Full Beszel Compose file for all cases (Windows/Linux/Cloudflare or Docker Tunnel, etc)

[Chinoman10]

So I've spent a few days troubleshooting why some things just wouldn't work... eventually gave up, and after sleeping on the subject a few times, I eventually got everything working as I wanted.

Here's my current scenario:

• Running Win11 PC as homelab host with no opened NAT ports;
• Docker Desktop is installed with WSLv2 as the engine (so the containers run on Linux, not Windows);
  • For containers that want to use 'host' networking, you need to toggle that in the DD Network settings (took my quite a while to figure this out!);
• On some rare occasions, I want to run Windows-native programs/servers/containers for whichever reasons;
• I have one main (remotely-managed (aka, without a local config file -> I use CF Zero Trust)) 'Cloudflare Tunnel' "server" (cloudflared daemon running the tunnel: tunnel run) which connects to all servers (within docker containers or not!);
  • Took me a while to figure out that as the CF Tunnel is running in a container itself, the service ports it uses are the container's (right-side), and not the hosts! This will be reversed (use the 'host' portion of the mapping), if the tunnel is running natively on Windows as a service;

Now I'll explain how to get it running on different configs:

Dashboard & Agent on the same stack

Note: The 'main tunnel' (which exposes the local ports, or "punches the FW" if you will) isn't running on this stack.

name: beszel

services:
  beszel:
    image: henrygd/beszel:latest
    container_name: beszel
    restart: unless-stopped
    ports:
      - 8090:8090
    volumes:
      - ./beszel_data:/beszel_data
      - ./beszel_socket:/beszel_socket

  # ====================================================
  # To run the full Beszel stack with Docker Compose 👇
  # Note: The 'main' Cloudflared remote-managed tunnel isn't set here.
  # ====================================================

  # Use this agent to use the Docker-native tunnel between the dashboard & agent.
  beszel-agent-docker-tunnel:
    # Same machine (Dashboard + Agent) config
    image: "henrygd/beszel-agent:latest"
    container_name: "beszel-agent"
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./beszel_socket:/beszel_socket
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # monitor other disks / partitions by mounting a folder in /extra-filesystems
      # - /mnt/disk/.beszel:/extra-filesystems/sda1:ro
    environment:
      LISTEN: /beszel_socket/beszel.sock
      # Host/IP as set above ☝️ on the dashboard; select 'Binary'.
      KEY: "ssh-RestOfYourKey"

In this case, the CF Tunnel is only needed if you wish to access your dashboard through the Internet, in which case it's a very simple/easy configuration to map your local 8090 port to https://example.com (your own domain).
If you don't already have a "tunnel server" that you can configure to add the dashboard, you can easily add one to your stack (just paste it below your existing docker-compose.yml, as a third service (dashboard (1), agent (2), tunnel (3)):

  # ====================================================
  # If you do not yet already have a Cloudflared "tunnel server" 👇
  # Typically, in homelab or enterprise scenarios where one machine hosts multiple services,
  # you'll want to use one single tunnel container for most, if not all, services.
  # In such cases, you'll want to create a "cloudflare_tunnel" network,
  # and add your respective containers to it, so that the tunnel can access the containers.
  # Alternatively, you can add the tunnel to all the different container networks as well;
  # (this is also safer, as compromised containers can't communicate with others, since they are on separate networks).
  # ====================================================
  cloudflared-tunnel-server:
    container_name: cloudflared-tunnel
    image: cloudflare/cloudflared
    restart: unless-stopped
    command: tunnel run
    environment:
      - TUNNEL_TOKEN=YOUR_TOKEN

Dashboard on Linux, Agent on Windows, using Cloudflare for both

name: beszel

services:
  beszel:
    # The dashboard is the same as before, just copy it instead (so this paste isn't too long)

  # If you're running a Windows native agent (not WSL) 👇
  cloudflared-windows-agent-tunnel-client:
    container_name: cloudflared-beszel-win-tunnel-client
    image: cloudflare/cloudflared
    restart: unless-stopped
    #command: access ssh --hostname beszel-agent-win.your-domain.com --url 172.25.0.5:22222
    command: access ssh --hostname beszel-agent-win.your-domain.com --url cf-beszel-windows-client:22222
    # On the dashboard, add 'binary' agent, with host and port as set above ☝️
    # No 'depends_on' here, because the Windows agent is not running on this stack.
    environment:
      - TUNNEL_TOKEN=YOUR-TOKEN
    networks:
      default:
        aliases:
          - cf-beszel-windows-client
          - cf-beszel-windows-client.local

