-
Notifications
You must be signed in to change notification settings - Fork 0
Standalone Web UI
Herald's web UI is always installed at http://<this-host>/herald/, whether or not Allmon3 or Supermon are present on the system. It's gated by its own username/password login — separate from Allmon3's and Supermon's own logins, and unaffected by anything you do in either of those.
-
Username:
admin -
Password:
admin
Change this immediately on the Global Settings tab, under Login Settings — enter your current password once, then set a new username and/or password. A warning banner stays visible on that card until you do. See Configuration Reference for where the credentials are stored on disk.
A real server-side session, not just "hide the page and hope" — every API call the UI makes is rejected with a 401 unless you're actually logged in. Password is stored as a bcrypt hash (PHP's own password_hash()), never in plain text.
If you're also using Allmon3 or Supermon, logging into either of those silently gives you a valid Herald session too — you won't see a second login screen. This is verified server-side each time (Supermon: your real sm61loggedin session state; Allmon3: see the caveat below), not just assumed from the page you clicked.
Allmon3's own session cookie can't be verified from outside Allmon3 itself without modifying Allmon3's own code — a line Herald doesn't cross. Because of that, the Allmon3-embedded Herald page uses a separate, deliberately unauthenticated set of API endpoints (distinct from the ones the standalone UI and Supermon use), the same trust model Herald's Allmon3 integration has always used: the page is hidden until you're logged into Allmon3, but the underlying API calls aren't independently re-verified — protected only by a narrow sudoers rule (www-data can only ever run the herald command, nothing else) and the assumption that your node isn't directly exposed to the internet.
This doesn't affect the standalone UI or Supermon at all — both of those get the real, fully-verified login described above. It only matters if you're relying on Allmon3 specifically to gate access to Herald's API, e.g. if your node's web server is reachable beyond your own LAN.
If you want to reach the standalone UI from outside your LAN, put it behind your own reverse proxy (e.g. NGINX Proxy Manager) with HTTPS — Herald's own login protects against a stranger using the UI, but a plain HTTP login form sends your password unencrypted on the wire between you and your node.