39 lines
1.5 KiB
Markdown
39 lines
1.5 KiB
Markdown
# Private admin panel
|
|
|
|
Twungeon can expose a separate server-rendered operator console on the private
|
|
`10.138.0.0/16` network. It is disabled by default and is never served from the
|
|
public application listener.
|
|
|
|
Configure the service environment:
|
|
|
|
```dotenv
|
|
ADMIN_ENABLED=true
|
|
ADMIN_HOST=10.138.4.44
|
|
ADMIN_PORT=3001
|
|
ADMIN_PASSWORD=use-a-unique-random-password-of-at-least-16-characters
|
|
```
|
|
|
|
Restart Twungeon, then open `http://10.138.4.44:3001` from a device on the
|
|
private network. Authenticate with username `admin` and the configured
|
|
password.
|
|
|
|
The process binds the panel to the configured `10.138.x.x` interface and also
|
|
rejects request source addresses outside `10.138.0.0/16`. Keep a host firewall
|
|
rule in place as a third boundary. For UFW, the intended policy is:
|
|
|
|
```bash
|
|
ufw allow from 10.138.0.0/16 to 10.138.4.44 port 3001 proto tcp
|
|
```
|
|
|
|
Do not publish or reverse-proxy this port. Basic authentication protects the
|
|
panel from other private-network users, while per-process form tokens protect
|
|
state-changing requests from cross-site submission. Because the listener uses
|
|
plain HTTP, use it only on the trusted private network; add internal TLS before
|
|
using it across an untrusted or shared network.
|
|
|
|
The panel displays service readiness, OAuth status, the current run and phase,
|
|
all players, and the latest 40 action-log entries. Operators can disconnect a
|
|
player into AutoGuard, remove a character, end the active player phase, or reset
|
|
the run. All mutations pass through the authoritative game core and broadcast
|
|
the resulting snapshot to connected viewers.
|