Administration

Overview

The Administration page is the central hub for all platform management tasks. From here you can open the sub-pages that let you manage user accounts and permission groups, maintain IP allowlists and blocklists, define internal network ranges, and configure the settings of the AI engine, the Action Manager, the DSS, and the retention policies.

The sub-pages are arranged as a tab strip at the top of the page. The tabs you see depend on your account permissions – you only see tabs for areas you are allowed to open.

How to Open This Page

Click Administration in the main navigation bar. The navigation item is only visible if your account has at least one of the Administration permissions (see Permissions below).

Administration always opens on a sub-page: if you open /administration directly, you are taken to the first tab you have access to (for an administrator, Users). Each tab has its own address (for example /administration/retention_policies), so you can bookmark or share a specific sub-page.

Page Layout

Click to enlarge

• 1 Navigation bar with Administration highlighted as the active page.
• 2 Page header – the Administration title and the description Manage access, protected networks, and platform configuration.
• 3 Tab strip – one tab per management area. The active tab is highlighted.
• 4 Content panel – the selected sub-page (here Users).

Tab Strip

Click to enlarge

The tabs appear in this order, from left to right. Click a tab to open that sub-page; the tab strip stays visible so you can switch areas at any time.

Settings Pages

The AI, Action Manager, DSS and Retention Policies tabs share the same settings layout:

• A Search by name or description… field that filters the settings as you type (press Escape or click the X to clear it). While a search is active, matching settings are shown even inside collapsed groups.
• Settings are organized in collapsible groups (for example Retention policies or Flood thresholds), each showing how many settings it contains. Click a group header to collapse or expand it, or use Expand all / Collapse all. The collapsed/expanded arrangement is remembered in your browser for each tab.
• Each row shows a question-mark help tip (hover or focus it for a short explanation), the human-readable setting name with its internal name underneath, the current value (with its unit, where known), and an Edit (pencil) button.
• The edit dialog shows the setting description, the accepted range and default value where the platform knows them, and rejects out-of-range values. The same range is enforced again by the server when you save.

See each settings sub-page for its specific parameters.

Permissions

Access to the Administration page and its tabs is controlled by three permissions, assigned through Groups:

A user needs at least one of these permissions to see the Administration link in the navigation bar. Each tab is shown only if the user holds a permission that the tab accepts. For example, a user with only View Settings sees the seven settings and list tabs but not Users or Groups, and can consult but not change them.

If you hold both Modify Settings and View Settings, Modify Settings takes precedence. The access checks are enforced by the server as well, not only by hiding controls in the page.

If you do not see the Administration link or a specific tab that you expect, ask an administrator to check your group memberships.

Node exporter installation

If you want to install the node_exporter used by prometheus to get metrics about production systems, you can use the following ansible playbook:

---
- name: Install Node Exporter
  hosts: node_exporters
  become: yes

  vars:
    node_exporter_version: "1.10.2"
    node_exporter_url: "https://github.com/prometheus/node_exporter/releases/download/v1.10.2/node_exporter-1.10.2.linux-amd64.tar.gz"
    archive_path: "/tmp/node_exporter.tar.gz"
    extract_path: "/tmp/node_exporter"
    install_path: "/opt/node_exporter"

  tasks:

    - name: Create install directory
      file:
        path: "{{ install_path }}"
        state: directory
        mode: '0755'

    - name: Download node exporter
      get_url:
        url: "{{ node_exporter_url }}"
        dest: "{{ archive_path }}"
        mode: '0644'

    - name: Create temporary extraction directory
      file:
        path: "{{ extract_path }}"
        state: directory
        mode: '0755'

    - name: Extract archive
      unarchive:
        src: "{{ archive_path }}"
        dest: "{{ extract_path }}"
        remote_src: yes

    - name: Copy binary to /opt
      copy:
        src: "{{ extract_path }}/node_exporter-{{ node_exporter_version }}.linux-amd64/node_exporter"
        dest: "{{ install_path }}/node_exporter"
        mode: '0755'
        remote_src: yes

    - name: Create systemd service
      copy:
        dest: /etc/systemd/system/node-exporter.service
        mode: '0644'
        content: |
          [Unit]
          Description=Node Exporter
          After=network.target

          [Service]
          Type=simple
          ExecStart=/opt/node_exporter/node_exporter
          Restart=always

          [Install]
          WantedBy=multi-user.target          
      notify: reload systemd

    - name: Enable and start node-exporter
      systemd:
        name: node-exporter
        enabled: yes
        state: started

    - name: Remove archive
      file:
        path: "{{ archive_path }}"
        state: absent

    - name: Remove extracted directory
      file:
        path: "{{ extract_path }}"
        state: absent

  handlers:
    - name: reload systemd
      systemd:
        daemon_reload: yes

You will also need an inventory file to define all the hosts you want node_exporter to be installed. This is an example inventory.ini file:

[node_exporters]
node1 ansible_host=172.16.1.10 ansible_user=ubuntu ansible_password=ubuntu ansible_become_password=ubuntu

[node_exporters:vars]
ansible_become=true

In the end you will need to point your prometheus instance to pull metrics from the IPs defined in the inventory. The default port used by node_exporter is 9100.

Platform Services

The platform services (the DSS detection engine, the Action Manager and the AI engine) read their settings, internal networks, allowlist and retention policies from the web platform, and the Action Manager writes blocklist updates to it. These requests authenticate with a shared service token that the installer sets up in the .service.env file, sent in the X-DeDDoS-Service-Token header.

• The web server and the AI server of one deployment must use the same .service.env.
• If a service’s requests to the web platform are rejected with HTTP 401 (Service authentication required), its token differs from the web server’s token.

Installation and token handling for operators are described in the deddos-deployment README.

Notes

• The Administration page does not display any data on its own; it always shows one of its sub-pages.
• The tab strip remains visible on every sub-page, so you can switch between management areas without going back to the navigation bar.
• The active tab is highlighted to show which sub-page is open.
• On smaller screens, the tabs reflow into several rows to fit the available width.
• Changes made in the settings tabs are global and affect the whole platform, not only your account.

Related Pages

• Users – Manage login accounts and passwords
• Groups – Create permission groups
• Allowlist – Trusted IPs that are never blocked
• Blocklist – Currently blocked IPs
• Internal Networks – Protected network ranges
• AI – AI engine settings
• Action Manager – Automated response settings
• DSS – Detection Subsystem settings
• Retention Policies – Data retention settings