mrhid6
11b1936bb2
Docusaurus 3 docs-only site at docsite/, served statically by nginx under /docs on the marketing host. Covers getting started (self-hosted install through first server and first licence), the control plane, Vantage HQ, a reference section and operations. Wired into docker-compose.site.yml as docsite (3005:80) and into the image build workflow, rebuilding on its own directory only. Never added to the self-hosted compose file.
3.4 KiB
id, title, sidebar_label
| id | title | sidebar_label |
|---|---|---|
| settings | Settings | Settings |
One page, three groups: Access, Monitoring and Integrations. Plus the licence, which has its own page.
Settings require the owner or admin role.
:::info Where instance settings went
Members and single sign-on used to live at /settings/instance. They are now
the Access group at the top of this page — splitting "who can sign in" from "how
this instance behaves" produced two half-pages and a nav entry nobody could
distinguish from Settings. The old path still redirects.
:::
Access
Members
Add, remove and re-role the people who can sign in.
| Role | Can |
|---|---|
owner |
Everything |
admin |
Everything except owner-only settings |
member |
Servers, keys, workflows, monitors, secrets, console |
Local members authenticate with email and a bcrypt-hashed password.
Members managed by Vantage HQ
On a cloud instance, people granted access from the HQ portal appear here as read-only rows with a link to the portal.
:::warning HQ-managed users cannot be edited locally
Changing the role of, or deleting, an hq-sourced user is refused with 409.
HQ owns their role, their password and whether they exist at all — a local
change would be overwritten by the next sync and would leave two writers for one
password hash. Manage them from People and roles.
:::
Single sign-on (OIDC)
Configured per organisation:
| Field | |
|---|---|
| Issuer | Your provider's issuer URL |
| Client ID | |
| Client secret | Stored AES-256-GCM encrypted |
Sign-in then goes /auth/oidc/start → your provider → /auth/oidc/callback.
Local and OIDC users coexist. Keep at least one local owner: if the provider is misconfigured or unreachable, a local account is the way back in.
Monitoring
- Alert defaults for monitors.
- Notification channels — their own page. See Notification channels.
Integrations
Workflow log retention
How long run logs are kept.
| Value | Meaning |
|---|---|
| unset | 30 days |
| a number | that many days |
0 |
forever |
ESO read token
The bearer token External Secrets Operator uses to read secret groups. Shown once, stored as a SHA-256 hash, rotatable. See Secrets.
Licence
/settings/license shows the deployment, tier, server allowance, enabled
features and expiry.
On self-hosted, paste a licence here. This works even while the current licence is expired — that is the way out of degraded mode.
On cloud, there is no paste form. The endpoint answers 409 cloud_managed,
because a cloud licence is written by HQ directly. The page links to the portal
instead.
See Licensing and entitlements.
Sessions
Sessions are an opaque token in the km_session cookie, held in Redis with a
24-hour TTL. There is no per-session management UI; restarting Redis signs
everyone out and affects nothing else.
Host and organisation guard
On a multi-tenant deployment, a request to <slug>.vantage.<tld> resolves the
organisation from the slug and rejects a session belonging to a different one.
The label it looks for comes from APP_ROOT_LABEL.
:::warning A wrong APP_ROOT_LABEL disables the guard
It does not fail loudly — it simply stops matching, and the host check stops
protecting anything. If you serve the UI on a custom domain, set it to match.
:::