Improve ObjectScale on dashboard and document management_clients

- Split ObjectScale into UI, S3 API, and SSH tiles on OPS tab
- Add docs/objectscale.md explaining 0.0.0.0/0 and lab ports
- Dedicated Object Storage row in homepage layout

config/homepage/services.yaml

@@ -81,12 +81,24 @@
         color: "#F46800"
 
 - Infrastructure:
-    - ObjectScale:
+    - ObjectScale UI:
         icon: http://atc-docker01.dell-atc.lan:8080/dell.svg
         href: https://10.0.20.111/
-        description: 10.0.20.111
+        description: ECS admin · https://10.0.20.111 · luna.local
         siteMonitor: https://10.0.20.111/
         color: "#007DB8"
+    - ObjectScale S3:
+        icon: http://atc-docker01.dell-atc.lan:8080/minio.svg
+        href: http://10.0.20.111:9020/
+        description: S3 API :9020 · bucket data · Trino Iceberg + Spark
+        siteMonitor: http://10.0.20.111:9020/
+        color: "#C72C48"
+    - ObjectScale SSH:
+        icon: mdi-console
+        href: https://10.0.20.111/
+        description: admin@atc-objectscale · appliance SSH · see docs/objectscale.md
+        ping: 10.0.20.111
+        color: "#64748b"
     - iDRAC:
         icon: http://atc-docker01.dell-atc.lan:8080/dell.svg
         href: https://10.0.41.102/

config/homepage/settings.yaml

@@ -27,6 +27,10 @@ layout:
     tab: OPS
     style: row
     columns: 4
+  Object Storage:
+    tab: OPS
+    style: row
+    columns: 3
   Infrastructure:
     tab: OPS
     style: row

config/objectscale/README.md

@@ -27,3 +27,21 @@
 ## Storage
 
 Single-node lab deployment; block device `/dev/sdb` in storage pool `sp1` per deploy.yml.
+
+## management_clients: 0.0.0.0/0 explained
+
+**`0.0.0.0/0` = allow management access from ANY IP address** (no whitelist).
+
+- Fine for isolated lab VLANs behind firewall
+- **Not OK** if management port is reachable from office internet or WAN
+
+**Recommended for ATC lab** (tighten when convenient):
+
+```yaml
+management_clients:
+  - 10.0.10.0/24
+  - 10.0.20.0/24
+  - 10.0.21.0/24
+```
+
+See [docs/objectscale.md](../../docs/objectscale.md) for ports and S3 consumers.

docs/objectscale.md

@@ -0,0 +1,57 @@
+# Dell ObjectScale (ECS) — atc-objectscale
+
+| Item | Value |
+|------|-------|
+| Hostname | `luna.local` / `atc-objectscale` |
+| IP | `10.0.20.111` |
+| SSH | `admin@10.0.20.111` (appliance; root via sudo keys) |
+| Management UI | https://10.0.20.111/ (port **443**) |
+| S3 API | http://10.0.20.111:**9020** |
+| Container | `ecs-storageos` (`emccorp/ecs-software`) |
+| Install config | `/opt/emc/ecs-install/deploy.yml` |
+
+## What is `management_clients: 0.0.0.0/0`?
+
+In `deploy.yml`, this setting controls **which client IP addresses may access ECS management ports** (admin API, node management, not the S3 data path).
+
+| Value | Meaning |
+|-------|---------|
+| `0.0.0.0/0` | **Everyone on any network** — entire Internet can reach management ports if routed/firewall allows |
+| `10.0.20.0/24` | Only hosts in `10.0.20.x` subnet |
+| `10.0.21.45` | Only that single host |
+
+**Lab default:** installer often sets `0.0.0.0/0` for convenience (= no IP whitelist).  
+**Production:** restrict to management subnet only, e.g.:
+
+```yaml
+management_clients:
+  - 10.0.10.0/24    # Proxmox / mgmt
+  - 10.0.20.0/24    # storage VLAN
+  - 10.0.21.0/24    # compute VLAN
+```
+
+Changing this requires editing `/opt/emc/ecs-install/deploy.yml` on the appliance and may need an ECS config apply — plan a maintenance window.
+
+## S3 usage in this lab
+
+| Consumer | Bucket / path | Config |
+|----------|---------------|--------|
+| Trino Iceberg | via `iceberg.properties` | `hive.s3.endpoint=http://10.0.20.111:9020` |
+| Spark jobs | bucket `data` | `/opt/spark-jobs/*.py` on lake01 |
+| AWS CLI | `aws --endpoint-url http://10.0.20.111:9020` | keys in Trino catalog (redacted in git) |
+
+## Ports (reference)
+
+| Port | Service |
+|------|---------|
+| 443 | ECS Management UI (HTTPS) |
+| 9020 | S3 API |
+| 4443 | ECS API (nginx) |
+| 9021–9025 | Data head services (internal) |
+
+## Health check
+
+```bash
+curl -sk -o /dev/null -w "%{http_code}\n" https://10.0.20.111/    # expect 200
+curl -s -o /dev/null -w "%{http_code}\n" http://10.0.20.111:9020/  # expect 403 without auth (normal)
+```

scripts/backup/check-services.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Health check all ATC lab HTTP endpoints (from homepage siteMonitors).
+set -u
+
+FAIL=0
+check() {
+  local name="$1" url="$2"
+  local code
+  code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 10 "$url" 2>/dev/null || echo "000")
+  if [[ "$code" =~ ^(200|301|302|303|401|403)$ ]]; then
+    printf "OK   %-28s %s (%s)\n" "$name" "$url" "$code"
+  else
+    printf "FAIL %-28s %s (%s)\n" "$name" "$url" "$code"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+check "Homepage"      "http://atc-docker01.dell-atc.lan/"
+check "RSS proxy"     "http://atc-docker01.dell-atc.lan:8090/health"
+check "Superset"      "http://atc-docker01.dell-atc.lan:8088/health"
+check "Kafka UI"      "http://atc-kafka01.dell-atc.lan:9000/"
+check "Debezium"      "http://atc-lake01.dell-atc.lan:8083/"
+check "Spark"         "http://atc-lake01.dell-atc.lan:8080/"
+check "Trino"         "http://atc-lake01.dell-atc.lan:8089/ui/"
+check "Airflow"       "http://10.0.21.55:8080/"
+check "Kibana"        "http://atc-elastic01.dell-atc.lan:5601/"
+check "Grafana"       "http://atc-grafana.dell-atc.lan:3000/api/health"
+check "Forgejo"       "http://atc-mgt01.dell-atc.lan:3001/"
+check "ObjectScale"   "https://10.0.20.111/"
+check "Proxmox"       "https://10.0.10.65:8006/"
+
+echo "---"
+[[ $FAIL -eq 0 ]] && echo "All checks passed" && exit 0
+echo "$FAIL check(s) failed" && exit 1