Dashboard Guide

Dashboard Guide

The dashboard is where you run the store. It lives at https://shop.example.com/admin (your own domain), works in Persian and English, in dark and light themes, and shows only the sections your role may use.

Signing in

Way	Details
One-time link	Send /dashboard to your bot, or run sudo bobres admin link on the server. No password or code needed
Password and authenticator	Every password login needs a code from an authenticator app
Initial owner password	A fresh install, or sudo bobres admin password, gives the login owner and a random password, shown once. The first session only lets you pick a new password and set up the authenticator. Then the rest of the dashboard opens

Sessions use secure cookies and CSRF tokens. If you lose your phone, sudo bobres admin password is the way back.

Approve sign-ins in Telegram (optional)

The owner can turn on Settings > Sign-in security > Approve sign-ins in Telegram. It is off by default. When it is on, a staff sign-in (a link, or a password with its code) does not open the dashboard by itself. The sign-in page says Waiting for approval in Telegram, and the bot messages the staff member (and the owners, for other staff members' sign-ins, unless you turn that off) with the time, the IP address, the browser and the system, and two buttons: Approve and Deny. Approve opens the dashboard within a few seconds. Deny, or five minutes without an answer, opens nothing.

Turning it on shows what it does and asks you to confirm, and sends you a test message first, so you cannot turn it on with nobody able to answer. If the bot or Telegram cannot be reached, the sign-in page says so and does not wait. The way out is on the server: sudo bobres admin approval off (sudo bobres admin approval status shows whether it is on). It needs neither the bot nor a dashboard login. See the runbook.

Roles

Role	Can do
Owner	Everything: license, staff, payment gateways, system actions, deleting a plan
Admin	Users, orders, plans, discounts, broadcasts, settings, branding, panel servers, reports and the audit log. Not staff, license or gateway secrets
Support	Tickets, read-only users and orders, and a few actions such as extending a service

Resellers are not staff and have no dashboard access. They work in the bot and the Mini App. See Resellers. Owners are named on the server (bobres admin owners). Everyone else is invited on the Staff page. A staff seat counts against your license: see Licensing.

Every change is written to an append-only audit log. Sensitive actions, such as a balance change, a refund or a ban, ask for a reason.

Sections

Group	Section	What it is for
Store	Overview	Users, services, revenue, failed deliveries, gateway and panel health at a glance
Customers	Users	Find a customer, see their services, orders, wallet and codes, ban, adjust a balance. The Codes tab lists the reward codes made for the customer and the gift codes they applied (read only; support can read it too)
	Services	Every subscription: extend, reset traffic, disable, delete, resync from the panel, regenerate the service's page address
	Support	Ticket inbox with canned replies. A customer's reseller application arrives here too
	Broadcasts	Send a message to all or some customers, now or later
Sales	Plans	Plans, plan groups, traffic packages, the free trial, reward codes. See Plans and Pricing
	Orders & payments	Orders, the receipt review queue, retry delivery, refunds. An order's page shows the cashback it earned
	Wallet & ledger	Every wallet movement, with CSV export
	Reports	Sales per currency. See Reports
	Discounts & referrals	Discount codes, the referral reward, top inviters
	Gift codes	Codes that add credit to a wallet
	Resellers	Tiers, prices, credit limits, settlements
Setup	Branding & texts	Name, logo, colors, every bot text, FAQ and tutorials, your Terms and Privacy pages
	Settings	Time zone, maintenance mode, required channels and groups, notifications, limits, bulk purchase, cashback, reseller targets, the daily wheel (with its report), daily sales summary
	Panel servers	Your 3x-ui, Marzban, S-UI and Hiddify panels. See Panels
	Payment gateways	Owner only. See Payments
Administration	Staff	Who may use the dashboard, roles, sessions
	System	Health and version of every service, updates, backups, HTTPS, logs, license
	Audit log	Every staff change, searchable and exportable

Four more sections, BOBRES licenses, Digital accounts, Affiliates and Hosted stores, belong to the vendor's own store and are hidden on a normal install. See Digital Accounts. Affiliates is the affiliate program of the license sales: people who bring a new license buyer get 20% (or the owner's percent) of that buyer's first payment in their wallet, a refund within 30 days takes it back, and payouts made by hand are recorded there. Hosted stores is the register of the stores the vendor runs for customers (installed with tools/hosted), with each store's health read from its metrics. Both are described in docs/18.

