One table for everything that happens: fleet events

Level AdvancedEstimated time an eveningRead first Homelab 14: automate without a Zapier subscription, with n8n and a decision cascade, Failures that call you: every service reports, every deploy can roll backA word you don't know? Glossary

Each tool has its own log, and none of them answers "what happened last night?". We gave the whole lab one table of events: a time, a source, a kind, a severity, a short payload. Every tool writes there; the dashboard, the phone and the agents read there. One question, one place.

What you get. A single timeline of your lab, readable by people and by agents, fed by signed webhooks and small scripts, protected by database roles that cannot do more than their job.

1. Three roles, three powers

an owner that creates the table;
a writer that can only INSERT: a compromised script cannot erase history;
a reader that can only SELECT: the dashboard and the agents.

Put the table in its own database, and remove the right to connect from everyone else on the automation tool's database. Passwords are generated on the host, in a file only root can read.

2. What writes to it

The forge: one webhook for all repositories, signed with HMAC; the automation checks the signature on the raw body and answers 401 otherwise.
Failed services and health pings (see failures that call you).
A nightly vulnerability scan of every container image with Trivy, in a throwaway container, with a signed report. The first run on 15 images found 124 critical and 2,718 high-severity findings: a list to work through, not a reason to panic.
Deliveries and agent runs: delivered, rolled back, failed.

3. Read it

A Grafana dashboard reads the table with the reader role, listening on the local network only. The phone console shows the last 24 hours by severity, and agents query it to answer "what changed before this broke?".

Traps

On first start, Grafana downloaded 18 plugins from the internet by default. Set GF_PLUGINS_PREINSTALL_DISABLED=true before the first start if you want nothing fetched.

n8n answers its health check before it has registered its webhooks. Wait for the webhook itself, not the health check, before sending the first event.

The forge refuses to send webhooks to a private address until you allow it in its configuration file ([webhook] ALLOWED_HOST_LIST).

Found this useful? Tell us what to measure next.