mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-28 03:06:57 +00:00
feat(pricing): collapse to two tiers (#1309)
* feat(pricing): collapse to two tiers (Community + Admiral) Collapse Sencho's pricing from three tiers (Community / Skipper / Admiral) to two: a generous free Community tier and a single paid Admiral tier. The Skipper tier is removed. Now free in Community: auto-heal, auto-update, scheduled operations, webhooks, notification routing, Fleet Actions and bulk operations, SSO preset providers (Google / GitHub / Okta), unlimited users with admin and viewer roles, and deploy safety (atomic deploys, auto-rollback, and one-click rollback). Admiral (paid) is focused on running and governing a fleet: blueprints, Fleet Secrets, deploy enforcement, vulnerability report export, audit log, host console, private registries, mesh networking, node cordon, managed cloud backup, LDAP / Active Directory SSO, and the advanced RBAC roles (deployer, node-admin, auditor) with per-resource scoped assignments. Internally the license variant distinction is removed so tier is binary (community / paid). License validation still verifies the Lemon Squeezy store and product before granting paid status. Docs and the contributor guide are updated to the two-tier model. * docs(pricing): correct licensing page to two-tier pricing and tidy stale tier wording The licensing docs page kept the old Admiral pricing plus a Founder Lifetime column and an Enterprise paragraph after the two-tier collapse. Update it to $12/month or $99/year, drop the lifetime and Enterprise content, and link to the pricing page for current pricing. Also fix stale "Skipper" wording in CLA.md, SUPPORT.md, one test title, and three test comments. Historical CHANGELOG entries and the retired-Skipper license-guard test are intentionally left as-is. * docs: align licensing and SSO pages with the two-tier model Correct the SSO overview so the Google, GitHub, and Okta presets read as available on every tier, matching the provider table; only LDAP and Active Directory require Sencho Admiral. Remove the lifetime-plan references from the licensing, settings, and troubleshooting pages so they reflect subscription-only Admiral pricing. * fix(rbac): omit scoped permissions from /me on the Community tier Scoped role assignments only take effect on the paid tier, but GET /api/permissions/me returned them unconditionally, so a downgraded instance with leftover assignments rendered per-resource affordances the API then rejected with 403. The endpoint now mirrors the permission middleware and includes scoped permissions only on the paid tier. Adds a regression test covering the downgrade case. * docs: use custom-pricing wording on the contact page The two-tier model has no Enterprise tier; reword the contact page's enterprise pricing/deals to custom pricing/deals so it does not imply a tier that no longer exists.
This commit is contained in:
Anso
@@ -67,8 +67,7 @@ The `code` field is present for specific error types:
|
||||
|
||||
| Code | Meaning |
|
||||
|------|---------|
|
||||
| `PAID_REQUIRED` | Endpoint requires a Skipper or Admiral license |
|
||||
| `ADMIRAL_REQUIRED` | Endpoint requires an Admiral license |
|
||||
| `PAID_REQUIRED` | Endpoint requires an Admiral license |
|
||||
| `SCOPE_DENIED` | API token scope does not allow this operation |
|
||||
|
||||
## Input validation
|
||||
@@ -117,10 +116,9 @@ Some endpoints are gated by license tier:
|
||||
|
||||
| Tier | Gated features |
|
||||
|------|---------------|
|
||||
| **Skipper+** | Webhooks, Fleet snapshots, Stack rollback |
|
||||
| **Admiral** | Scheduled Tasks |
|
||||
| **Admiral** | Scan policies, Private registries |
|
||||
|
||||
Requests to gated endpoints on a lower tier return `403` with the appropriate error code.
|
||||
Requests to gated endpoints on Community return `403` with the `PAID_REQUIRED` error code.
|
||||
|
||||
## WebSocket endpoints
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@ description: Automate scan policies, CVE suppressions, and vulnerability scans f
|
||||
|
||||
The Security API lets you manage scan policies, CVE suppressions, and trigger vulnerability scans from CI pipelines and automation scripts. Every endpoint in this reference is intended for external automation; internal frontend-only endpoints (finding listings, SARIF downloads) are not documented here.
|
||||
|
||||
All endpoints require [Bearer token authentication](/api-reference/overview#authentication). Manual scans, secret and misconfiguration results, scan comparison, and CVE suppressions are available on every tier. Scan policies (with `block_on_deploy` enforcement), SBOM, and SARIF stay on Skipper or Admiral. See the per-endpoint **License** row for details.
|
||||
All endpoints require [Bearer token authentication](/api-reference/overview#authentication). Manual scans, secret and misconfiguration results, scan comparison, and CVE suppressions are available on every tier. Scan policies (with `block_on_deploy` enforcement), SBOM, and SARIF require Admiral. See the per-endpoint **License** row for details.
|
||||
|
||||
## Scan policies
|
||||
|
||||
@@ -17,7 +17,7 @@ Writes are admin-only and rejected on replica nodes (policies are managed on the
|
||||
|
||||
**`GET /api/security/policies`**
|
||||
|
||||
**License:** Skipper or Admiral
|
||||
**License:** Admiral
|
||||
|
||||
```bash
|
||||
curl -H "Authorization: Bearer YOUR_API_TOKEN" \
|
||||
@@ -48,7 +48,7 @@ curl -H "Authorization: Bearer YOUR_API_TOKEN" \
|
||||
|
||||
**`POST /api/security/policies`**
|
||||
|
||||
**License:** Skipper or Admiral · **Role:** Admin
|
||||
**License:** Admiral · **Role:** Admin
|
||||
|
||||
| Field | Type | Required | Description |
|
||||
|-------|------|:--------:|-------------|
|
||||
@@ -84,7 +84,7 @@ curl -X POST https://your-sencho-instance:1852/api/security/policies \
|
||||
|
||||
**`PUT /api/security/policies/{id}`**
|
||||
|
||||
**License:** Skipper or Admiral · **Role:** Admin
|
||||
**License:** Admiral · **Role:** Admin
|
||||
|
||||
Any of the create fields can be updated individually. Omitted fields are left unchanged.
|
||||
|
||||
@@ -103,7 +103,7 @@ curl -X PUT https://your-sencho-instance:1852/api/security/policies/1 \
|
||||
|
||||
**`DELETE /api/security/policies/{id}`**
|
||||
|
||||
**License:** Skipper or Admiral · **Role:** Admin
|
||||
**License:** Admiral · **Role:** Admin
|
||||
|
||||
```bash
|
||||
curl -X DELETE https://your-sencho-instance:1852/api/security/policies/1 \
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
title: Alerts & Notifications
|
||||
description: Threshold and event alerts for your fleet, dispatched to Discord, Slack, or any webhook, with per-stack rules and Skipper routing.
|
||||
description: Threshold and event alerts for your fleet, dispatched to Discord, Slack, or any webhook, with per-stack rules and channel routing.
|
||||
---
|
||||
|
||||
Sencho watches each node it manages for container crashes, host pressure, scheduled-task results, and update availability, then surfaces every signal in two places: the in-app notification bell at the top of the shell and one of three external channels you configure. This page covers everything from configuring channels to writing per-stack threshold rules, routing alerts to dedicated channels with Skipper routing rules, and tuning retention.
|
||||
Sencho watches each node it manages for container crashes, host pressure, scheduled-task results, and update availability, then surfaces every signal in two places: the in-app notification bell at the top of the shell and one of three external channels you configure. This page covers everything from configuring channels to writing per-stack threshold rules, routing alerts to dedicated channels with routing rules, and tuning retention.
|
||||
|
||||
<Frame>
|
||||
<img src="/images/alerts-notifications/notifications-settings.png" alt="Settings · Notifications panel showing the Discord, Slack, and Webhook tabs with the masthead breadcrumb, the CHANNELS 3/3 stat, the active Discord tab with its Enabled toggle on, the Webhook URL input, and the Test and Save actions." />
|
||||
@@ -51,7 +51,7 @@ Each dispatch is a single-shot HTTP POST with a 10-second `AbortSignal.timeout`.
|
||||
## Notification Routing
|
||||
|
||||
<Note>
|
||||
Notification Routing requires a **Sencho Skipper or Admiral** license. Admin role is required to create, edit, or delete routes.
|
||||
Admin role is required to create, edit, or delete routes.
|
||||
</Note>
|
||||
|
||||
Routing lets you direct alerts that match specific criteria to dedicated channels. Production crashes can land in `#prod-incidents` on Slack while staging notifications go to a less urgent Discord channel, all without juggling per-channel webhook URLs across teams.
|
||||
|
||||
@@ -110,7 +110,7 @@ Clicking **Deploy** runs the following sequence:
|
||||
2. **Directory creation.** A new directory is created under `COMPOSE_DIR/<stack-name>` on the active node.
|
||||
3. **File generation.** Sencho writes `compose.yaml` (rendered from the template, with your port and volume overrides) and a `.env` file (when you configured environment variables).
|
||||
4. **Policy gate.** Any [deploy-enforcement policies](/features/deploy-enforcement) configured on the node run against the generated compose. If a rule blocks the deploy, the directory is cleaned up and you get the rule's reason.
|
||||
5. **`docker compose up -d`.** On Skipper and Admiral the deploy is **atomic**: any container that fails to start triggers an automatic rollback to the previous state. On Community the deploy is non-atomic.
|
||||
5. **`docker compose up -d`.** The deploy is **atomic**: any container that fails to start triggers an automatic rollback to the previous state.
|
||||
6. **Outcome.**
|
||||
- On success, you are switched to the editor for the new stack and a success toast confirms the deploy.
|
||||
- On failure, Sencho parses the error. Most failures (image pull, port collision, volume permission, compose validation) trigger a clean rollback: the stack is brought down and the directory is removed. A small set of failures that point to live containers (for example, a startup that crashes after the container is running) leave the stack on disk so you can inspect it. The error toast tells you which.
|
||||
|
||||
@@ -7,10 +7,6 @@ Sencho wraps every protected deploy in a four-step safety net: it copies the cur
|
||||
|
||||
The same backup also powers the **Rollback** action in the stack editor, so you can roll a stack back to its last good configuration on demand.
|
||||
|
||||
<Note>
|
||||
Atomic Deployments require a Sencho **Skipper** or **Admiral** license. Community Edition runs the same compose actions without a backup or automatic rollback.
|
||||
</Note>
|
||||
|
||||
## How it works
|
||||
|
||||
1. **Backup.** Before the action runs, Sencho copies `compose.yaml` (or `compose.yml` / `docker-compose.yaml` / `docker-compose.yml`) and `.env`, if present, into the backup directory. The deploy progress modal streams `=== Backup created for atomic deployment ===` once the copy completes, before any `docker compose` output.
|
||||
@@ -33,13 +29,13 @@ A scheduled image-update task uses the same atomic wrapper as a manual update, s
|
||||
|
||||
## Manual rollback
|
||||
|
||||
The stack editor's action bar carries a **More actions** overflow menu (the three-dot icon next to **Update**). Open it on a Skipper or Admiral instance and you'll see **Rollback** at the top, with the timestamp of the most recent backup rendered beneath the label. Selecting it restores the backed-up files and re-runs `docker compose up -d` non-atomically, to avoid nesting a rollback inside another atomic wrapper and overwriting the good backup with the broken state from the just-failed deploy.
|
||||
The stack editor's action bar carries a **More actions** overflow menu (the three-dot icon next to **Update**). Open it and you'll see **Rollback** at the top, with the timestamp of the most recent backup rendered beneath the label. Selecting it restores the backed-up files and re-runs `docker compose up -d` non-atomically, to avoid nesting a rollback inside another atomic wrapper and overwriting the good backup with the broken state from the just-failed deploy.
|
||||
|
||||
<Frame>
|
||||
<img src="/images/atomic-deployments/rollback-menu.png" alt="Stack editor action bar with the More actions overflow menu open, showing the Rollback entry at the top with the backup timestamp rendered beneath the label, followed by Scan config and Delete entries" />
|
||||
</Frame>
|
||||
|
||||
The menu entry is hidden when no backup exists for the stack, for example on a freshly created stack that has never been deployed atomically, and on a Community Edition instance. The endpoint additionally requires the `stack:deploy` permission, so a user without it will see the menu entry but receive a permission error if they invoke it.
|
||||
The menu entry is hidden when no backup exists for the stack, for example on a freshly created stack that has never been deployed. The endpoint additionally requires the `stack:deploy` permission, so a user without it will see the menu entry but receive a permission error if they invoke it.
|
||||
|
||||
## Where backups are stored
|
||||
|
||||
@@ -49,18 +45,11 @@ Each backup is a flat copy of the compose file Sencho found, plus `.env` if it e
|
||||
|
||||
A restore is a faithful revert, not an overlay. Sencho replaces the compose file and `.env` with the backed-up copies and removes any compose variant or `.env` that was added after the backup was taken, so the stack returns to exactly the file set it had before the run. For example, if a deploy switched the stack from `compose.yaml` to `docker-compose.yml` or introduced a new `.env`, a rollback undoes both. Files Sencho does not manage are left untouched.
|
||||
|
||||
## Community Edition behavior
|
||||
|
||||
On Community Edition, Sencho runs the same `docker compose` commands without the atomic wrapper. There is no backup, no health probe, and no automatic rollback, and the **Rollback** menu entry is hidden. On a Skipper or Admiral license, atomic deployments are active immediately for every protected action; no configuration is required.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="The Rollback option is not in the More actions menu">
|
||||
Sencho hides the entry whenever a rollback is not possible. The most common reasons are:
|
||||
|
||||
- The stack has never been deployed atomically, so no backup file exists yet. Run **Deploy** or **Update** once and the entry will appear.
|
||||
- The instance is on Community Edition. Atomic Deployments require Skipper or Admiral.
|
||||
Sencho hides the entry whenever a rollback is not possible. The most common reason is that the stack has never been deployed, so no backup file exists yet. Run **Deploy** or **Update** once and the entry will appear.
|
||||
|
||||
A user without the `stack:deploy` permission will still see the menu entry; the rejection comes from the backend with a permission error after they click. Ask an admin to grant `stack:deploy` through **Settings · Roles & Access** if that happens.
|
||||
</Accordion>
|
||||
|
||||
@@ -4,7 +4,7 @@ description: Track every mutating action on your Sencho instance with a searchab
|
||||
---
|
||||
|
||||
<Note>
|
||||
The Audit Log requires a Sencho **Admiral** license. Skipper and Community do not include this feature.
|
||||
The Audit Log requires a Sencho **Admiral** license.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
@@ -170,7 +170,7 @@ Sensitive database values (such as remote node API tokens) are encrypted at rest
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="The Audit tab is missing from the sidebar">
|
||||
The tab is visible only on **Admiral**, and only to users whose role grants the `system:audit` permission. By default that means **Admin** or **Auditor**. If your license is Community or Skipper, the tab is gated by the audit-log capability and will not render. If you are signed in as a Deployer or Viewer on an Admiral instance, ask an admin to assign you the Auditor role from **Settings · Users**.
|
||||
The Audit log requires an **Admiral** license, and the tab is shown only to users whose role grants the `system:audit` permission. By default that means **Admin** or **Auditor**. If you are signed in as a Deployer or Viewer on an Admiral instance, ask an admin to assign you the Auditor role from **Settings · Users**.
|
||||
</Accordion>
|
||||
<Accordion title="Stream view shows everything but I want to filter to a specific user, action, or date">
|
||||
Filters live in **Table view only**. Toggle the segmented control in the card header from **Stream** to **Table** and the search box, method dropdown, and From / To date pickers will appear above the grid. Switching back to Stream clears the filter strip but does not remember the last filter.
|
||||
|
||||
@@ -3,10 +3,6 @@ title: "Auto-Heal Policies"
|
||||
description: "Restart containers that fail their Docker healthcheck or crash, with per-policy thresholds and a built-in safety rail set."
|
||||
---
|
||||
|
||||
<Note>
|
||||
Auto-Heal Policies require a **Skipper** or **Admiral** license.
|
||||
</Note>
|
||||
|
||||
## Overview
|
||||
|
||||
Auto-Heal Policies restart a container when it stays broken for longer than you allow. A policy acts on two conditions:
|
||||
@@ -24,7 +20,6 @@ Policies live next to your stack-level alert rules in the stack's **Monitor** sh
|
||||
|
||||
- For **healthcheck-based** healing, containers must declare a `HEALTHCHECK` in the Dockerfile or a `healthcheck` block in `docker-compose.yml` so they report a Docker health status. **Crash-based** healing needs no healthcheck: any container that exits with a non-zero code qualifies.
|
||||
- You must be signed in as an admin.
|
||||
- A Skipper or Admiral license.
|
||||
|
||||
<Note>
|
||||
Crash healing acts on crashes Sencho observes while it is running. A container that crashed before Sencho started is left for you to inspect rather than restarted automatically.