Announcing a new product

Switch on Settings → Product announcements first (it is off by default). Then a megaphone Announce button appears on a plan of the Plans page, on a digital account of the Supplier page and beside each license price of the Licenses page (owner and admin). It opens a card prefilled from the product in Persian and English: the name, the kind, the price (a price in USDT also shows its Toman) and what it gives (days and traffic for a plan, the stock of a digital account). Edit it freely; the words in braces ({name}, {price}, {days}, {traffic}, {stock}, {kind}, {store}) are filled in when it goes out. Pick where it goes: the store's channel (the one in Settings, else your required channel; the bot must be an admin there allowed to post, and the dialog tells you plainly when it is not) and/or private messages to the customers who said yes to product news (the bot asks each customer once; the dialog shows how many). Look at the preview, press Send to me to see it in your own Telegram, then Announce (it asks first, with the count). Every card has a 🛒 Buy button that opens that product in the bot; the product is checked when the button is tapped, so a sold-out or switched-off product says so. Your limits always hold: a few announcements a day (3 by default), none in the quiet hours (23:00 to 08:00 by default: it waits until morning, and you can cancel it meanwhile), and the same product not twice within 24 hours unless you confirm. The private messages show on the Broadcasts page as "Product announcement", with their progress.

A service that is not on the panel

If someone deletes a customer's client (their account) on the panel (3x-ui, Marzban, S-UI or Hiddify), the customer cannot connect, yet the service still looks active in BOBRES. BOBRES notices it, marks the service Not on the panel and stops sending expiry reminders for it. Overview shows a Not on the panel card with how many there are, and Services has an Only services not on the panel switch. Open one and press Make the client again (owner and admin, with a reason): the same subscription link works again, the used traffic starts from zero on the panel, and the end date and the traffic limit stay as shown. With the switch on, owners and admins can also tick services (the box in the header ticks the whole page) and press Make again or Delete for all of them with one reason: a bar shows the progress, and a summary says which were done, which were skipped (back on the panel, or deleted meanwhile: nothing is done to them) and which failed, with the reason for each. The bot offers the same under the daily alert (Manage these services). On the Monitoring tab, a line that repeated shows once with ×N and the time it first and last came.

The System page

Tab	Use it to
Health	See each service's version and readiness, open problems, panels and payment methods
Monitoring	Watch the host, containers and charts (owner and admin)
Updates	See the running and newest versions, choose the stable or beta channel, press Update now (owner)
Backups	See each backup, run one now, download or restore one (owner)
HTTPS	Choose the certificate mode. See HTTPS
Logs	Read the newest warnings and errors of every service (owner)
License	See the plan in effect, paste a token or activate a key. See Licensing

Uptime and a public status page

System > Monitoring > Uptime shows how much of the time each service (core, bot, payments, provisioner) and each panel server was working over the last 24 hours, 7 days or 30 days: the percentage, how many outages and for how long in all, and a bar with a cell for each stretch of the period. Green is working, orange some downtime, red mostly down, and a hatched cell is no data: a time when nobody was there to measure (BOBRES itself was not running, monitoring was off, or the server was switched off or added later). No data is left out of the percentage; it is never counted as up or as down. BOBRES keeps 30 days of history, and the section says since when it has any.

If you want your customers to be able to see whether the store works, turn on Settings > Monitoring > Public status page. It adds https://<your domain>/status (a page, in Persian or, with ?l=en, English) and /status.json (for a monitoring service). They say only "All systems working" or "Some systems are down" and the state of four general parts: Dashboard, Bot, Payments and Panels. No server names, versions or numbers are on them. It is off by default; until you turn it on, both addresses answer "not found".

Metrics for Prometheus and Grafana

On the server, sudo bobres admin metrics-token generate makes the token too (printed once; status says whether one is set).

If you already run Prometheus and Grafana, Settings > Monitoring > Prometheus metrics lets them read the store's figures at https://<your domain>/metrics: which services answer, the queues, paid orders, open alerts, each panel server's services and limit, the license's days left, the newest backup, and the server's CPU, memory and disks. It is off until the owner makes a token: press Make a token, copy it (it is shown once; BOBRES keeps only a hash) and save it in a file on the Prometheus server. Until then /metrics answers 404 to everybody, and with a wrong token 401. Turn off brings the 404 back; Make a new token ends the old one at once. Nothing about customers is in it. A scrape configuration, alert rules and a Grafana dashboard to import are in the monitoring runbook.

Update now asks for a confirmation that names the versions and the channel. The dashboard and bot are away for a few minutes while customers' VPN links keep working. A backup comes first, and the update rolls back by itself if the new version is not healthy. The first update to a version that has this feature must still be run over SSH with sudo bobres update. See Updates, Backups, Restore.

Habits that save trouble

• Check Overview each day for failed deliveries and payments to review.
• Keep Settings > Staff notifications pointed at the right people. Alerts for payments to review, new tickets, failed deliveries and system problems arrive in Telegram.
• Use Test connection on a panel or gateway before you save it.
• Do not change rows in the database by hand. Use the dashboard, the bot or bobres, so that the ledger, audit log and events stay consistent.

For the full list of pages and API details, read docs/04-dashboard.md.