A deliberately small dashboard
The web admin is embedded in the server binary and served at /admin/. Its scope is intentionally narrow: set up the first administrator, manage the people who can sync, and see basic storage information. There is no file browser and no sprawling settings — that simplicity is the point.
First-run setup
When the server has no administrator yet, opening /admin/ presents a one-time setup screen that creates the first admin account. After that, the same URL shows the normal login.
Logging in and out
Admin sessions use a server-side session cookie that is HttpOnly and SameSite=Strict, protected by a same-origin check. When the request arrives over TLS — directly or through a reverse proxy that sets X-Forwarded-Proto — the cookie is also marked Secure, so it is never sent over plain HTTP; on plain localhost HTTP the admin still works without it. This is entirely separate from the bearer tokens your devices use for the sync API, so an admin session can never be used to sync and vice versa.
A session lapses after a week of inactivity and has to be re-entered; using the admin keeps it alive, so you are never signed out mid-task. Repeated failed logins from one address are throttled. Both are server settings — see Running the server.
Managing users
The Users page lists everyone who can sync — each with how much storage they are using, exact because every user's data lives in its own folder on the server — and lets you:
- Create a user with a username and password.
- Reset a user's password. This also signs out all of their devices, so a password reset genuinely closes an account rather than leaving already-logged-in devices syncing with the old credential. Resetting your own password keeps you signed in to the admin.
- Sign out a user: revoke every device token and admin session they hold, without touching the account or its files. Use it when a device is lost or stolen — the person signs back in with their existing password on the devices they still have.
- Delete a user. Their storage folder is removed with them, so the space is reclaimed immediately. The last remaining administrator cannot be deleted, so you can never lock yourself out.
Each of these asks for confirmation and spells out exactly what will happen first. An administrator is simply a user with the admin flag set; the account that completes first-run setup gets it.
Server settings
The Server page shows storage statistics — number of users, number of stored chunks, total bytes on disk (per-user copies counted, so the figure matches what the storage folders actually occupy), and how much space is left on the disk holding the data directory — and lets you set how many versions to keep per file. It also manages storage locations: besides the primary location inside the data directory, you can add folders on other disks (they must already exist on the server — under Docker, mount them into the container first). New chunks go to the location with the most free space, and a location can be removed only while it holds no data. To retire a drive, move data off copies every chunk to the other locations (verified in transit, deleted at the source only after the copy), with progress shown live — see the self-hosting page for the full replace-a-drive walkthrough. This limit is enforced: the server retains the newest N versions of each file and a background cleanup reclaims storage that no kept version still needs; see Conflicts and versioning.