|
||||
@@ -142,6 +137,6 @@ The dashboard's **Configuration status** card surfaces an **Auto-heal policies**
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="I cannot see the Auto-heal tab on a stack">
|
||||
Auto-Heal Policies require a Skipper or Admiral license and an admin sign-in. If the **Auto-heal** tab is not present on the **Monitor** sheet, confirm your license tier under **Settings → License** and that you are signed in as an admin.
|
||||
Configuring Auto-Heal Policies requires an admin sign-in. If the **Auto-heal** tab is not present on the **Monitor** sheet, confirm you are signed in as an admin.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
@@ -3,10 +3,6 @@ title: "Auto-Update Policies"
|
||||
description: "Review pending container updates across your fleet, with risk badges, changelogs, and scheduled run times, before applying."
|
||||
---
|
||||
|
||||
<Note>
|
||||
Auto-Update Policies require a **Skipper** or **Admiral** license.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
Auto-Update is hub-only and is hidden from the nav strip when a remote node is the active selection. See [Multi-Node Management](/features/multi-node#what-top-level-views-show-when-a-remote-node-is-active).
|
||||
</Note>
|
||||
|
||||
@@ -8,7 +8,7 @@ A **Blueprint** bundles a `docker-compose.yml` with a node selector and a drift
|
||||
Blueprints live under **Fleet · Deployments**.
|
||||
|
||||
<Note>
|
||||
Blueprints require a Sencho **Skipper** or **Admiral** license. Creating, editing, and withdrawing blueprints requires an admin role; operators and viewers can read the catalog and the detail sheet. Pinning a blueprint to a single node requires Admiral.
|
||||
Blueprints require a Sencho **Admiral** license. Creating, editing, withdrawing, and pinning blueprints requires an admin role; operators and viewers can read the catalog and the detail sheet.
|
||||
</Note>
|
||||
|
||||
<Frame caption="Fleet · Deployments catalog with blueprint tiles, the All / Drifted / Observe / Suggest / Enforce filter chips, and the New Blueprint action in the top-right.">
|
||||
@@ -47,7 +47,7 @@ Drift detection runs on every tick for every Active deployment regardless of pol
|
||||
|
||||
| Requirement | Detail |
|
||||
|---|---|
|
||||
| License tier | **Skipper** or **Admiral** to read, create, edit, and withdraw blueprints. **Admiral** to pin a blueprint to a node from the Federation tab. |
|
||||
| License tier | **Admiral** to read, create, edit, withdraw, and pin blueprints. |
|
||||
| User role | **Admin** to create, edit, withdraw, accept, and pin. Operators and viewers can read the catalog and the detail sheet. |
|
||||
| Nodes | At least one node that the selector resolves to. Remote nodes need a healthy proxy connection; see [Multi-node management](/features/multi-node) and [Pilot Agent](/features/pilot-agent) for enrollment. |
|
||||
| Compose YAML | Valid `docker-compose.yml`, 96 KiB or fewer. |
|
||||
@@ -251,7 +251,7 @@ Both events route through the standard alert pipeline. Configure delivery channe
|
||||
|
||||
## Security and trust boundaries
|
||||
|
||||
**Who can do what.** The license tier and the user role together determine the available actions. Reading the catalog, the detail sheet, and the deployment status requires Skipper or Admiral. Creating, editing, withdrawing, accepting a stateful deploy, and applying on demand require the admin role on top of the tier. Pinning a blueprint requires Admiral plus the admin role.
|
||||
**Who can do what.** The license tier and the user role together determine the available actions. Reading the catalog, the detail sheet, and the deployment status requires Admiral. Creating, editing, withdrawing, accepting a stateful deploy, applying on demand, and pinning a blueprint require the admin role on top of the Admiral tier.
|
||||
|
||||
**The marker file is the trust root.** The reconciler will only deploy into, modify, or withdraw a directory that carries a `.blueprint.json` marker whose blueprint ID matches. A pre-existing directory with no marker, or a marker referencing a different blueprint, surfaces as **Name conflict** and is never modified.
|
||||
|
||||
|
||||
@@ -93,14 +93,12 @@ The card is divided into four sections.
|
||||
|
||||
### Automation
|
||||
|
||||
The Automation block only renders on Skipper or Admiral.
|
||||
|
||||
| Row | What it shows |
|
||||
|-----|---------------|
|
||||
| **Auto-heal policies** | `<enabled> / <total> active` for crash-recovery policies across all stacks; reads `None` when no policies exist |
|
||||
| **Auto-update schedules** | `<enabled> / <total> active` count of `Auto-update Stack` / `Auto-update All Stacks` rows configured for this node; reads `None` when none are configured |
|
||||
| **Webhooks** (Skipper) | Active inbound deploy webhooks tied to Git Sources or stacks, formatted `<n> actives` |
|
||||
| **Scheduled tasks** (Admiral) | Active scheduled operations (backups, restarts, scripts), formatted `<n> actives` |
|
||||
| **Webhooks** | Active inbound deploy webhooks tied to Git Sources or stacks, formatted `<n> actives` |
|
||||
| **Scheduled tasks** | Active scheduled operations (backups, restarts, scripts), formatted `<n> actives` |
|
||||
|
||||
### Security
|
||||
|
||||
@@ -108,7 +106,7 @@ The Automation block only renders on Skipper or Admiral.
|
||||
|-----|---------------|
|
||||
| **MFA** | `On` when TOTP is configured for the signed-in operator, `Off` when configured but disabled, `Not set up` when there is no MFA secret on file |
|
||||
| **SSO** | The active SSO provider name (`OIDC`, `Google`, `GitHub`, `Okta`, `LDAP`); reads `Off` when SSO is not enabled |
|
||||
| **Vulnerability scanning** (Skipper) | Count of enabled scan policies on the active node; reads `None` when no policy is enabled |
|
||||
| **Vulnerability scanning** (Admiral) | Count of enabled scan policies on the active node; reads `None` when no policy is enabled |
|
||||
|
||||
### Backups & Thresholds
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ description: "Block deploys that violate a scan policy before docker compose up
|
||||
Deploy enforcement is the pre-flight half of Sencho's vulnerability workflow. When a [scan policy](/features/vulnerability-scanning#scan-policies) with **Block on deploy** enabled matches a stack, Sencho scans every image referenced by the stack's compose file before starting any container. If any image meets or exceeds the policy's severity threshold, the deploy is rejected and the stack never starts. Detection always continues post-deploy and on a schedule, so images that develop new vulnerabilities after the initial deploy still surface through alerts.
|
||||
|
||||
<Note>
|
||||
Deploy enforcement and scan policies require a **Skipper** or **Admiral** license.
|
||||
Deploy enforcement and scan policies require an **Admiral** license.
|
||||
</Note>
|
||||
|
||||
## Configuring a block policy
|
||||
|
||||
@@ -37,8 +37,8 @@ The action bar runs every state transition for the whole stack. The primary butt
|
||||
|
||||
The kebab dropdown carries:
|
||||
|
||||
- **Rollback `<timestamp>`** restores the previous deployment using the stored snapshot. Visible only when a backup exists. Skipper or Admiral.
|
||||
- **Scan config** runs Trivy against the compose configuration and surfaces misconfigurations inline. Visible only when Trivy is reachable. Admin role required. Skipper or Admiral.
|
||||
- **Rollback `<timestamp>`** restores the previous deployment using the stored snapshot. Visible only when a backup exists.
|
||||
- **Scan config** runs Trivy against the compose configuration and surfaces misconfigurations inline. Visible only when Trivy is reachable. Admin role required.
|
||||
- **Delete** stops the stack and removes its compose directory. Requires the `stack:delete` permission.
|
||||
|
||||
## Containers list
|
||||
|
||||
@@ -4,7 +4,7 @@ description: Snapshot compose files across all nodes for disaster recovery and a
|
||||
---
|
||||
|
||||
<Note>
|
||||
Manual fleet snapshots are available on every tier (admin role required). Scheduled fleet snapshots are a Skipper or Admiral feature.
|
||||
Manual and scheduled fleet snapshots are available on every tier (admin role required).
|
||||
</Note>
|
||||
|
||||
Create point-in-time snapshots of every `compose.yaml` and `.env` file across your entire fleet, local and remote nodes alike. Snapshots are stored centrally in Sencho's database and can be browsed, previewed, and restored at any time.
|
||||
|
||||
@@ -12,7 +12,7 @@ The unit of work is the **bundle**. One bundle has one current `kv` payload; pus
|
||||
</Frame>
|
||||
|
||||
<Note>
|
||||
Fleet Secrets is a Skipper feature. Every action requires an admin user role.
|
||||
Fleet Secrets is an Admiral feature. Every action requires an admin user role.
|
||||
</Note>
|
||||
|
||||
## What Fleet Secrets covers (and what it doesn't)
|
||||
@@ -38,7 +38,7 @@ A **push** is a separate action. It reads the bundle's current version, walks ev
|
||||
|
||||
| Requirement | Why it matters |
|
||||
|---|---|
|
||||
| Skipper or Admiral license on the control instance | The tab and the underlying actions are paid; this is the same gate that opens Blueprints and Fleet Federation |
|
||||
| Admiral license on the control instance | Fleet Secrets is an Admiral feature |
|
||||
| Admin user role | Bundle CRUD and push run as the signed-in operator and write authored-by rows into the audit log |
|
||||
| At least one stack on at least one node | Pushes target an existing stack directory; the wizard does not create stacks |
|
||||
| The target stack's compose declares the env file via `env_file:` | The env-file dropdown in the push wizard reads `env_file:` entries from a representative node's compose; a stack with only an inline `environment:` block will not show up |
|
||||
|
||||
@@ -43,13 +43,13 @@ The Fleet view is a tab strip. Four tab triggers are visible to every tier; the
|
||||
| Tab | Tier | What it does |
|
||||
|-----|------|--------------|
|
||||
| **Overview** | Community | The grid or topology view of every node and its health. Covered in the next section. |
|
||||
| **Snapshots** | Community (manual) / Skipper (scheduled) | Snapshot every compose file across the fleet. See [Fleet-Wide Backups](/features/fleet-backups). |
|
||||
| **Snapshots** | Community | Snapshot every compose file across the fleet. See [Fleet-Wide Backups](/features/fleet-backups). |
|
||||
| **Status** | Community | One card per node summarising which automations and security features are configured. Covered below. |
|
||||
| **Deployments** | Skipper | Blueprint deployments and reconciler state. See [Blueprints](/features/blueprint-model). |
|
||||
| **Deployments** | Admiral | Blueprint deployments and reconciler state. See [Blueprints](/features/blueprint-model). |
|
||||
| **Routing** | Admiral | Cross-node service routing via Sencho Mesh. See [Sencho Mesh](/features/sencho-mesh). |
|
||||
| **Federation** | Admiral | Cordon nodes and pin blueprints to specific hosts. See [Fleet Federation](/features/fleet-federation). |
|
||||
| **Fleet Actions** | Community (admin role) | Fleet-wide bulk operations: stop stacks by label, bulk-assign labels, prune Docker resources. See [Fleet Actions](/features/fleet-actions). |
|
||||
| **Secrets** | Skipper | Encrypted env-var bundles you push to labeled nodes. See [Fleet Secrets](/features/fleet-secrets). |
|
||||
| **Secrets** | Admiral | Encrypted env-var bundles you push to labeled nodes. See [Fleet Secrets](/features/fleet-secrets). |
|
||||
|
||||
### Action buttons
|
||||
|
||||
@@ -133,7 +133,7 @@ The graph is interactive: drag the canvas to pan, scroll to zoom, drag a node to
|
||||
|
||||
The graph re-lays out only when nodes are added, removed, or change type. Live metric updates on existing nodes do not move the layout, so an operator who has dragged nodes into a custom arrangement keeps it.
|
||||
|
||||
#### Topology layout modes (Skipper+)
|
||||
#### Topology layout modes
|
||||
|
||||
A toolbar at the top of the topology canvas offers three layouts. Pick the one that matches how you reason about your fleet.
|
||||
|
||||
@@ -191,7 +191,7 @@ Online nodes render a two-column summary grid with up to eight rows:
|
||||
|-----|---------------|------------|
|
||||
| **Agents** | Active notification agents, formatted `<n> active` or `None` | Always |
|
||||
| **Alert rules** | Per-stack alert rule count, formatted `<n> rule(s)` | Always |
|
||||
| **Auto-heal** | Enabled / total auto-heal policies, formatted `<enabled>/<total>` | Skipper or Admiral |
|
||||
| **Auto-heal** | Enabled / total auto-heal policies, formatted `<enabled>/<total>` | Always |
|
||||
| **Webhooks** | Active outbound webhooks, formatted `<n> active` | Always (when not gated) |
|
||||
| **MFA** | `On`, `Off`, or `Not set` | Local node only |
|
||||
| **Scanning** | Active vulnerability-scan policies, formatted `<n> policy/policies` | Always (when not gated) |
|
||||
|
||||
@@ -25,7 +25,7 @@ The palette groups results into three sections.
|
||||
|
||||
| Group | What it contains | What happens when you pick one |
|
||||
|-------|------------------|--------------------------------|
|
||||
| **Pages** | The same set of destinations the top bar shows you. Home, Fleet, Resources, App Store, and Logs always appear; Auto-Update appears for admins on Skipper or higher; Console and Schedules appear for admins on Admiral; Audit appears for any role on Admiral with the audit permission. | Navigates to that page |
|
||||
| **Pages** | The same set of destinations the top bar shows you. Home, Fleet, Resources, App Store, and Logs always appear; Auto-Update and Schedules appear for admins; Console appears for admins on Admiral; Audit appears for any role on Admiral with the audit permission. | Navigates to that page |
|
||||
| **Nodes** | Every node in your fleet, with a green dot for online and a grey dot for offline. The currently active node carries a small **ACTIVE** chip on the right. | Switches the active node without leaving the current page |
|
||||
| **Stacks** | Every compose stack on every online node, matched on the compose filename (extension included). | Switches to the stack's node and opens it in the editor |
|
||||
|
||||
|
||||
@@ -75,7 +75,7 @@ Environment variables whose names suggest secrets (passwords, tokens, keys, cred
|
||||
The Host Console is one of the most powerful features in Sencho and is treated as such:
|
||||
|
||||
- **Admin role required.** Only users with the **admin** role can open a console session.
|
||||
- **Admiral license required.** The Console tab is not available on the Community or Skipper tiers.
|
||||
- **Admiral license required.** The Host Console is an Admiral feature.
|
||||
- **Browser sessions only.** Console sessions are only available from a signed-in browser session, not from API tokens.
|
||||
- **Audited.** Every console session is recorded in the audit log. Opening and closing a session each write an entry capturing the user, node, client IP, and timestamp, so shell access is fully accountable.
|
||||
|
||||
|
||||
+33
-54
@@ -3,7 +3,7 @@ title: Licensing & Billing
|
||||
description: How Sencho licensing works, including trials, activation, and subscription management.
|
||||
---
|
||||
|
||||
Sencho uses an open-core model. The **Community** tier is free forever with unlimited nodes. Paid tiers unlock advanced features: **Skipper** for solo operators and **Admiral** for teams.
|
||||
Sencho uses an open-core model. **Community** is the complete self-hosted control plane, free forever with unlimited nodes. **Admiral** adds governance, security, and fleet control for teams.
|
||||
|
||||
<Tip>
|
||||
*Our tier names are inspired by the meaning of Sencho (船長), because you're the captain of your container fleet.*
|
||||
@@ -11,64 +11,48 @@ Sencho uses an open-core model. The **Community** tier is free forever with unli
|
||||
|
||||
## Plans
|
||||
|
||||
| Tier | Annual (per mo, billed yearly) | Monthly | Founder Lifetime | Seats |
|
||||
|------|--------------------------------|---------|------------------|-------|
|
||||
| **Community** | Free | Free | Free | 1 admin |
|
||||
| **Skipper** | $5.75 | $9.99 | $149 | 1 admin + 3 viewers |
|
||||
| **Admiral** | $20.75 | $39.99 | $499 | Unlimited |
|
||||
| Tier | Annual (per mo, billed yearly) | Monthly | Seats |
|
||||
|------|--------------------------------|---------|-------|
|
||||
| **Community** | Free | Free | Unlimited |
|
||||
| **Admiral** | $8.25 | $12 | Unlimited |
|
||||
|
||||
For larger deployments, an **Enterprise** tier is available with custom pricing, including SLA, priority support, security questionnaires, and custom contracts. Contact [licensing@sencho.io](mailto:licensing@sencho.io) or see [the pricing page](https://sencho.io/pricing) for details.
|
||||
|
||||
**Founder Lifetime** is an Early Access offer available for a limited time. Once the window closes, only the Monthly and Annual cycles remain.
|
||||
See [the pricing page](https://sencho.io/pricing) for current pricing.
