Admin panel

The panel at /admin on the private port is for the person running tralha. Agents use the API or MCP; the panel is where you look at what they stored.

Signing in

Sign in with a key that has the *:admin scope. The panel opens a session that lasts seven days, kept in a cookie that is HttpOnly, SameSite=Strict, limited to /admin and marked Secure when tralha is served over HTTPS. Only a hash of the session token is stored. Signing out deletes the session, and revoking the key ends every session opened with it.

Files

The sidebar lists every bucket with its object count. Inside a bucket, folders and files appear as a grid of thumbnails or as a list, and the choice is remembered in the browser. A filter field narrows the current folder; press / to focus it.

Uploading works with the button or by dropping files anywhere on the page, with a progress bar. Files go into the folder on screen. A new folder is only a prefix, so "New folder" opens an empty view at that path and the folder exists once something is uploaded into it.

Opening a file shows a full preview: images on a checkerboard background, video with controls, markdown rendered with a toggle to the source, and other text as plain text. The side panel holds the public links, with buttons to copy the URL or a markdown snippet for a PR, a form to create a link with or without expiry, and the file details: path, size, compression savings, upload time, last access, expiry and metadata.

Looking at a file in the panel does not count as an access, so it never keeps alive a file that a "not accessed for N days" rule should delete.

Buckets

The bucket page shows each bucket's file count, usage against its quota and its settings: visibility, compression mode, quota and what happens when the quota is full. Cleanup rules are listed as sentences and can be added or removed there. See Cleanup and compression.

System

The system page holds the defaults that buckets inherit: compression mode, lossy quality and whether to keep originals. It also previews what the next cleanup will delete and why, and can run the cleanup immediately.

Protection

The panel shares the private port with the API, so the same guard applies: requests without a valid session never reach the routes. On top of that:

• Every form POST is refused when its Origin header names another host.
• Pages carry a CSP that allows scripts only from tralha itself. The panel has no inline scripts, and markdown is sanitized before it is shown.
• Images embedded in markdown can come from tralha or from the public link domain, but not from arbitrary sites, so a note cannot act as a tracking pixel.
• TRALHA_ADMIN_ALLOWED_IPS hides the panel from every network outside the list.