Sign in to the console.
First run? If no users exist, the first sign-in bootstraps an admin.
central manager · fail2ban + WAF + DNS
These bans are delivered to every agent on check-in and enforced in each agent's nftables. Removing one un-blocks it fleet-wide on the next check-in.
| IP / CIDR | Reason | Expires | Added |
|---|
| User | Role | Status |
|---|
Must match the console's public domain exactly for passkeys to work.
| Session | Started |
|---|
Domains/apps this agent fronts. The host is matched against the request Host header to select a per-domain (app-specific) WAF overlay — applied in addition to the global rules. Agent-discovered domains appear automatically; you can add, label, and add per-app rules here.
| Host | App label | Upstream (optional) | Notes | App-WAF rules |
|---|
| Time | Actor | Action | Target | Detail |
|---|