|
||||
|
||||
### Feature breakdown
|
||||
|
||||
**Community** includes:
|
||||
**Community** is the complete self-hosted control plane. It includes:
|
||||
|
||||
- Unlimited nodes, the Monaco compose editor, the full stack file explorer (browse, view, edit, upload, download, rename, chmod, delete; admin role for writes), and the App Store with 199+ one-click templates
|
||||
- Real-time container stats, global logs, the interactive network topology graph, and stack labels
|
||||
- Git sources for compose stacks
|
||||
- Multi-node management in both Proxy and Pilot Agent modes
|
||||
- Manual fleet snapshots (create, browse, restore, delete) and Remote OTA node updates (per-node and **Update all**)
|
||||
- Fleet Actions tab (stop stacks fleet-wide by label, bulk-assign labels to many stacks on a node, prune Docker resources fleet-wide; admin role required)
|
||||
- Custom S3-compatible backup target (bring your own AWS S3, Cloudflare R2, MinIO, Backblaze B2, or Wasabi bucket)
|
||||
- Vulnerability scanning: install, update, and uninstall Trivy, on-demand scans for vulnerabilities, secrets, and misconfigurations, plus scan comparison
|
||||
- CVE suppressions
|
||||
- Alert rules with Discord, Slack, and webhook targets
|
||||
- Two-factor authentication (TOTP plus backup codes)
|
||||
- Custom OIDC single sign-on (works with Authelia, Keycloak, Authentik, Zitadel, Pocket ID, or any spec-compliant OIDC provider)
|
||||
|
||||
**Skipper** includes everything in Community, plus:
|
||||
|
||||
- Fleet View with search, sort, filter, and node-card drill-down
|
||||
- Webhooks (incoming, to trigger deploys from CI/CD)
|
||||
- Notification routing (per-stack and per-category rules to Discord, Slack, or any webhook)
|
||||
- Atomic deployments with rollback
|
||||
- Auto-update policies for stack images
|
||||
- Auto-heal policies
|
||||
- Scheduled operations across the full action catalog (lifecycle, updates, scans, snapshots, prune)
|
||||
- Scan policies with `block_on_deploy` deploy enforcement, SBOM (SPDX, CycloneDX), and SARIF export
|
||||
- Auto-update of the managed Trivy binary
|
||||
- Manual and scheduled fleet snapshots (create, browse, restore, delete) and Remote OTA node updates (per-node and **Update all**)
|
||||
- Fleet Actions tab (stop stacks fleet-wide by label, bulk-assign labels to many stacks on a node, prune Docker resources fleet-wide; admin role required), plus fleet-wide bulk Sencho restart
|
||||
- Bulk actions on a label (deploy, stop, or restart every stack tagged with it)
|
||||
- Fleet-wide bulk Sencho restart
|
||||
- Blueprints and Fleet Secrets
|
||||
- Preset SSO for Google, GitHub, and Okta
|
||||
- Viewer accounts (1 admin plus 3 viewers)
|
||||
- Atomic deployments with automatic rollback, and one-click rollback to the previous deployment
|
||||
- Auto-update policies for stack images and auto-heal policies for failed containers
|
||||
- Scheduled operations across the full action catalog (lifecycle, updates, scans, snapshots, prune)
|
||||
- Webhooks (incoming, to trigger deploys from CI/CD) and notification routing (per-stack and per-category rules to Discord, Slack, or any webhook)
|
||||
- Custom S3-compatible backup target (bring your own AWS S3, Cloudflare R2, MinIO, Backblaze B2, or Wasabi bucket)
|
||||
- Vulnerability scanning: install, update, and uninstall Trivy, on-demand scans for vulnerabilities, secrets, and misconfigurations, scan comparison, and CVE suppressions
|
||||
- Alert rules with Discord, Slack, and webhook targets
|
||||
- API tokens for CI/CD pipelines and scripts (admin role required)
|
||||
- Unlimited accounts with the Admin and Viewer roles
|
||||
- Two-factor authentication (TOTP plus backup codes)
|
||||
- Single sign-on with Custom OIDC (Authelia, Keycloak, Authentik, Zitadel, Pocket ID, or any spec-compliant OIDC provider) and preset providers for Google, GitHub, and Okta
|
||||
|
||||
**Admiral** includes everything in Skipper, plus:
|
||||
**Admiral** adds governance, security, and fleet control for teams. It includes everything in Community, plus:
|
||||
|
||||
- Unlimited admin and viewer accounts with the full role set (deployer, node-admin, auditor)
|
||||
- LDAP / Active Directory authentication
|
||||
- Audit log with CSV export
|
||||
- Host Console (a browser-based terminal on the Sencho host)
|
||||
- API tokens for CI/CD scripts
|
||||
- Private and custom registry credentials
|
||||
- Sencho Mesh (cross-node container networking)
|
||||
- Sencho Cloud Backup
|
||||
- **Governance:** advanced RBAC roles (Deployer, Node Admin, Auditor), scoped permissions per stack or node, and the audit log with CSV export
|
||||
- **Security:** Fleet Secrets, private and custom registry credentials, deploy enforcement (scan policies with `block_on_deploy`), SBOM (SPDX, CycloneDX) and SARIF export, auto-update of the managed Trivy binary, and LDAP / Active Directory authentication
|
||||
- **Fleet operations:** node labels, node cordon, Blueprints, and Sencho Mesh (cross-node container networking)
|
||||
- **Managed continuity:** Sencho Cloud Backup (a managed, off-site snapshot allowance)
|
||||
- **Operator access:** the Host Console (a browser-based terminal on the Sencho host)
|
||||
|
||||
## Free trial
|
||||
|
||||
Sencho offers a **14-day Admiral trial** so you can evaluate the flagship features (Host Console, Sencho Mesh, LDAP / Active Directory, audit log, unlimited accounts) with your real infrastructure before committing. The trial is offered on the monthly and annual Admiral plans; the Founder Lifetime plan does not include a trial.
|
||||
Sencho offers a **14-day Admiral trial** so you can evaluate the flagship features (Host Console, Sencho Mesh, LDAP / Active Directory, audit log, advanced RBAC) with your real infrastructure before committing. The trial is offered on the monthly and annual Admiral plans.
|
||||
|
||||
To start a trial:
|
||||
|
||||
@@ -103,7 +87,7 @@ Sencho validates the key and unlocks your tier. If activation fails, the toast s
|
||||
When a license is active, **Settings → License** opens on the **Plan** section. The page masthead at the top exposes three stat pills, and the section below lists the metadata for the active license.
|
||||
|
||||
<Frame>
|
||||
<img src="/images/licensing/license-admiral-active.png" alt="License page showing an Admiral lifetime plan with the masthead stat strip listing SCOPE, PLAN, and DURATION, then the Plan section with the Customer, Product, and masked License key fields and the Deactivate button" />
|
||||
<img src="/images/licensing/license-admiral-active.png" alt="License page showing an active Sencho Admiral license, with the Plan section listing the Customer, Product, and masked License key fields and a Deactivate button" />
|
||||
</Frame>
|
||||
|
||||
The masthead pills are:
|
||||
@@ -111,19 +95,19 @@ The masthead pills are:
|
||||
| Pill | Meaning |
|
||||
|------|---------|
|
||||
| **SCOPE** | Reads `operator` when you are signed in as an admin. |
|
||||
| **PLAN** | The current tier: `community`, `skipper`, or `admiral`. Trial licenses show the trial tier (typically `admiral`). |
|
||||
| **DURATION** / **RENEWS** / **TRIAL** / **STATUS** | `DURATION: lifetime` for lifetime licenses, `RENEWS: <date>` for active subscriptions, `TRIAL: Xd left` for trials, and `STATUS: expired` for expired licenses. |
|
||||
| **PLAN** | The current tier: `community` or `admiral`. Trial licenses show `admiral`. |
|
||||
| **RENEWS** / **TRIAL** / **STATUS** | `RENEWS: <date>` for active subscriptions, `TRIAL: Xd left` for trials, and `STATUS: expired` for expired licenses. |
|
||||
|
||||
The **Plan** card lists:
|
||||
|
||||
- **Tier name** (e.g. `Sencho Admiral`) with a short status line, such as "Active license on this control plane", "Trial: X days remaining", or "Your license has expired."
|
||||
- **Customer**: the customer name on the purchase.
|
||||
- **Product**: the purchased product variant (e.g. `Sencho Admiral`).
|
||||
- **Product**: the purchased product (e.g. `Sencho Admiral`).
|
||||
- **License key**: the last four characters of your key, displayed as `****-****-****-XXXX`. The full key is never re-displayed after activation.
|
||||
|
||||
## Managing your subscription
|
||||
|
||||
When the license is an active subscription (not lifetime), the Plan section action row exposes **Manage subscription** alongside **Deactivate**. **Manage subscription** opens the billing portal in a new tab, where you can update your payment method, view invoices, cancel, or switch plans.
|
||||
When the license is an active subscription, the Plan section action row exposes **Manage subscription** alongside **Deactivate**. **Manage subscription** opens the billing portal in a new tab, where you can update your payment method, view invoices, cancel, or switch plans.
|
||||
|
||||
The same portal is reachable from the profile menu in the top-right corner of the app:
|
||||
|
||||
@@ -131,11 +115,7 @@ The same portal is reachable from the profile menu in the top-right corner of th
|
||||
<img src="/images/licensing/profile-menu.png" alt="Profile dropdown popover showing an identity header with the admin role and Admiral tier badges, a navigation strip with Settings, Documentation, and Feedback entries, an Appearance theme picker, and a Log Out button" />
|
||||
</Frame>
|
||||
|
||||
Click your initials in the top-right corner to open the popover. For active subscription licenses, a **Billing** row appears between **Settings** and **Documentation** that opens the same portal as **Manage subscription**. Lifetime licenses have no recurring subscription to manage, so the **Billing** row is hidden.
|
||||
|
||||
### Lifetime licenses
|
||||
|
||||
Lifetime licenses have no recurring subscription, so the **Manage subscription** button and the profile menu **Billing** row are both hidden, and the masthead shows `DURATION: lifetime` instead of a renewal date. Deactivation, multi-node enforcement, and periodic validation work the same as for subscription licenses.
|
||||
Click your initials in the top-right corner to open the popover. For active subscription licenses, a **Billing** row appears between **Settings** and **Documentation** that opens the same portal as **Manage subscription**.
|
||||
|
||||
## License validation
|
||||
|
||||
@@ -150,7 +130,6 @@ The License page renders differently depending on the license status:
|
||||
| **Community** | `Sencho Community` with "Free tier with the core experience." | Visible | Visible |
|
||||
| **Trial** | `Sencho Admiral (Trial)` with a countdown chip | Visible (so a paid key can replace the trial) | Hidden |
|
||||
| **Active subscription** | Tier name with Customer, Product, License key, plus `Manage subscription` and `Deactivate` | Hidden | Hidden |
|
||||
| **Active lifetime** | Tier name with Customer, Product, License key, plus `Deactivate` only | Hidden | Hidden |
|
||||
| **Expired** | `Sencho Community` with "Your license has expired. Renew to restore paid features." and a destructive **Status: Expired** field | Visible | Visible |
|
||||
| **Disabled** | `Sencho Community` with "Your license has been disabled. Contact support for assistance." | Visible | Visible |
|
||||
|
||||
|
||||
@@ -169,7 +169,7 @@ The Nodes table surfaces routing, status, and per-node automation at a glance fo
|
||||
| **Mode** | `-` for the local node; `Proxy` or `Pilot Agent` badge for remotes, with an icon matching the mode. |
|
||||
| **Endpoint** | `docker.sock` for local; the full Sencho API URL for proxy nodes; `tunnel (seen X ago)` or `tunnel (waiting)` for pilot agents. |
|
||||
| **Status** | `Online`, `Offline`, or `Unknown` badge. |
|
||||
| **Labels** | Per-node label palette. On Skipper and Admiral the cell shows the picker (an empty cell reads `No labels` with an Add label control); on Community the cell shows a single dash. |
|
||||
| **Labels** | Per-node label palette. On Admiral the cell shows the picker (an empty cell reads `No labels` with an Add label control); on Community the cell shows a single dash. |
|
||||
| **Schedules** | Number of active scheduled tasks targeting this node, plus a `next X` countdown to the next run. Click the count or the calendar icon in the Actions column to filter the Schedules view to that node. |
|
||||
| **Updates** | `Auto` if at least one enabled `Auto-update Stack` or `Auto-update All Stacks` schedule targets the node; `Off` otherwise. A pulsing dot and count appear when stacks have pending image updates. |
|
||||
| **Actions** | **View Schedules**, **Test Connection**, **Edit Node**, and **Delete Node** icon buttons. The local row hides Delete because the local node cannot be removed. |
|
||||
@@ -198,7 +198,7 @@ Panels that manage control-plane concerns (Account, License, Users, SSO, API Tok
|
||||
|
||||
## License enforcement across nodes
|
||||
|
||||
When the control instance has a paid license (Skipper or Admiral), all remote nodes inherit that license tier for proxied requests. You do not activate a license on each remote node separately.
|
||||
When the control instance has an Admiral license, all remote nodes inherit that license tier for proxied requests. You do not activate a license on each remote node separately.
|
||||
|
||||
### How it works
|
||||
|
||||
@@ -206,8 +206,8 @@ The control instance asserts its license tier on every proxied request. Remote n
|
||||
|
||||
This means:
|
||||
|
||||
- **Paid control plane → remote nodes**: Skipper and Admiral features work on every remote node, governed by the control instance's license.
|
||||
- **Community control plane → remote nodes**: Paid features are blocked on remote nodes, even if a remote node has its own paid license. The control instance's tier is authoritative for proxied requests.
|
||||
- **Admiral control plane → remote nodes**: Admiral features work on every remote node, governed by the control instance's license.
|
||||
- **Community control plane → remote nodes**: Admiral features are blocked on remote nodes, even if a remote node has its own Admiral license. The control instance's tier is authoritative for proxied requests.
|
||||
- **Direct access to a node**: If you load a remote Sencho instance in your browser directly (not through the control plane), it uses its own local license tier.
|
||||
|
||||
<Note>
|
||||
@@ -319,7 +319,7 @@ Sencho takes the opposite approach: infrastructure-level encryption (VPN, revers
|
||||
The bearer token saved for the row no longer matches what the remote will accept. This usually means somebody clicked **Generate Token** on the remote (which invalidates the previous token) or the row was saved with a typo. Generate a fresh token on the remote, click the pencil icon on the row in the control instance, paste the new token into the API Token field, and save.
|
||||
</Accordion>
|
||||
<Accordion title="A paid feature is blocked when I switch to a remote node">
|
||||
The control instance's license tier is authoritative for proxied requests, so a Community control plane gates Skipper and Admiral features on every remote, even if the remote itself has its own paid license. Activate a paid license on the control instance to lift the gate fleet-wide. The reverse case (paid control plane, Community remote) works automatically because the control plane's tier is what the remote trusts.
|
||||
The control instance's license tier is authoritative for proxied requests, so a Community control plane gates Admiral features on every remote, even if the remote itself has its own Admiral license. Activate an Admiral license on the control instance to lift the gate fleet-wide. The reverse case (Admiral control plane, Community remote) works automatically because the control plane's tier is what the remote trusts.
|
||||
</Accordion>
|
||||
<Accordion title="Settings panels disappear when I switch to a remote">
|
||||
That is intentional. Account, License, Users, SSO, API Tokens, Registries, Cloud Backup, Nodes, Routing, and Webhooks are control-plane concerns and are hidden while a remote node is selected. Switch back to **Local** from the node switcher to manage them. The full list of which panels are per-node, per-browser, and control-plane-only lives in the [What Settings apply per node](#what-settings-apply-per-node) table above.
|
||||
|
||||
@@ -94,7 +94,7 @@ If you expect a node to support a feature that is being gated, the fastest fix i
|
||||
|
||||
## Interaction with license tiers
|
||||
|
||||
Some features need both a license tier (Skipper or Admiral) **and** node capability support. The two gates evaluate in this order:
|
||||
Some features need both an Admiral license **and** node capability support. The two gates evaluate in this order:
|
||||
|
||||
1. The license gate is checked first. On the wrong tier, the feature's entry point (sidebar item, top-nav button, settings section) is hidden entirely, so you never reach the panel.
|
||||
2. If you are on the right tier but the active node does not advertise the capability, the entry point is visible but the panel is replaced by the capability lock card.
