gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-07-26 20:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v0.93.4
sencho/docs/reference/settings.mdx
T
Anso 89b9341568 fix: replace Janitor wording with reclaim/prune actions in user-facing copy (#1518) 
Rename "Janitor threshold" to "Reclaimable Docker data threshold" in Settings
and update the unused-Docker-data alert to point users to the Resources view
and the Prune Node Resources scheduled action, which are the real UI surfaces
for reclaiming disk space. Remove "janitor" from settings search keywords.
The internal docker_janitor_gb database key and JANITOR_* constants are
unchanged.
2026-06-29 15:23:19 -04:00

676 lines
32 KiB
Plaintext
Raw Permalink Blame History

---
title: Settings Reference
description: Complete reference for every option in the Sencho Settings Hub.
---
Open the Settings Hub by clicking the **Profile** icon in the top bar and selecting **Settings**. The sidebar groups every section into themed groups so related settings live together.
<Frame>
<img src="/images/settings/settings-hub-grouped.png" alt="Settings Hub with the grouped sidebar" />
</Frame>
### Sidebar groups
| Group | What it covers |
|-------|----------------|
| **Personal** | Account, Appearance |
| **Access** | License, Users, SSO, API Tokens |
| **Infrastructure** | Nodes, Fleet, Registries, Cloud Backup, App Store, Stacks |
| **Monitoring** | Host Alerts, Container Alerts, Docker & Storage |
| **Notifications** | Channels, Notification Routing |
| **Automation** | Image update checks, Webhooks |
| **Organization** | Labels |
| **Operations** | Data Retention, Developer Diagnostics, Recovery |
| **Help** | Support, About |
Vulnerability scanning is no longer a Settings section: scanner setup, scan policies, suppressions, and acknowledgements now live on the dedicated [Security page](/features/security).
Sections that require a higher license tier stay hidden until the operator has the matching license. Admin-only sections (Users, SSO, API Tokens, Fleet, Registries, Cloud Backup, Notification Routing) stay hidden for non-admin operators.
### Page chrome
Every section renders inside the same masthead-and-sidebar layout. The masthead breadcrumb on the left tells you exactly where you are. Metadata pills on the right tell you what's loaded.
| Pill | Meaning |
|------|---------|
| **SCOPE** `operator` / `browser` / `global` | Setting applies to your account (`operator`), to this browser only (`browser`, for browser-local sections such as Appearance), or to the whole instance (`global`, every other non-node group) |
| **NODE** `<node name>` | Setting is per-node and is currently being edited against this node |
| **EDITED** `<count>` pending / `saved` | The current section has unsaved changes |
| Section-specific stats | Each section can publish its own pills: `2FA on`/`off` and `BACKUP <n> left` (Account); `PLAN`, `TRIAL <n>d left`, `RENEWS`, `STATUS` (License); `OPERATORS` (Users); `CHANNELS` (Channels); `ROUTES` (Notification Routing); `WEBHOOKS` and `ENABLED` (Webhooks); `LABELS` (Labels); `PROVIDER`, `USED`, `SNAPSHOTS` (Cloud Backup); `DEV MODE` (Developer Diagnostics) |
### Quick search
Click **Filter** at the top of the sidebar, or press `Ctrl+K` / `⌘K` while the hub is open, to open the command palette. Type any section name, keyword, or synonym (for example, `saml` finds SSO) and press Enter to jump to it.
<Frame>
<img src="/images/settings/settings-search.png" alt="Settings command palette filtered to a webhook query" />
</Frame>
### Node scope
For node-scoped sections the masthead replaces the **SCOPE** pill with a **NODE** pill showing the active node name. Switch the active node from the top bar's **Switch node** button to edit a different node's per-node settings.
<Frame>
<img src="/images/settings/settings-node-scope.png" alt="Host Alerts section showing the NODE pill in the masthead" />
</Frame>
---
## Account
**Scope:** Operator (applies to the signed-in account)
The Account section manages password and two-factor authentication for the operator currently signed in. The masthead publishes a **2FA** pill so you can see at a glance whether the second factor is enabled.
<Frame>
<img src="/images/settings/settings-account-2fa.png" alt="Account section showing the Password form and the Two-factor authentication card" />
</Frame>
### Password
| Field | Description |
|-------|-------------|
| **Current password** | Your existing password. Required to change any auth setting. |
| **New password** | Minimum 8 characters. 12 or more is recommended. |
| **Confirm new password** | Must match New password. |
Click **Update password** to apply. Existing sessions remain valid.
