Console

ScalWS Console: installation and operation

ScalWS Console is part of the standard ScalWS distribution: the DEB/RPM packages built by scripts/package.sh contain /usr/bin/scalws-console and scalws-console.service, next to scalwsd, scalws-controller and scalwsctl.

Install (packages)

The package’s post-install step (packaging/scripts/postinstall.sh):

1. creates /etc/scalws/console/credentials (0600, root) with user admin and a random 24-character password, unless the file exists;

2. prints, once, to the operator running the installer:

   ScalWS Console administrator account created
     address:  https://<server-address>:8090
     user:     admin
     password: sudo grep '^admin:' /etc/scalws/console/credentials | cut -d: -f3
     file:     /etc/scalws/console/credentials (0600)

   The password itself is never printed: package managers record the installer’s terminal (apt keeps it in /var/log/apt/term.log, readable by group adm).

3. enables and starts scalws-console.service.

Read the password from the credentials file with the command shown. Upgrades keep the file.

Manual equivalent (tarball installs, containers):

scalws-console init-credentials --credentials /etc/scalws/console/credentials \
    --url "https://$(hostname -I | awk '{print $1}'):8090"
systemctl enable --now scalws-console

If scalws-console run starts without a credentials file it creates one the same way and logs only the file’s path (development fallback).

systemd unit

/usr/lib/systemd/system/scalws-console.service runs:

scalws-console run --controller-config /etc/scalws/controller.yaml \
    --credentials /etc/scalws/console/credentials \
    --state-dir /var/lib/scalws-console --listen 0.0.0.0:8090 \
    --controller-restart-command "systemctl restart scalws-controller"

as root with a reduced capability set and a read-only file system except /etc/scalws and /var/lib/scalws-console (see docs/console-security.md, “Privileges”). It starts after the controller but does not depend on it: with the controller stopped the console shows it as unavailable.

Options

First sign-in

Open https://<server-address>:8090. With the generated self-signed certificate the browser warns once; replace it with a real certificate (--tls-cert/--tls-key, e.g. the host’s ACME certificate) for production. Sign in as admin with the password from the installer.

Accounts

Edit /etc/scalws/console/credentials (keep 0600):

admin:administrator:<password>
ops:operator:$argon2id$v=19$m=19456,t=2,p=1$...
dev:developer:<password>
look:viewer:<password>

Roles: administrator, operator, developer, viewer (docs/console-rbac.md). echo 'new password' | scalws-console hash-password prints a hash to use instead of plain text. Changes apply on the next request; sessions of changed or removed accounts end. A file readable by group or others disables sign-in until it is fixed (logged).

Files

Back up /var/lib/scalws-console with /etc/scalws.

Upgrade, removal

Package upgrades replace the binary and restart the unit (sessions end; drafts are lost; history and audit stay). Removal stops and disables the unit; the state directory and the credentials file are left in place.

Development / demo deployment

The development host runs a demo stack separate from benchmark and soak runs: a controller with its own state directory, socket, configuration, CPUs and ports, and the console on port 8090 managing it (docs/console-architecture.md). Every process of that stack runs under taskset -c 6-7 nice -n 10.

Overhead

The console is not on the request path. Its telemetry is one controller status call per 2 s per open browser tab (paused for hidden tabs); measured overhead on the data plane is reported in the console test report.