Web Panel

Web Panel

Getting in

The panel runs at http://<your-server-ip>:<port>, where the port is whatever's set under web.port in config.yml (default 8080). Log in with admin and the password that was printed to your console the very first time the plugin started.

Change that password immediately. It's random and reasonably strong, but it was printed in plaintext to a log file, which isn't somewhere a credential should live long-term. Settings → Account, once you're logged in.

I lost my admin password

If you missed the console output on first boot and never changed it:

• Check your server's log files — the password was written there too (logs/latest.log or equivalent, depending on your setup), not just the live console. Search for "SXBans Web Panel".
• If the logs have rotated out, there isn't a "forgot password" flow built in yet. You'll need server access to reset it — stop the server, delete or edit plugins/SXBans/web-users.json, and restart to have a fresh admin account generated.

Adding staff accounts

From Settings → Users (admin access required), you can create additional web panel logins with their own permission levels. This is separate from your Bukkit permissions plugin — it controls access to the web panel specifically, not in-game commands.

Give trial staff a low-level account so they can look up player history without being able to touch the server console or issue punishments through the panel. Reserve full admin-level web accounts for people you'd trust with in-game admin anyway — an admin-level web account can execute arbitrary server console commands through the live console feature, so treat it with the same weight as op.

What's actually in the panel

• Dashboard — active bans/mutes/warnings at a glance, basic stats, database and web server status
• Players — searchable list, click into any player for their full punishment history
• History — the same history data, browsable across all players
• Console — a live view of the server console, with the ability to run commands (admin-level accounts only)
• Settings — reload configs, manage web users, adjust panel-specific options

Running it behind a reverse proxy

If you want the panel reachable at a normal domain/HTTPS URL instead of http://ip:8080, put nginx or Caddy in front of it and reverse-proxy to the local port. SXBans' built-in server doesn't handle TLS itself — that's intentionally left to whatever's already good at it.

A minimal nginx example:

server {
    listen 443 ssl;
    server_name panel.yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Firewalling it

If you don't need the panel reachable from outside your own network, don't expose the port publicly at all — bind your firewall rules to only allow the port from IPs you trust, or only expose it through the reverse-proxy setup above with real authentication in front of it. Fewer things listening on the open internet is always better.