What is rackpad?

This project provides a self-hosted workspace for homelabs and lab environments that unifies physical rack layouts, device inventories, port and cable mapping, logical networking with VLANs and IP address management, operational monitoring via ICMP, TCP, HTTP, and SNMP checks, automated network discovery, virtualization host and container tracking, wireless controller integration, and Markdown-based documentation. It runs as a single Docker container backed by SQLite, includes light and dark themes with 24 language options, uses session authentication with three role levels, and optionally supports OpenID Connect through providers such as Authentik or Keycloak. Integrations with several infrastructure platforms pull live inventory for review before applying changes. Installation uses Docker Compose or a one-line script; a native Proxmox LXC option remains experimental. The codebase is MIT-licensed with stable and beta release channels.

Should you self-host rackpad?

rackpad scores 53/100 on selfhost.directory (how scoring works) and ranks #15 of 34 in Network Management. It has 422 GitHub stars.

It shipped 5 stable releases in the past year. The latest, v1.8.5, came out on 20 October 2026. New versions land roughly every 3 weeks.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is 3x-ui (84/100, 48 757 stars). It scores higher overall, so compare the two before you pick. See rackpad vs 3x-ui side by side.

Features

Audit Log
Compute inventory
Controller integrations
Discovery scanning
Documentation & runbooks
Monitoring & Alerting
Network & IPAM management
OIDC Authentication
Physical infrastructure inventory
Reports & exports
Role-based Access Control
SNMP trap receiverDisabled by default, enabled via SNMP_TRAP_ENABLED=1
Storage topology
Visual topology diagram
WiFi inventory

