Olivetin

OliveTin is a neat web interface that can run your shell scripts and present output. It can also monitor all your containers and servers and so much more. It can also be intergated into Home Assistant!

OliveTin can be installed both containerized or not. Read this page to understand why using a container in this case is overcomplicated and not recomented. I do share this opinion, so i will install it on bare metal as a service.

Given that i use Gentoo, let's go with the tar.gz approach. As general rule, see this page, but i don't like that approach and i prefer to keep this kind of stuff confined into /opt, so keep in mind that the following will be slightly different.

First of all, OliveTin will be installed as root so that it can do stuff on your server. I know this is dangarous and whatnot, but i will not expose it directly to the internet rather keep it protected behind the reverse proxy, with HTTPS, and accessible only after a proper SSO layer of authentication. If you prefer, you can disable access from outside your home as well for added security.

Download the latest relesase from GitHub and decompress it under /opt/olivetin:

mkdir /opt/olivetin
cd /opt/olivetin
wget https://github.com/OliveTin/OliveTin/releases/download/2025.4.22/OliveTin-linux-amd64.tar.gz
tar xvf OliveTin-linux-amd64.tar.gz
mv OliveTin-linux-amd64/* .
rmdir OliveTin-linux-amd64

As for the configuration file, i think it's a good idea to keep it under /etc/OliveTin since we are installing the service as a normal service:

mkdir /etc/OliveTin
mv /opt/olivetin/config.yaml /etc/OliveTin

Please refer to this page for more details on NGINX as a reverse proxy.

This will enable your SSO login protection (see here for more details). Do not use this without SSO!

olivetin.conf

server {
        server_name olivetin.mydomain.com;
        listen 8443 ssl;
        listen 443 ssl;

        access_log /var/log/nginx/olivetin.mydomain.com_access_log main;
        error_log /var/log/nginx/olivetin.mydomain.com_error_log info;
        
        include "com.mydomain/authelia_location.conf";

        location / {
                include "com.mydomain/authelia_proxy.conf";
                include "com.mydomain/authelia_authrequest.conf";
        
                proxy_pass http://localhost:1337/;
                proxy_redirect http://localhost:1337/ http://localhost/OliveTin/;
        }
                
        location /websocket {
                include "com.mydomain/authelia_proxy.conf";
                include "com.mydomain/authelia_authrequest.conf";

                proxy_set_header Upgrade "websocket";
                proxy_set_header Connection "upgrade";
                proxy_pass http://localhost:1337/websocket;
        }
        
        include com.mydomain/certbot.conf;
}

OliveTin can be used on a subpath. While it is not recomended, and i didnt manage (yet) to get it running, here is what the documentation suggest:

olivetin.conf

location /olivetin/ {
        proxy_pass http://localhost:1337/;
        proxy_redirect http://localhost:1337/ http://localhost/olivetin/;
}

location /olivetin/websocket {
        proxy_set_header Upgrade "websocket";
        proxy_set_header Connection "upgrade";
        proxy_pass http://localhost:1337/websocket;
}

Of course, this assume that this is hosted under the main domain, which is already protected by the SSO (see here for more details). Do not run OliveTin unprotected.

In order to let OliveTin work under a sub-path you need to add the following configuration directive to /opt/olivetin/config.yaml:

externalRestAddress: https://internal.mydomain.com/olivetin

OliveTin provides both a SystemD service file and an OpenRC init script. If you, like me, prefeer to use OpenRC, keep in mind that the provided one has some limits like no stdout/err redirect and the binary path should be changed to /opt/olivetin. So i rolled my own, which is pretty easy, and almost identical.

Drop the following to /etc/init.d/olivetin:

olivetin

#!/sbin/openrc-run
# Copyright 1999-2021 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2

description="OliveTin"
pidfile="/run/olivetin.pid"
command_background=true
command="/opt/olivetin/OliveTin"
command_args=""
output_log="/var/log/olivetin/olivetin.log"
output_err="/var/log/olivetin/olivetin.log"

depend() {
        need net
}

and make it executable, add to the runlevel, and start it:

mkdir /var/log/olivetin
chmod +x /etc/init.d/olivetin
rc-update add olivetin default
/etc/init.d/olivetin start

Yes, i prefer to keep it's log separate, so i created also a log folder for it.