Admin UI

Browser-based operations dashboard. Architecture: admin-ui.md.

Enable

CHRONACTA_ADMIN_ENABLED=true \
CHRONACTA_ADMIN_ADDRESS=127.0.0.1:8080 \
./bin/chronacta-server

Open http://127.0.0.1:8080/admin.

Variable	Default	Purpose
CHRONACTA_ADMIN_ENABLED	false	Enable HTTP admin UI
CHRONACTA_ADMIN_ADDRESS	127.0.0.1:8080	Admin listen address
CHRONACTA_ADMIN_GRPC_ADDRESS	127.0.0.1:{GRPC_PORT}	Backend gRPC for BFF

When CHRONACTA_AUTH_ENABLED=true, sign in with permissions matching the screen: verify (dashboard, cluster), stream.read / stream.append (streams), schema.manage, projection.read / projection.manage, backup. When auth is disabled, the UI uses an anonymous session.

Screens

Route	Purpose
/admin/dashboard	Storage + cluster overview (htmx refresh)
/admin/streams	Stream catalog, events, append
/admin/schemas	Schema list, register, validate
/admin/projections	Projection lifecycle, state/result/errors
/admin/backups	Backup create, list, inspect
/admin/cluster	Membership, add/remove/promote, snapshot push

Operator DR drill

Documented backup workflow using the UI plus offline restore:

1. Create (UI): open /admin/backups, run Create (optionally Dry run first).
2. Verify (UI): confirm the archive appears in the list; open Inspect and check manifest HW position and file checksums.
3. Restore (CLI): stop the server, then:

./bin/chronacta-admin restore \
  --archive ./backups/<archive>.tar.gz \
  --target ./restored-data \
  --confirm

4. Validate: start server on restored data, run ./bin/chronacta verify and browse streams in the UI.

See Backup and restore for full details.

Security notes

• Bind CHRONACTA_ADMIN_ADDRESS to localhost unless behind a trusted reverse proxy with TLS.
• Logout and mutating forms use CSRF token validation.
• Cluster remove/promote and projection delete/rebuild require typed confirmation in the UI.
• Development auth mode shows a warning banner; do not use in production without TLS.