Console traffic
This content is for 0.1.0. Switch to the latest version for up-to-date documentation.
The dashboard serves the console UI and proxies authenticated requests to hub services:
| Prefix | Backend |
|---|---|
/api/ |
DCM Traefik gateway |
/fleet/api/ |
fleet-site-controller |
/fleet/auth/ |
fleet-console-auth |
/fleet/ |
SPA + auth gate |
The console-auth service validates the user session and applies authorization before proxying protected operations. Bootstrap enrollment uses the bundle-specific bearer credential; that credential and its bundle are sensitive and must remain within the authorized bootstrap workflow.
Reach console services through WireGuard. Management NodePorts are off the WAN by default; public edge routing is a separate, experimental path.