Environment health
by group · from live peer/agent handshakesRecent activity
Onboarding
All 3 onboarding paths are live: invite by email, invite by copy-link, or "New user" below for a direct-create password.
| User | Groups | MFA | Status | Created |
|---|
Invites
email + copy-link onboarding — pending, accepted, and revoked| Group | Status | Expires |
|---|
| Group | Environment | Overlay pool | Created |
|---|
| Source group | Target group | Scope | Created |
|---|
| Device | Group | Overlay IP | Handshake | Status |
|---|
| Agent | Kind | Group | Endpoint | Overlay IP | Handshake | Status |
|---|
| Group | Uses | Expires | Status |
|---|
| Hostname | Resolves to | Group |
|---|
| User | Source | Proxy | Started | Duration | Status |
|---|
Audit log search
| Time | User | Event type | Detail | Session |
|---|---|---|---|---|
| Enter a search above, or Search with no filters for the most recent events. | ||||
Certificate authorities
SSH CA rotation
Rotating generates a new signing key immediately — new SSH certs use it right away. The old key stays trusted (dual-trust window) until explicitly revoked below, so already-issued, not-yet-expired certs keep working. An already-running ssh-proxy only picks up the new trusted-key set on its own restart (it fetches once at startup).
| Generation | Status | Created |
|---|
mTLS CA rotation
Same rotation model as the SSH CA, for pg-proxy/k8s-proxy's shared client-cert trust.
| Generation | Status | Created |
|---|
Retention & cleanup
sessions/audit_events are partitioned by month (docs/architecture.md's "Indexing & Partisi") — the worker drops a whole partition once every row in it is past its own table's retention window, and always keeps a few months of future partitions ready so inserts never fail. Runs automatically once a day (cmd/controlplane); the button below runs it immediately instead of waiting.