|
||||
|
||||
+14
-14
@@ -29,7 +29,7 @@ Full in-browser Monaco editor for `compose.yaml` and `.env` files with syntax hi
|
||||
|
||||
### Stack file explorer
|
||||
|
||||
Browse, edit, upload, and manage files inside a stack's directory from the dashboard. Read-only browsing and text-file viewing are available on every tier; upload, download, edit, folder creation, and file deletion are Skipper or Admiral features. [Learn more →](/features/stack-file-explorer)
|
||||
Browse, edit, upload, and manage files inside a stack's directory from the dashboard. Read-only browsing and text-file viewing are open to every role; upload, download, edit, folder creation, and file deletion require the admin role. [Learn more →](/features/stack-file-explorer)
|
||||
|
||||
### Deploy progress
|
||||
|
||||
@@ -45,15 +45,15 @@ Browse pre-configured application templates. Filter by category (Media, Automati
|
||||
|
||||
### Atomic deployments
|
||||
|
||||
Sencho snapshots your compose and environment files before applying changes. If containers crash after deploy, the previous configuration is restored automatically. Skipper or Admiral. [Learn more →](/features/atomic-deployments)
|
||||
Sencho snapshots your compose and environment files before applying changes. If containers crash after deploy, the previous configuration is restored automatically. [Learn more →](/features/atomic-deployments)
|
||||
|
||||
### Deploy enforcement
|
||||
|
||||
Block deploys that violate a scan policy before `docker compose up` runs, with an admin bypass path and a full audit trail. The pre-flight gate enumerates images and rejects deploys when any image meets or exceeds the policy's severity threshold; drift detection continues post-deploy and on schedule. Skipper or Admiral. [Learn more →](/features/deploy-enforcement)
|
||||
Block deploys that violate a scan policy before `docker compose up` runs, with an admin bypass path and a full audit trail. The pre-flight gate enumerates images and rejects deploys when any image meets or exceeds the policy's severity threshold; drift detection continues post-deploy and on schedule. Admiral. [Learn more →](/features/deploy-enforcement)
|
||||
|
||||
### Blueprints
|
||||
|
||||
Fleet-wide compose templates that Sencho keeps in sync across the nodes you choose. One declaration covers many nodes via label selectors, drift detection always runs, and stateful blueprints get confirmation prompts before first deploy and before eviction. Skipper or Admiral. [Learn more →](/features/blueprint-model)
|
||||
Fleet-wide compose templates that Sencho keeps in sync across the nodes you choose. One declaration covers many nodes via label selectors, drift detection always runs, and stateful blueprints get confirmation prompts before first deploy and before eviction. Admiral. [Learn more →](/features/blueprint-model)
|
||||
|
||||
### Git sources
|
||||
|
||||
@@ -61,7 +61,7 @@ Link a stack to a Git repository and keep `compose.yaml` in sync via manual pull
|
||||
|
||||
### Stack labels
|
||||
|
||||
Tag your stacks with custom colored labels like `production`, `staging`, or `media-server`. Filter the sidebar by label, identify stacks at a glance, and organize your infrastructure visually. Bulk-action a label (deploy, stop, or restart every stack tagged with it) on Skipper or Admiral. [Learn more →](/features/stack-labels)
|
||||
Tag your stacks with custom colored labels like `production`, `staging`, or `media-server`. Filter the sidebar by label, identify stacks at a glance, and organize your infrastructure visually. Bulk-action a label to deploy, stop, or restart every stack tagged with it. [Learn more →](/features/stack-labels)
|
||||
|
||||
## Observability
|
||||
|
||||
@@ -125,11 +125,11 @@ When several Sencho instances run as a fleet, the control instance is the source
|
||||
|
||||
### Fleet Secrets
|
||||
|
||||
Centralized, encrypted, versioned env-var bundles you can push to labeled nodes' stacks. Bundles are encrypted at rest with AES-256-GCM, every save bumps a version, and every push records a per-node diff in the audit log using overlay merge semantics. Skipper or Admiral. [Learn more →](/features/fleet-secrets)
|
||||
Centralized, encrypted, versioned env-var bundles you can push to labeled nodes' stacks. Bundles are encrypted at rest with AES-256-GCM, every save bumps a version, and every push records a per-node diff in the audit log using overlay merge semantics. Admiral. [Learn more →](/features/fleet-secrets)
|
||||
|
||||
### Fleet-wide backups
|
||||
|
||||
Create point-in-time snapshots of every compose file and environment file across all nodes. Snapshots are stored centrally and can be browsed by node and stack. Restore individual stacks from any snapshot with optional one-click redeploy, even to remote nodes. Manual snapshots are available on every tier; scheduled fleet snapshots are Skipper or Admiral. [Learn more →](/features/fleet-backups)
|
||||
Create point-in-time snapshots of every compose file and environment file across all nodes. Snapshots are stored centrally and can be browsed by node and stack. Restore individual stacks from any snapshot with optional one-click redeploy, even to remote nodes. Both manual and scheduled fleet snapshots are available on every tier. [Learn more →](/features/fleet-backups)
|
||||
|
||||
### Remote updates
|
||||
|
||||
@@ -137,7 +137,7 @@ Check for outdated nodes and trigger over-the-air updates from the Fleet View. W
|
||||
|
||||
### Scheduled operations
|
||||
|
||||
Automate recurring maintenance tasks like stack restarts, fleet snapshots, and system prunes on a cron schedule. Every execution is logged with full history so you always know what ran and when. Scheduled scans, updates, and snapshots are available on Skipper and Admiral; other scheduled actions remain Admiral only. [Learn more →](/features/scheduled-operations)
|
||||
Automate recurring maintenance tasks like stack restarts, fleet snapshots, system prunes, scans, and image updates on a cron schedule. Every execution is logged with full history so you always know what ran and when. [Learn more →](/features/scheduled-operations)
|
||||
|
||||
## Security & Identity
|
||||
|
||||
@@ -147,11 +147,11 @@ Protect your Sencho account with a time-based one-time password (TOTP) from an a
|
||||
|
||||
### RBAC & user management
|
||||
|
||||
Create viewer accounts with read-only access to dashboards, logs, and file contents, while keeping deploy and edit permissions locked to admins. Skipper supports two roles (Admin and Viewer); Admiral adds three more (Deployer, Node Admin, Auditor) plus scoped permissions per stack or node. [Learn more →](/features/rbac)
|
||||
Create unlimited accounts with read-only Viewer access to dashboards, logs, and file contents, while keeping deploy and edit permissions locked to admins. Community includes the Admin and Viewer roles; Admiral adds three more (Deployer, Node Admin, Auditor) plus scoped permissions per stack or node. [Learn more →](/features/rbac)
|
||||
|
||||
### SSO & LDAP authentication
|
||||
|
||||
Authenticate with your existing identity provider. Custom OIDC (Authelia, Keycloak, Authentik, any spec-compliant OIDC provider) is available on every tier. Skipper adds preset providers for Google, GitHub, and Okta. Admiral adds LDAP / Active Directory for enterprise directories. SSO works alongside password authentication and auto-provisions accounts on first login with configurable role mapping. [Learn more →](/features/sso)
|
||||
Authenticate with your existing identity provider. Custom OIDC (Authelia, Keycloak, Authentik, any spec-compliant OIDC provider) and preset providers for Google, GitHub, and Okta are available on every tier. Admiral adds LDAP / Active Directory for enterprise directories. SSO works alongside password authentication and auto-provisions accounts on first login with configurable role mapping. [Learn more →](/features/sso)
|
||||
|
||||
### API tokens
|
||||
|
||||
@@ -159,7 +159,7 @@ Generate scoped API tokens for CI/CD pipelines, scripts, and automation workflow
|
||||
|
||||
### Vulnerability scanning
|
||||
|
||||
Scan container images for known CVEs with [Trivy](https://trivy.dev). Install Trivy with one click from Settings → Security on first use; the [setup guide](/operations/trivy-setup) covers bind-mounted and air-gapped alternatives. Manual scanning, secret and misconfiguration detection, scan comparison, and CVE suppressions are available on every tier; scheduled scans, scan policies that gate deploys, SBOM generation, and SARIF export are available on Skipper and Admiral. Auto-update of the managed Trivy binary is Skipper. [Learn more →](/features/vulnerability-scanning)
|
||||
Scan container images for known CVEs with [Trivy](https://trivy.dev). Install Trivy with one click from Settings → Security on first use; the [setup guide](/operations/trivy-setup) covers bind-mounted and air-gapped alternatives. Manual scanning, secret and misconfiguration detection, scan comparison, scheduled scans, and CVE suppressions are available on every tier; scan policies that gate deploys, SBOM generation, SARIF export, and auto-update of the managed Trivy binary are Admiral. [Learn more →](/features/vulnerability-scanning)
|
||||
|
||||
### CVE suppressions
|
||||
|
||||
@@ -173,11 +173,11 @@ Store credentials for private Docker registries: Docker Hub organizations, GHCR,
|
||||
|
||||
### Auto-Update Policies
|
||||
|
||||
Review pending container updates across your fleet with risk badges (`Safe · patch`, `Review · minor`, `Blocked · major`, `Digest rebuild`) and one-line changelog previews on a single board. The hero counts pending updates and tells you how many are ready to apply without human review; stacks with a major version bump are surfaced as a separate count for review. Skipper or Admiral. [Learn more →](/features/auto-update-policies)
|
||||
Review pending container updates across your fleet with risk badges (`Safe · patch`, `Review · minor`, `Blocked · major`, `Digest rebuild`) and one-line changelog previews on a single board. The hero counts pending updates and tells you how many are ready to apply without human review; stacks with a major version bump are surfaced as a separate count for review. [Learn more →](/features/auto-update-policies)
|
||||
|
||||
### Auto-Heal Policies
|
||||
|
||||
Automatically restart containers that fail Docker healthchecks for longer than a specified threshold. Each policy ships with safety rails: a cooldown period, hourly restart cap, recent-user-action suppression, and auto-disable on repeated restart failures. Skipper or Admiral. [Learn more →](/features/auto-heal-policies)
|
||||
Automatically restart containers that fail Docker healthchecks for longer than a specified threshold. Each policy ships with safety rails: a cooldown period, hourly restart cap, recent-user-action suppression, and auto-disable on repeated restart failures. [Learn more →](/features/auto-heal-policies)
|
||||
|
||||
### Webhooks
|
||||
|
||||
@@ -201,4 +201,4 @@ When you manage multiple nodes running different Sencho versions, the dashboard
|
||||
|
||||
### Licensing & billing
|
||||
|
||||
Sencho is free for personal use with the Community tier. Skipper and Admiral unlock RBAC, webhooks, fleet backups, atomic deployments, and advanced fleet features. Manage your license, view subscription details, and access the billing portal from Settings. [Learn more →](/features/licensing)
|
||||
Community is the complete self-hosted control plane, free forever. Admiral adds governance, security, and fleet control for teams: advanced RBAC, the audit log, Fleet Secrets, deploy enforcement, Blueprints, Sencho Mesh, and more. Manage your license, view subscription details, and access the billing portal from Settings. [Learn more →](/features/licensing)
|
||||
|
||||
+12
-16
@@ -4,7 +4,7 @@ description: Role-based access control for Sencho. Manage admin, viewer, deploye
|
||||
---
|
||||
|
||||
<Note>
|
||||
Multi-user support requires a Sencho **Skipper** or **Admiral** license. Community Edition runs as a single admin account. The **Deployer**, **Node Admin**, and **Auditor** roles, plus scoped permissions, require **Admiral**.
|
||||
Community supports unlimited accounts with the **Admin** and **Viewer** roles. The **Deployer**, **Node Admin**, and **Auditor** roles, plus scoped permissions, require **Admiral**.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
@@ -17,8 +17,8 @@ Sencho ships with five built-in roles that map to the permissions most operators
|
||||
|
||||
| Role | What it grants | Tier |
|
||||
|------|----------------|------|
|
||||
| **Admin** | Full operator access: deploy, edit compose, manage users, configure nodes, view audit log, every system setting | Skipper+ |
|
||||
| **Viewer** | Read-only access to stacks, logs, stats, file contents, and node listings | Skipper+ |
|
||||
| **Admin** | Full operator access: deploy, edit compose, manage users, configure nodes, view audit log, every system setting | Community |
|
||||
| **Viewer** | Read-only access to stacks, logs, stats, file contents, and node listings | Community |
|
||||
| **Deployer** | Deploy, restart, stop, and start stacks. Cannot edit compose files, create or delete stacks, or view nodes | Admiral |
|
||||
| **Node Admin** | Full stack and node management across the fleet. No access to system settings, users, or license | Admiral |
|
||||
| **Auditor** | Read-only access to stacks, nodes, and the audit log. No write access anywhere | Admiral |
|
||||
@@ -51,15 +51,14 @@ On Admiral, a user with a lower global role can still hold extra permissions on
|
||||
|
||||
| Tier | Admin accounts | Non-admin accounts | Intermediate roles | Scoped permissions |
|
||||
|------|---------------|--------------------|--------------------|--------------------|
|
||||
| **Community** | 1 | 0 | No | No |
|
||||
| **Skipper** | 1 | 3 | No | No |
|
||||
| **Community** | Unlimited | Unlimited | No | No |
|
||||
| **Admiral** | Unlimited | Unlimited | Yes | Yes |
|
||||
|
||||
Quotas are enforced when you click **Create user**. Hitting a cap returns a `403` with a clear message, and the form keeps your input so you can adjust the role.
|
||||
Community accounts use the **Admin** and **Viewer** roles. Admiral adds the intermediate roles (Deployer, Node Admin, Auditor) and scoped permissions.
|
||||
|
||||
## Managing users
|
||||
|
||||
The Users panel lives at **Settings · Users**, under the **Identity** group of the settings sidebar. It is visible only to users with the Admin role on Skipper or Admiral, and is hidden when a remote node is the active selection.
|
||||
The Users panel lives at **Settings · Users**, under the **Identity** group of the settings sidebar. It is visible only to users with the Admin role, and is hidden when a remote node is the active selection.
|
||||
|
||||
<Frame>
|
||||
<img src="/images/rbac/users-list.png" alt="Settings Users panel showing the Identity sidebar selection, a SCOPE operator chip, an OPERATORS 2 counter, an Add user button, and a four-column table (Username, Role, Created, Actions) with two rows: admin marked (you) with a disabled trash icon and viewer with active edit and trash icons." />
|
||||
@@ -84,7 +83,7 @@ Click **Add user**. The form opens inline below the button (it is not a modal),
|
||||
| Field | Rules |
|
||||
|-------|-------|
|
||||
| **Username** | At least 3 characters. Letters, numbers, underscores, and hyphens only. Submitting with `.` or whitespace returns `Username can only contain letters, numbers, underscores, and hyphens.` |
|
||||
| **Role** | Combobox. On Admiral you see all five roles; on Skipper you see Admin and Viewer only. |
|
||||
| **Role** | Combobox. On Admiral you see all five roles; on Community you see Admin and Viewer only. |
|
||||
| **Password** | At least 8 characters. The placeholder reads `min. 8 characters`. |
|
||||
| **Confirm Password** | Must match the password field, validated on submit. |
|
||||
|
||||
@@ -105,7 +104,7 @@ The password fields change subtly in edit mode:
|
||||
- The **Password** label becomes **New Password (optional)** with the placeholder `Leave blank to keep`. Submit without filling them in and the current password is preserved.
|
||||
- If the user was provisioned via SSO, the password fields are replaced with an inline line that reads `Password is managed by the identity provider (<provider>).` Sencho never stores or rotates passwords for SSO accounts.
|
||||
|
||||
Click **Update user** to save. Changing the role takes effect on the next API request from any of that user's active sessions; see [Session security](#session-security) below. Promoting a user to **Admin** consumes an admin seat, so it is subject to the same per-tier limit as creating an admin: at your cap, the change is rejected until you free a seat or upgrade.
|
||||
Click **Update user** to save. Changing the role takes effect on the next API request from any of that user's active sessions; see [Session security](#session-security) below.
|
||||
|
||||
## Scoped permissions
|
||||
|
||||
@@ -195,7 +194,7 @@ Two SSO-specific behaviors to keep in mind:
|
||||
|
||||
The role assigned at provisioning is the role configured on the SSO provider (or, for LDAP, derived from group membership). After provisioning, an admin can adjust the role and add scoped permissions just like any local account.
|
||||
|
||||
To configure a provider, see [SSO Authentication](/features/sso). The tier split for provider configuration (Custom OIDC at Community, preset providers at Skipper, LDAP at Admiral) is enforced separately from the rest of the user-management surface.
|
||||
To configure a provider, see [SSO Authentication](/features/sso). The tier split for provider configuration (Custom OIDC and preset providers at Community, LDAP at Admiral) is enforced separately from the rest of the user-management surface.
|
||||
|
||||
## API tokens for automation
|
||||
|
||||
@@ -219,19 +218,16 @@ Entries include the acting user, IP address, HTTP method and path, response stat
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="The Users entry is missing from the Settings sidebar">
|
||||
The Users entry is hidden in three cases. **One,** the active license is Community: the Users panel is gated to Skipper+ and does not render on Community. Activate a Skipper or Admiral license under **Settings · License** to expose it. **Two,** you are signed in as a non-admin (Viewer, Deployer, Auditor): the entry is admin-only. **Three,** you have a remote node selected: the panel is hub-only and is hidden in the sidebar when any remote node is active. Switch back to the local node via the node switcher in the masthead.
|
||||
The Users entry is hidden in two cases. **One,** you are signed in as a non-admin (Viewer, Deployer, Auditor): the entry is admin-only. **Two,** you have a remote node selected: the panel is hub-only and is hidden in the sidebar when any remote node is active. Switch back to the local node via the node switcher in the masthead.
