Panel hosting

The admin panel is a static single-page application. It has no server of its own and talks only to your API.

Build it

pnpm web:build

The output is a folder of static files. Any static host serves it: an object store with a CDN, a static-site platform, or your own web server.

Point it at your API

The API base URL is a build-time value:

VITE_API_BASE=https://<your-api-host>

No trailing /api — the panel calls the API’s routes at the root. Because it is baked in at build time, changing your API URL means rebuilding the panel.

Note

In local development the panel proxies /api to http://localhost:3000, so you do not need this variable while developing.

Allow the origin on the API

The API only sends CORS headers for origins you list:

WEB_ORIGIN=https://<your-panel-host>

Set it on the API, then restart it. Without this, the browser blocks every request and the panel appears broken while the API is perfectly healthy.

Deployment steps

1. Build with VITE_API_BASE set to your API URL.
2. Upload the output to your static host.
3. Add the panel’s origin to the API’s WEB_ORIGIN and restart the API.
4. Open the panel; it should load /config/status before you even sign in.
5. Sign in with an account created by pnpm users:create.

Routing

The panel is a single-page app that handles two real paths — the emailed verification and password-reset links. Configure your host to serve index.html for unknown paths (the usual SPA fallback), or those links will 404.

Access

Caution

The panel is a private admin tool. It has no public content, and everything it displays comes from an authenticated API. Nothing sensitive is baked into the bundle — the API base URL and, if you enabled Google sign-in, a public OAuth client id.

Even so, put it behind whatever access control your host offers if you would rather not expose a login form to the internet.

Verifying

• The panel loads and shows the sign-in screen.
• Sign-in succeeds and the watch list renders.
• The secrets-status panel shows the integrations you configured.
• A “Run now” on a watch returns an outcome within a reasonable time.

If sign-in fails with a network error but curl against the API works, the cause is almost always WEB_ORIGIN.