Initial admin commit

AGENTS.md

@@ -458,6 +458,7 @@ Key variables:
 - `MQTT_HOST`, `MQTT_PORT`, `MQTT_PREFIX` - MQTT broker connection
 - `MQTT_TLS` - Enable TLS/SSL for MQTT (default: `false`)
 - `API_READ_KEY`, `API_ADMIN_KEY` - API authentication keys
+- `WEB_ADMIN_ENABLED` - Enable admin interface at /a/ (default: `false`, requires auth proxy)
 - `LOG_LEVEL` - Logging verbosity
 
 The database defaults to `sqlite:///{DATA_HOME}/collector/meshcore.db` and does not typically need to be configured.

README.md

@@ -376,6 +376,7 @@ The collector automatically cleans up old event data and inactive nodes:
 | `WEB_HOST` | `0.0.0.0` | Web server bind address |
 | `WEB_PORT` | `8080` | Web server port |
 | `API_BASE_URL` | `http://localhost:8000` | API endpoint URL |
+| `WEB_ADMIN_ENABLED` | `false` | Enable admin interface at /a/ (requires auth proxy) |
 | `NETWORK_NAME` | `MeshCore Network` | Display name for the network |
 | `NETWORK_CITY` | *(none)* | City where network is located |
 | `NETWORK_COUNTRY` | *(none)* | Country code (ISO 3166-1 alpha-2) |

docker-compose.yml

@@ -252,6 +252,7 @@ services:
       - API_KEY=${API_READ_KEY:-}
       - WEB_HOST=0.0.0.0
       - WEB_PORT=8080
+      - WEB_ADMIN_ENABLED=${WEB_ADMIN_ENABLED:-false}
       - NETWORK_NAME=${NETWORK_NAME:-MeshCore Network}
       - NETWORK_CITY=${NETWORK_CITY:-}
       - NETWORK_COUNTRY=${NETWORK_COUNTRY:-}

src/meshcore_hub/common/config.py

@@ -253,6 +253,12 @@ class WebSettings(CommonSettings):
     web_host: str = Field(default="0.0.0.0", description="Web server host")
     web_port: int = Field(default=8080, description="Web server port")
 
+    # Admin interface (disabled by default for security)
+    web_admin_enabled: bool = Field(
+        default=False,
+        description="Enable admin interface at /a/ (requires OAuth2Proxy in front)",
+    )
+
     # API connection
     api_base_url: str = Field(
         default="http://localhost:8000",

src/meshcore_hub/web/app.py

@@ -50,6 +50,7 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
 def create_app(
     api_url: str | None = None,
     api_key: str | None = None,
+    admin_enabled: bool | None = None,
     network_name: str | None = None,
     network_city: str | None = None,
     network_country: str | None = None,
@@ -67,6 +68,7 @@ def create_app(
     Args:
         api_url: Base URL of the MeshCore Hub API
         api_key: API key for authentication
+        admin_enabled: Enable admin interface at /a/
         network_name: Display name for the network
         network_city: City where the network is located
         network_country: Country where the network is located
@@ -96,6 +98,9 @@ def create_app(
     # Store configuration in app state (use args if provided, else settings)
     app.state.api_url = api_url or settings.api_base_url
     app.state.api_key = api_key or settings.api_key
+    app.state.admin_enabled = (
+        admin_enabled if admin_enabled is not None else settings.web_admin_enabled
+    )
     app.state.network_name = network_name or settings.network_name
     app.state.network_city = network_city or settings.network_city
     app.state.network_country = network_country or settings.network_country

src/meshcore_hub/web/routes/__init__.py

@@ -9,6 +9,7 @@ from meshcore_hub.web.routes.messages import router as messages_router
 from meshcore_hub.web.routes.advertisements import router as advertisements_router
 from meshcore_hub.web.routes.map import router as map_router
 from meshcore_hub.web.routes.members import router as members_router
+from meshcore_hub.web.routes.admin import router as admin_router
 
 # Create main web router
 web_router = APIRouter()
@@ -21,5 +22,6 @@ web_router.include_router(messages_router)
 web_router.include_router(advertisements_router)
 web_router.include_router(map_router)
 web_router.include_router(members_router)
+web_router.include_router(admin_router)
 
 __all__ = ["web_router"]

src/meshcore_hub/web/routes/admin.py

@@ -0,0 +1,31 @@
+"""Admin page route."""
+
+import logging
+
+from fastapi import APIRouter, HTTPException, Request
+from fastapi.responses import HTMLResponse
+
+from meshcore_hub.web.app import get_network_context, get_templates
+
+logger = logging.getLogger(__name__)
+router = APIRouter(prefix="/a", tags=["admin"])
+
+
+@router.get("/", response_class=HTMLResponse)
+async def admin_home(request: Request) -> HTMLResponse:
+    """Render the admin page with OAuth2Proxy user info."""
+    # Check if admin interface is enabled
+    if not getattr(request.app.state, "admin_enabled", False):
+        raise HTTPException(status_code=404, detail="Not Found")
+
+    templates = get_templates(request)
+    context = get_network_context(request)
+    context["request"] = request
+
+    # Extract OAuth2Proxy headers
+    context["auth_user"] = request.headers.get("X-Forwarded-User")
+    context["auth_groups"] = request.headers.get("X-Forwarded-Groups")
+    context["auth_email"] = request.headers.get("X-Forwarded-Email")
+    context["auth_username"] = request.headers.get("X-Forwarded-Preferred-Username")
+
+    return templates.TemplateResponse("admin.html", context)

src/meshcore_hub/web/templates/admin.html

@@ -0,0 +1,38 @@
+{% extends "base.html" %}
+
+{% block title %}{{ network_name }} - Admin{% endblock %}
+
+{% block content %}
+<div class="flex items-center justify-between mb-6">
+    <h1 class="text-3xl font-bold">Admin</h1>
+    <a href="/oauth2/sign_out" class="btn btn-outline btn-sm">Sign Out</a>
+</div>
+
+<div class="card bg-base-100 shadow-xl">
+    <div class="card-body">
+        <h2 class="card-title">Authenticated User</h2>
+        <div class="overflow-x-auto">
+            <table class="table">
+                <tbody>
+                    <tr>
+                        <th class="w-64">X-Forwarded-User</th>
+                        <td>{{ auth_user or '-' }}</td>
+                    </tr>
+                    <tr>
+                        <th>X-Forwarded-Preferred-Username</th>
+                        <td>{{ auth_username or '-' }}</td>
+                    </tr>
+                    <tr>
+                        <th>X-Forwarded-Email</th>
+                        <td>{{ auth_email or '-' }}</td>
+                    </tr>
+                    <tr>
+                        <th>X-Forwarded-Groups</th>
+                        <td>{{ auth_groups or '-' }}</td>
+                    </tr>
+                </tbody>
+            </table>
+        </div>
+    </div>
+</div>
+{% endblock %}