How to configure rackpad

APP_URLPublic Rackpad origin for OIDC
Public Rackpad origin for OIDC
DISCOVERY_MAC_SCAN_MODEautoMAC discovery mode
MAC discovery mode
values: auto, neighbor, arp-scan, nmap, off
DISCOVERY_SCAN_MAX_ACTIVE2Bound concurrent discovery work
Bound concurrent discovery work
DISCOVERY_SCAN_MAX_ACTIVE_PER_LAB1Max active discovery scans per lab
Max active discovery scans per lab
DISCOVERY_SCAN_MAX_QUEUED32Max queued discovery scans
Max queued discovery scans
DISCOVERY_SCAN_SCHEDULE_INTERVAL_MS60000Background discovery schedule interval in milliseconds
Background discovery schedule interval in milliseconds
DOCKER_STATUS_SYNC_INTERVAL_MS300000Docker status refresh interval in milliseconds
Docker status refresh interval in milliseconds
GITHUB_REPO_OWNERkobii-gitGitHub user/org that owns the GHCR image
GitHub user/org that owns the GHCR image
INTEGRATION_STATUS_SYNC_INTERVAL_MS300000Background connection-status refresh for controller integrations in milliseconds
Background connection-status refresh for controller integrations in milliseconds
MCP_ENABLED0Opt-in MCP inventory proposals on the existing HTTPS endpoint at /api/mcp
Opt-in MCP inventory proposals on the existing HTTPS endpoint at /api/mcp
MONITOR_INTERVAL_MS300000Background health-check loop interval in milliseconds
Background health-check loop interval in milliseconds
OIDC_ADMIN_GROUPSOIDC admin groups (comma-separated)
OIDC admin groups (comma-separated)
OIDC_ADMIN_USERSOIDC admin users (comma-separated emails)
OIDC admin users (comma-separated emails)
OIDC_ALLOWED_DOMAINSOIDC allowed domains
OIDC allowed domains
OIDC_CLIENT_AUTH_METHODclient_secret_basicOIDC client authentication method
OIDC client authentication method
OIDC_CLIENT_IDOIDC client ID
OIDC client ID
OIDC_CLIENT_SECRETOIDC client secret
OIDC client secret
OIDC_DEBUG0OIDC debug mode
OIDC debug mode
OIDC_DEFAULT_ROLEviewerOIDC default role for new users
OIDC default role for new users
OIDC_DISPLAY_NAME_CLAIMnameOIDC display name claim
OIDC display name claim
OIDC_EDITOR_GROUPSOIDC editor groups (comma-separated)
OIDC editor groups (comma-separated)
OIDC_EDITOR_USERSOIDC editor users (comma-separated emails)
OIDC editor users (comma-separated emails)
OIDC_ENABLED0Optional OIDC sign-in enable flag
Optional OIDC sign-in enable flag
OIDC_ISSUER_URLOIDC issuer URL
OIDC issuer URL
OIDC_LABELOIDCOIDC button label
OIDC button label
OIDC_REDIRECT_URIOIDC redirect URI
OIDC redirect URI
OIDC_ROLE_CLAIMgroupsOIDC role claim
OIDC role claim
OIDC_SCOPESopenid profile emailOIDC scopes
OIDC scopes
OIDC_USERNAME_CLAIMpreferred_usernameOIDC username claim
OIDC username claim
OIDC_VIEWER_GROUPSOIDC viewer groups (comma-separated)
OIDC viewer groups (comma-separated)
OIDC_VIEWER_USERSOIDC viewer users (comma-separated emails)
OIDC viewer users (comma-separated emails)
OUI_AUTO_UPDATE1Set to 0 to prevent discovery from refreshing IEEE MAC OUI vendor data
Set to 0 to prevent discovery from refreshing IEEE MAC OUI vendor data
RACKPAD_IMAGEghcr.io/kobii-git/rackpadFull image repository used by the release and host-discovery Compose files
Full image repository used by the release and host-discovery Compose files
RACKPAD_NATIVE_BACKUP_DIROptional operator-mounted directory for native SQLite snapshots
Optional operator-mounted directory for native SQLite snapshots
RACKPAD_PORT3000Port to expose Rackpad on (default: 3000)
Port to expose Rackpad on (default: 3000)
RACKPAD_RATE_LIMIT_DISABLED0API rate limit disable flag
API rate limit disable flag
RACKPAD_RATE_LIMIT_MAX600API rate limit maximum requests
API rate limit maximum requests
RACKPAD_RATE_LIMIT_WINDOW1 minuteAPI rate limit window
API rate limit window
RACKPAD_SECRET_KEYRequired before storing inline SNMP communities, shared SNMP credential secrets, or controller integration credentials
Required before storing inline SNMP communities, shared SNMP credential secrets, or controller integration credentials
RACKPAD_TAGlatestImage tag or release version to pull
Image tag or release version to pull
SNMP_INVENTORY_SYNC0Enable SNMP inventory sync for VLANs, subnets, and DHCP scopes
Enable SNMP inventory sync for VLANs, subnets, and DHCP scopes
SNMP_TRAP_BIND0.0.0.0SNMP trap bind address
SNMP trap bind address
SNMP_TRAP_ENABLED0SNMP trap receiver enable flag
SNMP trap receiver enable flag
SNMP_TRAP_PORT1162SNMP trap receiver port
SNMP trap receiver port
TRUSTED_HOSTSOptional comma-separated hostnames Rackpad should accept in production
Optional comma-separated hostnames Rackpad should accept in production
TRUSTED_ORIGINSOptional comma-separated browser origins Rackpad should trust in production
Optional comma-separated browser origins Rackpad should trust in production
TRUST_PROXY0Comma/space-separated trusted reverse-proxy IPs/CIDRs, or 0 to disable
Comma/space-separated trusted reverse-proxy IPs/CIDRs, or 0 to disable

FAQ

What if I lose the admin password?

Run the Docker CLI recovery command (node dist-server/cli/reset-password.js --username admin) from inside the container to set a new password — no public reset endpoint is exposed.

Does it need internet access?

No. Fonts are self-hosted and there are no outbound calls, so it runs happily air-gapped. You only need network access for the features you point at it — SNMP, discovery scans, imports and alert delivery.

Can I run it behind a reverse proxy?

Yes. Set TRUST_PROXY=1 and configure TRUSTED_HOSTS/TRUSTED_ORIGINS so Rackpad knows its public address. Terminate TLS at your proxy (Caddy, Traefik, nginx, etc.).

How do I update Rackpad?

Pull the new image and recreate the container (docker compose pull && docker compose up -d, or re-run the installer). Your data volume is untouched and migrations run automatically on start.

Where is my data stored?

In a single SQLite database inside the mounted /data volume, on your own machine. There's no cloud component and no telemetry — back up by copying the volume.