Skip to content

Admin Panel

Jump to bottom
jack edited this page Jun 25, 2026 · 9 revisions

Wawel Auth provides a built-in admin web UI for server administration.

image

When enabled, it is available at:

  • https://your-host:your-port/admin when server.http.httpsEnabled=true (default)
  • <publicBaseUrl>/admin for bootstrap/status only, if publicBaseUrl uses plain HTTP

The admin panel is enabled/disabled by server.admin.enabled (server.json).

The admin login token is resolved in this order:

  • server.admin.tokenEnvVar, if that environment variable is set and non-empty
  • otherwise server.admin.token

The default environment variable name is WAWELAUTH_ADMIN_TOKEN.

Admin login and authenticated admin API calls require HTTPS. Plain HTTP can load the UI and bootstrap/status data, but it cannot log in or use admin actions.

Note

If HTTPS is terminated by nginx or another reverse proxy, proxy to Wawel Auth from loopback. Forwarded HTTPS headers are ignored for non-loopback clients.

Same-port HTTPS

Wawel Auth can accept HTTPS on the same port as Minecraft and plain HTTP.

This is controlled by server.http.httpsEnabled and is enabled by default.

The generated admin URL is:

  • https://<publicBaseUrl host and port>/admin

Same-port HTTPS uses a self-signed certificate generated in:

  • config/wawelauth/data/https-cert.der
  • config/wawelauth/data/https-private.der

The browser will warn about the certificate. Verify the SHA-256 fingerprint shown by the admin page or printed in the server log before accepting it.

The certificate includes hosts from publicBaseUrl, the effective API root, serverAddress, localhost, 127.0.0.1, and ::1 when it is generated. If those SAN entries become stale after configuration changes, startup shows an FML confirmation prompt. Confirming backs up the existing HTTPS certificate files under config/wawelauth/data/https-certificate-backups/ and regenerates the self-signed certificate with the existing HTTPS private key. Cancelling aborts server startup. Headless setups can answer the prompt with -Dfml.queryResult=confirm or -Dfml.queryResult=cancel.

Management capabilities

The admin UI can manage:

  • Local Wawel Auth users and profiles
  • Profile UUID changes, including setting a profile to its offline UUID
  • Password resets
  • Texture resets
  • Invites
  • Provider-aware profile resolution
  • Provider-aware whitelist entries using provider + username resolution
  • Provider-aware op entries using provider + username resolution
  • server.json
  • server.properties

It also displays server stats:

  • User count
  • Profile count
  • Token count
  • Invite count
  • Database size
  • Texture storage size

Note

Most server.properties changes require a server restart.

Clone this wiki locally