• Since agents are running/exposed on SSH and not HTTP, you'll need a tunnel server & client, the cloudflared-windows-agent-tunnel-client service is that tunnel client part.
• To configure the tunnel server, either locally-managed (through config file) or remotely-managed (through CF Zero Trust), you'll want to choose a random public hostname (in this case, it won't really be 'seen' anywhere except the docker compose config), the protocol is SSH, and the port is whatever you picked/used/chose as an argument for the agent.exe.
  • If the CF Tunnel "server" is running itself on a Docker Container, use host.docker.internal as the host instead of localhost or 127.0.0.1, otherwise you can ignore;
• In the "tunnel client" configuration above (in the docker-compose), you'll notice there's a --url command argument: this is what your dashboard will need to connect to the agent; you can use the container's own IP address (which isn't great as it can change), or give it a network alias name (like I've done) instead; the port can be anything as long as it's available on your host (or wherever the dashboard+cf-tunnel-client stack is running).
• Guide for compiling a Windows agent: https://blog.ktz.me/using-beszel-to-monitor-windows/
  • Note: The guide doesn't work at the very last portion where it tells you to add the LISTEN and KEY variables as Environment variables, since the agent can't/doesn't read Windows env. variables; instead, you have to pass them as command arguments instead;
  • Note (2): If you prefer GUIs over command lines, you can simply execute nssm install beszel-agent, and a GUI will appear where you can configure the rest (program path, command arguments, service behaviours, etc.);

Dashboard + Agent exposed via CF Tunnel (instead of Docker); can be separate hosts!

name: beszel

services:
  beszel:
    # The dashboard is the same as before, just copy it instead (so this paste isn't too long)

  # ====================================================
  # To run the full Beszel stack with Docker Compose 👇
  # Note: The 'main' Cloudflared remote-managed tunnel isn't set here.
  # ====================================================

  # ======== Solution #2 (1) ========
  # Use this agent if you want to expose it via a Cloudflare Tunnel
  beszel-agent-cloudflare-tunnel:
    # Docker Agent config that requires Cloudflared tunnelling.
    image: "henrygd/beszel-agent:latest"
    container_name: "beszel-agent-cf"
    restart: unless-stopped
    network_mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      LISTEN: 45876
      KEY: "ssh-..."

  # ======== Solution #2 (2) ========
  # CF Tunnels for non-HTTP traffic (in this case, SSH), require a 'client tunnel' to connect to the remote 'server tunnel' and expose it locally
  cloudflared-docker-agent-tunnel-client:
    container_name: cloudflared-beszel-docker-tunnel-client
    image: cloudflare/cloudflared
    restart: unless-stopped
    #command: access ssh --hostname beszel-agent.your-domain.com --url 172.25.0.3:22222
    command: access ssh --hostname beszel-agent.your-domain.com --url cf-beszel-docker-client:22222
    # On the dashboard, add 'binary' agent, with host and port as set above ☝️
    depends_on:
      - beszel-agent-cloudflare-tunnel
    environment:
      - TUNNEL_TOKEN=YOUR-TOKEN
    networks:
      default:
        aliases:
          - cf-beszel-docker-client
          - cf-beszel-docker-client.local

• Again: note that the Cloudflare Tunnel "server" isn't in this last docker-compose, see the If you do not yet already have a Cloudflared "tunnel server" portion above if you also need that (if you're running this stack on a completely new/empty host with no Cloudflare Tunnels already configured (for other apps/containers).
• You'll probably want to customize the network alias to make it more 'descriptive', since that's what will appear on the dashboard under the "Host's IP/name".
• Added a depends_on so the tunnel 'client' only launches after the agent; on next versions of this file, it would be nice to add a health-check as well, which would check if the chosen agent port is open (use nc (netcat), for example), for example.

[henrygd]

Thanks, lots of useful info here! I'll link this in the docs next time I update them.