Admin Console

The operator console (krizaka/orochia-admin) is a separate application with its own database, its own single account and its own network gate. It never touches Orochia's database: every decision goes through Orochia's admin API (/api/admin/*, listed in the API reference), server side, with a service token the browser never sees. What an operator decides is recorded in the console's own log.

The operator reaches the console from an allowed IP only, with its one account; the console keeps its account, sessions and operator log in its own PostgreSQL, and calls Orochia server-side on /api/admin/* with the service token — never the Orochia database.

What you controlCopy Anchor Link

ScreensCopy Anchor Link

Captured on a local development stack (e-mail addresses and the operator's name redacted).

Overview — the three queues that need a human, and the ledger.

Accounts — every account, its role, its checks and its state.

Platform & Database — deployment, migrations, backups and rows per table.

The factory reset — backup first by default, locked until the phrase is typed.

How it is securedCopy Anchor Link

Four gates, each enforced in code:

1. The network. Every request — the sign-in page included — is refused with 403 unless the client address is in ADMIN_ALLOWED_IPS (comma-separated). On DigitalOcean the address is do-connecting-ip, set by the platform's edge, never by the client. In production the list is mandatory: empty, the console answers 403 to everyone. Only the liveness route /api/health (no data) is outside it.
2. One account. Nobody signs up. The single operator is defined by environment — ADMIN_EMAIL, ADMIN_NAME, ADMIN_PASSWORD (12 characters or more) — and written to the console's database on first use. The password is stored as a salted scrypt hash and compared in constant time. Sessions are random tokens stored hashed, valid 8 hours, in an httpOnly, SameSite=Strict cookie. Changing the password in the environment revokes every open session.
3. A service token. The console calls Orochia as a service: Authorization: Bearer OROCHIA_ADMIN_API_TOKEN (32 characters or more, shared by the two deployments only), compared in constant time. Orochia accepts it on its ADMIN routes only, and acts as the platform owner (OROCHIA_OWNER_EMAIL), who must exist, be an administrator and not be suspended — otherwise every call is refused. Without the variable, no token is accepted.
4. Armed confirmations. Every decision opens a dialog that says what will happen before it does. A decision that affects someone requires a recorded reason (a takedown, a suspension, a failed payout, a cancelled auction) or the transfer reference (a settled payout). Irreversible operations are armed by a phrase: the operator types it before the button works. Benign, reversible steps (start a review, reopen a report) are one click.

Every decision — done or refused, with its target and detail — is written to the operator log, shown on Platform & Database.

Backups and factory resetCopy Anchor Link

• Backup now writes the whole database (gzipped JSON of every table) to private storage; backups can be described, downloaded and deleted from the console.
• Factory reset deletes every account, video, payment, auction and setting and rebuilds the schema from the release's migrations — the state of a fresh install. Orochia's owner account is kept; the console, its account and its log live in their own database and are not affected; media files at Bunny are not deleted. It is available only where OROCHIA_ALLOW_DATABASE_RESET=true and never on the public, indexed production, whatever the flag says. The operator must type reset <database name>; "back up first" is on by default, and if that backup fails nothing is deleted.

Run it locallyCopy Anchor Link

Start Orochia first, with the same OROCHIA_ADMIN_API_TOKEN in its .env, then:

git clone https://github.com/krizaka/orochia-admin.git && cd orochia-admin
cp .env.example .env.local      # its database, the operator account, the token shared with Orochia
docker exec orochia-postgres-dev psql -U orochia_user -d orochia_db -c "CREATE DATABASE orochia_admin"
npm install
npm run dev                     # http://localhost:3001 — sign in with ADMIN_EMAIL / ADMIN_PASSWORD

Locally (outside production) an empty ADMIN_ALLOWED_IPS lets every address in. On a deployment, deploy/Dockerfile builds a standalone image (port 3001); ADMIN_PASSWORD and OROCHIA_ADMIN_API_TOKEN are app secrets, never in git.

Product overview →