3.7 KiB
id, title, sidebar_label
| id | title | sidebar_label |
|---|---|---|
| settings | Settings | Settings |
One page, three groups: Access, Monitoring and Integrations. Plus the licence, which has its own page.
Settings require the owner or admin role.
:::info Where instance settings went
Members and single sign-on used to live at /settings/instance. They are now
the Access group at the top of this page splitting "who can sign in" from "how
this instance behaves" produced two half-pages and a nav entry nobody could
distinguish from Settings. The old path still redirects.
:::
Access
Members
Add, remove and re-role the people who can sign in.
| Role | Can |
|---|---|
owner |
Everything |
admin |
Everything except owner-only settings |
member |
Servers, keys, workflows, monitors, secrets, console |
Local members authenticate with email and a bcrypt-hashed password.
Members managed by Vantage HQ
On a cloud instance, people granted access from the HQ portal appear here as read-only rows with a link to the portal.
:::warning HQ-managed users cannot be edited locally
Changing the role of, or deleting, an hq-sourced user is refused with 409.
HQ owns their role, their password and whether they exist at all a local
change would be overwritten by the next sync and would leave two writers for one
password hash. Manage them from People and roles.
:::
Single sign-on (OIDC)
Configured per organisation:
| Field | |
|---|---|
| Issuer | Your provider's issuer URL |
| Client ID | |
| Client secret | Stored AES-256-GCM encrypted |
Sign-in then goes /auth/oidc/start → your provider → /auth/oidc/callback.
Local and OIDC users coexist. Keep at least one local owner: if the provider is misconfigured or unreachable, a local account is the way back in.
Monitoring
- Alert defaults for monitors.
- Notification channels their own page. See Notification channels.
Integrations
Workflow log retention
How long run logs are kept.
| Value | Meaning |
|---|---|
| unset | 30 days |
| a number | that many days |
0 |
forever |
ESO read token
The bearer token External Secrets Operator uses to read secret groups. Shown once, stored as a SHA-256 hash, rotatable. See Secrets.
Licence
/settings/license shows the deployment, tier, server allowance, enabled
features and expiry.
On self-hosted, paste a licence here. This works even while the current licence is expired that is the way out of degraded mode.
On cloud, there is no paste form. The endpoint answers 409 cloud_managed,
because a cloud licence is written by HQ directly. The page links to the portal
instead.
See Licensing and entitlements.
Sessions
Sessions are an opaque token in the km_session cookie, held in Redis with a
24-hour TTL. There is no per-session management UI; restarting Redis signs
everyone out and affects nothing else.
Host and organisation guard
On a multi-tenant deployment, a request to <slug>.vantage.<tld> resolves the
organisation from the slug and rejects a session belonging to a different one.
The label it looks for comes from APP_ROOT_LABEL.
:::warning A wrong APP_ROOT_LABEL disables the guard
It does not fail loudly it simply stops matching, and the host check stops
protecting anything. If you serve the UI on a custom domain, set it to match.
:::