### Two-factor authentication
When 2FA is off, a **Set up 2FA** button opens the enrolment dialog. The dialog walks through scanning the QR code in an authenticator app (Authy, 1Password, Aegis, etc.) and verifying a code.
Once enrolled, the card shows:
| Element | Description |
|---------|-------------|
| **Authenticator app** | Confirms the enrolment is active. |
| **Backup codes** | Shows how many single-use recovery codes remain. **Regenerate** issues a fresh set; the count resets to ten. |
| **Require 2FA on SSO sign-in** | Visible only when an SSO provider is configured. When on, SSO logins must also pass the second factor; when off, SSO logins skip it. |
| **Disable 2FA** | Removes the second factor after a confirmation prompt. |
See [Two-Factor Authentication](/features/two-factor-authentication) for the enrolment walkthrough and recovery options. If you lose access to your authenticator and have no backup codes left, an admin can clear your second factor from the [Users](#users) section.
---
## Appearance
**Scope:** This browser (preferences are saved to local storage)
Control how Sencho looks and how dense the workspace feels. Each browser remembers its own choices so a compact laptop setup does not force the same rhythm on a larger desktop. See [Appearance](/features/appearance) for the full walkthrough.
<Frame>
<img src="/images/settings/appearance-density.png" alt="Appearance settings showing the Density selector" />
</Frame>
### Visual style and readability
| Control | What it does |
|---------|--------------|
| **Visual style** | Master switch between **Calm** (upright headings, muted charts, reduced effects, the default) and **Signature** (italic Instrument Serif headings, saturated charts). |
| **Readability mode** | One switch for the most legible result: upright headings, muted charts, reduced effects, and a contrast lift. Locks the heading and chart controls while on. |
| **Header style** | Clean (upright interface face) or Signature (italic serif). |
| **Contrast** | Spreads the page tone, borders, and text tiers together. |
### Charts and effects
| Control | What it does |
|---------|--------------|
| **Chart palette** | Colors the Security page charts: **Muted**, **Heat** (one warm ramp), or **Signature** (saturated). |
| **Reduced effects** | Flattens card bevels, the accent glow, and chart gradients. |
| **Ambient glow** | Intensity of the accent-tinted page glow. |
### Theme and typography
The **Mode** (Dim, OLED, Light, Auto) and **Accent** (one of eight hues) set the surface palette and data color; **Border brightness** tunes every hairline. The **Interface font**, **Data font**, and **Text size** are yours to change; the heading style follows your Visual style choice.
### Density
| Value | When to pick it |
|-------|-----------------|
| **Comfortable** | Default spacing. Roomier rows and tiles for review and orientation. |
| **Compact** | Tighter rows and tiles. Fits more stacks, tasks, and audit entries on screen at once. |
Density affects the dashboard stack table, the resource gauge strip, the Settings Hub sidebar, the Schedules and Audit Log tables, and every other data table in Sencho. Typography, color, and layout structure stay the same; only vertical padding compresses.
Deploy-progress behavior and the diff-preview-before-save step are stack workflow preferences and live in their own [Stacks](#stacks) section under Infrastructure.
---
## License
**Scope:** Operator-facing, but reflects the instance license
Activate, view, or deactivate the license for this Sencho control plane. The masthead publishes a **PLAN** pill showing the current tier, a **TRIAL** pill with days remaining if a trial is active, a **RENEWS** pill with the next renewal date, and a **STATUS** pill if the license is in an unusual state (expired, error).
<Frame>
<img src="/images/settings/settings-license.png" alt="License section showing the Plan, Customer, Product, License key, and Deactivate action" />
</Frame>
| Element | Description |
|---------|-------------|
| **Plan** | The active tier (Sencho Community, Sencho Admiral, or Sencho Admiral (Trial)) with a tier badge. |
| **Customer** | The customer name on file with Lemon Squeezy (paid plans only). |
| **Product** | The product (paid plans only). |
| **License key** | The active key, masked to the last four characters. |
| **Trial countdown** | Days remaining. Visible only while a trial is active. |
| **Manage subscription** | Opens the Lemon Squeezy customer portal to update payment, view invoices, or cancel. |
| **Deactivate** | Releases the key from this instance and reverts to Community features. |
| **See pricing** | Direct link to the pricing page; visible on Community or when an existing license has expired. |
See [Licensing & Billing](/features/licensing) for the full walkthrough including trial activation.
