Enable this installation
Nobody has taken ownership of this deployment yet, so it will not hand out names, shares or agents. The controller printed an installation token when it first started. Enter it to become an administrator and enable the platform.
It works once. Whoever presents it becomes the first administrator and can then promote colleagues from the Platform section.
Get started
Overview
The path your traffic takes
Getting started
Names and shares
A reservation is a name you hold. A share publishes something local under one — on the internet, or privately to people you name.
Reservations
Shares
Create a share
A private share gets no DNS record, no certificate, and no public port. Nothing on the internet can reach it; it exists for the platform's own access path.
Each share keeps its own, so two shares can serve two apps on two ports from one agent. It must be a loopback address, and an agent started with --upstream uses that instead.
Private access
Private services have no public address at all. Access is granted to named people, groups, or a whole domain — default deny, and a revocation cuts connections that are already open.
Private services
Groups
Activity
Live access sessions
Access history
Agents and tokens
An agent is a machine holding a tunnel out to the platform. An API token is for a script or a CI job. Both are credentials — each is shown once, and revoking one takes effect immediately.
Agents
To add a machine, run argus-agent enroll --label "$(hostname)" on it with an API token from below. It gets its own credential and stores it there — nothing to copy across.
API tokens
Platform
Every account, name, share and agent on this deployment — not just yours. Start at Health: it is the only section that says whether anything is wrong, rather than how much of everything there is.
Health
Webhooks
Where the platform tells somebody when a certificate fails, an edge goes silent, or an edge runs low on certificate slots. Everything fires on a change and again when it clears — nothing repeats while a condition holds. The body is signed with X-Argus-Signature; verify it, because a URL is not a secret.
Maintenance
Shown to every tenant whose change is refused. Traffic is unaffected — shares go on serving and no edge hears about this.
Edges
Traffic and totals
Activity
Who did what, newest first. Actor is who performed the action; account is whose it was done to — an administrator suspending somebody, or a visitor signing in to a share, differ in exactly that.
Export as CSV — the same rows you can see here, newest first, for an archive or an audit.
Feedback
What people using this deployment have said about it, newest first. Every message names the account that sent it, so it can be answered — and where they were when they wrote it, which is usually the fastest way to tell what they are describing.
Blocked paths
Paths the edges refuse on every hostname this deployment serves, before resolving the host and before anything is opened toward the developer's machine. Issuing a certificate publishes the hostname to public Certificate Transparency logs, and the scan for /.env arrives minutes later — usually before whoever reserved the name has finished their first deploy. These rules are what answers it instead of their app.
A refusal is 404 with no detail, so a scanner cannot tell a blocked path from one the tenant does not have. Changes reach each edge within 30s — including switching a rule off, so give it that long before concluding a rule is not the cause of something.
.env* matches that segment at any depth; /server-status the whole path; /debug/pprof/ everything beneath it. Case-insensitive, and .. is resolved first.
Replaces the whole set with what a new installation starts with, discarding anything added here.
Accounts
Names
Shares
Agents
Machine accounts
A machine account owns reservations and shares the way a person does, but offboarding a person never touches it. Its agent tokens are issued here and shown once; issue a new one to rotate, then revoke the old agent.