vnatcap

Ops login (this is the admin key — no user/password)

You do not create an admin user. Status tools, allocate, support, WG overview, and funding pack all use one shared API token (header X-Api-Token). That is the same value as VNATCAP_API_TOKEN on the edge (/etc/vnatcap/api.env or ~/.config/vnatcap/api.token).

Google “Sign in” below is optional customer portal only (currently off when google_oauth=false). It is not required for admin/status tools.

API token (ops secret)

No token saved yet — paste token, click Save, then use Admin overview / Refresh.

# from ootp workstation
ssh -L 8000:127.0.0.1:8000 macdaddyroot
# get token (do not commit):
ssh macdaddyroot 'grep ^VNATCAP_API_TOKEN= /etc/vnatcap/api.env | cut -d= -f2-'
# or:  ssh macdaddyroot 'cat ~/.config/vnatcap/api.token'
# browser: http://127.0.0.1:8000/  → paste token → Save → Admin overview / Ops dashboard

Customer account (Google OAuth — optional, not ops admin)

Checking session…

Leave this alone for operator work. “Not signed in” is normal for ops. Only enable Google when customer self-serve portal is configured.

Sign in with Google

Ops allocate (uses API token above)

Email = tester identity (not their IP). System assigns next 199.242.9.x. Same token for all testers — there is no per-operator login. After allocate on edge: sudo ./scripts/provision-after-allocate.sh or full admit: sudo ./scripts/admit-tester.sh -e email -s slug

Tester email

Slug hint (hostname label)

Allocation

WireGuard client conf (secret)

Download conf

Client wg0 must have Address = <tunnel>/32. Remote VPS: use split tunnel, not full 0.0.0.0/0 over SSH.

Headscale / Tailscale (ops token)

If preauth says permission denied on config.yaml: sudo ./scripts/fix-headscale-api-access.sh. CLI one-shot admit (WG+welcome+HS): sudo ./scripts/admit-tester.sh --email you@x.com --slug name. Email only if SMTP on; else pack under /var/lib/vnatcap/welcome/<slug>/. Resend pack: ./scripts/make-welcome-pack.sh slug or --resend-welcome.

Optional dual path. Tunnel prefix 100.65.0.0/16 (WG stays 100.64.0.0/24). Requires edge deploy.

Slug (HS user)

Live WireGuard clients (ops token)

online = handshake ≤ 180s. Snapshot refreshed by exit-agent (~1 min).

Paste API token above, then Refresh.

Admin console (ops token)

Look up an account, adjust entitlements, edit peer rDNS, and freeze / cooldown / revoke from one place.

Target

Action

Reason

User email

Billing tier

Peer limit

Stripe customer id

Stripe subscription id

Stripe price id

Peer id for rDNS

Reverse DNS FQDN

Paste API token above, then lookup a target.

Funding pack (ops token)

Generate the current metrics + architecture + unit economics snapshot from live metering counters.

Use the API token to generate the pack.

Admin overview (ops token)

Live peer inventory and metering summary. Use the row actions to jump into lookup, freeze, cooldown, revoke, or rDNS editing.

Refresh the overview with the API token.

Peer	Public / tunnel	Status	rdns	Actions
Refresh the overview with the API token.

Ops dashboard headscale / tailscale / environment

Unified status screen for routing, overlay peers, and standard environment workflows.

Headscale

Refresh dashboard.

Waiting for live status…

Tailscale / WireGuard

Refresh dashboard.

Waiting for live status…

Best-practice tools

Use the same operational sequence every time: health first, overlay second, allocation and support last.

CLI mirrors: ./scripts/ops-checklist.sh · ./scripts/ops-status.sh

1. Refresh health and overlay status with ./scripts/ops-status.sh
      2. Check admin overview for active peers and metering drift
      3. Sync entitlement or update rDNS when needed
      4. Use funding pack before changing pricing or support policy
      5. Keep PLAN.md updated after each admin workflow

Public status

No token required. Live API / Headscale / BIRD health.

Loading…

Open status page · Legal drafts