Overview

platform status

User applications

Technical components

These services are not used directly: they are called by the other applications or by your browser while they run. They must stay exposed for the suite to work — they are not "extra pages".

Applications & public exposures

Everything reachable on the Internet, with its actual role and status.

SSO accounts

Keycloak realm "ceffio" — an account created here works on Nextcloud, Element and Jitsi.

Create an account

UsernameEmailStatusActions

Transcription in Talk

Two steps, in order. Nextcloud cannot start a containerised feature on its own — it needs a deployer first, then the application itself can be installed.

1 Deployer

HaRP runs the containers Nextcloud asks for, speaking the Kubernetes API directly. Nothing below can be installed without it.

2 Live transcription

Transcribes speech live during a call, on this server, with open source speech models. Nothing is sent to a third party.

This is a heavy optional component. It downloads about 9 GB (container and speech models) and needs around 16 GB of RAM for one or two simultaneous calls. Its settings cannot be changed once installed — the app has to be removed and installed again.

Uninstalling removes the app, its workload, its service and its volume — including the downloaded models.

Administration

A single account administers the platform: Nextcloud, the mail server and this console. It is created in the authentication directory (Keycloak), so the same identity works everywhere — and the password rotation propagates from there.

Administrator account

Loading…

Administration interfaces

The console does not reimplement these interfaces: it takes you there. Nextcloud's knows its application catalogue (categories, compatibility, reviews) better than a page rebuilt here.

Password rotation

The password is generated here and then applied to each system. It is shown only once: note it down before leaving this page. No system can read it back afterwards — only an irreversible fingerprint is kept, which is what protects the account.

Rotation log

—

Platform mail

Configuration of mail sending by Nextcloud itself: share invitations, password reset, notifications. This is not your Mail app account — that one reads your own mailboxes; this one is the address the platform writes from.

Sending server

—

TLS certificates

Issued by cert-manager (authority "ceffio-ca"). Expiry is monitored: an expired certificate breaks the HTTPS of the corresponding service.

DomainCertificateStatusExpires

Internal infrastructure

Diagnostic view: pods per Kubernetes layer. The layers are internal to the platform — they do not correspond to reachable sites.

LayerReady podsRestartsDetails

Administration key

The administration key lives in the secrets vault (OpenBao), at entry kv/ceffio/console/api — and nowhere else. It is only stored in your browser.

TOKEN=$(kubectl get secret openbao-installation -n ceffio-vault -o jsonpath='{.data.token}' | base64 -d)
kubectl exec -n ceffio-vault openbao-0 -- \
  sh -c "BAO_ADDR=http://127.0.0.1:8200 BAO_TOKEN='$TOKEN' bao kv get -field=key kv/ceffio/console/api"

The administration token is read from the openbao-installation Secret (namespace ceffio-vault). It is the installation token that administers the vault; the one named openbao-token is reserved for services and does not grant access to this entry.

The token is a Kubernetes Secret, not a file inside the pod: it must be read with kubectl and passed in, as above. Copying it into the pod by hand is what the previous version of this page told you to do, and it fails — nothing creates that file.