Admin Services
This page lists the admin services the team uses, what each one is for, and where to find it. The table records the access controls (login and two-factor authentication) for each service. Update it whenever a service's URL or login setup changes.
| Service | URL | Access Controls |
|---|---|---|
| Vaultwarden | vault.abair.ie | 2FA required for all users |
| Uptime Kuma | status.abair.ie | One shared account (admin) |
| Rocket.Chat | alerts.abair.ie | 2FA optional, set per user |
| Grafana (Corais) | corais.abair.ie | Password only (Gitea OAuth with 2FA to be implemented) |
| Wazuh | SSH tunnel only | One shared admin account, no MFA (accepted risk) |
| Gitea | gitea.abair.ie | 2FA required for all users |
| Dagda | abair.synology.me:5001 | 2FA required for all users |
| API | api.abair.ie | Through auth.abair.ie |
| Auth | auth.abair.ie | Password only |
| Supabase | supabase.com/dashboard/project/pdntukcptgktuzpynlsv | 2FA required for all users |
Vaultwarden
The team's password vault. It holds the credentials, API tokens and secure notes for every other service, and most make targets pull their secrets from it at run time. Vaultwarden is self-hosted and works with the standard Bitwarden apps and the bw CLI. As an admin you invite new team members from its admin panel and manage which collections they can see. It runs on its own isolated server. See Vaultwarden.
Uptime Kuma
Checks that ABAIR's API services and web apps are up, and publishes the public status page at /status/main. Its monitors are set up in its own UI, not in the repo, so an admin adds a monitor here whenever a new service or site goes live. See Monitoring → Uptime Kuma.
Rocket.Chat
The team's chat server, used for internal communication about production services. It receives alerts from Uptime Kuma, and will also receive alerts from Corais (Grafana) and Wazuh in future. Admins manage users and channels under Administration, and should keep an eye on the alert channels. It runs on Secops and updates itself to the latest image every night. See Secops → Rocket.Chat.
Grafana
Dashboards for the metrics (Prometheus) and logs (Loki) collected from every server, including Amergin's GPU services, the API gateway and Púca. Use it to investigate slow or failing services, and use Explore to search logs directly. Dashboards are JSON files in the repo, so change them there rather than in the UI. Accounts are created by hand. See Monitoring → Grafana.
Wazuh
The security monitoring system (SIEM). It collects security events from an agent on each host, and runs vulnerability detection, file-integrity monitoring and configuration checks. Admins use the dashboard to review alerts and see which hosts have outstanding vulnerabilities. See Monitoring → Wazuh.
The dashboard isn't exposed publicly. Reach it through an SSH tunnel:
ssh -L 8443:127.0.0.1:443 secops-host
Then open https://localhost:8443. make wazuh-dashboard runs the same command inside the tooling container, so the tunnel may not reach your own localhost; if it doesn't work, run the ssh command above directly. See Secops → Wazuh.
Gitea
ABAIR's self-hosted Git server, holding the source code and models under the ABAIR organisation, including the infrastructure-automation repo. It also runs Gitea Actions for CI. Admins create user accounts (registration is closed), manage organisation membership and team permissions, and look after the Actions runner. See Secops → Gitea.
Dagda
The lab's Synology NAS, where large files such as Púca's radio and TV recordings are stored. Its admin interface (Synology DSM) is only reachable from the wired TCD network. Admins use it to manage shared folders, user access and storage.
API
The public ABAIR API. /v4/ is served by the API gateway, which checks API keys and credits, applies rate limits and forwards requests to the back-end services; /v3/ is the legacy API. The API docs are at /v4/docs. See API Gateway.
Auth
The single sign-on service for all ABAIR products. Apps send users here to log in, and it hands a Supabase session back to the app. It only handles logging in; each product manages its own roles and permissions. See Authentication.
Supabase
supabase.com/dashboard/project/pdntukcptgktuzpynlsv
The hosted Postgres database and user-account store behind auth.abair.ie and several ABAIR apps. Admins use the dashboard to look up or manage user accounts, inspect and edit tables, and check the database's logs and usage.