A web page for whoever runs the server: what the store holds, the traffic since the last start, and the access settings, which it can also change without a restart. It is off by default.
LFSX_DASHBOARD=true
LFSX_DASHBOARD_REPO=acme/infraIt is served at /-/dashboard/, so https://lfs.example.com/-/dashboard/. No organisation on a
forge can start with -, so the prefix never shadows a repository.
| Variable | Default | Purpose |
|---|---|---|
LFSX_DASHBOARD |
false |
true to serve the dashboard and its API |
LFSX_DASHBOARD_REPO |
none | org/repo whose admins may sign in with their forge token; required unless LFSX_AUTH=disabled |
LFSX_DASHBOARD_FORGE |
the main forge | the named forge LFSX_DASHBOARD_REPO lives on, when it is not the one LFSX_AUTH names |
LFSX_DASHBOARD_DIR |
/usr/share/lfsx/dashboard |
where the built pages are; the image ships them there |
Anyone holding a dashboard token, and the admins of LFSX_DASHBOARD_REPO on the forge.
A dashboard token is issued by the server itself, from where it runs:
lfsx-server dashboard token create alice
lfsx-server dashboard token list
lfsx-server dashboard token revoke alicecreate prints the token once. The store keeps only its SHA-256 hash, in .lfsx/dashboard-tokens.json
on the volume or in the bucket, so every replica accepts it. The command reads the same environment
as the server, so run it inside the container: kubectl exec deploy/lfsx -- lfsx-server dashboard token create alice. Revoking a token ends the sessions it opened.
A forge token works too, for an admin of LFSX_DASHBOARD_REPO. Pick a repository whose admins should
run the server, an infrastructure repository rather than one every contributor administers. It does
not have to be in LFSX_ALLOWED: the dashboard asks the forge about it
directly, so an allow-list cannot lock its admins out.
With LFSX_AUTH=disabled there is no forge to ask, and only dashboard tokens get in.
Signing in trades the token for a session cookie valid 12 hours, HttpOnly and SameSite=Strict,
and Secure when LFSX_PUBLIC_URL is https://. The browser keeps the cookie, never the token.
Sessions are signed with a key the server keeps at .lfsx/session.key and reads once; deleting it
and restarting every replica ends every session. A session opened with a forge token is checked
against the forge on every request, through the same cache as git traffic, so it ends within the
cache lifetime of its owner losing admin rights, and signing out ends it on the server. The server
holds that token in memory for the session's life, so a forge session ends on restart and only
works on the replica that opened it: route dashboard traffic with session affinity when running
several.
That key lives in the store, so whoever can read the bucket can mint sessions and whoever can write
to it can rewrite the saved access settings and the dashboard tokens. Set LFSX_SESSION_KEY_FILE to
a file holding a 32-byte key as 64 hex characters (on Kubernetes, sessionKey.existingSecret) and
the key comes from there instead. access*.json and dashboard-tokens.json are then written signed
with it, and an unsigned or altered copy is ignored: the environment's access settings apply and no
dashboard token is valid. Turning it on therefore retires the files written before: save the access
settings again and reissue the tokens. Turning it off again needs the same, because the signed
files are not plain JSON. Every replica must hold the same key.
Scripts can skip the cookie and send a forge admin's token as Authorization: Bearer on every call.
The overview reads the store's size and object count (on a volume, not a bucket), the requests and refusals counted since the server started, the bytes uploaded and downloaded, the transfers in flight, the uploads by object size and the read cache's hit rate. The figures are this replica's; behind a load balancer each replica counts its own. Prometheus is the place for history and for adding replicas up.
The Settings page edits the three access settings:
- the repositories this server serves,
LFSX_ALLOWED - the repositories whose objects take write access to read,
LFSX_RESTRICTED - anonymous reads,
LFSX_ANONYMOUS_READ
A change applies at once on the replica that saved it. It is written to the store as
.lfsx/access.json, on the volume or in the bucket, and every replica reads it back within 30
seconds. With several forges, a selector picks the forge the settings apply to, and
each named forge keeps its own file, .lfsx/access-<name>.json. A saved value takes precedence
over the environment until Reset to the environment deletes it.
Everything else on the page is read from the environment and takes a restart to change.