|
||||
</Accordion>
|
||||
<Accordion title="The role I want is greyed out in the role combobox">
|
||||
The combobox only shows roles available on your tier. On Skipper, the combobox lists Admin and Viewer only. **Deployer**, **Node Admin**, and **Auditor** are Admiral-only roles and do not appear on Skipper. Upgrade to Admiral, or use scoped permissions equivalents once you do.
|
||||
</Accordion>
|
||||
<Accordion title="Creating a user or promoting one to Admin fails with `Your license allows a maximum of N account(s)`">
|
||||
You have hit the seat limit for your tier. Skipper allows one admin and three non-admin users; Admiral has no cap. Promoting an existing user to Admin counts against the admin limit the same way creating one does. Either delete an unused account or upgrade. The exact remaining capacity is visible on the OPERATORS counter in the panel header.
|
||||
The combobox only shows roles available on your tier. On Community, the combobox lists Admin and Viewer only. **Deployer**, **Node Admin**, and **Auditor** are Admiral roles. Upgrade to Admiral to use them, or the scoped-permission equivalents.
|
||||
</Accordion>
|
||||
<Accordion title="A user complains they were signed out unexpectedly">
|
||||
Token-version bumps invalidate sessions. Two events do this: an admin changed the user's password, or an admin reset their 2FA. Both rotate the user's token version, so every JWT issued before the rotation is rejected on the next request. The user can sign in again with their (possibly new) password. Role changes do **not** sign the user out; they take effect on the next request without rotating the token version.
|
||||
</Accordion>
|
||||
<Accordion title="A scoped Deployer cannot deploy a stack they were granted">
|
||||
Two causes. **One,** the assignment was created on Admiral but the license has since dropped to Skipper. The permission resolver only consults scoped assignments when the effective tier is Admiral; on Skipper the scope is ignored and the user falls back to their global role. **Two,** the resource type or name on the assignment does not match the request's resource. Re-open the user in the edit form and check the existing-scope row matches the stack name (case-sensitive) exactly.
|
||||
Two causes. **One,** the assignment was created on Admiral but the license has since dropped to Community. The permission resolver only consults scoped assignments when the effective tier is Admiral; on Community the scope is ignored and the user falls back to their global role. **Two,** the resource type or name on the assignment does not match the request's resource. Re-open the user in the edit form and check the existing-scope row matches the stack name (case-sensitive) exactly.
|
||||
</Accordion>
|
||||
<Accordion title="The shield (Reset 2FA) icon is missing on a user I expected to see it on">
|
||||
The icon only appears for users with a finished TOTP enrollment. If the user started enrollment but never confirmed their first code, the enrollment is incomplete and the icon stays hidden. Ask the user to finish enrollment from their account settings, or, if they cannot, leave the row alone: there is nothing to reset.
|
||||
|
||||
@@ -6,7 +6,7 @@ description: Automate stack lifecycle, image updates, vulnerability scans, fleet
|
||||
Schedules is a unified surface for every recurring maintenance operation Sencho knows how to run: stack restarts, per-node and fleet-wide image updates, lifecycle events (stop, take down, start, backup), system prunes, and vulnerability scans. The default view is a next-24-hour Timeline of upcoming runs across five lanes; an All tasks table view lists every schedule regardless of when it next fires.
|
||||
|
||||
<Note>
|
||||
Available to admins on Skipper and Admiral.
|
||||
Available to admins.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
|
||||
@@ -4,7 +4,7 @@ description: Cross-node container networking. Reach any meshed service on any no
|
||||
---
|
||||
|
||||
<Note>
|
||||
Sencho Mesh requires an [Admiral license](/features/licensing). Community and Skipper do not include this feature.
|
||||
Sencho Mesh requires an [Admiral license](/features/licensing).
|
||||
</Note>
|
||||
|
||||
Sencho Mesh gives a multi-node fleet the network topology of a single machine. Once a stack opts in, every service it exposes becomes reachable from any other meshed stack on the fleet by a stable hostname. Cross-node traffic rides the same authenticated channel Sencho already uses to manage the fleet, so a node behind NAT or a residential firewall participates exactly like a public VPS.
|
||||
|
||||
@@ -67,7 +67,7 @@ Each row gives you everything you need to read the stack at a glance, in a fixed
|
||||
Click the **Bulk mode** icon next to **Create Stack** (or press <kbd>B</kbd>) to enter selection mode. A checkbox appears at the left of every row, and a sticky toolbar slides in just above the list:
|
||||
|
||||
- **Start**, **Stop**, **Restart** apply the action to every selected stack.
|
||||
- **Update** pulls the latest images for every selected stack and requires a **Skipper** or **Admiral** license.
|
||||
- **Update** pulls the latest images for every selected stack.
|
||||
|
||||
Click rows to toggle their selection. The toolbar header shows a running count. Click the **×** in the corner of the toolbar to clear the selection, and click the icon again (or press <kbd>B</kbd>) to leave bulk mode.
|
||||
|
||||
@@ -85,7 +85,7 @@ Right-click any stack (or open the kebab that appears on hover) for its context
|
||||
- **Destructive**: **Delete**.
|
||||
|
||||
<Note>
|
||||
**Auto-Heal** requires a **Skipper** or **Admiral** license; configuring policies (add, toggle, delete) also requires an **admin** role. **Schedule task** requires a **Skipper** or **Admiral** license and an **admin** role.
|
||||
Configuring **Auto-Heal** policies (add, toggle, delete) requires an **admin** role. **Schedule task** also requires an **admin** role.
|
||||
</Note>
|
||||
|
||||
<Frame>
|
||||
@@ -113,7 +113,7 @@ On macOS, use <kbd>Cmd</kbd> in place of <kbd>Ctrl</kbd>.
|
||||
| Key | Action |
|
||||
|-----|--------|
|
||||
| <kbd>A</kbd> | Open the alerts sheet |
|
||||
| <kbd>H</kbd> | Open the auto-heal sheet (Skipper or Admiral) |
|
||||
| <kbd>H</kbd> | Open the auto-heal sheet |
|
||||
| <kbd>U</kbd> | Check for image updates |
|
||||
| <kbd>P</kbd> | Pin or unpin the stack |
|
||||
| <kbd>B</kbd> | Toggle bulk mode |
|
||||
@@ -144,9 +144,9 @@ The footer surfaces the most recent stack lifecycle event on the node. Each tick
|
||||
Click the **+** icon to the right of the search box to bring them back. The chip row collapses to a thin **−** / **+** toggle, and the state is remembered in your browser, so an earlier collapse persists across reloads until you expand it again.
|
||||
</Accordion>
|
||||
<Accordion title="Schedule task is missing from the right-click menu">
|
||||
Scheduling requires a **Skipper** or **Admiral** license and an **admin** role. Ask an admin on this node to schedule the task for you, or sign in with an admin account.
|
||||
Scheduling requires an **admin** role. Ask an admin on this node to schedule the task for you, or sign in with an admin account.
|
||||
</Accordion>
|
||||
<Accordion title="Auto-Heal panel opens but Add Policy and the toggles are missing">
|
||||
Reading existing Auto-Heal policies only needs a **Skipper** or **Admiral** license, so the panel still opens for non-admin operators on paid tiers. Adding, enabling, disabling, or deleting policies also requires the **admin** role. Sign in with an admin account, or ask an admin on this node to make the change.
|
||||
Reading existing Auto-Heal policies is open to every operator, so the panel still opens for non-admins. Adding, enabling, disabling, or deleting policies requires the **admin** role. Sign in with an admin account, or ask an admin on this node to make the change.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
@@ -5,16 +5,16 @@ description: Authenticate with your existing identity provider, including LDAP,
|
||||
|
||||
Sencho lets your team sign in with the identity provider you already use instead of maintaining a second set of credentials. SSO works **alongside** password authentication; it does not replace it.
|
||||
|
||||
SSO is available on every Sencho tier. Higher tiers add preset providers for Google, GitHub, and Okta, plus enterprise directory support via LDAP and Active Directory.
|
||||
SSO is available on every Sencho tier. Custom OIDC and the preset providers for Google, GitHub, and Okta work on every tier; LDAP and Active Directory require Sencho Admiral.
|
||||
|
||||
## Supported providers
|
||||
|
||||
| Provider | Protocol | Tier | Notes |
|
||||
|----------|----------|------|-------|
|
||||
| **Custom OIDC** | OpenID Connect | Community | Any spec-compliant OIDC provider: Authelia, Keycloak, Authentik, Zitadel, KanIDM, Pocket ID, and more |
|
||||
| **Google** | OpenID Connect | Skipper | Preset for Google Workspace or personal Google accounts, with branded login button |
|
||||
| **GitHub** | OAuth 2.0 | Skipper | Preset for GitHub personal accounts and GitHub orgs, with branded login button |
|
||||
| **Okta** | OpenID Connect | Skipper | Preset for any Okta org or Okta-compatible IdP, with branded login button |
|
||||
| **Google** | OpenID Connect | Community | Preset for Google Workspace or personal Google accounts, with branded login button |
|
||||
| **GitHub** | OAuth 2.0 | Community | Preset for GitHub personal accounts and GitHub orgs, with branded login button |
|
||||
| **Okta** | OpenID Connect | Community | Preset for any Okta org or Okta-compatible IdP, with branded login button |
|
||||
| **LDAP / Active Directory** | LDAP bind + search | Admiral | Works with OpenLDAP, Active Directory, FreeIPA, and any LDAPv3 server |
|
||||
|
||||
## How it works
|
||||
@@ -42,9 +42,8 @@ When a user signs in via SSO for the first time, Sencho creates a local account:
|
||||
- **Username** is derived from the identity provider profile (display name, email prefix, or login handle).
|
||||
- **Role** is assigned from [role mapping](#role-mapping); defaults to Viewer if no mapping matches.
|
||||
- **Password** is set to an unusable placeholder. SSO users cannot sign in with the password form.
|
||||
- **Seat limits** from your license apply. If admin seats are full, the user is downgraded to Viewer. If every seat is full, sign-in is denied with a clear error message.
|
||||
|
||||
On every subsequent sign-in, the existing account is reused and the user's **email** and **role** are synced from the identity provider. Adding someone to your admin group promotes them to Admin on their next sign-in; removing them demotes them to the default role. Promotions defer cleanly when admin seats are full and apply as soon as a seat opens up.
|
||||
On every subsequent sign-in, the existing account is reused and the user's **email** and **role** are synced from the identity provider. Adding someone to your admin group promotes them to Admin on their next sign-in; removing them demotes them to the default role.
|
||||
|
||||
## Role mapping
|
||||
|
||||
|
||||
@@ -129,7 +129,7 @@ When a flag is not supported, paste the partial output into the **Empty** tab as
|
||||
|
||||
## The stack list
|
||||
|
||||
All discovered stacks appear in the left sidebar. The list groups stacks by label (Skipper+) and by pinned status, so the most relevant entries surface at the top.
|
||||
All discovered stacks appear in the left sidebar. The list groups stacks by label and by pinned status, so the most relevant entries surface at the top.
|
||||
|
||||
### Status indicator
|
||||
|
||||
@@ -163,7 +163,7 @@ Each chip carries a live count. Click **Hide filters** in the top-right of the r
|
||||
The list is grouped to keep frequently used stacks reachable.
|
||||
|
||||
- **PINNED**: sits at the very top when at least one stack is pinned. Pin a stack with **Pin to top** in the kebab menu (`P` shortcut).
|
||||
- **Label groups**: each label produces its own collapsible section, header rendered uppercase. Labels are a Skipper+ feature; see [Stack Labels](/features/stack-labels) for color and assignment options.
|
||||
- **Label groups**: each label produces its own collapsible section, header rendered uppercase. See [Stack Labels](/features/stack-labels) for color and assignment options.
|
||||
- **UNLABELED**: bottom group with everything that has no label.
|
||||
|
||||
Click any group header to collapse or expand it. The group's stack count appears in the header.
|
||||
@@ -279,8 +279,8 @@ The stack header groups actions by frequency of use. The most common action is t
|
||||
| Primary | **Restart** | `docker compose restart` | Restarts all containers in the stack. |
|
||||
| Secondary | **Stop** | `docker compose stop` | Stops containers without removing them. State is preserved. |
|
||||
| Secondary | **Update** | `docker compose pull` + `up -d` | Pulls the latest image tags and recreates containers. |
|
||||
| Overflow | **Rollback** | Restores backup | Reverts compose and env files to the pre-deploy snapshot and redeploys. Only shown when a backup exists (Skipper+). |
|
||||
| Overflow | **Scan config** | Trivy config scan | Scans the compose file for misconfigurations (Skipper+, admin). |
|
||||
| Overflow | **Rollback** | Restores backup | Reverts compose and env files to the pre-deploy snapshot and redeploys. Only shown when a backup exists. |
|
||||
| Overflow | **Scan config** | Trivy config scan | Scans the compose file for misconfigurations (admin role). |
|
||||
| Overflow | **Delete** | `down --volumes` + removes files | Stops and removes containers and volumes, then deletes the stack directory. |
|
||||
|
||||
**When stopped:**
|
||||
@@ -316,7 +316,7 @@ Bulk mode lets you run a single lifecycle action across several stacks at once,
|
||||
- **Start**: deploys every selected stack that is currently down.
|
||||
- **Stop**: stops every selected stack that is currently running.
|
||||
- **Restart**: restarts every selected stack that is currently running.
|
||||
- **Update**: pulls the latest image tags and redeploys (Skipper+).
|
||||
- **Update**: pulls the latest image tags and redeploys.
|
||||
|
||||
Press `B` again or toggle the bulk mode button to leave bulk mode.
|
||||
|
||||
@@ -345,13 +345,13 @@ Click the kebab on a stack row in the sidebar to open its context menu. The menu
|
||||
**inspect**
|
||||
|
||||
- **Alerts** (`A`): open the alert rule editor for this stack. See [Alerts and Notifications](/features/alerts-notifications).
|
||||
- **Auto-Heal** (`H`): configure auto-recovery for this stack (Skipper+). See [Auto-Heal Policies](/features/auto-heal-policies).
|
||||
- **Auto-Heal** (`H`): configure auto-recovery for this stack. See [Auto-Heal Policies](/features/auto-heal-policies).
|
||||
- **Check updates** (`U`): force an image update check now.
|
||||
- **Open App** (`↗`): open the stack's web interface in a new tab. Shown only when the stack is running and exposes a web port.
|
||||
|
||||
**organize**
|
||||
|
||||
- **Labels** (`›`): assign or remove labels (Skipper+). See [Stack Labels](/features/stack-labels).
|
||||
- **Labels** (`›`): assign or remove labels. See [Stack Labels](/features/stack-labels).
|
||||
- **Pin to top** (`P`): pin or unpin the stack from the **PINNED** group at the top of the list.
|
||||
|
||||
**lifecycle**
|
||||
@@ -359,7 +359,7 @@ Click the kebab on a stack row in the sidebar to open its context menu. The menu
|
||||
- **Stop** (`⌘.`): shown when running.
|
||||
- **Restart** (`⌘R`): shown when running.
|
||||
- **Update** (`⌘↑`): pulls the latest image tags and redeploys.
|
||||
- **Schedule task**: open the scheduler pre-filled for this stack (Skipper+); pick **Auto-update Stack** to set up unattended image updates on your own cadence. See [Scheduled Operations](/features/scheduled-operations) and [Auto-Update Policies](/features/auto-update-policies).
|
||||
- **Schedule task**: open the scheduler pre-filled for this stack; pick **Auto-update Stack** to set up unattended image updates on your own cadence. See [Scheduled Operations](/features/scheduled-operations) and [Auto-Update Policies](/features/auto-update-policies).
|
||||
- **Deploy** (`⌘↵`): shown when stopped, in place of Stop and Restart.
|
||||
|
||||
**destructive**
|
||||
@@ -391,7 +391,3 @@ Click the **Scan stacks folder** icon button to the right of **Create Stack**. S
|
||||
### Service action returns a "service not found" error
|
||||
|
||||
The service name used in the action must match the `services:` key in the stack's `compose.yaml`. This error occurs when no running containers match that service name, either because the service was never deployed or because the compose file defines a different name. Verify the service key in your compose file and ensure the stack has been deployed at least once so containers exist for that service.
|
||||
|
||||
### Bulk **Update** is missing from the action bar
|
||||
|
||||
The bulk **Update** action is a Skipper-tier feature; on Community, it does not appear in the action bar at all. **Start**, **Stop**, and **Restart** are available on every tier.
|
||||
|
||||
@@ -3,7 +3,7 @@ title: "Vulnerability Scanning"
|
||||
description: "Scan container images and stack compose files for CVEs, secrets, and misconfigurations. Surface severity badges in the Resources Hub, compare scans over time, and gate deploys on policy violations."
|
||||
---
|
||||
|
||||
Sencho integrates with [Trivy](https://trivy.dev) to scan container images and Compose files for vulnerabilities (CVEs), hardcoded secrets, and misconfigurations. Findings surface as severity badges in the Resources Hub and as drillable reports in the scan drawer. Manual scanning, secret and misconfig detection, scan history, comparison, and CVE suppressions are available on every tier. Skipper and Admiral add scheduled fleet scans, policy enforcement, SBOM, and SARIF exports.