---
## Users
<Note>
User management requires an admin role. Community supports unlimited accounts with the Admin and Viewer roles.
</Note>
**Scope:** Global
Create and manage user accounts with role-based access. The masthead publishes an **OPERATORS** pill with the total user count.
| Action | Description |
|--------|-------------|
| **Create user** | Add a new account with username, password, and role. |
| **Edit user** | Change an existing user's password or role. |
| **Delete user** | Remove a user account (you cannot delete your own account). |
| **Reset MFA** | Clears the second factor for a user who has lost access to their authenticator. |
**Available roles:**
| Role | Tier | Description |
|------|------|-------------|
| **Admin** | Community | Full access to all features |
| **Viewer** | Community | Read-only access to stacks and nodes |
| **Deployer** | Admiral | Can view stacks and trigger deployments |
| **Node Admin** | Admiral | Full stack and node management, no system settings |
| **Auditor** | Admiral | Read-only plus audit log access |
See [RBAC & User Management](/features/rbac) for details on what each role can access.
---
## SSO
<Note>
Custom OIDC and the preset providers (Google, GitHub, Okta) are available on Community; LDAP / Active Directory requires Admiral.
</Note>
**Scope:** Global, admin-only
Configure Single Sign-On providers for centralized authentication. Each provider type has its own configuration card with connection fields, a test button, and an active toggle.
See [SSO](/features/sso) for the full configuration walkthrough.
---
## API Tokens
<Note>
API Tokens are available on every tier. Creation, listing, and revocation require an admin role.
</Note>
**Scope:** Global, admin-only
Create and manage long-lived API tokens for external integrations and automation. Tokens can be scoped to specific permissions.
See [API Tokens](/features/api-tokens) for the full walkthrough.
---
## Host Alerts
**Scope:** Per-node (applies to the currently selected node)
Configure the host resource thresholds that trigger warnings and the suppression cadence for repeated alerts. These are alerting thresholds, not enforcement: Sencho warns when a metric crosses a line, it never throttles or kills containers. The masthead **NODE** pill names which node you are configuring; the **EDITED** pill counts unsaved changes.
<Frame>
<img src="/images/settings/settings-host-alerts.png" alt="Host Alerts section showing the Host thresholds subsection with the master toggle and CPU, RAM, Disk, and Alert suppression controls" />
</Frame>
| Setting | Default | Description |
|---------|---------|-------------|
| **Host threshold alerts** | On | Master switch for CPU, RAM, and disk threshold alerts only. When OFF, no host threshold checks run and the controls below are inactive. |
| **CPU limit** | 90% | Alerts fire when host CPU utilization exceeds this percentage. The input warns at values above 95%. |
| **RAM limit** | 90% | Set this below the point at which the host starts paging to swap. |
| **Disk limit** | 90% | Low free space slows image pulls and backups. |
| **Alert suppression** | 60 min | How long to wait before resending a host alert while the metric stays over threshold. The follow-up message includes a count of suppressed cycles. Range 1 to 1,440 minutes. |
Click **Save alerts** to apply.
---
## Container Alerts
**Scope:** Per-node (applies to the currently selected node)
<Frame>
<img src="/images/settings/settings-container-alerts.png" alt="Container Alerts section showing the crash and health alerts toggle" />
</Frame>
Controls whether Sencho watches every managed container on this node for unexpected exits, OOM kills, and Docker healthcheck failures, and dispatches alerts for each. Auto-Heal observes crash signals independently regardless of this toggle, so turning it off stops alerts but does not stop Auto-Heal.
| Setting | Default | Description |
|---------|---------|-------------|
| **Container crash & health alerts** | On | Send alerts for unexpected container exits, OOM kills, and Docker healthcheck failures. Auto-Heal can still observe crash signals independently. |
Click **Save settings** to apply.
---
## Docker & Storage
**Scope:** Per-node (applies to the currently selected node)
Configure the reclaimable-space alert, the reclaimable-space banner, and automatic image cleanup after updates.
