Overview

platform status

User applications

Technical components

These services are not used directly: they are called by the other applications or by your browser while they run. They must stay exposed for the suite to work — they are not "extra pages".

Applications & public exposures

Everything reachable on the Internet, with its actual role and status.

SSO accounts

Keycloak realm "ceffio" — an account created here works on Nextcloud, Element and Jitsi.

Create an account

UsernameEmailStatusActions

Optional modules

Every optional module of the registry, generated from /api/modules: state, resources, and the install or uninstall action. While an operation runs, this page re-reads the state every 3 seconds and shows the operation journal.

Administration

A single account administers the platform: Nextcloud, the mail server and this console. It is created in the authentication directory (Keycloak), so the same identity works everywhere — and the password rotation propagates from there.

Administrator account

Loading…

Administration interfaces

The console does not reimplement these interfaces: it takes you there. Nextcloud's knows its application catalogue (categories, compatibility, reviews) better than a page rebuilt here.

Password rotation

The password is generated here and then applied to each system. It is shown only once: note it down before leaving this page. No system can read it back afterwards — only an irreversible fingerprint is kept, which is what protects the account.

Rotation log

—

Platform mail

Configuration of mail sending by Nextcloud itself: share invitations, password reset, notifications. This is not your Mail app account — that one reads your own mailboxes; this one is the address the platform writes from.

Sending server

—

TLS certificates

Issued by cert-manager (authority "ceffio-ca"). Expiry is monitored: an expired certificate breaks the HTTPS of the corresponding service.

DomainCertificateStatusExpires

Internal infrastructure

Diagnostic view: pods per Kubernetes layer. The layers are internal to the platform — they do not correspond to reachable sites.

LayerReady podsRestartsDetails

Settings

Settings declared by each module. Secrets are never sent back to this page: a stored secret shows a placeholder, and leaving the field empty keeps it.

Loading…

Administration key

The administration key lives in the secrets vault (OpenBao), at entry kv/ceffio/console/api — and nowhere else. It is only stored in your browser.

TOKEN=$(kubectl get secret openbao-installation -n ceffio-vault -o jsonpath='{.data.token}' | base64 -d)
kubectl exec -n ceffio-vault openbao-0 -- \
  sh -c "BAO_ADDR=http://127.0.0.1:8200 BAO_TOKEN='$TOKEN' bao kv get -field=key kv/ceffio/console/api"

The administration token is read from the openbao-installation Secret (namespace ceffio-vault). It is the installation token that administers the vault; the one named openbao-token is reserved for services and does not grant access to this entry.

The token is a Kubernetes Secret, not a file inside the pod: it must be read with kubectl and passed in, as above. Copying it into the pod by hand is what the previous version of this page told you to do, and it fails — nothing creates that file.