heather: homepage live container status via docker-socket-proxy

tecnativa/docker-socket-proxy (read-only, CONTAINERS=1, POST=0) exposes
docker API to homepage over compose network. Per-service server/container
in services.yaml → green dot status. statusStyle: dot. Syncthing and
tuwunel-admin are systemd, no container status.

hosts/heather/arion-compose.nix

@@ -29,36 +29,48 @@ let
             icon: forgejo.png
             href: https://git.iscg.dev
             description: Git forge (ssh :2222)
+            server: heather
+            container: forgejo
         - Syncthing:
             icon: syncthing.png
             href: https://sync.iscg.dev
-            description: File sync GUI
+            description: File sync GUI (systemd, not container)
         - tuwunel-admin:
             icon: matrix.png
             href: https://admin.iscg.dev
-            description: Matrix admin room UI
+            description: Matrix admin room UI (systemd, not container)
     - Communication:
         - Tuwunel:
             icon: matrix.png
             href: https://iscg.dev
             description: Matrix homeserver (iscg.dev)
+            server: heather
+            container: tuwunel
         - Cinny:
             icon: cinny.png
             href: https://chat.iscg.dev
             description: Matrix web client
+            server: heather
+            container: cinny
         - Jitsi Meet:
             icon: jitsi-meet.png
             href: https://jitsi.iscg.dev
             description: Video conferencing
+            server: heather
+            container: jitsi-web
     - Productivity:
         - Silverbullet:
             icon: silverbullet.png
             href: https://note.iscg.dev
             description: Notes wiki (herbarium)
+            server: heather
+            container: silverbullet
         - Teable:
             icon: https://teable.iscg.dev/favicon.ico
             href: https://teable.iscg.dev
             description: No-code database
+            server: heather
+            container: teable
   '';
 
   homepageSettingsYaml = pkgs.writeText "homepage-settings.yaml" ''
@@ -74,6 +86,8 @@ let
       searchDescriptions: true
       hideInternetSearch: true
     hideVersion: true
+    # Live container status: green dot for healthy containers (docker-socket-proxy).
+    statusStyle: dot
     # Background photo (mounted ro at /app/public/images/ from /var/lib/homepage-images).
     # cardBlur = frosted-glass / matte semi-transparent service & bookmark cards.
     # NB: cardBlur incompatible with background blur/saturate/brightness filters,
@@ -91,6 +105,15 @@ let
               href: https://git.iscg.dev/mikl/nix-config
   '';
 
+  # Docker integration: live container status (green dot / UP) per service.
+  # docker-socket-proxy exposes read-only /containers/json. homepage talks to it
+  # over the compose network (service name `dockerproxy`), no root on docker.sock.
+  homepageDockerYaml = pkgs.writeText "homepage-docker.yaml" ''
+    heather:
+      host: dockerproxy
+      port: 2375
+  '';
+
 in
 {
   # Обязательное имя проекта (COMPOSE_PROJECT_NAME). Объекты префиксуются им:
@@ -389,6 +412,26 @@ in
       };
     };
 
+    # === Docker socket proxy (read-only, for homepage live container status) ===
+    # tecnativa/docker-socket-proxy: whitelisted read-only subset of Docker API.
+    # CONTAINERS=1 → only /containers/json + /containers/{id}/json. POST=0 →
+    # no mutations. homepage connects over compose network (host: dockerproxy).
+    # Avoids mounting docker.sock directly into homepage (which would need root).
+    dockerproxy = {
+      service.image = "ghcr.io/tecnativa/docker-socket-proxy:latest";
+      service.container_name = "dockerproxy";
+      service.restart = "unless-stopped";
+      service.volumes = [
+        "/var/run/docker.sock:/var/run/docker.sock:ro"
+      ];
+      service.environment = {
+        CONTAINERS = "1";
+        POST = "0";
+        SERVICES = "1";
+        TASKS = "1";
+      };
+    };
+
     # === Homepage (home.iscg.dev) — dashboard со всеми сервисами ===
     # gethomepage/homepage: статичный список ссылок на все сервисы heather.
     # Конфиги (services/settings/bookmarks.yaml) генерятся через pkgs.writeText
@@ -404,6 +447,7 @@ in
         "${homepageServicesYaml}:/app/config/services.yaml:ro"
         "${homepageSettingsYaml}:/app/config/settings.yaml:ro"
         "${homepageBookmarksYaml}:/app/config/bookmarks.yaml:ro"
+        "${homepageDockerYaml}:/app/config/docker.yaml:ro"
         # Background image (photo), outside git (binary). See settings.yaml `background`.
         "/var/lib/homepage-images:/app/public/images:ro"
       ];