### Storage alerts
| Setting | Default | Description |
|---------|---------|-------------|
| **Reclaimable Docker data threshold** | 5 GiB | Alert when reclaimable Docker data (images, volumes, build cache that `docker prune` could free) exceeds this size. Set to `0` to disable the alert. |
| **Show reclaimable-space banner** | On | Show the reclaimable-space banner at the top of the Resource Hub when this node has unused images, stopped containers, or dangling volumes to clear. |
### Image cleanup
| Setting | Default | Description |
|---------|---------|-------------|
| **Prune dangling images after updates** | On | When a stack update or a Sencho self-update finishes, remove the node's dangling (untagged) image layers, including the one the update just orphaned. Only untagged layers are touched: tagged images, your volumes, and your data are never removed. Turn it off to keep every old layer. |
Click **Save settings** to apply.
---
## Fleet
<Note>
Fleet is admin-only.
</Note>
**Scope:** Per-node (applies to the currently selected node)
<Frame>
<img src="/images/settings/settings-fleet.png" alt="Fleet section showing the Mesh data plane and Documentation snapshots subsections" />
</Frame>
### Mesh data plane
| Setting | Default | Description |
|---------|---------|-------------|
| **Auto-recreate mesh network** | Off | If `sencho_mesh` is removed at runtime, rebuild it at the same subnet on the next 10-second tick. Off by default; leave it off and restart Sencho manually for the safest path. See [Sencho Mesh](/features/sencho-mesh) for the reconciler behavior. |
### Documentation snapshots
| Setting | Default | Description |
|---------|---------|-------------|
| **Capture stack documentation in snapshots** | Off | Preserve each stack's Dossier notes alongside its captured files when a fleet snapshot is taken. Restoring a stack never overwrites current notes unless you explicitly choose to. |
Click **Save settings** to apply.
---
## Registries
<Note>
Docker Hub, GHCR, and custom registry credentials are available on every tier. AWS ECR requires a Sencho Admiral license.
</Note>
**Scope:** Global, admin-only
Configure private Docker registries so Sencho can pull images that require authentication.
See [Private Registries](/features/private-registries) for the full walkthrough.
---
## Cloud Backup
<Note>
Custom S3-compatible storage is available on every tier. Sencho Cloud Backup is an Admiral feature.
</Note>
**Scope:** Global, admin-only
Mirror fleet snapshots to Sencho Cloud Backup or any S3-compatible storage so a control-plane loss does not take the recovery history with it. The masthead publishes a **PROVIDER** pill (`sencho` / `s3` / `disabled`), a **USED** pill showing storage consumption, and a **SNAPSHOTS** pill with the cloud object count.
<Frame>
<img src="/images/settings/settings-cloud-backup.png" alt="Cloud Backup section with Sencho Cloud Backup mode selected" />
</Frame>
### Storage modes
| Mode | When to pick it |
|------|-----------------|
| **Disabled** | Snapshots stay on the control plane's local disk only. Default for fresh installs. |
| **Sencho Cloud Backup (included)** | Replicate snapshots to managed storage that ships with the Admiral subscription. On first selection, click **Activate** to provision the 500 MB allowance (backed by Cloudflare R2, scoped to this Admiral license). Auto-upload is always on for this mode. The **Test** and **Reprovision** buttons appear on the activated card if you need to verify connectivity or replace the credentials. |
| **Custom S3 (BYOB)** | Point Sencho at your own S3-compatible bucket (AWS S3, Cloudflare R2, MinIO, Backblaze B2). Required fields: **Endpoint URL**, **Region**, **Bucket**, **Path Prefix** (default `sencho/`), **Access Key ID**, **Secret Access Key**. The secret access key is masked after save. Use **Test connection** to verify credentials, then toggle **Auto-upload** to start replicating snapshots. |
The **Cloud Snapshots** list at the bottom of the section is an inventory of objects currently in the configured destination. Each row exposes a **Download** icon and a **Delete** icon.
See [Fleet Snapshots & Backups](/features/fleet-backups) for restore workflows.
---
## Nodes
**Scope:** Global
Manage connections to local and remote Sencho instances. This is the same interface as the [Multi-Node](/features/multi-node) feature; see that page for the full walkthrough.