|
||||
Sencho integrates with [Trivy](https://trivy.dev) to scan container images and Compose files for vulnerabilities (CVEs), hardcoded secrets, and misconfigurations. Findings surface as severity badges in the Resources Hub and as drillable reports in the scan drawer. Manual scanning, secret and misconfig detection, scan history, comparison, scheduled fleet scans, and CVE suppressions are available on every tier. Admiral adds policy enforcement, SBOM, and SARIF exports.
|
||||
|
||||
<Frame>
|
||||
<img src="/images/vulnerability-scanning/resources-badges.png" alt="Resources Hub Images table with severity badges (CRITICAL, HIGH, MEDIUM) on managed image rows alongside the Scan history button" />
|
||||
@@ -19,25 +19,25 @@ The Trivy CLI must be available on the machine running Sencho. Trivy is not bund
|
||||
|
||||
## Tier availability
|
||||
|
||||
| Feature | Community | Skipper | Admiral |
|
||||
|---------|:---------:|:-------:|:-------:|
|
||||
| Install / update / uninstall Trivy from Settings | ✓ | ✓ | ✓ |
|
||||
| On-demand image vulnerability scanning | ✓ | ✓ | ✓ |
|
||||
| Full scan (vulnerabilities + secrets) | ✓ | ✓ | ✓ |
|
||||
| Compose file misconfiguration scanning | ✓ | ✓ | ✓ |
|
||||
| Severity badges in the Resources Hub | ✓ | ✓ | ✓ |
|
||||
| Scan results drawer with grouped tabs | ✓ | ✓ | ✓ |
|
||||
| Post-deploy automated scanning | ✓ | ✓ | ✓ |
|
||||
| Scan history sheet | ✓ | ✓ | ✓ |
|
||||
| Scan comparison | ✓ | ✓ | ✓ |
|
||||
| CVE suppressions | ✓ | ✓ | ✓ |
|
||||
| Misconfig acknowledgements | ✓ | ✓ | ✓ |
|
||||
| Scheduled fleet scans (all images on a node) | | ✓ | ✓ |
|
||||
| Scan policies with `block_on_deploy` enforcement | | ✓ | ✓ |
|
||||
| Suppression-aware deploy blocking (optional toggle) | | ✓ | ✓ |
|
||||
| SBOM generation (SPDX, CycloneDX) | | ✓ | ✓ |
|
||||
| SARIF export (code scanning integration) | | ✓ | ✓ |
|
||||
| Auto-update of the managed Trivy binary | | ✓ | ✓ |
|
||||
| Feature | Community | Admiral |
|
||||
|---------|:---------:|:-------:|
|
||||
| Install / update / uninstall Trivy from Settings | ✓ | ✓ |
|
||||
| On-demand image vulnerability scanning | ✓ | ✓ |
|
||||
| Full scan (vulnerabilities + secrets) | ✓ | ✓ |
|
||||
| Compose file misconfiguration scanning | ✓ | ✓ |
|
||||
| Severity badges in the Resources Hub | ✓ | ✓ |
|
||||
| Scan results drawer with grouped tabs | ✓ | ✓ |
|
||||
| Post-deploy automated scanning | ✓ | ✓ |
|
||||
| Scan history sheet | ✓ | ✓ |
|
||||
| Scan comparison | ✓ | ✓ |
|
||||
| CVE suppressions | ✓ | ✓ |
|
||||
| Misconfig acknowledgements | ✓ | ✓ |
|
||||
| Scheduled fleet scans (all images on a node) | ✓ | ✓ |
|
||||
| Scan policies with `block_on_deploy` enforcement | | ✓ |
|
||||
| Suppression-aware deploy blocking (optional toggle) | | ✓ |
|
||||
| SBOM generation (SPDX, CycloneDX) | | ✓ |
|
||||
| SARIF export (code scanning integration) | | ✓ |
|
||||
| Auto-update of the managed Trivy binary | | ✓ |
|
||||
|
||||
## On-demand scanning
|
||||
|
||||
@@ -75,9 +75,9 @@ The drawer opens as a right-side sheet with the breadcrumb `Security › Scans
|
||||
- **Re-scan**: kick off a fresh scan, ignoring the digest cache.
|
||||
- **Compare**: pick a baseline scan from the dropdown to diff against this one.
|
||||
- **CSV**: export the full vulnerability list for offline review.
|
||||
- **SARIF**: download the full scan (vulnerabilities, secrets, and misconfigs) as SARIF 2.1.0 for upload to GitHub code scanning or any SARIF-aware tool. Skipper or Admiral required.
|
||||
- **SARIF**: download the full scan (vulnerabilities, secrets, and misconfigs) as SARIF 2.1.0 for upload to GitHub code scanning or any SARIF-aware tool. Admiral required.
|
||||
|
||||
The summary header below the actions reports the per-severity counts, the total, how many findings have a fix available, when the scan ran, and what triggered it. An **SBOM** button below the summary downloads a Software Bill of Materials in SPDX JSON or CycloneDX format (Skipper or Admiral).
|
||||
The summary header below the actions reports the per-severity counts, the total, how many findings have a fix available, when the scan ran, and what triggered it. An **SBOM** button below the summary downloads a Software Bill of Materials in SPDX JSON or CycloneDX format (Admiral).
|
||||
|
||||
### Vulnerabilities tab
|
||||
|
||||
@@ -120,10 +120,6 @@ The App Store deploy sheet has a **Security** section with a **Scan images for v
|
||||
|
||||
## Scheduled fleet scans
|
||||
|
||||
<Note>
|
||||
Scheduled fleet scans require a **Skipper** or **Admiral** license.
|
||||
</Note>
|
||||
|
||||
You can run recurring scans of every image on a node through the standard [Scheduled Operations](/features/scheduled-operations) system. Create a scheduled task with action **Scan** and a cron expression. The scheduler iterates every image on the target node with a short delay between scans and records the result in the task's run history.
|
||||
|
||||
Use scheduled scans to keep badge counts fresh even for images that are rarely redeployed. A nightly cron like `0 3 * * *` is a sensible default for most fleets.
|
||||
@@ -140,7 +136,7 @@ Failures are usually transient (registry timeouts, missing credentials) and neve
|
||||
## Scan policies
|
||||
|
||||
<Note>
|
||||
Scan policies require a **Skipper** or **Admiral** license.
|
||||
Scan policies require an **Admiral** license.
|
||||
</Note>
|
||||
|
||||
Policies define severity thresholds that govern whether a stack can deploy. A policy with **Block on deploy** enabled runs a pre-flight scan on every image in the stack before `docker compose up` executes; if any image meets or exceeds the threshold, the deploy is rejected with a dialog listing the offending images. Policies with **Block on deploy** disabled still evaluate every post-deploy and scheduled scan and dispatch warning alerts when the threshold is exceeded.
|
||||
@@ -297,7 +293,7 @@ Acknowledged misconfigs are emitted in the SARIF export with a `suppressions` en
|
||||
## SBOM generation
|
||||
|
||||
<Note>
|
||||
SBOM generation requires a **Skipper** or **Admiral** license.
|
||||
SBOM generation requires an **Admiral** license.
|
||||
</Note>
|
||||
|
||||
A Software Bill of Materials (SBOM) is a machine-readable inventory of every package in a container image. SBOMs satisfy security frameworks (SLSA, Executive Order 14028, EU Cyber Resilience Act) and support offline supply-chain analysis.
|
||||
@@ -314,7 +310,7 @@ The download starts immediately and uses the image's digest (when available) in
|
||||
## SARIF export
|
||||
|
||||
<Note>
|
||||
SARIF export requires a **Skipper** or **Admiral** license.
|
||||
SARIF export requires an **Admiral** license.
|
||||
</Note>
|
||||
|
||||
SARIF (Static Analysis Results Interchange Format) is the standard format supported by GitHub code scanning, Microsoft Defender for Cloud, and most security dashboards. Sencho generates SARIF 2.1.0 documents from the stored scan results, so the download matches what you see in the drawer (same findings, same suppression state) without re-running Trivy.
|
||||
@@ -395,7 +391,7 @@ Up to 1000 findings per scan are loaded for comparison. When a scan exceeds this
|
||||
Sencho forwards the same registry credentials configured under **Settings → Registries** to Trivy. If a pull works in Sencho but a scan fails, make sure the image has been pulled at least once so Trivy can work against the cached local image.
|
||||
</Accordion>
|
||||
<Accordion title="Badge is out of date after an image update">
|
||||
Post-deploy scanning only runs on deploy actions. For long-running images that aren't redeployed, schedule a recurring scan (Skipper or Admiral) or click the shield icon in the Resources Hub to re-scan on demand.
|
||||
Post-deploy scanning only runs on deploy actions. For long-running images that aren't redeployed, schedule a recurring scan or click the shield icon in the Resources Hub to re-scan on demand.
|
||||
</Accordion>
|
||||
<Accordion title="A scan shows in progress for a long time">
|
||||
Scans have a 5-minute internal timeout. The scheduler sweeps every tick and marks any scan stuck `in_progress` for more than 15 minutes as failed, so the UI always recovers on its own. Wait for the sweep, then click the shield icon again to trigger a fresh scan.
|
||||
|
||||
@@ -4,7 +4,7 @@ description: Trigger stack actions from CI/CD pipelines via HTTP webhooks with H
|
||||
---
|
||||
|
||||
<Note>
|
||||
Webhooks require a **Skipper** or **Admiral** license. Managing webhooks is admin-only.
|
||||
Managing webhooks is admin-only.
|
||||
</Note>
|
||||
|
||||
Sencho webhooks let external systems trigger stack actions over HTTP. The typical use case: your CI pipeline builds a new image, then calls a Sencho webhook to deploy the updated stack, with no manual intervention required.
|
||||
@@ -163,7 +163,7 @@ Sencho retains the last 100 executions per webhook and surfaces the 20 most rece
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="I don't see Webhooks in Settings.">
|
||||
The page requires a **Skipper** or **Admiral** license. If you are on a paid tier but the node switcher in the top-left shows a remote node, switch to **Local** to reveal the page.
|
||||
Webhooks are managed on the local node. If the node switcher in the top-left shows a remote node, switch to **Local** to reveal the page.
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="My trigger returns 404 'Webhook not found or signature invalid'.">
|
||||
|
||||
@@ -73,7 +73,7 @@ services:
|
||||
|
||||
## SSO environment variables
|
||||
|
||||
If you use SSO (Admiral), configure your identity providers via environment variables:
|
||||
If you use SSO, configure your identity providers via environment variables:
|
||||
|
||||
| Variable | Description |
|
||||
|----------|-------------|
|
||||
|
||||
@@ -64,7 +64,7 @@ The **Fleet** view is the multi-node command center. The masthead summarizes onl
|
||||
|
||||
The Fleet toolbar includes **Check Updates**, **Refresh**, and **Add node** for admins. The **Overview** tab supports search, sort, status filters, label filters, and a Grid or Topology view. Node cards show online state, resource use, container counts, version state, update actions, and direct drill-down into stacks on that node.
|
||||
|
||||
Fleet also provides dedicated tabs for snapshots, node status, blueprint deployments, traffic management, federation, fleet actions, and secrets. Some fleet features require Skipper or Admiral. See [Licensing](/features/licensing) for the full tier breakdown.
|
||||
Fleet also provides dedicated tabs for snapshots, node status, blueprint deployments, traffic management, federation, fleet actions, and secrets. Some fleet features require Admiral. See [Licensing](/features/licensing) for the full tier breakdown.
|
||||
|
||||
## Resources, templates, and logs
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ description: Step-by-step instructions for connecting Sencho to your identity pr
|
||||
SSO can be configured from the Settings UI or seeded via environment variables (shown below).
|
||||
|
||||
<Note>
|
||||
**Tier availability.** Custom OIDC is available on every tier, including Community. The Google, GitHub, and Okta preset providers require Skipper or higher. LDAP / Active Directory requires Admiral. See [Licensing & Billing](/features/licensing#feature-breakdown) for the full breakdown.
|
||||
**Tier availability.** Custom OIDC and the Google, GitHub, and Okta preset providers are available on every tier, including Community. LDAP / Active Directory requires Admiral. See [Licensing & Billing](/features/licensing#feature-breakdown) for the full breakdown.
|
||||
</Note>
|
||||
|
||||
<Frame>
|
||||
|
||||
+35
-35
@@ -11,7 +11,7 @@ info:
|
||||
## Authentication
|
||||
|
||||
All authenticated endpoints accept a Bearer token in the `Authorization` header.
|
||||
Generate API tokens from **Settings > API Tokens** in the Sencho dashboard (requires Admiral license).
|
||||
Generate API tokens from **Settings > API Tokens** in the Sencho dashboard (admin role required).
|
||||
|
||||
```
|
||||
Authorization: Bearer YOUR_API_TOKEN
|
||||
@@ -25,8 +25,8 @@ info:
|
||||
|
||||
## License Tiers
|
||||
|
||||
Some endpoints require a Skipper or Admiral license. Requests to gated endpoints
|
||||
on Community Edition return `403` with `code: "PAID_REQUIRED"` or `code: "ADMIRAL_REQUIRED"`.
|
||||
Some endpoints require an Admiral license. Requests to gated endpoints
|
||||
on Community return `403` with `code: "PAID_REQUIRED"`.
|
||||
contact:
|
||||
name: Sencho
|
||||
url: https://sencho.io
|
||||
@@ -57,15 +57,15 @@ tags:
|
||||
- name: Containers
|
||||
description: List and manage running containers
|
||||
- name: API Tokens
|
||||
description: Manage scoped API tokens (Admiral license required)
|
||||
description: Manage scoped API tokens (admin role required)
|
||||
- name: Webhooks
|
||||
description: Configure and trigger deployment webhooks (Skipper or Admiral license required)
|
||||
description: Configure and trigger deployment webhooks
|
||||
- name: Nodes
|
||||
description: Manage local and remote Sencho nodes
|
||||
- name: Fleet
|
||||
description: Multi-node fleet overview and snapshots (Skipper or Admiral license required)
|
||||
description: Multi-node fleet overview and snapshots
|
||||
- name: Scheduled Tasks
|
||||
description: Configure recurring automated operations (Admiral license required)
|
||||
description: Configure recurring automated operations (admin role required)
|
||||
- name: Registries
|
||||
description: Manage private container registry credentials (Admiral license required). These endpoints are only accessible via browser sessions — API tokens receive `SCOPE_DENIED`.
|
||||
- name: Image Updates
|
||||
@@ -132,7 +132,7 @@ components:
|
||||
code:
|
||||
type: string
|
||||
description: Machine-readable error code (e.g., `PAID_REQUIRED`, `SCOPE_DENIED`).
|
||||
enum: [PAID_REQUIRED, ADMIRAL_REQUIRED, SCOPE_DENIED]
|
||||
enum: [PAID_REQUIRED, SCOPE_DENIED]
|
||||
|
||||
SuccessMessage:
|
||||
type: object
|
||||
@@ -506,7 +506,7 @@ components:
|
||||
schema:
|
||||
$ref: "#/components/schemas/Error"
|
||||
example:
|
||||
error: "This feature requires a Skipper or Admiral license."
|
||||
error: "This feature requires a Sencho Admiral license."
|
||||
code: "PAID_REQUIRED"
|
||||
NotFound:
|
||||
description: Resource not found.
|
||||
@@ -934,7 +934,7 @@ paths:
|
||||
tags: [Stacks]
|
||||
summary: Deploy stack
|
||||
description: |
|
||||
Runs `docker compose up -d` for the stack. On Skipper/Admiral tier, uses atomic deployment
|
||||
Runs `docker compose up -d` for the stack using atomic deployment
|
||||
with automatic rollback on failure. Requires `stack:deploy` permission.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/stackName"
|
||||
@@ -962,7 +962,7 @@ paths:
|
||||
type: string
|
||||
rolledBack:
|
||||
type: boolean
|
||||
description: Whether the stack was automatically rolled back (Skipper/Admiral tier).
|
||||
description: Whether the stack was automatically rolled back.
|
||||
|
||||
/api/stacks/{stackName}/down:
|
||||
post:
|
||||
@@ -1077,8 +1077,8 @@ paths:
|
||||
tags: [Stacks]
|
||||
summary: Pull and recreate stack
|
||||
description: |
|
||||
Pulls latest images and recreates containers (`docker compose pull && up -d`).
|
||||
On Skipper/Admiral tier, uses atomic update with automatic rollback on failure.
|
||||
Pulls latest images and recreates containers (`docker compose pull && up -d`)
|
||||
using atomic update with automatic rollback on failure.
