Back office in CÚL

Léigh Dom's back office is a page in the CÚL staff portal: Content → Léigh Dom (cul.abair.ie/leigh-dom). It shows who uses Léigh Dom, how much each account stores against its quota, and how full the disk is, and it is where staff change tiers and delete data. It also e-mails when the disk crosses 80%.

Who can open it

Staff with lei_admin (Léigh Dom Admin, granted in CÚL → User Management), and CÚL admins, who see every tool. The column comes from file-tts-tool/supabase/0004_lei_admin.sql. See Authorization & Permissions.

What is on the page

Part	Shows
Tiles	Disk used against the alert line; people who have used Léigh Dom and how many in the last 30 days; what is stored now; accounts near their quota
Disk	services-user's disk as Léigh Dom / other apps / free, with the alert line; what the 30-day clean-up frees in the next week; when the alert last checked and who it e-mails
Uploads per day	The last 30 or 90 days, with a table view
Accounts	Everyone who has uploaded: tier, stored against quota, documents, uploads, last upload. Search, filters (has files, near quota, Pro), sorting, CSV

Opening an account shows its tier, its documents on the disk with each voice's state, and its upload history with where each upload is now (stored, deleted, expired, or removed).

What staff can change

Action	What happens
Change the tier	Upserts lei_account_tiers with granted_by = cul:<email> and an optional note. Léigh Dom picks it up within 5 minutes of the account's next visit
Remove the grant	Deletes the row; the account is Basic again
Delete a document	Léigh Dom deletes it in every voice, through the same code as the owner's own delete; CÚL marks its upload-log rows deleted
Remove an upload row	Deletes one row of the history. Files are not touched
Delete everything	The account's documents, then its tier grant and its whole upload history. The ABAIR account stays

How it gets the data

• Supabase has the history: one row per upload, kept after the file is gone, and who is on Pro. RLS lets each account read only its own rows, so CÚL reads and writes them server-side with its secret key.
• Léigh Dom's admin API has the present: what each account stores now, the disk itself, and the deletes. CÚL calls it at http://10.0.0.18:3015 from services-staff; the public vhost refuses those routes.
• Each source is read separately, so one being down leaves the other on the page with a note saying what is missing.

The disk alert

Every 15 minutes a pg_cron job asks CÚL to check the disk. It e-mails the fixed list in LEIGHDOM_ALERT_EMAILS:

• once when the disk passes the line (LEIGHDOM_ALERT_PERCENT, default 80),
• once a day while it stays over,
• once when it is back 2 points under.

A check that cannot reach Léigh Dom changes nothing and is shown on the page as the last error, so a broken check is visible. The disk is services-user's, shared with every app there, so the e-mail says how much of it is Léigh Dom's. Where the alert stands is one row in cul_storage_alerts.

Setting it up

1. Supabase. file-tts-tool/supabase/0004_lei_admin.sql (the lei_admin column; applied), then CÚL's sql/leigh_dom_storage_alert.sql and sql/schedule_leigh_dom_storage_alert_pg_cron.sql.
2. Vaultwarden. One token, openssl rand -hex 32, in two notes:
   • leigh-dom .env: ADMIN_API_TOKEN=<token>
   • cul .env: LEIGHDOM_API_URL=http://10.0.0.18:3015, LEIGHDOM_API_TOKEN=<token> and LEIGHDOM_ALERT_EMAILS=<addresses>
3. Léigh Dom. Deploy the version with the admin API, then make setup-services-user (the UFW rule letting services-staff reach port 3015) and make deploy-services-user-apps (writes its .env).
4. nginx. make update-webserver, so leighdom.abair.ie answers 404 for /api/admin/stats, /api/admin/users/ and /api/admin/documents/.
5. CÚL. make deploy-services-staff-apps writes its .env from the note. Compose doesn't restart a container when only .env changes, so deploy the new CÚL image after this step (its pipeline recreates the container), or run docker compose up -d --force-recreate in /opt/apps/cul. Grant lei_admin in User Management.

Useful Links

Page	https://cul.abair.ie/leigh-dom
Code	cul: src/pages/leigh-dom.js and the files listed in its CLAUDE.md → Léigh Dom
Admin API	file-tts-tool README → Admin API

Last updated 2026-10-05