Quick reference:
| Action | How |
|--------|-----|
| Add a remote node | Click **+ Add Node** |
| Generate a token for this instance | Click **Generate Token** |
| Test an existing node's connectivity | Click the wifi icon on any row |
| Edit a node | Click the pencil icon |
| Delete a node | Click the trash icon (remote nodes only) |
---
## Channels
**Scope:** Per-node (each node has its own notification agents; remote nodes dispatch alerts through their own channels)
Configure external destinations for alert notifications. Three agent types are available on separate tabs: **Discord**, **Slack**, and **Webhook**. The masthead publishes a **CHANNELS** pill showing how many agents are enabled (for example, `2/3`).
For each agent:
| Field | Description |
|-------|-------------|
| **Enabled** toggle | Activates or deactivates this agent. Disabled agents receive no messages even if a URL is saved. |
| **Webhook URL** | The endpoint Sencho will POST to when an alert fires. |
Click **Save** to persist changes. Click **Test** to send a test payload immediately and verify delivery.
At least one agent must be enabled for stack alerts to deliver notifications. See [Alerts & Notifications](/features/alerts-notifications) for how to create alert rules.
---
## Notification Routing
<Note>
Creating, editing, and deleting routes is admin-only.
</Note>
**Scope:** Global, admin-only
Create routing rules that direct specific alert types to specific notification channels. Rules let you send critical alerts to one channel and informational alerts to another. The masthead publishes a **ROUTES** pill with the active rule count.
| Field | Description |
|-------|-------------|
| **Name** | Operator-facing label for the rule. |
| **Node** | Specific node, or all nodes if left empty. |
| **Stack patterns** | Glob patterns to match stack names (multi-select). |
| **Labels** | Apply this rule to stacks that carry any of the selected labels. |
| **Categories** | Event categories that trigger the rule (crash, deploy, vulnerability, etc.). |
| **Channel type** | `discord`, `slack`, or `webhook`. |
| **Channel URL** | The destination endpoint for this rule. |
| **Priority** | Order in which rules are evaluated; the first match wins. |
| **Enabled** toggle | Mute a rule without deleting it. |
Each rule keeps an execution history (collapsible per row) showing which alerts triggered it, when, and whether the delivery succeeded.
See [Notification Routing](/features/alerts-notifications#notification-routing) for the full walkthrough.
---
## Image update checks
**Scope:** Per-node (applies to the currently selected node)
<Frame>
<img src="/images/settings/settings-image-updates.png" alt="Image update checks section showing the scheduling mode selector and interval dropdown" />
</Frame>
Configure how often this node polls container registries to detect available image updates. The masthead publishes an **INTERVAL** pill showing the current check cadence. Each node checks on its own independent schedule.
### Registry checks
| Setting | Default | Description |
|---------|---------|-------------|
| **Scheduling mode** | Interval | **Interval**: check every fixed period. **Cron**: check on a precise cron schedule (runs in the node's local timezone). |
| **Check interval** | 2 hours | How often to poll registries when in Interval mode. Presets: 15 min, 30 min, 1 h, 2 h, 6 h, 12 h, 24 h. Selecting a new preset saves immediately. |
| **Cron expression** | - | A standard five-field cron expression (for example, `0 3 * * 1` for every Monday at 03:00). A human-readable description appears below the field as you type. Click **Save schedule** to apply. |
The section footer shows the last-checked timestamp and when the next check is scheduled.
---
## Webhooks
<Note>
Managing webhooks is admin-only.
</Note>
**Scope:** Global
Create and manage HTTP webhooks that external systems (CI/CD pipelines, automation tools) can call to trigger stack actions. The masthead publishes **WEBHOOKS** and **ENABLED** counts.
| Field | Description |
|-------|-------------|
| **Name** | Operator-facing label. |
| **Stack** | Target stack for this webhook. |
| **Action** | `deploy`, `restart`, `update`, etc. |
| **Secret** | Auto-generated on create. Shown once in a confirmation dialog so you can copy it into your CI secret store; recoverable later via **Copy secret** on the row. |
| **Enabled** toggle | Mute a webhook without deleting it. |
Each row exposes an execution history with timestamp, trigger source, duration, and any error returned to the caller.
See [Webhooks](/features/webhooks) for the full walkthrough including authentication and CI examples.
---
## Labels
<Note>
Label organization (create, edit, assign, remove) and bulk label actions (apply or remove a label across multiple stacks in one operation) are available on every tier.