|
||||
Requires `stack:deploy` permission.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/stackName"
|
||||
@@ -1115,7 +1115,7 @@ paths:
|
||||
operationId: rollbackStack
|
||||
tags: [Stacks]
|
||||
summary: Rollback stack
|
||||
description: Restores the stack to its previous deployment state. Requires Skipper or Admiral license and `stack:deploy` permission.
|
||||
description: Restores the stack to its previous deployment state. Requires `stack:deploy` permission.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/stackName"
|
||||
- $ref: "#/components/parameters/nodeId"
|
||||
@@ -1301,7 +1301,7 @@ paths:
|
||||
summary: Create API token
|
||||
description: |
|
||||
Generates a new scoped API token. The full token is only returned in the creation response
|
||||
and cannot be retrieved again. Requires Admiral license and admin role.
|
||||
and cannot be retrieved again. Requires admin role.
|
||||
|
||||
**Note:** API tokens cannot create other API tokens.
|
||||
responses:
|
||||
@@ -1366,7 +1366,7 @@ paths:
|
||||
summary: List API tokens
|
||||
description: |
|
||||
Returns all API tokens for the current user. Token hashes are never exposed.
|
||||
Requires Admiral license and admin role.
|
||||
Requires admin role.
|
||||
|
||||
**Note:** API tokens cannot list other API tokens.
|
||||
responses:
|
||||
@@ -1390,7 +1390,7 @@ paths:
|
||||
summary: Revoke API token
|
||||
description: |
|
||||
Permanently revokes an API token. Users can only revoke their own tokens.
|
||||
Requires Admiral license and admin role.
|
||||
Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
responses:
|
||||
@@ -1419,7 +1419,7 @@ paths:
|
||||
operationId: listWebhooks
|
||||
tags: [Webhooks]
|
||||
summary: List webhooks
|
||||
description: Returns all configured webhooks with masked secrets. Requires Skipper or Admiral license.
|
||||
description: Returns all configured webhooks with masked secrets.
|
||||
responses:
|
||||
"200":
|
||||
description: Array of webhook objects.
|
||||
@@ -1439,7 +1439,7 @@ paths:
|
||||
summary: Create webhook
|
||||
description: |
|
||||
Creates a new webhook for a stack. The webhook secret is auto-generated and only
|
||||
returned in the creation response. Requires Skipper or Admiral license and admin role.
|
||||
returned in the creation response. Requires admin role.
|
||||
requestBody:
|
||||
required: true
|
||||
content:
|
||||
@@ -1496,7 +1496,7 @@ paths:
|
||||
operationId: updateWebhook
|
||||
tags: [Webhooks]
|
||||
summary: Update webhook
|
||||
description: Updates webhook configuration. Requires Skipper or Admiral license and admin role.
|
||||
description: Updates webhook configuration. Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
requestBody:
|
||||
@@ -1542,7 +1542,7 @@ paths:
|
||||
operationId: deleteWebhook
|
||||
tags: [Webhooks]
|
||||
summary: Delete webhook
|
||||
description: Permanently deletes a webhook. Requires Skipper or Admiral license and admin role.
|
||||
description: Permanently deletes a webhook. Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
responses:
|
||||
@@ -1564,7 +1564,7 @@ paths:
|
||||
operationId: getWebhookHistory
|
||||
tags: [Webhooks]
|
||||
summary: Get webhook execution history
|
||||
description: Returns the execution log for a webhook. Requires Skipper or Admiral license.
|
||||
description: Returns the execution log for a webhook.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
responses:
|
||||
@@ -2100,7 +2100,7 @@ paths:
|
||||
operationId: createFleetSnapshot
|
||||
tags: [Fleet]
|
||||
summary: Create fleet snapshot
|
||||
description: Creates a point-in-time backup of all compose files across all nodes. Requires Skipper or Admiral license and admin role.
|
||||
description: Creates a point-in-time backup of all compose files across all nodes. Requires admin role.
|
||||
requestBody:
|
||||
required: false
|
||||
content:
|
||||
@@ -2127,7 +2127,7 @@ paths:
|
||||
operationId: listFleetSnapshots
|
||||
tags: [Fleet]
|
||||
summary: List fleet snapshots
|
||||
description: Returns paginated fleet snapshots. Requires Skipper or Admiral license.
|
||||
description: Returns paginated fleet snapshots.
|
||||
parameters:
|
||||
- name: limit
|
||||
in: query
|
||||
@@ -2165,7 +2165,7 @@ paths:
|
||||
operationId: getFleetSnapshot
|
||||
tags: [Fleet]
|
||||
summary: Get snapshot details
|
||||
description: Returns full snapshot details including all captured files grouped by node and stack. Requires Skipper or Admiral license.
|
||||
description: Returns full snapshot details including all captured files grouped by node and stack.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
responses:
|
||||
@@ -2185,7 +2185,7 @@ paths:
|
||||
operationId: deleteFleetSnapshot
|
||||
tags: [Fleet]
|
||||
summary: Delete snapshot
|
||||
description: Permanently deletes a fleet snapshot. Requires Skipper or Admiral license and admin role.
|
||||
description: Permanently deletes a fleet snapshot. Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
responses:
|
||||
@@ -2207,7 +2207,7 @@ paths:
|
||||
operationId: restoreFleetSnapshot
|
||||
tags: [Fleet]
|
||||
summary: Restore from snapshot
|
||||
description: Restores a specific stack on a specific node from the snapshot. Optionally redeploys after restore. Requires Skipper or Admiral license and admin role.
|
||||
description: Restores a specific stack on a specific node from the snapshot. Optionally redeploys after restore. Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
requestBody:
|
||||
@@ -2256,7 +2256,7 @@ paths:
|
||||
operationId: listScheduledTasks
|
||||
tags: [Scheduled Tasks]
|
||||
summary: List scheduled tasks
|
||||
description: Returns all scheduled tasks. Requires Admiral license and admin role.
|
||||
description: Returns all scheduled tasks. Requires admin role.
|
||||
responses:
|
||||
"200":
|
||||
description: Array of scheduled task objects.
|
||||
@@ -2280,7 +2280,7 @@ paths:
|
||||
- `snapshot` requires `target_type: fleet`
|
||||
- `prune` requires `target_type: system`
|
||||
|
||||
Requires Admiral license and admin role.
|
||||
Requires admin role.
|
||||
requestBody:
|
||||
required: true
|
||||
content:
|
||||
@@ -2373,7 +2373,7 @@ paths:
|
||||
operationId: updateScheduledTask
|
||||
tags: [Scheduled Tasks]
|
||||
summary: Update scheduled task
|
||||
description: Updates task configuration. Same validation rules as creation apply. Requires Admiral license and admin role.
|
||||
description: Updates task configuration. Same validation rules as creation apply. Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
requestBody:
|
||||
@@ -2432,7 +2432,7 @@ paths:
|
||||
operationId: deleteScheduledTask
|
||||
tags: [Scheduled Tasks]
|
||||
summary: Delete scheduled task
|
||||
description: Permanently deletes a scheduled task. Requires Admiral license and admin role.
|
||||
description: Permanently deletes a scheduled task. Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
responses:
|
||||
@@ -2460,7 +2460,7 @@ paths:
|
||||
operationId: toggleScheduledTask
|
||||
tags: [Scheduled Tasks]
|
||||
summary: Toggle task enabled/disabled
|
||||
description: Flips the enabled state of a scheduled task. Requires Admiral license and admin role.
|
||||
description: Flips the enabled state of a scheduled task. Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
responses:
|
||||
@@ -2488,7 +2488,7 @@ paths:
|
||||
operationId: runScheduledTask
|
||||
tags: [Scheduled Tasks]
|
||||
summary: Run task immediately
|
||||
description: Executes the scheduled task immediately, regardless of its cron schedule. Requires Admiral license and admin role.
|
||||
description: Executes the scheduled task immediately, regardless of its cron schedule. Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
responses:
|
||||
@@ -2516,7 +2516,7 @@ paths:
|
||||
operationId: listScheduledTaskRuns
|
||||
tags: [Scheduled Tasks]
|
||||
summary: List task execution history
|
||||
description: Returns paginated execution history for a scheduled task. Requires Admiral license and admin role.
|
||||
description: Returns paginated execution history for a scheduled task. Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
- name: limit
|
||||
@@ -2556,7 +2556,7 @@ paths:
|
||||
operationId: exportScheduledTaskRuns
|
||||
tags: [Scheduled Tasks]
|
||||
summary: Export task history as CSV
|
||||
description: Downloads the execution history for a scheduled task as a CSV file. Requires Admiral license and admin role.
|
||||
description: Downloads the execution history for a scheduled task as a CSV file. Requires admin role.
|
||||
parameters:
|
||||
- $ref: "#/components/parameters/idPath"
|
||||
responses:
|
||||
|
||||
@@ -6,7 +6,7 @@ description: What to back up, how to restore it, and how to migrate Sencho to a
|
||||
Sencho stores all its state in two places: the **data directory** (SQLite database and encryption key) and your **compose directory** (your actual stack files). Both need to be backed up for a complete recovery.
|
||||
|
||||
<Note>
|
||||
Skipper and Admiral users also have access to [Fleet-Wide Backups](/features/fleet-backups), which snapshot compose files across all nodes directly from the dashboard. This page covers lower-level backup of the Sencho instance itself.
|
||||
Every tier also has access to [Fleet-Wide Backups](/features/fleet-backups), which snapshot compose files across all nodes directly from the dashboard. This page covers lower-level backup of the Sencho instance itself.
|
||||
</Note>
|
||||
|
||||
---
|
||||
|
||||
@@ -44,7 +44,7 @@ When a newer Trivy release is available, Settings → Security shows an **Update
|
||||
|
||||
To update automatically instead, toggle **Auto-update Trivy** on. Sencho checks for new releases once a day and installs them in the background. You'll get an in-app notification each time a new version is installed, or when an update is available and auto-update is off.
|
||||
|
||||
The install, update, and uninstall buttons are available to admins on every tier. The **Auto-update Trivy** toggle requires Skipper.
|
||||
The install, update, and uninstall buttons are available to admins on every tier. The **Auto-update Trivy** toggle requires Admiral.
|
||||
|
||||
### Removing the managed install
|
||||
|
||||
|
||||
@@ -164,11 +164,11 @@ To re-test connectivity after making changes, open **Profile > Settings > Nodes*
|
||||
|
||||
## License tier shows the wrong name
|
||||
|
||||
**Symptom:** The license card in **Settings > License** shows the wrong tier name (e.g. "Sencho Skipper" when you purchased Admiral).
|
||||
**Symptom:** The license card in **Settings > License** shows a tier that does not match what you purchased.
|
||||
|
||||
**Cause:** Older versions of Sencho could misidentify certain license variant names from the payment provider.
|
||||
**Cause:** The tier is read from your license at validation time. A stale cached value can show after the key was activated but before the next validation cycle ran.
|
||||
|
||||
**Fix:** Update to the latest version of Sencho and restart. The correct tier name will appear automatically in **Settings > License**.
|
||||
**Fix:** Deactivate and re-activate the key in **Settings > License**, then restart the Sencho container. The tier is re-read on the next validation and the correct name appears automatically. If it still does not match, email `licensing@sencho.io` with your order ID.
|
||||
|
||||
---
|
||||
|
||||
@@ -192,7 +192,7 @@ To re-test connectivity after making changes, open **Profile > Settings > Nodes*
|
||||
**Checks in order:**
|
||||
|
||||
1. Open **Settings > License** and verify it shows your license as **active** with the correct tier name.
|
||||
2. If the tier shows "Skipper" but you purchased Admiral, this is the same variant identification issue described above. Update Sencho to the latest version to resolve it.
|
||||
2. If the tier name does not match what you purchased, see [License tier shows the wrong name](#license-tier-shows-the-wrong-name) above.
|
||||
3. If the tier shows correctly but features are still locked, restart the Sencho container.
|
||||
|
||||
---
|
||||
@@ -203,18 +203,17 @@ To re-test connectivity after making changes, open **Profile > Settings > Nodes*
|
||||
|
||||
**Possible causes:**
|
||||
|
||||
- **Lifetime license:** Lifetime licenses do not have a billing portal. This is expected behavior. In the latest version, the **Manage Subscription** button is hidden for lifetime licenses.
|
||||
- **Network issues:** If your Sencho instance cannot reach the internet, the billing portal URL cannot be fetched. Check your instance's outbound connectivity and try again.
|
||||
|
||||
---
|
||||
|
||||
## Paid features return 403 on remote nodes
|
||||
|
||||
**Symptom:** A Skipper or Admiral feature works on the local node but returns a 403 error when you switch to a remote node.
|
||||
**Symptom:** An Admiral feature works on the local node but returns a 403 error when you switch to a remote node.
|
||||
|
||||
**Checks in order:**
|
||||
|
||||
1. **Is your primary instance licensed?** Open **Profile > Settings > License** on the primary instance and verify it shows an active Skipper or Admiral license. Remote nodes inherit the primary's tier; if the primary is on Community, all remote nodes will be Community too.
|
||||
1. **Is your primary instance licensed?** Open **Profile > Settings > License** on the primary instance and verify it shows an active Admiral license. Remote nodes inherit the primary's tier; if the primary is on Community, all remote nodes will be Community too.
|
||||
2. **Is the remote node's token valid?** An expired or revoked token prevents the license tier from being transmitted. Regenerate the token on the remote instance and update the node config on the primary.
|
||||
3. **Is the remote node running an up-to-date version of Sencho?** Distributed license enforcement requires both the primary and remote instances to be on a compatible version. Update the remote node if it's outdated.
|
||||
4. **Are you accessing the remote node directly?** If you navigate directly to the remote Sencho instance's URL (bypassing the primary), it uses its own local license. License inheritance only works through the primary's proxy.
|
||||
@@ -301,10 +300,6 @@ If you need to clean up unused *user-created* networks, use the **Prune Dead Net
|
||||
|
||||
**Symptom:** Switching to the **Topology** view mode on the Networks tab shows "No user-created networks found" even though you have running containers.
|
||||
|
||||
<Note>
|
||||
Network Topology requires a Skipper or Admiral license.
|
||||
</Note>
|
||||
|
||||
**Possible causes:**
|
||||
|
||||
- **All containers are on system networks only.** The topology view excludes Docker's built-in `bridge`, `host`, and `none` networks. If your containers only use the default bridge, they won't appear. Create a custom network in your compose file to see them in the topology.
|
||||
@@ -472,9 +467,8 @@ docker compose pull && docker compose up -d
|
||||
|
||||
**Checks:**
|
||||
|
||||
1. **License tier**: Labels require a Skipper or Admiral license. Verify your tier in **Profile > Settings > License**.
|
||||
2. **At least one label must exist**: Labels are managed in **Profile > Settings > Labels**. Create at least one label before assigning it to stacks.
|
||||
3. **Downgrade**: If you downgraded from a paid tier to Community, the label UI is hidden but your data is preserved. Upgrading again restores all labels and assignments.
|
||||
1. **At least one label must exist**: Labels are managed in **Profile > Settings > Labels**. Create at least one label before assigning it to stacks.
|
||||
2. **Assignments are saved**: Open the stack's context menu, choose **Labels**, and confirm the label is checked. Pills appear in the sidebar once at least one label is assigned.
|
||||
|
||||
---
|
||||
|
||||
@@ -486,7 +480,6 @@ docker compose pull && docker compose up -d
|
||||
|
||||
1. **Stack name match**: The stack name in the routing rule must match exactly. Stack names are case-sensitive and correspond to the directory name in your compose folder.
|
||||
2. **Rule is enabled**: Check that the route's toggle is turned on in **Profile > Settings > Routing**.
|
||||
3. **License tier**: Notification Routing requires a Skipper or Admiral license.
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -60,7 +60,7 @@ Two separate toggles let you change this, and they are independent:
|
||||
| Toggle | Where it lives | Tier | What it does |
|
||||
|--------|----------------|------|--------------|
|
||||
| **Require 2FA on SSO sign-in** | Each user's own **Settings · Account · Two-factor authentication** section | All tiers | Per-user opt-in. When on, that one user's SSO sign-ins also require a TOTP after the SSO flow returns. Helper text: `By default, SSO logins skip the second factor. Enforce it here to require both.` |
|
||||
| **Require MFA** (per provider) | The provider config under **Settings · SSO** | Admiral (LDAP), Skipper (preset OIDC), Community (Custom OIDC) | Admin-set, fleet-wide for that provider. When on, every SSO-provisioned user must enrol TOTP after their first successful sign-in before they can use the rest of the console. |
|
||||
| **Require MFA** (per provider) | The provider config under **Settings · SSO** | Admiral (LDAP), Community (Custom OIDC and preset OIDC) | Admin-set, fleet-wide for that provider. When on, every SSO-provisioned user must enrol TOTP after their first successful sign-in before they can use the rest of the console. |
|
||||
|
||||
The per-user toggle decides *whether a TOTP is asked for on every SSO sign-in*. The per-provider toggle decides *whether new SSO users are forced to enrol TOTP at all*. Both can be on at once: the per-provider toggle ensures enrolment, the per-user toggle then asks for the TOTP on every sign-in.
