System
Who may sign up, what changed and who changed it, whether it is up, how to take a snapshot, and how to start over.
Seven screens. Two are used weekly, one is used when something is wrong, and two are the ones with a typed confirmation on them.
Security
System → Security is the front door.
| Setting | Options |
|---|---|
| Who may sign up | Anybody, only people who were invited, or only addresses on domains you list |
| Password floor | The shortest password allowed for a new account |
| Session length | How long a signed-in browser stays signed in before it asks again |
| Live sessions | Every session currently open, with the ability to end one or all |
The shipped sign-up policy is friendly, because a fresh installation is usually being tested. A public address should decide deliberately rather than inherit that. Ending a session is immediate: the next request from that browser is refused.
Audit log
System → Audit log is every settings change, with who, when, and which fields moved. It can be searched and
exported as CSV.
Three things it is used for, in order of frequency: answering "who changed this", answering "when did this change", and producing a record for somebody outside the installation who has asked for one. It is append-only: nothing in the panel edits or deletes an entry.
Status & health
System → Status & health is four checks and a history.
| Check | What it means when it is red |
|---|---|
| The app | This Next.js process is not answering |
| The backend | The Convex deployment is unreachable or refusing |
| The gateway | No model key, or the gateway is not answering |
| The mail provider | No mail key, or the provider is refusing mail |
Each check reports how long it took, and each one says which variable it is missing rather than only that it failed. Uptime and incidents are kept beside the checks, so "has this been flaky" is answerable without opening a terminal.
Backups & exports
System → Backups & exports is the screen that makes every other screen safe to use.
Take a snapshot: give it a name, and the settings of the installation are recorded as one document.
Download a snapshot to keep it somewhere that is not this machine.
Restore a snapshot when a change needs undoing, after a typed confirmation.
Set the retention window, which decides how many snapshots are kept.
Two things on this screen lose something, and one of them is the obvious one
Restore replaces the current settings with the snapshot's, so anything changed since it was taken is gone. Removing a snapshot deletes the only copy of whatever it held. Both are confirmations, and neither is a substitute for downloading a copy to another machine.
Onboarding
System → Onboarding is the questionnaire a new account is asked, and the defaults their account starts with.
| Part | What it decides |
|---|---|
| The steps | Which of the four are asked: style, emails, role, size |
| The order | The order they are asked in |
| Skippable | Whether somebody can walk past them |
| The options | The choices offered for roles and company sizes |
| New-account defaults | What a fresh account starts with when a step is skipped |
The first step arrives with an answer already chosen, so somebody who is in a hurry can keep pressing forward and still end up with a working set of preferences.
Setup & licensing
System → Setup & licensing is installation-level housekeeping.
| Part | What it does |
|---|---|
| Tiles | Installed version, channel, and how many administrators exist |
| The first administrator | Creates one if there is none. Needs ADMIN_EMAIL and ADMIN_PASSWORD on the deployment |
| Where newer copies come from | A repository or a manifest address, saved once |
| Channel | Which line of releases this installation follows |
| Check for a newer copy | Checks, and then runs the commands that install one, or shows them |
| The licence record | Who this installation is for, and what it is licensed for |
When ALLOW_SELF_UPDATE is not exactly 1, the screen still checks and still shows the exact commands, and it
does not run them. That is the honest shape for a host with no shell: the panel tells you what to type rather
than pretending it did it.
Advanced
System → Advanced is where an installation is repaired, paused, or started over.
| Part | What it does |
|---|---|
| Maintenance mode | Closes the product for everybody except administrators, with a sentence you write |
| Repairs | Re-runs the checks that put derived data back in step with the settings it came from |
| Rate counters | Clears the counters behind the rate limits, for the case where a test filled them |
| The wipe | Shows, per table, how many rows it would clear, and asks for a typed word before it does |
Maintenance mode is not a sign-out
Administrators still get in, which is the point. If the intent is to stop everybody including yourself, the reverse proxy is where that belongs, not this switch. And the sentence shown to users is worth writing in advance rather than during the incident.
The screens to be careful with, in one list
| Screen | Action | Why it matters |
|---|---|---|
System → Advanced | The wipe | Removes rows. Typed confirmation, and it prints the counts first |
System → Backups | Restore | Replaces current settings with the snapshot's |
System → Backups | Remove a snapshot | Deletes the only copy of what it held |
People → Users | Delete an account | Removes the person, not just the access |
Platform → API & keys | Revoke every key | Every integration using one stops working at once |
Platform → Webhooks | Rotate the signing secret | The old secret stops working immediately |
System → Security | End every other session | Everybody except you is signed out on their next request |
Before a change you are unsure about
- Take a named snapshot in
System → Backups & exports. - Download it somewhere that is not this machine.
- Make the change.
- Check
System → Status & health. - If it was wrong, restore, and read
System → Audit logto see exactly what moved.