Admin guide
This guide is for the people who run a Selfmade Ninja Labs platform: platform administrators, and the moderators who help keep discussions clean. By the end of this page you will know how to open the admin panel, how someone becomes an admin or a moderator, and which page of this guide covers each part of the panel.
If you are a student, developer or organization member, you do not need this section. Everything you can do is in the rest of the docs.
Opening the admin panel
Open the profile menu in the top-right corner and choose Admin Panel. The
panel lives at /admin. The Back to Labs link at the bottom of the admin
sidebar returns you to the normal dashboard.
Anyone who is not an admin and opens /admin is sent back to their own
dashboard. That includes moderators.
The profile menu shows a Faculty Panel link to users marked as faculty, and the panel shows them a shorter sidebar. In this release faculty cannot load or save anything there. Treat the admin panel as admin-only.
Security & access → Roles and permissions explains every role users and admins can hold (platform, plan, sharing, organization, clan, club and MCP) on one page. Point people there when they ask why they can or cannot do something.
How someone becomes an admin
There are three separate routes. Any one of them is enough.
| Route | Where you set it | Applies to |
|---|---|---|
| GitLab admin group | The user's page, Admin access → Add to group | Every platform that signs in through the same GitLab |
| Local platform admin | The user's page, Admin access → Make platform admin, or Make platform admin when you create the account | This platform only |
| Identity-provider admin group | Settings → Sign-in & Auth, the OpenID Connect Admin groups field | Decided at each sign-in |
All three take effect at the person's next sign-in, because admin rights are worked out when someone signs in. Ask them to sign out and back in.
The first administrator on a new platform is created by the first-run setup wizard, and is made a local platform admin automatically.
- The Role dropdown on a user's page offers "Admin". Choosing it changes the label only. That person still cannot open the admin panel.
- A GitLab account can be a GitLab instance administrator. That is shown for information only and grants nothing on this platform.
The Admin access card on a user's page is the one place that shows the real answer.
With the identity-provider route, removing the person from the group in your identity provider removes their admin rights at their next sign-in.
How someone becomes a moderator
Open the user's page and turn on Platform moderator. It applies immediately. Admins count as moderators automatically.
A moderator gets:
- a shield icon in the top bar, the review queue, listing the most recent open discussion reports
- the power to delete or hide discussion content wherever they meet it on the site
Moderators cannot open the admin panel. Links in the review queue point to the admin report pages, so a moderator who follows one is sent back to their dashboard. Moderators act on the content in place instead.
Club owners and club moderators have narrower rights: they can moderate inside their own club only.
Map of the admin panel
The sidebar is split into six groups. Every group except Platform belongs to a module. Switching that module off in Modules hides the whole group from the sidebar.
| Group | Pages | Covered in |
|---|---|---|
| Platform | Dashboard | Admin dashboard |
| Settings, Services, Config (Advanced), Modules, Themes, Notification Templates | Platform settings | |
| Users | Users | |
| Organizations | Organizations | |
| Storage Quotas | Storage quotas | |
| Access Control, Gate Rules | Access control | |
| SSL Queue, VPN Interfaces | Certificates and VPN | |
| Transactions | Economy | |
| Labs | Instances (All Instances, Launchable Reviews) | Labs and instances |
| CTF & Events | Clans, Clubs, Events | Community and learning |
| Evaluation & Arena | Reports, Cheat Detection | Assessments and integrity |
| Achievements | Economy | |
| Education | Cohorts, Proof Evaluation, Accreditation Evidence | Assessments and integrity |
| Learn AI, Syllabus Requests | Community and learning | |
| Community | Message Reports | Community and learning |
| AI assistant (MCP) | The admin_* tools in a connected AI client | Admin tools over MCP |
Behaviours that repeat across pages
Confirmations
Most destructive actions ask you to confirm in a dialog. The riskiest ones make you type a phrase before the button unlocks:
| Action | You type |
|---|---|
| Transfer everything a user owns to someone else | TRANSFER followed by the recipient's email |
| Tear down an organization | DELETE followed by the organization's slug |
Some state changes apply the moment you click, with no confirmation. Each page of this guide calls those out.
The audit trail
Many admin actions write a row to the audit trail: who did it, when, to what, and what changed. You read it in two places:
- Access Control → Audit log, with filters and older history
- the Activity feed on the admin Dashboard, which shows the most recent admin actions
Not everything is audited. Each page of this guide says which actions are recorded and which are not.
Settings fixed by the server
Some settings can also be fixed in the platform's server configuration, which whoever runs the server controls. When that happens, the server value wins over the panel:
| Where | What you see |
|---|---|
| Settings pages | Your change is saved, then a message says the setting is pinned by the deployed config and the field is highlighted. Your value is stored but not used. |
| Config (Advanced) | "Stored, but the deployed config pins this…" |
| Modules | "pinned on disk — the panel cannot change this", and the switch is disabled |
A few fields can only ever be changed on the server. The panel shows them read-only with the reason, or reports "could not save". This is deliberate: it means a stolen admin session cannot repoint the platform's sign-in or storage.
Secrets are write-only
Password, token and key fields always show empty with "leave blank to keep". Leave a field blank and the stored value stays as it is.
Modules hide groups
Switching a module off hides its features from users and its group from the admin sidebar. If a page you expect is missing, check Modules first. See Platform settings.
In this section
Admin dashboard
The at-a-glance health check that opens the admin panel, and what each row asks of you.
Users
Find and create accounts, change plans and limits, grant admin rights, impersonate, sign people out and hand over what they own.
Organizations
Create organizations and departments, set their owner, members and limits, and archive or tear them down safely.
Storage quotas
See who is using the disk, set storage limits, manage storage pools and move accounts between them.
Access control
Oversee every sharing grant, set the platform-wide minimum role for each action, read the audit trail, and manage gate rules.
Labs and instances
Find any running lab, stop or restart it, open an admin shell, review launcher requests, and use the admin-only controls on normal pages.
Certificates and VPN
Review certificate deletion and reissue requests, clean up stale certificates, and run extra WireGuard networks for chosen teams.
Platform settings
The Settings pages, backend services, the advanced config editor and background jobs, module switches, themes, notification templates and first-run setup.
Economy
Watch Zeal and Jolt move through the platform, understand where currency comes from, and what the Achievements pages can and cannot do today.
Assessments and integrity
Handle reports about quizzes, problems and posts, use the cheat-detection tools honestly, review proof of work, and run cohorts and accreditation reports.
Community and learning
Manage clans, clubs and events, curate Learn AI lessons, approve syllabus uploads, and moderate chat and discussions.
MCP admin tools
The administrator-only tools an AI assistant gets when a platform admin connects it — users and labs, organizations, ownership lookups, storage and certificate re-issue review.