</Note>
**Scope:** Per-node
Create, edit, and delete labels used to organize and filter stacks across your fleet. Each label has a name and one of ten available colors. Up to 100 labels per node. The masthead publishes a **LABELS** pill with the current and maximum counts.
See [Stack Labels](/features/stack-labels) for the full walkthrough.
---
## Data Retention
**Scope:** Per-node
How long Sencho keeps historical data on this node before pruning it.
| Setting | Default | Max | Description |
|---------|---------|-----|-------------|
| **Container metrics** | 24 hrs | 8,760 (1 year) | How long to keep per-container CPU, RAM, and network history for dashboard charts. |
| **Notification log** | 30 days | 365 | How long to keep alert and notification history. |
| **Scan history per image** | 50 scans | 1,000 | How many vulnerability scans to keep per image. Older scans beyond the cap are pruned. |
| **Remove scans for deleted images and stacks** | On | - | When on, scan results are deleted once their image is gone from this node or their stack is deleted, so the Security Overview stays tied to what still exists. Turn it off to keep scan history for removed images and stacks. |
| **Audit log** | 90 days | 365 | How long to keep audit trail entries. Requires Admiral. |
Removing scans for deleted artifacts runs in the background a few minutes after an image or stack disappears, and immediately when you delete a stack. An image that is still present on the node keeps its scan results, even when no stack uses it.
Click **Save settings** to apply.
---
## Developer Diagnostics
**Scope:** Per-node
Debug diagnostics for this node. Most operators can leave this off. The masthead publishes a **DEV MODE** pill (`on` / `off`).
| Setting | Default | Description |
|---------|---------|-------------|
| **Developer mode** | Off | Enables real-time metrics streams and verbose debug diagnostics in the UI. Does not affect [Global Observability](/features/global-observability) streaming, which is always on. |
Click **Save settings** to apply.
---
## Recovery
<Note>
Recovery is admin-only and is not visible on remote nodes.
</Note>
**Scope:** Global, admin-only
A read-only diagnostic panel and safe recovery tools for the control plane. It is the first place to look when the dashboard behaves unexpectedly.
<Frame>
<img src="/images/settings/settings-recovery.png" alt="Recovery section showing the System health snapshot with database, encryption key, Docker, and administrator status" />
</Frame>
### System health
A read-only snapshot of the control plane. It loads without Docker or live metrics, so it stays available when the dashboard does not. **Refresh** reloads the snapshot. **Export diagnostics** downloads the full report as a JSON file.
| Field | Status indicators |
|-------|------------------|
| **Version** | Current Sencho version string |
| **Database** | `Healthy` (green check) or `Problem detected` (red X) |
| **Encryption key** | `Present` (green check), `Missing`, or `Invalid` (red X) |
| **Docker** | `Reachable` (green check) or `Unreachable` (amber warning) |
| **Administrators** | Count of admin accounts out of total users |
| **Two-factor enrolled** | Count of users with an active second factor |
| **SSO providers** | Each configured provider and whether it is enabled |
### Environment (preflight)
Checks what deployments depend on: the Docker engine, the Compose plugin, the compose directory and its host path mapping, TLS, and disk headroom. Each failed check includes a fix.
### Safe actions
| Action | Description |
|--------|-------------|
| **Reset interface preferences** | Clears density and editor display options from this browser's local storage and reloads the page. Use this if a display setting wedges the layout. |
| **Recovery guide** | Opens the step-by-step recovery guide at docs.sencho.io. |
### Command-line recovery
When the UI is fully unreachable, run these from a shell on the host. Prefix each with `docker compose exec sencho`:
| Command | What it does |
|---------|-------------|
| `node dist/cli/resetMfa.js <username>` | Clear a user's two-factor enrolment |
| `node dist/cli/resetPassword.js <username> <new-password>` | Reset a local user's password |
| `node dist/cli/createEmergencyAdmin.js <username> <password>` | Create a new admin account |
| `node dist/cli/clearSessions.js` | Sign every user out |
| `node dist/cli/disableSso.js [provider]` | Disable a broken SSO provider |
| `node dist/cli/diagnostics.js` | Print the diagnostics report as JSON |
| `node dist/cli/validateDb.js` | Check database and encryption-key integrity |
| `node dist/cli/backupData.js [dir]` | Back up the data directory |
**Download commands** saves a plain-text copy of the reference so it is on hand when the dashboard is unavailable.
---
## App Store
**Scope:** Per-node
Configure the template source used by the App Store.
