Proxy hosts. list/get are read-only. create, update and delete change NPM and need the person's approval (or HOMELAB_PROXY_ALLOW_WRITES=true). dry_run=true previews without asking.

HTTP redirections. list is read-only; create and delete need approval (or ALLOW_WRITES).

SSL certificates. list is read-only. request asks Let's Encrypt for a new certificate (needs approval, or ALLOW_WRITES). Let's Encrypt must be able to reach the domains.

IP access lists. list is read-only. create and delete need approval (or ALLOW_WRITES). allow and deny are comma-separated IPs or CIDRs. Deleting a list affects every proxy host that uses it.

Containers. list, get, logs and stats are read-only. start, stop, restart, remove and prune change state and need the person's approval (or HOMELAB_DOCKER_ALLOW_WRITES=true). remove deletes a container permanently. prune removes ALL stopped containers. container is a name or id (not needed for list or prune).

Images. list is read-only. pull, remove and prune change the host and need approval (or HOMELAB_DOCKER_ALLOW_WRITES=true). remove deletes an image; prune removes dangling and unused images.

Read-only lists: volumes, networks, or Portainer stacks (stacks need the Portainer backend). Pass stack_id with kind=stacks to get that stack's compose file.

Zones for the Cloudflare account (action=list), or one zone exported in BIND format (action=export).

DNS records. list and get are read-only. create, update and delete change the zone and need the person's approval (or HOMELAB_DNS_ALLOW_WRITES=true). create needs name, record_type and content; update needs record_id and any field to change; delete removes the record permanently.

Expose a container: check it runs, add a Cloudflare CNAME to tunnel_hostname (only if given), and add an Nginx Proxy Manager host that forwards domain to forward_host:forward_port. The plan is shown to the person before anything changes.

Reverse expose_service: delete the proxy host for domain (found by name unless proxy_host_id is given) and, if dns_record_id is given, that DNS record. The exact plan is shown to the person first.

One view of a service: the container, the proxy hosts that name the domain, and its DNS records.

Counts across Docker, Nginx Proxy Manager and Cloudflare DNS, in one call.

Check each hop between a public domain and its upstream container, and name the first one that fails with the fix for it. Hops: DNS record, tunnel route (if the tunnel module is on), Nginx Proxy Manager host, TLS certificate (expiry and trust), upstream container running (Docker), upstream port answering, uptime monitor (if on), Authentik login in front (if on). Read-only: it changes nothing.

Which modules are on, which settings are missing, whether writes are pre-approved, and what each tool does. Pass a module name for its full settings list (values are never shown, only whether they are set).

Connectivity and version for every enabled module. A module with missing settings reports the variable it needs.