Admin API and console

[admin]
listen = "0.0.0.0:8080"           # file API, file explorer
control_listen = "0.0.0.0:8081"   # admin console, /admin, /metrics, probes
bearer_token = "changez-moi-en-production"

[api]
enabled = true
prefix = "/api/v1/files"

The keys: reference.

One door or two

With the file API, set control_listen: bans, kicks, /metrics and probes stay reachable when transfers saturate the server. The Helm chart does it (service.control.port). probes_listen gives probes and Prometheus a port without TLS or console; without [admin], it is the only HTTP listener (Kubernetes). The console reads its health on /admin/health, served next to it in every case.

Authenticating

Each protected route requires Authorization: Bearer <token>.

An admin role names permissions; an authority that carries its name grants them.

[[admin.roles]]
name = "support"
permissions = ["overview", "sessions", "logs"]

[[admin.roles]]
name = "admins"
permissions = ["overview", "sessions", "kick", "bans", "unban", "config", "logs", "audit", "revoke", "grant"]

The names of admin roles and those of [[roles]] are distinct. An account that carries both kinds opens the console and the file doors; an account that carries only admin roles opens only the console. The authorization service never receives an admin role name, and no admin token opens a file. Failures count in [admin.ban] (Bans).

Sessions

{"total": 1, "offset": 0, "limit": 50, "server_time": "2026-10-07T14:42:10.125Z", "inactivity_timeout_secs": 600,
 "sessions": [{"session_id": "550e8400-e29b-41d4-a716-446655440000", "username": "alice", "remote_addr": "192.168.1.42:54321", "auth_method": "password",
   "mounts": [{"mount_path": "/", "backend": "disque", "home_dir": "/alice", "acl": [{"path": "/", "rights": ["read", "write", "list", "delete", "rename"], "recursive": true}]}],
   "connected_at": "2026-10-07T14:30:00Z", "idle_since": null, "last_sftp_op_at": "2026-10-07T14:41:25.402Z", "last_traffic_at": "2026-10-07T14:42:05.871Z",
   "bytes_read": 1048576, "bytes_written": 524288, "sftp_ops": 412, "has_active_transfer": false, "pod_name": "craft-file-gate-0", "authorities": ["utilisateurs"],
   "client_version": "SSH-2.0-OpenSSH_9.6", "algorithms": {"kex": "curve25519-sha256", "host_key": "ssh-ed25519", "cipher": "chacha20-poly1305@openssh.com",
     "mac_client_to_server": "hmac-sha2-256", "mac_server_to_client": "hmac-sha2-256"}, "user_key": null, "weak_algorithms": [], "type": "sftp"}]}

The list also carries REST transfers (upload, download) in progress for long_request_threshold_secs (30 s by default, 0: all, reloaded at runtime): "type": "rest" (an SFTP session has "sftp"), session_id, username, remote_addr, method (PUT, GET), direction (upload, download), path (the path seen by the user), mounts (mount_path, backend), connected_at (its start), bytes, bytes_read, bytes_written, bytes_per_sec (the average since the start).

Logs and streams

With [log] dir, GET /admin/logs/{app|audit} returns the last entries of the current file, filtered by the server. See Logs.

Parameters: lines (500, 5000 at most; 4 MiB scanned at most), level (ERROR to TRACE), since and until (RFC 3339), q (text, 256 bytes), field=key:value (16 at most). 3 concurrent reads at most.

SSE streams (text/event-stream) follow activity live:

At most 8 open streams, 2 per identity; a stream ends at the exp of its token or on its revocation, at the latest after 15 minutes.

Probes and health

The console

http://serveur:8081/: a page that calls /admin/*. It loads nothing from a third party. Its login: Console sessions.

• Filters and sorts (ip:, user:, role:, backend:, type:) live in the URL: /#sessions?q=user:bob&sort=-last_op. The token never appears there.
• The page and its files (/ui/*) carry a strict CSP (default-src 'none', everything from the same origin, 'wasm-unsafe-eval'); a reverse proxy that sets its own allows at least as much.

What you will see