| Element | Description |
|---------|-------------|
| **Default registry** | `api.linuxserver.io/api/v1/images` (read-only; used when no custom URL is set). |
| **Custom registry URL** | A URL pointing to a Portainer v2 compatible template JSON file. Overrides the default registry. Leave empty to use the default. |
| **Reset to default** | Clears the custom URL and reverts to the default registry. |
| **Save & refresh** | Saves the URL and immediately refreshes the cached template list. |
See [App Store](/features/app-store#custom-template-registry) for more on custom registries.
---
## Stacks
Stack editor, lifecycle workflow preferences, and deploy guardrails. The Workflow controls are browser-local (each browser remembers its own choices). The Deploy Guardrails are node-scoped backend settings. The masthead shows the **NODE** pill for this section.
### Workflow
**Scope:** This browser (preferences are saved to local storage)
#### Deploy progress
Sencho streams live output whenever you deploy, restart, update, install, or run a Git operation. It is on by default; turn it off to run operations without it. When it is on, **Progress style** chooses how it appears: **Modal** (a centered overlay that closes automatically on success or stays open on failure) or **Inline** (a quiet status band on the stack detail). See [Deploy Progress](/features/deploy-progress) for the full reference.
| Value | Behavior |
|-------|----------|
| **Enabled** (default) | A progress surface (the Modal overlay or the Inline band, per Progress style) shows for every long-running operation |
| **Disabled** | Operations run without it; results surface via toast notifications, and a failed operation still shows recovery actions on the stack page |
#### Diff preview before save
When enabled, clicking **Save & Deploy** or **Save Only** in the compose or env editor opens a side-by-side diff modal before writing anything to disk. The left pane shows the current on-disk content; the right pane shows your unsaved edits, with additions highlighted green and removals highlighted red.
| Value | Behavior |
|-------|----------|
| **Enabled** | Diff modal opens on every save that has unsaved changes |
| **Disabled** (default) | File is saved directly without a review step |
If there are no unsaved changes the modal is skipped and the save proceeds immediately. See [Diff preview before save](/features/editor#diff-preview-before-save) in the Editor guide for the full workflow.
### Deploy Guardrails
**Scope:** Per-node (saved on the active node, admin-only)
<Frame>
<img src="/images/settings/settings-stacks-guardrails.png" alt="Stacks section showing the Deploy Guardrails subsection with health gate and env-var block controls" />
</Frame>
Node-level safety checks and post-deploy observation used during stack deploys and updates.
| Setting | Default | Description |
|---------|---------|-------------|
| **Observe health after updates** | On | After a stack deploy or update succeeds, watch its containers for the observation window and record a passed or failed verdict on the stack timeline. Observational only: nothing is restarted or rolled back automatically. |
| **Observation window** | 90 s | How long to watch containers before declaring the update healthy. Raise it for stacks that take a while to settle. Range 15 to 600 seconds. |
| **Block deploy on missing required env vars** | Off | When on, a deploy or update is refused before it starts if a required `${VAR:?message}` variable is unset or empty, so the stack fails fast with a clear message instead of mid-deploy. |
Click **Save settings** to apply.
---
## Support
**Scope:** Global
Links to help resources, with an additional channel for Admiral operators.
### Resources (all tiers)
| Resource | Description |
|----------|-------------|
| **Documentation** | Opens docs.sencho.io. |
| **GitHub Issues** | Report bugs and request features on GitHub. |
### Admiral support
| Channel | Tier | Description |
|---------|------|-------------|
| **Priority Email Support** | Admiral | Direct email support with responses within 24 hours. |
Community operators see an upgrade callout with a link to the pricing page in place of the support channels.
---
## About
**Scope:** Global
Displays instance information at a glance.
| Field | Description |
|-------|-------------|
| **Version** | Current Sencho version. |
| **Tier** | Community or Admiral badge. |
| **License Status** | active, trial, expired, or community. |
| **Instance ID** | First eight characters of the unique identifier for this Sencho control plane (used by the license server to identify it). |
The **Links** section contains a link to the full changelog on GitHub.
Reference in New Issue View Git Blame Copy Permalink