Lab Drop

A fork of lab-dash by Anthony Gress, licensed under GPL-3.0. Lab Drop builds on lab-dash with a free-2D drag-and-drop tile layout and a hardened backend (fail-closed secrets, deny-by-default auth on state-changing endpoints, command-injection and path-traversal fixes). All credit for the original project goes to the upstream author and contributors. See LICENSE and the upstream repo for history.

This is an open-source user interface designed to be your internally hosted homepage for your homelab/server.

Features

Lab Drop features a customizable grid layout where you can add various widgets:

• Shortcuts to your tools/services
• System information
• Service health checks
• Custom widgets and more

Customization

You can easily customize your dashboard by:

• Dragging and reordering
• Changing the background image
• Adding custom search providers
• Custom title and tab name

Privacy & Data Control

You have complete control over your data and dashboard configuration.

• All data is stored & used on your own device
• Sensitive data is encrypted locally using AES-256-CBC
• Only administrator accounts can make changes
• Configurations can be easily backed up and restored

Installation

This only requires docker to be installed. Install Docker. Run using docker compose

---
services:
  lab-drop:
    container_name: lab-drop
    image: ghcr.io/plongitudes/lab-drop:latest
    # privileged + network_mode: host are only needed for network-usage stats.
    #privileged: true
    #network_mode: host   # then e.g. `sudo ufw allow 2022/tcp` on Ubuntu
    ports:
      - 2022:2022
    environment:
      # Run the app as this uid:gid (defaults = unraid's nobody:users).
      # On a plain Linux host set your own, e.g. PUID=1000 PGID=1000.
      - PUID=99
      - PGID=100
      # SECRET is optional. If omitted, a random per-install secret is generated
      # and persisted to the config volume (/config/.secret) on first run.
      # Only set it to manage the key yourself (e.g. `openssl rand -base64 32`).
      # - SECRET=CHANGE_ME_TO_A_RANDOM_VALUE
    volumes:
      - ./config:/config
      - ./uploads:/app/public/uploads
      # Optional: read-only /sys for temperature/sensor readings.
      - /sys:/sys:ro
    restart: unless-stopped

Usage

Lab Drop can aslo be accessed from any web browser via

• http://localhost:2022 on the device running the container
• 192.168.x.x:2022 on local network
• www.your-homepage.com using your custom domain name

Lab Drop can also be installed as an app on your computer/phone as a PWA (Progressive Web App):

• Using Google Chrome on Mac/Windows/Android/Linux
• Using Safari on iOS/iPad OS via the share menu > add to homscreen

Important

You should assign a static IP address for you server so any LAN/WAN device can access the Lab Drop instance.

Simply copy/download the docker-compose.yml or add it to an existing docker-compose file.

Running Docker compose file

docker compose up -d

This docker container will restart automatically after reboots unless it was manually stopped. This is designed to be run on your hosting server.

Stopping this docker container

1. Navigate to the directory that this docker compose file is in
2. Run: docker compose down

Local Development

npm install
npm run dev

Updating

Portainer

• Navigate to stacks
• Click on the lab-drop stack
• Click Editor tab at the top
• Click Update the stack
• Enable Re-pull image and redploy toggle
• Click Update

Docker CLI:

• cd /directory_of_compose_yaml
• docker compose down
• docker compose pull
• docker compose up -d

FAQ

Can I import my existing lab-dash config into Lab Drop?

Mostly yes, with two caveats. Lab Drop was forked from lab-dash v1.3.7, so a config exported from lab-dash v1.3.7 or earlier will definitively import. Newer lab-dash releases may include widgets or config fields added after the fork that Lab Drop doesn't support. If you've exported your config from lab-dash, just keep that file on hand and try uploading it as a restore file in lab-drop.

What transfers cleanly: your dashboard layout auto-migrates. Lab Drop replaces lab-dash's grid with a free-2D drag-and-drop engine, and a built-in migration replays your old layout into explicit coordinates — freezing the exact visual arrangement, so the dashboard looks identical after import. Widget definitions, titles, background, and custom search providers come across too.

The credential caveat: service API keys and passwords are stored AES-256-CBC-encrypted with each install's secret key. Lab Drop generates its own key, so by default those encrypted fields won't decrypt on import — they arrive blank and you re-enter each service's credentials once. The import itself succeeds; only the secrets are affected.

To carry credentials over instead of re-entering them, point Lab Drop at the same secret your lab-dash install used, before importing:

1. Find your lab-dash secret:
   • If you set SECRET explicitly (env var / compose), use that value.
   • If lab-dash auto-generated it, it's persisted in the config volume — e.g. docker exec <lab-dash> cat /config/.secret.
2. Set that value as Lab Drop's SECRET (env var or compose environment:) and start the container.
3. Import the config — the encrypted credentials now decrypt correctly.

Exception: if your lab-dash relied on the old built-in default secret, this won't work — Lab Drop deliberately rejects that value (a fail-closed security fix), so you'll need to re-enter credentials in that case.

Note: importing requires an admin login, so set up your Lab Drop admin account first.

How do I recover a lost or forgotten password?

There's only one real route, and it involves having access to the container that's running the dashboard. Accounts live in users.json (wherever the config volume is mounted) with bcrypt-hashed passwords, so a reset involves writing a new hash to users.json.

1. Find the config path on the host (skip if you already know it):

   docker inspect lab-drop --format '{{range .Mounts}}{{.Source}} -> {{.Destination}}{{"\n"}}{{end}}'

   Use the mount ending in -> /config; users.json lives there.

2. Generate a bcrypt hash for the new password (bcrypt ships inside the container):

   docker exec lab-drop node -e "console.log(require('bcrypt').hashSync('YOUR_NEW_PASSWORD', 10))"

   Copy the $2b$10$... string that the above command outputs.

3. Edit users.json in the config dir. Replace the target account's passwordHash with the string from step 2, leaving username and role as-is. If the file is empty ([]), add a full admin record instead:

   [
     { "username": "admin", "passwordHash": "$2b$10$...paste-here...", "refreshTokens": [], "role": "admin" }
   ]

4. Restart and log in:

   docker restart lab-drop

This touches only the user account — your dashboard layout (config.json), encryption key (.secret), and saved service credentials are left untouched.

Contributing

Contributions to Lab Drop are welcome! Please follow these guidelines:

• One feature per PR - Keep pull requests focused on a single feature or fix
• Review AI-generated code - If using AI tools, all code must be thoroughly reviewed and tested before submitting
• Maintain consistency - New code must align with the app's existing style, theme, and overall user experience

Disclaimer

This code is provided for informational and educational purposes only. I am not associated with any of the services/applications mentioned in this project.