Embedding and Access

Embedded mode mounts Aludel inside an existing Phoenix router while sharing the host repository, session pipeline, and user boundary.

Basic Mount

use MyAppWeb, :router
import Aludel.Web.Router

scope "/admin" do
  pipe_through [:browser, :require_authenticated_user]

  aludel_dashboard "/aludel"
end

Configure the host repository and install migrations first:

config :aludel, repo: MyApp.Repo

mix aludel.install
mix ecto.migrate

Router Options

Option	Default	Purpose
:as	:aludel_dashboard	Live session and route name
:aludel_name	Aludel	Instance label
:resolver	Aludel.Web.Resolver	User, access, and refresh policy
:on_mount	[]	Additional host LiveView hooks
:socket_path	"/live"	Host LiveView socket path
:transport	"websocket"	"websocket" or "longpoll"
:logo_path	nil	Dashboard logo link target
:csp_nonce_assign_key	nil	One nonce assign or a map for image/style/script nonces

aludel_dashboard "/aludel",
  as: :llm_workbench,
  aludel_name: MyApp,
  resolver: MyApp.AludelResolver,
  logo_path: "/admin",
  csp_nonce_assign_key: %{
    img: :img_nonce,
    style: :style_nonce,
    script: :script_nonce
  }

Aludel serves versioned CSS and JavaScript plus packaged fonts, icons, and images beneath the mounted path, so the host does not need to copy package assets.

Resolver

The resolver connects an authenticated host user to Aludel access:

defmodule MyApp.AludelResolver do
  @behaviour Aludel.Web.Resolver

  @impl true
  def resolve_user(conn) do
    conn.assigns[:current_user]
  end

  @impl true
  def resolve_access(%{role: :admin}) do
    :all
  end

  def resolve_access(_user) do
    :read_only
  end

  @impl true
  def resolve_refresh(_user) do
    5
  end
end

:all enables mutations. :read_only preserves inspection and navigation while server-side authorization blocks mutations and model requests. The refresh value is the polling interval in seconds for result views.

Use router pipelines and :on_mount for authentication. Resolve authorization again through the resolver rather than treating dashboard visibility as write permission.

Multiple Instances

Use a distinct :as value when mounting more than one dashboard:

aludel_dashboard "/team-a", as: :team_a_aludel, resolver: TeamA.Resolver
aludel_dashboard "/team-b", as: :team_b_aludel, resolver: TeamB.Resolver

Standalone Access

Production releases require HTTP Basic Authentication and optionally support read-only mode:

export BASIC_AUTH_USER=admin
export BASIC_AUTH_PASS="$(openssl rand -base64 32)"
export READ_ONLY=true

Production startup rejects missing, partial, blank, or unsafe credentials. Local development remains unauthenticated and listens only on loopback. READ_ONLY=true changes the standalone resolver to read-only access, with mutation and model-request events denied on the server.

Serve Basic Authentication over TLS. When a reverse proxy terminates TLS, preserve the Authorization header and keep the backend port private so requests cannot bypass the authentication boundary.

Docker Compose also requires a generated database password and keeps PostgreSQL private to its internal network. See Installation for fresh-deployment and existing-volume upgrade steps.

Related Pages

• Installation
• Runs and Execution
• Architecture