Open the dashboard

ReverseDock has a dashboard built into the rdock binary since v0.5. It is served by the admin listener (127.0.0.1:2080 by default), loads nothing from the internet, and works in light and dark mode. It has the login with two-step verification, Overview (requests per second, error rate, p95, healthy backends, a 15-minute traffic chart, top routes and live events), Metrics (charts and per-route and per-service numbers for the last 1, 5 or 15 minutes), Logs (requests as they happen, filtered by route, status, client or text, with pause and download) Routes, Services (with backend drain), Middlewares, Certificates (with renew now), Listeners, Providers, Config (the API’s objects in an editor with completion and checks from the JSON Schema, Validate with the problems and a diff, Apply, the effective configuration, and the history with roll back), Security (two-step verification and recovery codes, users for admins, sessions, API tokens and the audit log) and Settings (theme and the admin settings in use). Every object shows its owner (file, docker, api); objects created in the dashboard belong to the API and are the only ones it changes, through the same validation as a reload.

Open it

The admin listener only listens on the machine itself. From your computer, forward the port over SSH and open the address in your browser:

ssh -L 2080:127.0.0.1:2080 you@your-server

Then go to http://127.0.0.1:2080. On the server itself you can open http://localhost:2080 directly. Use Chrome, Edge or Firefox: the session cookie is marked Secure, which these browsers accept on localhost and 127.0.0.1; Safari does not keep it on plain HTTP. To reach the dashboard on a network address or a domain instead, set admin.tls and admin.allowed_hosts (see Security model).

First run

There is no default account. While no admin exists, every start writes a one-time setup token and logs the file’s path:

sudo cat /var/lib/rdock/admin/bootstrap-token

Enter it on the setup page with a user name and a password of at least 12 characters. The token works once and for 24 hours; restart rdock to get a new one.

Two-step verification

Admins must set up an authenticator app before they can do anything else (admin.mfa: required_for_admins). Scan the QR code with 1Password, Bitwarden, Google Authenticator or a similar app, enter the 6-digit code, and store the ten recovery codes somewhere safe: each lets you log in once if you lose your phone. Later logins ask for a code after the password. Running low? Security → Generate new recovery codes asks for your password and a code, shows ten new codes once and cancels the old ones.

Sessions

A session ends after 30 minutes without activity or 8 hours after login (admin.sessions), and when rdock restarts. Activity means you using the page: an open tab that only refreshes its data on its own still reaches the idle timeout since v0.5. Security lists your sessions; admins see everyone’s and can end any of them.

Your password

Security → Password changes your own password since v0.5: enter the current one and the new one twice. Your other sessions end; the one you are using stays. The same rules apply as for a first password (at least 12 characters, not a common password).

Sensitive changes

Adding or changing users, creating tokens and similar changes need your password (and code) from the last five minutes. When it is older, the dashboard asks for it and then makes the change. API tokens cannot create other tokens since v0.5: a token is made by a person in the dashboard or with rdock tokens create on the server.

Behind a route

If a route of this rdock forwards to the admin listener, every visitor arrives from loopback. Set admin.trust_forwarded_on_loopback: true since v0.5 so rate limits and token networks see real client addresses, and add the domain to admin.allowed_hosts. Leave it off otherwise: with it on, any process on the machine can claim any address.

Turn it off

Set admin.dashboard: false to serve only the admin API, or admin.enabled: false to turn the admin listener off entirely.