1.5 KiB
Private admin panel
Twungeon can expose a separate server-rendered operator console on the private
10.138.0.0/16 network. It is disabled by default and is never served from the
public application listener.
Configure the service environment:
ADMIN_ENABLED=true
ADMIN_HOST=10.138.4.44
ADMIN_PORT=3001
ADMIN_PASSWORD=use-a-unique-random-password-of-at-least-16-characters
Restart Twungeon, then open http://10.138.4.44:3001 from a device on the
private network. Authenticate with username admin and the configured
password.
The process binds the panel to the configured 10.138.x.x interface and also
rejects request source addresses outside 10.138.0.0/16. Keep a host firewall
rule in place as a third boundary. For UFW, the intended policy is:
ufw allow from 10.138.0.0/16 to 10.138.4.44 port 3001 proto tcp
Do not publish or reverse-proxy this port. Basic authentication protects the panel from other private-network users, while per-process form tokens protect state-changing requests from cross-site submission. Because the listener uses plain HTTP, use it only on the trusted private network; add internal TLS before using it across an untrusted or shared network.
The panel displays service readiness, OAuth status, the current run and phase, all players, and the latest 40 action-log entries. Operators can disconnect a player into AutoGuard, remove a character, end the active player phase, or reset the run. All mutations pass through the authoritative game core and broadcast the resulting snapshot to connected viewers.