ActivePush/docs/PANEL.md

Administration panel

The panel is a separate listener (default 127.0.0.1:9091) embedded in the binary. Reach it through an SSH tunnel (ssh -L 9091:127.0.0.1:9091 server) or a VPN. It is in English by default; switch to Polish with the language selector (remembered per browser). Settings pages apply changes immediately, without a restart.

First login

On the first start there is no administrator. Generate a one-time token on the server and paste it together with the new login and password (at least 12 characters):

sudo -u active-push active-push admin setup-token     # valid 60 minutes, single use

Without a browser: sudo -u active-push active-push admin init --username admin.

01 Overview

• Tiles - requests per minute, active push connections, devices (physical phones, counted by DeviceId), mailboxes (logins), mails sent, errors, failed logins and transfer. One person with several mailboxes on one phone counts as one device and several mailboxes; the devices tile also shows the number of partnerships (device x mailbox pairs).
• Charts - traffic, synchronised items and data per minute (60 min / 6 h / 24 h), requests per hour for the last 7 days. Hover a chart to read exact values.
• Commands, device types and server (version, uptime, memory, IMAP pool, database and WAL size, configured backends).

02 Live

Push connections (Ping or hanging Sync) with their heartbeat progress, requests in flight and a live stream of finished requests (Server-Sent Events). Filter the stream by mailbox, device or command; pause it while reading.

03 Devices

One row per physical device. Every mailbox configured on it is a chip; a green dot means that mailbox currently holds a push connection. Filters: push, pending approval, blocked, inactive for 30 days.

Click a mailbox chip (or the row) to open the partnership:

• details reported by the device (model, OS, IMEI, user agent, protocol, policy),
• per-folder statistics (items, sent/received, last sync, window size, loop detection hits),
• recent requests and free-form notes,
• actions: approve, full resync, force re-provision, block/unblock, remote wipe (confirmed by typing the device id), cancel wipe, show recovery password, remove partnership.

All actions are written to the audit log.

04 Mailboxes

Every login that synchronises through ActiveSync, with its devices, the other mailboxes on the same device (useful to see one person's accounts together), push connections, requests, last activity and effective policy. Blocking a mailbox applies immediately on every device. Active login lockouts can be cleared here.

05 Backends

IMAP, SMTP, CalDAV and CardDAV. Each section has a Test connection button that uses the values currently in the form (also unsaved ones) and an optional test login; the password is never stored.

06 ActiveSync

Login format and default domain, e-mail address template, protocol version, synchronisation limits, push intervals, logging and retention.

07 Autodiscover

Settings for the automatic account setup on phones plus a diagnostics tool. Phones look for Autodiscover on the domain of the e-mail address, not on the server name: https://<domain>/autodiscover/autodiscover.xml, https://autodiscover.<domain>/autodiscover/autodiscover.xml or the DNS record _autodiscover._tcp.<domain>.

• E-mail domains - domains Autodiscover is published for (one per line). When the list is not empty, requests for other domains are refused. One line per domain; optionally add a space and an ActiveSync URL for that domain (example.org https://mail.example.org/Microsoft-Server-ActiveSync), otherwise the Public ActiveSync URL is used. An empty list serves every domain.
• Public ActiveSync URL - the address handed to phones. Set it, otherwise it is derived from the request's Host header (usually autodiscover.<domain>).
• Run diagnostics (saved domains only) checks, per domain: A/AAAA records of the domain, autodiscover.<domain> and the ActiveSync host, the SRV record and its target, every candidate endpoint (TLS certificate, redirects, whether ActivePush answers and not another application) and the ActiveSync URL. A verdict states whether devices will find Autodiscover; when not, ready-to-use DNS records and an nginx server block are shown. Redirects (for example to a web site or an old .php Autodiscover) are reported as failures because phones do not reliably follow them.

Every real Autodiscover request (including the unauthenticated first request and failures) appears in Live with the host it arrived on.

08 Policies

Provisioning switch, loose provisioning, named policies with every policies.ini option and per-mailbox assignments (login=policy, one per line). Changing a policy makes devices accept it again.

09 Security

Login lockout thresholds, trusted proxies and client IP header, network allow lists for ActiveSync and the panel, allowed/blocked mailboxes and device types, device approval, panel session lifetime, Prometheus token, administrator password change and signing out other sessions.

10 Logs and audit

Recent server log lines (level filter, search, auto refresh) and the audit trail of administrative actions. The log view is an in-memory ring buffer; the full log goes to journald. See LOGS.md.

Themes and small screens

The theme button switches between dark and light. On narrow screens the navigation collapses into a menu.