start: live server stats over SSE (1 s): CPU, RAM, net, disk IO with 60 s sparklines, per-container CPU/mem/state; one shared netdata poller that runs only while /start is open (owner-only /start/live)

deploy/home-collector/README.md

@@ -13,6 +13,18 @@ every minute (systemd **user** timer `home-collector.timer`) and upserts two row
 The page reads both rows in the same parallel query batch as tasks and links, so a slow
 upstream never delays it; a snapshot older than 3 minutes is shown as stale.
 
+## Live stats (1 s)
+
+On top of the minute snapshot, `/start` opens a Server-Sent Events stream (`/start/live`,
+owner only) while the tab is visible. The app reads netdata on the host
+(`NETDATA_URL`, default `http://100.116.93.104:19999`, the Tailscale-only bind) once a second
+through one shared poller (`src/lib/server/live-stats.ts`): host CPU, RAM, network, disk IO
+and per-container CPU/mem/state/health (netdata's docker and cgroups collectors), so the app
+still never touches the Docker socket. The poller stops 5 s after the last viewer leaves.
+The app container reaches netdata through one ufw rule:
+`ufw allow in on br-c1585f0009ac from 172.26.0.0/16 to 100.116.93.104 port 19999 proto tcp`
+(the `backend` compose network's bridge).
+
 ## Setup
 
 1. A login role that may only upsert snapshots (created once, cluster superuser):