Running the service
Everything an operator needs is in one console, rendered by the master itself and calling its own application services directly — it never goes back out over its own HTTP API, which would make the server depend on being able to reach itself.
Users
Every account with its status, device count, session limit, quota and last sign-in. Filter by status or search by address. Activate a pending registration in one click, or create an account outright that comes out already active.
Per-user limits
Device count and concurrent sessions are independent knobs — one limits how many machines may hold credentials, the other how many may be tunnelled at once. Set quota, quota period, rate limit and what happens at the session limit.
Nodes
Approve, drain, disable and revoke. See heartbeat age, CPU, memory, throughput, active sessions against capacity, address-pool utilisation and certificate expiry.
Sessions
Who is connected, on which node, since when, from which address, and how much they have moved. Force a disconnect and the node acts on it within one ten-second reconciliation.
Enrollment keys
Mint a key with a label, a use count and an expiry, optionally pre-authorizing the node it enrolls. Shown once, stored hashed, revocable at any time.
Audit
Every administrative action, newest first, with actor, target, before and after, and source address. Append-only: no updates, no deletes, enforced by database permissions rather than convention.
Nothing works until an administrator says so
A registration creates an account in pending activation. That account can sign in — deliberately, so the person can see why they are stuck and support can see they registered — and every authorization path refuses it. The server list comes back empty with a reason.
That single gate is what makes a public registration form safe to offer at all.
Pending
Can sign in, can connect to nothing.
Active
Normal. The only state that may hold a session.
Suspended
Reversible. Revokes live sessions and refresh tokens immediately.
Disabled
Closed, and retained for audit and usage history.
What a user can do without asking you
An ordinary account signs in to the same place and reaches exactly one page: its own. Every administrative page is gated on a role their cookie simply does not carry.
See their own state
Status, device list, session limit, quota used against quota allowed, and when the period rolls over.
Change their password
Having proved the old one. Audited as a different action from an administrator resetting it — one is hygiene, the other is a takeover.
Turn on two-factor
Per account, not per deployment. An account is asked for a code exactly when it has enrolled one, so nobody is asked who has not.
Registration says nothing about who exists
The form answers identically whether or not the address is already registered, and sign-in answers uniformly until a password is known to be right — only then does it say "suspended" or ask for a code. An account list is not something a stranger should be able to assemble one guess at a time.
Questions about running it?
Tell us what you are trying to operate and we will answer with specifics.