Console

Applies to: SimpleTwo 1.0.50 and later · agent 1.0.14 · directory 1.4.26 · Checked: 03.11.2026

The administration console is the /admin page. The coordinator and every role of the installation are administered from it: the directory, mail, drive, messaging, prov and the others.

1. How the console reaches the roles

The browser talks to the console only. The console carries the calls to the roles itself, through its gateway: the page calls /gateway/<role's name>/control/… on its own address, and the console forwards the call to the role with your own token, unchanged.

• The role decides, as before: by your token and your roles in the directory. The role's audit names you, not the console. The console holds no rights and no token of its own.
• The administrator's computer needs to reach the console only. The roles' public names need not open from the administrators' network — the console opens them.
• No more certificate prompt. prov asks every client for a certificate (that is how Poly devices sign in to it); now the console connects to it, not the browser.
• The gateway leads only to this installation's roles and only to their administration (/control/…, and the directory's /scim/v2/…). No other address can be opened through it.
• A break-glass sign-in does not administer the roles: it holds no directory token. The roles' cards say so.

2. Where the console runs

By default the console runs inside the coordinator: open it at the coordinator's address, nothing to install.

As its own role the console is installed when the administration should live elsewhere — in the administrators' network, for one, with the coordinator in the DMZ. There may be several consoles.

1. Servers → Add a host, role console, the console's public name (for example, admin.example.com). The DNS name must point at this host.
2. Run the join command on the host. The agent installs the simpletwo-console service, and the coordinator orders the name's certificate (or import your own: Servers → Certificate).
3. Open https://<console's name>/admin and sign in through the directory as usual.

The console's host needs to reach the coordinator (HTTPS) and the roles' public names (HTTPS). The port is 443. The console keeps no data: losing its host means installing the console again.

The page and /admin/api are the coordinator's: the console forwards them, so the console's version is always the coordinator's and is updated with it. The break-glass sign-in works through a separate console too.

3. Keeping the roles' administration off the internet

Settings → Console and control API → Networks the roles' control API admits. Put the consoles' addresses there (comma-separated, an address or a CIDR network), and every role's /control/… answers them only. While the coordinator also serves the page, add its address too. Blank — any network (the default).

Calls from the role's own host (127.0.0.1) always pass. So for a role behind a TLS front on its own host — the drive — the list restricts nothing: close its network at the firewall in front of the host.

The other parameters are there too:

Parameter	Default	Meaning
Calls a minute per token at a role	the role's default (600)	how many calls a role takes from one token
Largest body through the console	2048 MiB	the upload size limit through the gateway (prov's firmware images are the biggest)
One call's time	1800 s	how long one call may take, its body included
Calls a minute per token through the console	1200	the gateway's rate limit

The networks and the rate reach the roles with their desired state within a minute or two.

4. Troubleshooting

Symptom	Cause	What to do
A role's card: "does not answer through the console"	the console cannot reach the role's public name or does not trust its certificate	from the console's (coordinator's) host: curl -I https://<role's name>/control/about — 401 or 403 means the network is fine
The role answers 403 the control API is not open to this network	the console's address is not in the networks	add it in Settings → Console and control API
Sign-in on a separate console fails with a redirect_uri error	the directory does not know the console's name yet	wait for the directory's next desired state (a minute or two); the directory must be 1.4.26 or later
The console does not start: "no certificate … yet"	the console name's certificate is not issued yet	check the DNS name and Servers → Certificate