bobbanandClaude Sonnet 5.5
3035d7fc08
Name lists now live in settings instead of the web bundle. Admins edit them under Settings -> Names (add/remove names, create/rename/delete lists, reset a built-in list). Names are folded to hostname-safe form (a-z, 0-9, hyphen) and validated on the server; saves are audited. Adds Swedish boy names, Pixar, Norse mythology and Astrid Lindgren lists, and lengthens the Swedish girl and Disney lists. "Mixed" is now every list with each name counted once. Admins can preview and import the most common Swedish names from Skatteverket's open "Namn pa nyfodda" data (girls or boys, latest 1-5 full years); nothing is stored until the editor is saved. The old comment that credited SCB statistics is gone: SCB stopped publishing name statistics after 2023. Privacy page, README and ROLES updated for the new outbound call and page. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
93 lines
4.3 KiB
Markdown
93 lines
4.3 KiB
Markdown
# Roles & menu access
|
|
|
|
Homelab Manager has three roles, ranked lowest to highest: **viewer**,
|
|
**operator**, **admin**. The first person to sign in becomes admin;
|
|
everyone after that starts as viewer until an admin changes their role
|
|
under **Administration → Users**.
|
|
|
|
A role can do everything the roles below it can, plus what's listed for
|
|
it — operator includes everything viewer has, admin includes everything
|
|
operator has.
|
|
|
|
## Sidebar menu, by role
|
|
|
|
✅ = the menu item appears for that role · ❌ = it's hidden entirely (not
|
|
just disabled) — a group that would end up with zero visible items
|
|
disappears too, and a group left with exactly one just shows as that
|
|
page's own top-level link.
|
|
|
|
| Menu item | Path | Viewer | Operator | Admin |
|
|
|---|---|:---:|:---:|:---:|
|
|
| Dashboard | `/` | ✅ | ✅ | ✅ |
|
|
| **Infrastructure** | | | | |
|
|
| Servers | `/servers` | ✅ | ✅ | ✅ |
|
|
| Proxmox | `/proxmox` | ✅ | ✅ | ✅ |
|
|
| Synology | `/synology` | ✅ | ✅ | ✅ |
|
|
| Proxmox Backup | `/pbs` | ✅ | ✅ | ✅ |
|
|
| Docker | `/docker` | ✅ | ✅ | ✅ |
|
|
| Tailscale | `/tailscale` | ✅ | ✅ | ✅ |
|
|
| **Network** | | | | |
|
|
| DNS | `/dns` | ✅ | ✅ | ✅ |
|
|
| Domains | `/domains` | ✅ | ✅ | ✅ |
|
|
| IP Addresses | `/ipam` | ✅ | ✅ | ✅ |
|
|
| Ports | `/ports` | ✅ | ✅ | ✅ |
|
|
| Consistency | `/consistency` | ✅ | ✅ | ✅ |
|
|
| **Automation** | | | | |
|
|
| Semaphore | `/semaphore` | ✅ | ✅ | ✅ |
|
|
| Gitea | `/gitea` | ✅ | ✅ | ✅ |
|
|
| Secrets | `/secrets` | ✅ | ✅ | ✅ |
|
|
| **Operations** | | | | |
|
|
| Alerts | `/alerts` | ✅ | ✅ | ✅ |
|
|
| Maintenance | `/maintenance` | ✅ | ✅ | ✅ |
|
|
| Uptime Kuma | `/uptime-kuma` | ✅ | ✅ | ✅ |
|
|
| osTicket | `/osticket` | ✅ | ✅ | ✅ |
|
|
| Admin Links | `/admin-links` | ✅ | ✅ | ✅ |
|
|
| Generator | `/generator` | ✅ | ✅ | ✅ |
|
|
| **Administration** | | | | |
|
|
| Integrations | `/integrations` | ✅ | ✅ | ✅ |
|
|
| Users | `/users` | ❌ | ❌ | ✅ |
|
|
| Sessions | `/sessions` | ❌ | ❌ | ✅ |
|
|
| Audit Log | `/audit-log` | ❌ | ✅ | ✅ |
|
|
| Diagnostic Log | `/diag-log` | ❌ | ❌ | ✅ |
|
|
| Settings | `/settings` | ❌ | ❌ | ✅ |
|
|
| Privacy (footer link, not in a group) | `/privacy` | ✅ | ✅ | ✅ |
|
|
|
|
So in practice: **every page is visible to every role except the five
|
|
under Administration** — Users, Sessions, and Diagnostic Log need admin;
|
|
Audit Log needs operator or admin; Settings needs admin.
|
|
|
|
## Being able to see a page isn't the same as being able to change things
|
|
|
|
Almost every page above is visible to viewers, but most of the buttons
|
|
on them aren't — a viewer can look at everything but can't act on
|
|
anything. Operators can use the page's normal working actions (starting
|
|
a container, syncing DNS, adding a secret, opening a maintenance
|
|
window…). Some actions on otherwise-viewer-visible pages are held back
|
|
even further, to admin only:
|
|
|
|
- **Integrations & DNS providers**: any operator can use an integration
|
|
once it's configured (start/stop a guest, run a template, sync DNS
|
|
records, etc.), but adding, editing, testing, or deleting an
|
|
integration or DNS provider is admin-only.
|
|
- **Servers**: registering a new server, rotating its agent token, and
|
|
editing/deleting a server are admin-only; tagging a server and
|
|
linking/unlinking it to a Proxmox guest just need operator.
|
|
- **Tags**: creating, renaming, recoloring, or deleting a tag is
|
|
admin-only (applying an existing tag to a server needs operator).
|
|
- **Ports**: everyone can see both the agent-reported and manual tables;
|
|
adding, editing, or deleting a manual port opening needs operator.
|
|
- **Admin Links**: everyone can see and open every server's admin
|
|
bookmarks, from that server's own page or the summary page; adding,
|
|
editing, or removing one needs operator, from either place.
|
|
- **Generator**: everyone can use it; the name lists it picks server names from
|
|
are edited under Settings → Names, which is admin-only (and so is importing
|
|
names from Skatteverket).
|
|
- Everything under **Settings** (notification channels, badge colors,
|
|
display prefs, log retention, backup/restore) is admin-only, matching
|
|
the page itself being admin-only.
|
|
|
|
If you need the exact role for one specific button rather than this
|
|
summary, check the corresponding route in `server/src/routes/` — each
|
|
one that needs more than "signed in" calls `requireRole("operator")` or
|
|
`requireRole("admin")` right where that action is defined.
|