A deliberately small dashboard
The web admin is embedded in the server binary and served at /admin/. Its scope is intentionally narrow: set up the first administrator, manage the people who can sync, and see basic storage information. There is no file browser and no sprawling settings — that simplicity is the point.
First-run setup
When the server has no administrator yet, opening /admin/ presents a one-time setup screen that creates the first admin account. After that, the same URL shows the normal login.
Logging in and out
Admin sessions use a server-side session cookie that is HttpOnly and SameSite=Strict, protected by a same-origin check. When the request arrives over TLS — directly or through a reverse proxy that sets X-Forwarded-Proto — the cookie is also marked Secure, so it is never sent over plain HTTP; on plain localhost HTTP the admin still works without it. This is entirely separate from the bearer tokens your devices use for the sync API, so an admin session can never be used to sync and vice versa.
A session lapses after a week of inactivity and has to be re-entered; using the admin keeps it alive, so you are never signed out mid-task. Repeated failed logins from one address are throttled. Both are server settings — see Running the server.
Managing users
The Users page lists everyone who can sync — each with how much storage they are using, exact because every user's data lives in its own folder on the server — and lets you:
- Create a user with a username and password.
- Reset a user's password. This also signs out all of their devices, so a password reset genuinely closes an account rather than leaving already-logged-in devices syncing with the old credential. Resetting your own password keeps you signed in to the admin.
- Sign out a user: revoke every device token and admin session they hold, without touching the account or its files. Use it when a device is lost or stolen — the person signs back in with their existing password on the devices they still have.
- Delete a user. Their storage folder is removed with them, so the space is reclaimed immediately. The last remaining administrator cannot be deleted, so you can never lock yourself out.
Each of these asks for confirmation and spells out exactly what will happen first. An administrator is simply a user with the admin flag set; the account that completes first-run setup gets it.
Server settings
The Server page shows storage statistics — number of users, number of stored chunks, total bytes on disk (per-user copies counted, so the figure matches what the storage folders actually occupy), and how much space is left across all storage locations (a disk holding two locations is counted once) — and lets you set how many versions to keep per file. It also manages storage locations: besides the data folder location inside the data directory, you can add folders on other disks (they must already exist on the server — under Docker, mount them into the container first). New chunks go to the location with the most free space — unless you click make primary on one, in which case new chunks fill that location first and only spill elsewhere once it has less than 10 GB free; removing the primary makes the remaining location with the most free space the primary. Any location, the data folder one included, can be removed while it holds no data, as long as another location remains. To retire a drive, move data off copies every chunk to the other locations (verified in transit, deleted at the source only after the copy), with progress shown live — see the self-hosting page for the full replace-a-drive walkthrough. Each location lists the space its data uses and the free space on its disk. Measuring that usage means looking at every stored chunk, which takes a while on a large server, so it is counted in the background: the page opens straight away, a location reads counting… until it has been counted once since the server started, and the figures are recounted after a data move and otherwise at most every five minutes. This limit is enforced: the server retains the newest N versions of each file and a background cleanup reclaims storage that no kept version still needs; see Conflicts and versioning.