Admin
The admin section controls access to the built-in admin dashboard. The block is optional; by
default the dashboard has no auth provider and an empty IP allowlist (all IPs permitted).
admin:
auth_provider: client-certs
allowed_ips:
- 10.0.0.0/8
- 192.168.1.10admin01
| Key | Type | Default | Description |
auth_provider | string | none | Name of an auth provider used to protect the dashboard. When unset, the dashboard requires no authentication. |
allowed_ips | array of string | [] | IP allowlist for admin access. Empty means all IPs are allowed. |
Warning
With no auth_provider and an empty allowed_ips, the admin dashboard is reachable without
authentication. Both are enforced: allowed_ips matches the client address against each IP / CIDR
/ range pattern and returns 403 on a miss, and auth_provider requires authentication (static
assets bypass the auth check). Set at least one in any non-local deployment. See
Admin API.
The dashboard is served under the gateway's internal route prefix (see
gateway.internal_route_prefix in Gateway).