Dashboard and Authentication

Dashboard and Authentication

secwatch serves a single-page dashboard: traffic over time, top talkers and offenders, the event feed, active bans, log sources, CVE findings, and (if enabled) the AI analysis.

Access

By default it listens on 0.0.0.0:8931 (set SECWATCH_PORT or paths.dashboard_url). Open http://SERVER-IP:PORT/.

Two ways to secure it

1. Built-in login (for direct IP:PORT use)

Turn this on if you reach secwatch directly rather than through an authenticating proxy. The install wizard sets it up; to do it by hand:

auth:
  enabled: true
  username: admin
  password_hash: "pbkdf2_sha256$..."   # generated by the installer, never plaintext
  session_ttl: 86400
  max_fails: 8
  lockout_secs: 300

• Passwords are stored only as a pbkdf2 hash; sessions use an HMAC-signed cookie.
• Repeated failed logins lock out the source IP and raise a dashboard_bruteforce event.

2. Behind an authenticating reverse proxy

If a proxy in front already authenticates users (SSO, forward-auth, etc.), let it do the work. auth.trust_proxy_from lists sources that bypass the built-in login — it defaults to loopback, so a co-located proxy keeps working:

auth:
  enabled: true
  trust_proxy_from:
    - 127.0.0.1/32
    - ::1/128

Requests from a trusted proxy are passed through; everything else must log in.

Behind a strict-CSP or CSRF-enforcing proxy? The dashboard adds an optional header to its mutating (POST) requests — set dashboard.proxy_mutation_header to the header your proxy expects. Leave it empty when not needed.

Discord alerts

secwatch pushes high-severity events to a Discord channel via an incoming webhook, and quiets routine scanner noise by default so you're only pinged for what matters. See Alerting for setup and tuning.

Health endpoint

GET /api/health returns secwatch's own self-check (database, disk, KEV freshness, ban actuator, edge liveness) — handy for uptime monitoring. GET /healthz is a simple liveness probe.