A unified monitoring dashboard that consolidates Prometheus, Alertmanager, Loki, Wazuh, and CrowdSec into one interface. Built for homelab infrastructure.
Stop switching between Grafana, the Wazuh dashboard, and CrowdSec's CLI. Helix surfaces everything in one place with real-time updates.
D3 force-directed topology graph of your service mesh, active alerts from Prometheus and Wazuh, system metric sparklines, and a live event timeline.
Unified alert table across Prometheus and Wazuh with search, source and severity filtering, detail expansion, and the ability to create Alertmanager silences directly.
Wazuh agent inventory with status and scan triggers, HIDS alerts, file integrity monitoring events, and CrowdSec ban decisions with confirmation-gated unbanning.
Time-series charts for CPU, memory, disk, and network. Per-container resource usage and network probe results backed by Prometheus range queries.
Loki log viewer with container filtering, text search, and virtualised scrolling. Supports both polling and live tail mode via Server-Sent Events.
Alertmanager and Wazuh push webhooks into an in-memory event bus. Browsers subscribe over SSE. UI refreshes instantly without waiting for the next poll cycle.
Helix runs as a thin proxy layer with no persistent state. Next.js API routes handle authentication, input validation, and response caching between the browser and each monitoring backend.
API routes handle auth, input validation, and response caching. No direct client-to-backend communication.
Webhooks from Alertmanager and Wazuh feed an in-memory pub/sub. Browsers subscribe over SSE for instant updates.
Server-side cache with 50 entries, 5-second TTL, and 50MB cap. Reduces redundant upstream calls across connected clients.
Capped at 512MB. Typical usage sits around 150-250MB. Runs on Node.js 20 Alpine in production.
Production-grade tooling for a responsive, real-time monitoring experience.
Helix assumes your backend services (Prometheus, Alertmanager, Loki, Wazuh, CrowdSec) are already running.
Copy the example environment file and fill in your Wazuh passwords and webhook secret.
git clone https://github.com/asharahmed/helix.git cd helix cp .env.example .env.local
Install dependencies and start the dev server. Backend services must be reachable from your machine.
npm install npm run dev # Available at http://localhost:3000
Deploy with Docker Compose. The container exposes no ports directly. Caddy reaches it over the Docker network.
docker compose -f docker-compose.yml -f docker-compose.helix.yml up -d