🌐 Cluster Browser

A real Firefox running inside your cluster — accessed through your normal web browser. Reach Proxmox Backup Server, Portainer, Home Assistant, Grafana, the *arr stack, and any other internal web UI without setting up a VPN, exposing ports, or fighting self-signed certificates.

The Problem

Your cluster has dozens of services with web UIs — Portainer on one node, Proxmox Backup Server on another, Home Assistant in an LXC, *arr containers behind WolfNet IPs. From your laptop none of them are reachable: they live on private cluster IPs, or behind WolfNet's encrypted overlay, or on ports you'd rather not expose to the internet.

The traditional fixes — per-user WireGuard configs, SSH tunnels, jump boxes, public reverse proxies with auth — all add friction every time a new service appears.

The Solution

Run the browser inside the cluster. WolfStack spins up a Firefox container (with KasmVNC bundled) on any node, then streams the browser back to your laptop over HTTP. The Firefox is already on the WolfNet, so every internal service is one click away — no VPN, no port forwarding, no certificate warnings.

Key Features

• Real Firefox — full desktop browser (not a screenshot proxy), running linuxserver/firefox with KasmVNC built in. Tabs, bookmarks, extensions, cookies all behave like a normal Firefox.
• Zero VPN required — the container sits on the WolfNet, so it can reach any cluster service. You only need a web browser to reach the container.
• Auto-discovery of internal services — on page load, WolfStack sweeps every WolfNet IP across the cluster for HTTP services on 25+ common ports and identifies what they are: PBS, Plex, Sonarr/Radarr/Lidarr/Prowlarr, Grafana, Portainer, Home Assistant, Proxmox VE, Vaultwarden, Pi-hole, AdGuard, and more.
• Per-user pinned URLs — bookmark your own services. Pins are stored against your login, not the node, so they follow you across browsers and machines and never leak to other operators.
• Cluster-wide discovery — reads routes.json, /etc/wolfnet/config.toml peers, and the local IP, so a single page load surfaces services from every node in the mesh.
• Sticky session modal — first launch pulls the Firefox image. The sticky modal streams docker-pull progress live so you can see what's happening instead of staring at a blank screen for two minutes.
• One container per session — each user gets their own isolated browser. Cookies and history are scoped to the session, not shared across operators.
• Pre-loaded homepage — new sessions open on the discovered-services grid, so the first thing you see is every internal UI you might want to click.

Starting a Session

1. Open Cluster Browser from the sidebar.
2. The discovery sweep fires automatically and the services grid populates as results come in.
3. Click Start Browser. The first time on a node, WolfStack pulls the Firefox image (~600 MB) — a sticky progress modal shows the docker-pull layers as they download. Subsequent launches start in seconds.
4. Once the container is up, the browser opens in a new tab. The Firefox homepage is the discovered-services grid — click any tile to load that service.

Discovered Services

The discovery sweep probes every IP on your WolfNet for common service ports and matches the response signature against a built-in catalogue. Recognised services include:

Category	Detected
Virtualisation	Proxmox VE (8006), Proxmox Backup Server (8007), WolfStack itself (8553), Cockpit (9090)
Containers	Portainer (9443/9000), Yacht, Dockge
Media	Plex (32400), Jellyfin (8096), Emby, Sonarr (8989), Radarr (7878), Lidarr (8686), Prowlarr (9696), Bazarr, Overseerr, Tautulli
Home Automation	Home Assistant (8123), Node-RED (1880), ESPHome, Zigbee2MQTT
Monitoring	Grafana (3000), Prometheus (9090), Uptime Kuma (3001), Netdata (19999)
DNS & Network	Pi-hole, AdGuard Home, Unbound
Storage / Files	Nextcloud, Filebrowser, MinIO, Syncthing
Security	Vaultwarden, Bitwarden
Generic	Anything else returning HTTP/HTTPS — identified by title tag or fallback to "Unknown service on port X"

Discovery runs on demand — only when the page loads — not on a periodic timer. There's no background scanning hammering your services every five minutes.

Pinned URLs

Anything not auto-detected (custom apps on unusual ports, internal admin pages, dashboards) can be pinned manually:

• Click Pin URL, give it a name and the full URL.
• Pins are stored per user — they live in /etc/wolfstack/cluster-services-by-user/<username>.json and never appear on another operator's grid.
• Use Unpin on any of your own pinned tiles to remove it. Auto-discovered services don't have an Unpin button — they vanish on their own when the next sweep can't find them.

How It Works

• Container image: lscr.io/linuxserver/firefox:latest — a maintained Firefox-in-KasmVNC build that runs on x86_64 and arm64.
• Two backends, auto-selected:
  • Docker hosts — docker run with a free host port from 33234–33999, bound to 127.0.0.1.
  • Kubernetes hosts (WolfKube / k3s / RKE2 / microk8s / kubeadm / k0s) — deployed as a Pod + ClusterIP Service in the wolfstack-browser namespace via kubectl apply. WolfStack proxies through the ClusterIP, so there's no host-port allocation and no conflict with kube-proxy. (Added in v20.9.0.)
• Reverse proxied through WolfStack's own port (8553) under /api/cluster-browser/session/<id>/, so the user only ever sees one origin — works behind Cloudflare, corporate proxies, anything that restricts traffic to well-known ports.
• Homepage: the container's default homepage points at /cluster-home on the WolfStack node, an unauthenticated page that renders the discovered-services grid for the user who started the session.
• Persistence: active sessions are tracked in /etc/wolfstack/cluster-browser-sessions.json. A 60-second background reconcile loop prunes ghost sessions whose containers / pods died.
• Cleanup: closing the session stops and removes the container (or deletes the Pod + Service on Kubernetes). No orphan processes, no leaked port mappings.

Use Cases

• Homelab admin from a phone — reach your *arr stack, Home Assistant, and Pi-hole from anywhere with a browser.
• Operating a remote cluster — admin a customer's PBS, Portainer, or Proxmox UI without distributing VPN configs.
• Self-signed cert hell — the in-cluster Firefox can store cert exceptions once and they stick across sessions; your laptop browser doesn't have to learn them.
• Quick service inventory — the discovery sweep doubles as a "what's actually running on this cluster" report when you walk into someone else's setup.
• Locked-down networks — a single inbound HTTPS connection to the WolfStack dashboard gives you full browser access to everything on the cluster's internal network.

Requirements

• Docker or Kubernetes (k3s, RKE2, microk8s, kubeadm, or k0s) on at least one cluster node — WolfStack auto-detects which is present and uses it.
• WolfNet configured (recommended) — without it, discovery falls back to the local node only. With WolfNet, every node's services show up.
• ~600 MB of disk for the Firefox image (one-time pull per node).
• A modern browser on your laptop — the KasmVNC stream uses standard WebSockets.