Admin Dashboard¶

Olla ships with a read-only, single-page dashboard at /internal/ui/, embedded in the binary and served on the same listener as the proxy. It answers "is my fleet healthy", "which backend is slow" and "which models are loaded where" at a glance, without curl-ing /internal/status* and reading JSON.

Getting there¶

With the shipped default config, start Olla and open:

http://localhost:40114/internal/ui/

The trailing slash matters: the SPA is mounted at that exact prefix and loads its assets relative to it. localhost is in the default allowed_hosts, and an IP-literal Host such as 127.0.0.1 is always accepted, so both work out of the box. A hostname not listed in allowed_hosts is rejected, even if it resolves to an allowed IP.

The three panels¶

Clicking a model's host jumps to that endpoint's row in the Endpoints panel. The active panel and any selected endpoint live in the URL hash, so refreshes and shared links restore the same view. The theme follows the browser's light/dark preference, with a toggle to override it.

Polling is jittered so multiple open tabs don't fire in lockstep, backs off while the tab is hidden, and flags a panel as stale when its data is older than expected.

Two columns are deliberately absent: circuit-breaker state (the breaker only trips on health probes, so it would under-report live failures) and per-model traffic (the proxy engines don't record per-model counts).

The frontend targets current evergreen browsers; older browsers are untested. Building the SPA is covered in Development Setup.

Configuration¶

The shipped default enables the dashboard with a loopback-only access policy:

dashboard:
  enabled: true
  access_policy:
    allowed_cidrs:
      - "127.0.0.0/8"
      - "::1/128"
    allowed_hosts:
      - "localhost"
  gate_internal_api: false

enabled: false is a genuine off switch: no /internal/ui/* routes are registered and requests get the default 404, so the mount point is not discoverable when disabled.

Startup fails if allowed_cidrs is empty or a CIDR does not parse.

Widening access¶

LAN access¶

Add the client subnet, plus any non-IP hostname you will type into the browser:

dashboard:
  enabled: true
  access_policy:
    allowed_cidrs:
      - "127.0.0.0/8"
      - "::1/128"
      - "10.0.1.0/24"
    allowed_hosts:
      - "olla.internal.example.net"
  gate_internal_api: false

Browsing by IP (http://10.0.1.5:40114/internal/ui/) needs no allowed_hosts entry; browsing by hostname does.

Docker¶

The published image ships ready to go: it binds 0.0.0.0 and the dashboard's allowed_cidrs is pre-widened to the private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), so a request arriving through a published port - which comes from the Docker bridge gateway, not loopback - is accepted. The dashboard loads with no extra configuration:

docker run -p 40114:40114 ghcr.io/thushan/olla:latest
# then open http://localhost:40114/internal/ui/

services:
  olla:
    image: ghcr.io/thushan/olla:latest
    ports:
      - "40114:40114"
    # No volume required for the dashboard. Mount one only to customise the
    # config; it lands at the first path in Olla's config search order, so it
    # overrides the baked-in container defaults.
    # volumes:
    #   - ./olla.local.yaml:/app/config/config.local.yaml:ro

The Host check is unchanged, so reaching the container by a non-IP hostname (from another compose service, or via a DNS name on your LAN) still needs that name in allowed_hosts. localhost and any IP literal work as shipped.

Security model¶

The dashboard has no authentication, consistent with the rest of /internal/*. The access policy is the only control, enforced per request. Binding the listener to loopback is not an alternative: the proxy legitimately binds 0.0.0.0 (the shipped config.yaml does), and the dashboard shares that listener.

The two checks¶

Every request must pass both; failure returns 403 Forbidden.

1. Client IP within allowed_cidrs. The IP is the TCP source address. X-Forwarded-For and X-Real-IP are never consulted, under any configuration.
2. Host header parses as an IP literal, or matches allowed_hosts (port stripped, case-insensitive). Any Host that parses as an IP literal is accepted unconditionally, whatever address it names - it is not checked against the connection's actual destination. This check exists to block DNS-rebinding-style hostnames, not to bind the request to a specific IP; allowed_cidrs is the real security boundary. A non-IP Host is rejected unless listed.

A failed check returns a body naming what failed and what Olla saw, with a matching Warn log line:

403 forbidden: ip not in allowed range (ip=172.17.0.1, host=172.17.0.1:40114)
403 forbidden: host not accepted (ip=10.0.1.5, host=olla.corp.example:40114)

Scope and limits¶

• The gate covers /internal/ui/ only. The JSON endpoints the dashboard reads (/internal/status*, /internal/health, /internal/metrics, /version) stay as reachable as they already were; gating the UI does not gate the data it renders. gate_internal_api is reserved to close that gap in a future release.
• Anyone inside allowed_cidrs with an accepted Host can read the dashboard. Widening the CIDR is a deliberate trade of exposure for convenience.
• The container image ships that trade already made. Its allowed_cidrs covers the private ranges so the dashboard works through a published port, which also admits anyone on the same LAN. Mount a config narrowing it to the bridge subnet if the host sits on an untrusted network.

Troubleshooting¶

After changing dashboard.*, restart Olla and check from the same host:

curl -i http://127.0.0.1:40114/internal/ui/