Administration Surface

Administrator documentation for the instance-wide administration surface — everything reached through an admin JWT under /api/v1/admin/ and its corresponding admin UI screens. These pages describe the health and runner endpoints the dashboard reads, the typed settings store that holds runtime configuration, the security policy that store enforces, account administration, and the append-only record of what was done.

Pages

• Admin Dashboard API — The single /api/v1/admin/health endpoint and its response shape: database reachability and connection-pool counts, disk usage for the data path, runner totals by status, pending queue depth, and process uptime. Notes that latency_ms is a Go duration serialised in nanoseconds, and lists the runner list/register/delete endpoints along with the one-time registration token and its stored SHA-256 hash.
• Runtime Configuration — The app_settings typed key-value store, which takes effect without a restart: reading all or one setting, single and all-or-nothing batch writes, and the catalog of available keys with types and defaults. Also documents maintenance mode and the admin paths that stay reachable through it, the cross-replica propagation model that converges every replica on a write within seconds via Postgres LISTEN/NOTIFY plus a bounded fallback reload (and the stale-replica triage steps), the Redis-backed sliding-window rate limiter and its fail-open no-op behaviour when REDIS_URL is unset, and the auth.trusted_proxies CIDR allow-list that decides whether forwarded client-IP headers are honoured.
• Security Policy — Instance-wide security.* settings covering secret detection mode, SAST merge blocking on critical and high findings, signed-commit enforcement, password length, and session lifetime; the per-protected-branch require_pipeline gate and its differing merge, merge-request-open, and push behaviour; OAuth2 provider credentials, which are configurable only through admin settings and never through the environment; JWT_SECRET rotation and its immediate session invalidation; what SECRET_ENC_KEY seals, how the server boots in each key state, and the manual rotation procedure; plus 2FA enforcement, IP allow-listing, and maintenance mode.
• User Management — Admin account administration through /api/v1/admin/users: paginated search by username or email, fetching and creating accounts, partial updates including suspension via is_active, deletion and its cascade onto owned repositories, forced password reset, bulk revocation of personal access tokens, and short-lived impersonation tokens with their four-hour expiry and revocation endpoint.
• Audit Log — The append-only audit_log table that no application endpoint can delete from: the instance-wide and per-repository query endpoints with their pagination parameters, the admin single-event detail endpoint and its status codes, and the catalog of recorded actions spanning repository, authentication, token, ACL, admin, pipeline-gate, scan, and repository-transfer events. Also covers the chained transfer event set and its required details fields, direct SQL export for compliance, and why retention is implemented as a scheduled database job rather than an application delete.