions.

Two-Factor Authentication

Checking status...

Scan this QR code with an authenticator app, then enter the six-digit code it shows.

Authenticator setup QR code

Cannot scan it? Choose “enter a setup key” in the app and type this:

0 unused recovery codes remain.

To replace your recovery codes or turn two-factor authentication off, confirm with your password and a current code.

Save these recovery codes now. Each works once and they will not be shown again.

                                        
                                        
                                    

Passkeys and security keys

Checking passkeys…

Add a passkey or YubiKey

Use the dashboard HTTPS domain and a fresh authenticator code. Your authenticator and recovery codes stay available as a fallback.

These choices belong only to this account. Messages are sent to your account email.

See what an alert looks likeA preview goes to your saved account email, even if alerts are paused. Save a new email address first. It does not change anyone’s choices.

OurGrove loading version...

⏻

Shutting down...

The system is powering off. Please wait.