Panel settings

Most of the panel configuration can be changed on the Settings page, without SSH. Values you save there are kept in /var/lib/wardpane/settings.json and take priority over /opt/wardpane/.env.

Groups

Where values come from

The order is: the built-in default, then .env, then settings.json. Every setting shows where its current value comes from (default, from .env, from panel), and you can reset it to the .env value with one button.

The Cloudflare token and the MaxMind key are never sent to the browser; the page only shows whether they are set. On disk they are stored as plain text, the same as in .env. Only the panel can read the file, and it goes into the update backups, which only root can read.

Each save keeps the previous file as settings.json.bak. A card is saved as a whole or not at all, and if something is wrong, every error is shown next to its field in one go.

What applies when

The sign-in name and password, PANEL_ALLOW_IPS, sign-in limits, session lifetime, ACME_EMAIL, Cloudflare, MaxMind and IP_FEEDS apply as soon as you save them.

ACME_STAGING, IP_CERT, PUBLIC_IP, PUBLIC_IPV6 and PHP_SANDBOX apply after a restart. They are marked “applies after restart”, and once you save one of them, the dashboard reminds you that a restart is pending.

Ports, BIND_ADDRESS and paths (DATA_DIR, WWW_ROOT, GEOIP_DIR) can be set only in .env. The installer sets up the firewall, systemd units, permissions and backups for these values, so change them in .env and run install.sh again.

Changing the password and name

The password has its own form under Panel access. You enter the current password first, and a wrong one counts as a failed sign-in. The new password must be 12 to 128 characters long; it is stored as an scrypt hash, and saving it ends all other sessions. Changing the sign-in name works the same way: it asks for the current password and signs out the other sessions.

The IP allow list

PANEL_ALLOW_IPS is not saved if the new list does not include the address you are using right now, so you cannot lock yourself out of the panel. If you connect over IPv6 and allow only your exact address instead of your /64, the panel warns you, because IPv6 addresses change over time. More in panel security.

Restarting the panel

Restart panel works when the panel runs under systemd. The panel saves its data, gives requests in flight up to five seconds to finish and exits. systemd starts it again while the page waits for it to come back. For a few seconds the panel and all sites are unavailable, and everyone has to sign in again. From the console:

sudo systemctl restart wardpane

Lost access

If you forgot a name or password set in the panel, locked yourself out with the allow list, or settings.json is damaged, run this on the server:

sudo node /opt/wardpane/bin/unlock-login.js --reset-access   # name, password, allow list and root sign-in from .env again
sudo node /opt/wardpane/bin/unlock-login.js --reset-access=allow-ips   # only PANEL_ALLOW_IPS (or user, password, root-login)
sudo systemctl restart wardpane

The previous file is kept as settings.json.before-reset-<time>; other settings stay. To reset the password, PANEL_PASSWORD must be set in .env.

.env reference

After editing .env, restart the panel with sudo systemctl restart wardpane. A value saved in the panel wins over .env; reset it in Settings to let .env apply again.