Administration

Admin console sections

The admin console is at /admin in the dashboard and is available to admin and owner operators. Owners can also create and delete organizations and see all organizations; admins are limited to their own. Operators and viewers cannot access administration.

Section	Purpose
Organizations	Create an organization (slug and name) or delete it. Owners only.
Operators	Create operators, set roles, enable/disable or delete accounts, assign a local Unix user for terminals, and configure command approval categories.
Agents	Machine registration (login, hostname, display name), enrollment tokens, tags, relay, access mode (Managed / Code only), update channels and policies, temporary worker root, Skills, managed tunnels, and the Windows installer link.
NX endpoints	Register NX endpoints (self-hosted only), set update channels and policies. See NX endpoints.
Releases	Signing keys and published agent/NX releases, channel promotion, and revocation.
Audit log	Filtered event history.
Requests	Closed-beta requests from the public form, with statuses new, contacted, accepted, or rejected.

Operators

Creation. In Operators, enter an email, password, and role. Leave Organization empty to use your organization. The same operation is available on the control plane host:

nythronix-server admin create-operator \
  --email new@example.com --password "…" --role admin
nythronix-server admin list operators

Disabling. Use Disable in the list or nythronix-server admin disable operators --id <operator-id>. Both immediately revoke the operator’s sessions and audit admin.operator.disabled.

Password reset. There is no password-change UI; settings tell operators to contact an administrator. Reset through the CLI using the same pepper as the server:

nythronix-server admin \
  --password-pepper "$NYTHRONIX_PASSWORD_PEPPER" \
  reset-password --email admin@example.com --password "$(openssl rand -base64 24)"

Active sessions are revoked, and auth.password_changed is audited with operator_id=cli. In a Compose stack, run it inside the container: docker compose exec control-plane /app/nythronix-server admin ….

Reset agent and NX endpoint passwords with admin reset-agent-password and admin reset-nx-endpoint-password, then update the credentials on the machine.

Caution

Do not lose NYTHRONIX_PASSWORD_PEPPER. Changing it invalidates all password hashes: every operator, agent, and NX endpoint needs a new password.

Publishing agent releases and automatic updates

Releases are signed with Ed25519, and agents verify signatures against pinned public keys, preventing the control plane from substituting a binary.

1. Signing key. On the build machine, run nythronix-release init --out ~/keys/nyx.hex; it prints the public key. In Releases, click Register signing key, enter a name and the public key in hex. Leaving the key field empty generates a key on the server and shows the private part once.

2. Trust on machines. Agents enrolled with enroll receive pinned keys automatically and store them in /etc/nythronix/agent.json. For manual installations, set NYTHRONIX_TRUSTED_KEYS=<hex> in /etc/nythronix-agent/agent.env. Without keys, the agent checks only SHA-256 and logs a warning.

3. Publication. On the build machine, not the control plane, because the build is resource-intensive:

   NYTHRONIX_SERVER=https://cp.example.com \
   NYTHRONIX_ADMIN_EMAIL=admin@example.com NYTHRONIX_ADMIN_PASSWORD=… \
   NYX_SIGN_KEY=~/keys/nyx.hex \
   scripts/release.sh 0.1.5

   The script bumps the version, builds the agent, NX endpoint, and nx CLI, signs them, and publishes to stable. Use CHANNEL for another channel.

4. Channels and policy. Each agent has a Channel (stable / canary) and Update policy: manual (default, acknowledge the offer only), disabled, auto (apply immediately), or auto_idle_only (apply when no sessions are active). Offers arrive on reconnection or through POST /api/admin/agents/<id>/update-trigger. The agent verifies SHA-256 and the signature, restarts into the new binary, and reports endpoint.update.ack in the audit log.

5. Release management. Move releases to stable or canary, or Revoke them to stop offering them. Signing keys can be disabled, preventing new publications with that key from passing validation.

Working with the audit log

Audit log filters by action prefix (such as auth or admin.operator), severity, operator ID, target type, and an RFC3339 date range. Load more retrieves more events. CLI actions use operator_id=cli.

Useful event names:

• auth.login, auth.login_failed, auth.password_changed.
• admin.operator.*, admin.agent.*, admin.enroll_token.*, admin.release.*.
• admin.agent.sudo_policy_set, admin.agent.mcp_config_set: worker root grants and skill changes.
• agent.cmd_exec: every worker command, including its text and approval details.
• agent.mcp.call: every executed MCP tool.
• chat.approval.decided: an operator’s approval decision.
• security.unauthorized_access, security.signature_failure, endpoint.auth_failed: events with severity security.

With JSON storage, the log is audit.jsonl in the state directory and can be read from the host:

jq -c 'select(.severity=="security")' /var/lib/nythronix/audit.jsonl | tail -50

Backup and restore

By default, control plane state consists of files in NYTHRONIX_STATE_DIR (the Compose volume nythronix_state, mounted at /var/lib/nythronix). Back it up as a directory archive:

tar -czf nythronix-state-$(date -u +%Y%m%dT%H%M%S).tgz -C "$NYTHRONIX_STATE_DIR" .

Restore with the control plane stopped:

systemctl stop nythronix-server        # or: docker compose stop control-plane
rm -rf "$NYTHRONIX_STATE_DIR" && mkdir -p "$NYTHRONIX_STATE_DIR"
tar -xzf nythronix-state-XXX.tgz -C "$NYTHRONIX_STATE_DIR"
systemctl start nythronix-server

After restoring, check recent events at /admin/audit and list operators with nythronix-server admin list operators. Keep NYTHRONIX_PASSWORD_PEPPER and the private release signing key with the backup; without them the restored copy is unusable. If NYTHRONIX_STORAGE=postgres is enabled, back up the database with standard Postgres tools such as pg_dump.