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@ Sencho provides dedicated email channels for different types of inquiries. Use t
|
||||
## Support
|
||||
|
||||
<Card title="support@sencho.io" icon="life-ring" href="mailto:support@sencho.io">
|
||||
Technical support, how-to questions, and troubleshooting help. Available to Skipper and Admiral license holders via **Settings > Help & Support** in the app.
|
||||
Technical support, how-to questions, and troubleshooting help. Available to Admiral license holders via **Settings > Help & Support** in the app.
|
||||
</Card>
|
||||
|
||||
Community users can get help through the [Documentation](https://docs.sencho.io) and [GitHub Issues](https://github.com/studio-saelix/sencho/issues).
|
||||
@@ -22,7 +22,7 @@ Community users can get help through the [Documentation](https://docs.sencho.io)
|
||||
## Licensing
|
||||
|
||||
<Card title="licensing@sencho.io" icon="key" href="mailto:licensing@sencho.io">
|
||||
License activation issues, upgrade questions, enterprise pricing, refund requests, and alternative licensing arrangements.
|
||||
License activation issues, upgrade questions, custom pricing, refund requests, and alternative licensing arrangements.
|
||||
</Card>
|
||||
|
||||
This address appears in:
|
||||
@@ -60,9 +60,9 @@ All reports are reviewed promptly and handled with confidentiality. See the [Cod
|
||||
|
||||
| Email | When to use |
|
||||
|-------|-------------|
|
||||
| `support@sencho.io` | Technical help (paid tiers) |
|
||||
| `support@sencho.io` | Technical help (Admiral) |
|
||||
| `contact@sencho.io` | General inquiries, partnerships, media |
|
||||
| `licensing@sencho.io` | Upgrades, enterprise deals, refunds, license issues |
|
||||
| `licensing@sencho.io` | Upgrades, custom deals, refunds, license issues |
|
||||
| `security@sencho.io` | Vulnerability reports, security incidents |
|
||||
| `privacy@sencho.io` | GDPR/CCPA requests, legal, DMCA |
|
||||
| `conduct@sencho.io` | Code of Conduct violations |
|
||||
|
||||
+25
-26
@@ -73,30 +73,30 @@ Every self-hosted instance includes the full security stack, with advanced featu
|
||||
|
||||
Every Sencho instance includes the foundational security stack. Advanced access-control and compliance features are available on paid tiers.
|
||||
|
||||
| Feature | Community | Skipper | Admiral |
|
||||
|---------|:---------:|:-------:|:-------:|
|
||||
| Password authentication | ✓ | ✓ | ✓ |
|
||||
| Custom OIDC SSO (Authelia, Keycloak, Authentik, any provider) | ✓ | ✓ | ✓ |
|
||||
| Preset Google / GitHub / Okta SSO | | ✓ | ✓ |
|
||||
| LDAP / Active Directory | | | ✓ |
|
||||
| Two-factor authentication (TOTP + backup codes) | ✓ | ✓ | ✓ |
|
||||
| Session management (httpOnly, Secure, SameSite) | ✓ | ✓ | ✓ |
|
||||
| Encryption at rest (AES-256-GCM) | ✓ | ✓ | ✓ |
|
||||
| Rate limiting (auth + API) | ✓ | ✓ | ✓ |
|
||||
| Node-to-node authentication | ✓ | ✓ | ✓ |
|
||||
| Vulnerability scanning (on-demand + post-deploy) | ✓ | ✓ | ✓ |
|
||||
| Multi-user with RBAC (Admin, Viewer) | | ✓ | ✓ |
|
||||
| Scan policies, scheduled scans, SBOM generation | | ✓ | ✓ |
|
||||
| Fleet Secrets (encrypted env-var bundles) | | ✓ | ✓ |
|
||||
| Webhook signatures (HMAC-SHA256) | | ✓ | ✓ |
|
||||
| API tokens (scoped, expiring) | ✓ | ✓ | ✓ |
|
||||
| Advanced RBAC (Deployer, Node Admin, Auditor) | | | ✓ |
|
||||
| Scoped permissions (per-stack, per-node) | | | ✓ |
|
||||
| Audit log with export | | | ✓ |
|
||||
| Feature | Community | Admiral |
|
||||
|---------|:---------:|:-------:|
|
||||
| Password authentication | ✓ | ✓ |
|
||||
| Custom OIDC SSO (Authelia, Keycloak, Authentik, any provider) | ✓ | ✓ |
|
||||
| Preset Google / GitHub / Okta SSO | ✓ | ✓ |
|
||||
| LDAP / Active Directory | | ✓ |
|
||||
| Two-factor authentication (TOTP + backup codes) | ✓ | ✓ |
|
||||
| Session management (httpOnly, Secure, SameSite) | ✓ | ✓ |
|
||||
| Encryption at rest (AES-256-GCM) | ✓ | ✓ |
|
||||
| Rate limiting (auth + API) | ✓ | ✓ |
|
||||
| Node-to-node authentication | ✓ | ✓ |
|
||||
| Vulnerability scanning (on-demand + post-deploy + scheduled) | ✓ | ✓ |
|
||||
| Multi-user with RBAC (Admin, Viewer) | ✓ | ✓ |
|
||||
| Webhook signatures (HMAC-SHA256) | ✓ | ✓ |
|
||||
| API tokens (scoped, expiring) | ✓ | ✓ |
|
||||
| Scan policies and SBOM generation | | ✓ |
|
||||
| Fleet Secrets (encrypted env-var bundles) | | ✓ |
|
||||
| Advanced RBAC (Deployer, Node Admin, Auditor) | | ✓ |
|
||||
| Scoped permissions (per-stack, per-node) | | ✓ |
|
||||
| Audit log with export | | ✓ |
|
||||
|
||||
## Password authentication
|
||||
|
||||
Sencho enforces a minimum 8-character password policy aligned with [NIST SP 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html). Passwords are hashed with bcrypt (cost factor 10) before storage. On first launch, you create the initial admin account through a setup wizard; additional users can be created from **Settings · Users** on paid tiers.
|
||||
Sencho enforces a minimum 8-character password policy aligned with [NIST SP 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html). Passwords are hashed with bcrypt (cost factor 10) before storage. On first launch, you create the initial admin account through a setup wizard; additional users can be created from **Settings · Users**.
|
||||
|
||||
Changing your password immediately invalidates all other active sessions, so a compromised session cannot survive a password reset.
|
||||
|
||||
@@ -104,8 +104,7 @@ Changing your password immediately invalidates all other active sessions, so a c
|
||||
|
||||
Sencho supports five identity providers split across tiers by delivery model:
|
||||
|
||||
- **Community**: **Custom OIDC**, which connects to any spec-compliant OpenID Connect provider (Authelia, Keycloak, Authentik, Zitadel, KanIDM, Pocket ID, and others).
|
||||
- **Skipper**: preset providers for **Google**, **GitHub**, and **Okta**.
|
||||
- **Community**: **Custom OIDC**, which connects to any spec-compliant OpenID Connect provider (Authelia, Keycloak, Authentik, Zitadel, KanIDM, Pocket ID, and others), plus preset providers for **Google**, **GitHub**, and **Okta**.
|
||||
- **Admiral**: **LDAP / Active Directory** for on-premises directories.
|
||||
|
||||
All OIDC flows use PKCE (Proof Key for Code Exchange) and a cryptographic state parameter to prevent authorization code interception and cross-site request forgery. SSO credentials (client secrets and LDAP bind passwords) are encrypted at rest with AES-256-GCM.
|
||||
@@ -174,11 +173,11 @@ For setup and usage, see [API Tokens](/features/api-tokens).
|
||||
|
||||
Webhook triggers are authenticated with a per-webhook HMAC-SHA256 secret (32 random bytes). The secret is generated at create time and displayed exactly once in the success callout; the configured-webhooks list shows only a masked preview thereafter. Every inbound trigger must present a matching `X-Webhook-Signature` header computed over the raw request body. Sencho recomputes the HMAC server-side and compares it with a constant-time check to defeat timing attacks; mismatches return 401 before any deploy action runs.
|
||||
|
||||
Webhooks are available on Skipper and Admiral. For setup and verification recipes, see [Webhooks](/features/webhooks).
|
||||
Webhooks are available on every tier. For setup and verification recipes, see [Webhooks](/features/webhooks).
|
||||
|
||||
## Role-based access control
|
||||
|
||||
Sencho defines five roles with increasing levels of access. Admin and Viewer are available on Skipper; Deployer, Node Admin, and Auditor require Admiral.
|
||||
Sencho defines five roles with increasing levels of access. Admin and Viewer are available on every tier; Deployer, Node Admin, and Auditor require Admiral.
|
||||
|
||||
### Permission matrix
|
||||
|
||||
@@ -200,7 +199,7 @@ Sencho defines five roles with increasing levels of access. Admin and Viewer are
|
||||
|
||||
On Admiral, you can create **scoped assignments** that grant a user elevated permissions on specific stacks or nodes without giving them broad access. For example, a Viewer can be promoted to Deployer on a single production stack.
|
||||
|
||||
Account limits are enforced by tier: Community supports one admin, Skipper supports one admin and three viewers, and Admiral supports unlimited accounts.
|
||||
Both tiers support unlimited accounts. Community uses the Admin and Viewer roles; Admiral adds the Deployer, Node Admin, and Auditor roles plus scoped permissions.
|
||||
|
||||
For user management and scoped permissions, see [RBAC & User Management](/features/rbac).
|
||||
|
||||
|
||||
+16
-17
@@ -139,12 +139,12 @@ Activate, view, or deactivate the license for this Sencho control plane. The mas
|
||||
|
||||
| Element | Description |
|
||||
|---------|-------------|
|
||||
| **Plan** | The active tier (Sencho Community, Sencho Skipper, Sencho Admiral, or Sencho Admiral (Trial)) with a tier badge. |
|
||||
| **Plan** | The active tier (Sencho Community, Sencho Admiral, or Sencho Admiral (Trial)) with a tier badge. |
|
||||
| **Customer** | The customer name on file with Lemon Squeezy (paid plans only). |
|
||||
| **Product** | The product variant (paid plans only). |
|
||||
| **Product** | The product (paid plans only). |
|
||||
| **License key** | The active key, masked to the last four characters. |
|
||||
| **Trial countdown** | Days remaining. Visible only while a trial is active. |
|
||||
| **Manage subscription** | Opens the Lemon Squeezy customer portal (subscription plans only; not shown for lifetime). |
|
||||
| **Manage subscription** | Opens the Lemon Squeezy customer portal to update payment, view invoices, or cancel. |
|
||||
| **Deactivate** | Releases the key from this instance and reverts to Community features. |
|
||||
| **See pricing** | Direct link to the pricing page; visible on Community or when an existing license has expired. |
|
||||
|
||||
@@ -155,7 +155,7 @@ See [Licensing & Billing](/features/licensing) for the full walkthrough includin
|
||||
## Users
|
||||
|
||||
<Note>
|
||||
User management requires a Sencho Skipper or Admiral license and admin role. Community supports a single admin account only.
|
||||
User management requires an admin role. Community supports unlimited accounts with the Admin and Viewer roles.
|
||||
</Note>
|
||||
|
||||
**Scope:** Global
|
||||
@@ -173,8 +173,8 @@ Create and manage user accounts with role-based access. The masthead publishes a
|
||||
|
||||
| Role | Tier | Description |
|
||||
|------|------|-------------|
|
||||
| **Admin** | Skipper+ | Full access to all features |
|
||||
| **Viewer** | Skipper+ | Read-only access to stacks and nodes |
|
||||
| **Admin** | Community | Full access to all features |
|
||||
| **Viewer** | Community | Read-only access to stacks and nodes |
|
||||
| **Deployer** | Admiral | Can view stacks and trigger deployments |
|
||||
| **Node Admin** | Admiral | Full stack and node management, no system settings |
|
||||
| **Auditor** | Admiral | Read-only plus audit log access |
|
||||
@@ -186,7 +186,7 @@ See [RBAC & User Management](/features/rbac) for details on what each role can a
|
||||
## SSO
|
||||
|
||||
<Note>
|
||||
Custom OIDC is available on Community; preset providers (Google, GitHub, Okta) require Skipper; LDAP / Active Directory requires Admiral.
|
||||
Custom OIDC and the preset providers (Google, GitHub, Okta) are available on Community; LDAP / Active Directory requires Admiral.
|
||||
</Note>
|
||||
|
||||
**Scope:** Global, admin-only
|
||||
@@ -322,7 +322,7 @@ At least one agent must be enabled for stack alerts to deliver notifications. Se
|
||||
## Routing
|
||||
|
||||
<Note>
|
||||
Notification Routing requires a Sencho Skipper or Admiral license.
|
||||
Creating, editing, and deleting routes is admin-only.
|
||||
</Note>
|
||||
|
||||
**Scope:** Global, admin-only
|
||||
@@ -350,7 +350,7 @@ See [Notification Routing](/features/alerts-notifications#notification-routing)
|
||||
## Webhooks
|
||||
|
||||
<Note>
|
||||
Webhooks require a Sencho Skipper or Admiral license.
|
||||
Managing webhooks is admin-only.
|
||||
</Note>
|
||||
|
||||
**Scope:** Global
|
||||
@@ -374,7 +374,7 @@ See [Webhooks](/features/webhooks) for the full walkthrough including authentica
|
||||
## Labels
|
||||
|
||||
<Note>
|
||||
Label organization (create, edit, assign, remove) is available on every tier. Bulk label actions (apply or remove a label across multiple stacks in one operation) require Skipper or Admiral.
|
||||
Label organization (create, edit, assign, remove) and bulk label actions (apply or remove a label across multiple stacks in one operation) are available on every tier.
|
||||
</Note>
|
||||
|
||||
**Scope:** Per-node
|
||||
@@ -388,7 +388,7 @@ See [Stack Labels](/features/stack-labels) for the full walkthrough.
|
||||
## Security
|
||||
|
||||
<Note>
|
||||
Security is admin-only. The Trivy installer and CVE/misconfig suppressions are available on all tiers; scan policies and the **Auto-update Trivy** toggle require Sencho Skipper or Admiral (the toggle also requires a managed Trivy binary).
|
||||
Security is admin-only. The Trivy installer and CVE/misconfig suppressions are available on all tiers; scan policies and the **Auto-update Trivy** toggle require an Admiral license (the toggle also requires a managed Trivy binary).
|
||||
</Note>
|
||||
|
||||
**Scope:** Per-node
|
||||
@@ -406,7 +406,7 @@ Manage the Trivy scanner, scan policies, suppressions, and acknowledgements that
|
||||
| **Status** | `Installed (managed)` when Sencho manages the binary, `Installed (host)` when an existing host binary is being reused, or empty when nothing is detected. |
|
||||
| **Version** | The current Trivy version, when installed. |
|
||||
| **Install / Update / Uninstall** | Lifecycle actions for the managed binary. Uninstall asks for confirmation. |
|
||||
| **Auto-update Trivy** toggle | When on, Sencho checks daily and installs newer Trivy releases automatically. Requires Skipper and a managed Trivy binary. |
|
||||
| **Auto-update Trivy** toggle | When on, Sencho checks daily and installs newer Trivy releases automatically. Requires Admiral and a managed Trivy binary. |
|
||||
|
||||
### Scan policies
|
||||
|
||||
@@ -472,7 +472,7 @@ See [App Store](/features/app-store#custom-template-registry) for more on custom
|
||||
|
||||
**Scope:** Global
|
||||
|
||||
Links to help resources, with additional channels for Skipper and Admiral operators.
|
||||
Links to help resources, with an additional channel for Admiral operators.
|
||||
|
||||
### Resources (all tiers)
|
||||
|
||||
@@ -481,12 +481,11 @@ Links to help resources, with additional channels for Skipper and Admiral operat
|
||||
| **Documentation** | Opens docs.sencho.io. |
|
||||
| **GitHub Issues** | Report bugs and request features on GitHub. |
|
||||
|
||||
### Paid tier support
|
||||
### Admiral support
|
||||
|
||||
| Channel | Tier | Description |
|
||||
|---------|------|-------------|
|
||||
| **Email Support** | Skipper | Direct email support. |
|
||||
| **Priority Email Support** | Admiral | Responses within 24 hours. |
|
||||
| **Priority Email Support** | Admiral | Direct email support with responses within 24 hours. |
|
||||
|
||||
Community operators see an upgrade callout with a link to the pricing page in place of the support channels.
|
||||
|
||||
@@ -501,7 +500,7 @@ Displays instance information at a glance.
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| **Version** | Current Sencho version. |
|
||||
| **Tier** | Community, Skipper, or Admiral badge. |
|
||||
| **Tier** | Community or Admiral badge. |
|
||||
| **License Status** | active, trial, expired, or community. |
|
||||
| **Instance ID** | First eight characters of the unique identifier for this Sencho control plane (used by the license server to identify it). |
|
||||
|
||||
|
||||
Reference in New Issue
Block a user