Everything the panel can manage.

What it doesShows the live control-plane summary.

How it worksAggregates /health checks, node heartbeats, workload counts, and recent activity.

What it doesTracks platform and node health.

How it worksReads target-health checks, per-node metrics, and the shipped Prometheus, Alertmanager, and Grafana stack.

What it doesSchedules administrative shell tasks.

How it worksForge API runs a seconds-enabled scheduler loaded from PostgreSQL, executes jobs with sh -c in-process, and retries with growing delays.

What it doesProvides host system information and management.

How it worksInspects info, disk, memory, network, and processes, and manages firewall rules; host terminal is privileged — restrict access.

What it doesShows human-readable audit history.

How it worksServes admin activity with stats and export, per-user and per-resource audit logs, and an operations timeline with correlations.

What it doesPlans movement and recovery work.

How it worksThe registered UI is planning metadata; no workload executor is available from this area.

What it doesOrganize infrastructure geography.

How it worksAssociate nodes with regions and locations, with per-region capacity views for placement context.

What it doesRegisters Beacon hosts.

How it worksEnrolls with an id.secret token, ingests 30-second heartbeats with capacity snapshots, and exposes lifecycle, health, drain, and maintenance controls.

What it doesReserves workload ports.

How it worksMaps TCP or UDP assignments to one node; assignments require the same node and the primary cannot be unassigned.

What it doesDefines workload-database provisioning targets.

How it worksRegisters external MySQL or Postgres with TLS mode and max databases, optionally node-scoped, with test-connection before use.

What it doesShares approved host paths with workloads.

How it worksAttaches controlled paths to servers, eggs, or nodes; keep every destination path consistent before migration.

What it doesAdministers host files and shells.

How it worksPanel file operations proxy to Beacon with per-route permissions; SFTP logins take user.server-id form; host terminal is privileged.

What it doesManages game-server instances.

How it worksCombines an egg template, allocation, resource limits, and Beacon runtime action with power, console, schedules, and backups.

What it doesManages container applications, Git sources, and Compose stacks.

How it worksStores GIT, DOCKER_IMAGE, or COMPOSE sources with desired vs observed state; creation folds wizard fields into source_config and deploys via the git engine or Compose path.

What it doesControls accounts, limits, and additional roles.

How it worksApplies admin, user, and custom path-ruled roles plus a per-server subuser permission catalog with invitations.

What it doesCreates user-owned OAuth clients.

How it worksClient-credentials flow over HTTP Basic with server-bound or account scopes and HMAC-signed tokens.

What it doesDefines canonical game-server templates.

How it worksSupplies startup commands, Docker image maps, install scripts, and validated UPPER_SNAKE variables with typed rules.

What it doesProvides reusable application deployment templates.

How it worksFive built-in blueprints (nginx image, node/git, python/git, postgres compose, redis image) prefill the app creation wizard.

What it doesProvisions one-click databases, caches, and queues.

How it worksValidates entries and versions, provisions managed-database or Compose runtimes, tracks instances, injects connection URLs, and prunes backups per retention policy.

What it doesMaintains legacy template compatibility.

How it worksPreserves older template shapes for migration or import.

What it doesDelivers lifecycle events outward.

How it worksSends configured event notifications to external endpoints.

What it doesRegisters plugin manifests.

How it worksStores metadata only; runtime plugin execution is not available.

What it doesConfigures application access and panel behavior.

How it worksIssues prefix-looked-up keys with scopes, expiry, and IP allowlists; panel settings include the 2FA policy.

What it doesInspects containers, images, networks, and volumes.

How it worksFans out over Beacon per node with an explicit node target; single-node calls without one fail closed.

What it doesScores placements and applies scaling policies.

How it worksLeast-loaded, bin-pack, spread, and random strategies over capacity snapshots with hard and soft constraints plus per-node score explanations; vertical and horizontal autoscaler policies evaluate separately.

What it doesRuns rolling, blue-green, and preview delivery flows.

How it worksRecords digest-pinned revisions with gated steps, one active deployment per server, per-PR preview environments, and separate zero-downtime releases.

What it doesDefines failover policy and crash simulation.

How it worksRecords per-node policies, failures, and crashes with metrics; requires a tested multi-node topology and does not establish automatic stateful ownership failover by itself.

What it doesDefines target groups, routes, and traffic policy.

How it worksManages weighted L4 target groups and L7 traffic rules synced to the gateway, with rollback that fails loudly when no backup exists.

What it doesManages custom domains and TLS certificate records.

How it worksVerifies ownership via well-known token with DNS fallback, issues through configurable ACME providers (wildcard needs DNS-01), and tracks ACME and DNS accounts.

What it doesConnects provider accounts and instance provisioning.

How it worksCreates provider-side infrastructure; validate Beacon bootstrap and hardening before production.

What it doesImports and manages Compose files.

How it worksValidates security-sensitive directives server-side, runs live stacks with GitOps (poll, preview, drift, rollback), and keeps legacy projects and per-app compose views separate.

What it doesConfigures identity providers and mutual TLS materials.

How it worksLinks Discord, Steam, and Authentik through short-lived state plus single-use exchange codes; mTLS identifies nodes by certificate with fail-closed revocation.

What it doesConnects Git credentials, providers, and repository sources.

How it worksStores encrypted credentials, validates provider tokens live, links repositories, and installs auto-deploy webhooks on provider-token sources.

What it doesRuns reusable multi-stage delivery flows.

How it worksFreezes run snapshots from definitions, executes pull/build/deploy/compose/health/notify/approval/sleep/script stages, and records logs and capped artifacts.