Platform settings

This page covers everything that changes how the whole platform behaves: the everyday Settings pages, the backend Services, the advanced Config editor and its background jobs, the Modules that decide which features exist, user-made Themes, and the Notification Templates viewer.

Start with Settings for day-to-day changes. Use Config (Advanced) only when Settings does not have the field you need.

When the server has the final say

Some values can also be fixed in the platform's server configuration, and then the server wins. The panel tells you when this happens. See Settings fixed by the server. On most production platforms a handful of fields can only be changed on the server; they show as read-only or report "could not save".

Settings

Admin Panel → Platform → Settings (/admin/settings)

Eight sub-pages. Each form has Save changes. The confirmation reports how many settings were saved, and names any that are pinned by the server or could not be saved; those fields are highlighted. Saves are listed in Config (Advanced) → Edit History.

General

Field	Meaning
Platform name	Shown in the browser title, emails and the sign-in page
Home mode	Which landing experience users see first: Lab, Ctf or Dev
Welcome message	A short greeting on the home page
Description	Used for link previews
Default theme	The theme new users start with
Default color mode	Dark or Light, until a user changes it

On most platforms in this release only Platform name can be saved here. The other fields come back as "could not save" and are set on the server.

Sign-in & Auth

Username / password sign-in. Applies immediately. It refuses to turn off, and flips back with the reason, if no working identity provider is set up or if your own account has never signed in through one. That protects you from locking everyone out, including yourself.

GitLab sign-in, per domain. One card per domain the platform serves, with a badge: Configured, Global fallback or Not configured. Each card asks for the application ID, secret and redirect address, and tells you the two redirect addresses to register on GitLab (the site itself and the AI connector callback). Add a domain, Save this domain, or Remove one (with confirmation). These changes are audited.

Global GitLab fallback (collapsed). The fallback application ID and secret used by domains without their own card. The GitLab address and admin group are shown here but can only be changed on the server; edits to them are ignored.

Other providers. GitHub, Google and OpenID Connect. A sign-in button appears on the sign-in page once a provider's fields are filled.

OpenID Connect — claims, admins and admission:

Field	Meaning
Email, username and groups claims	Which fields of the provider's answer to read
Admin groups	Members are admins for that session. Removing them from the group removes admin at their next sign-in.
Allowed email domains	Empty means any domain
Invite-only	Only accounts that already exist may sign in
Sign out of the issuer too	Signing out here also signs out of the provider
Trust addresses without email_verified	Accept email addresses the provider has not verified. Read the warning next to it.

Click Save providers.

Branding

Four logo tiles: full logo and icon, each for the dark and light interface. PNG, WebP or SVG. A logo uploads as soon as you drop or choose it; SVGs are cleaned of anything unsafe. Uploads need Object Storage set up, and the page warns you if it is not. Set by URL instead lets you point at a logo hosted elsewhere; save it with Save changes.

Network & Limits

Hard ceiling is the highest request rate any single lab may be given; no per-lab setting can exceed it. The page also shows Requests per window, Window and Burst for a global limit, and Cloudflare fields, but in this release those are stored without effect, and the Cloudflare fields cannot be saved on most platforms.

Object Storage

Where the platform keeps logos, lab icons and uploads: endpoint, access key, secret key, and the public addresses assets are served from. Test connection writes, reads and deletes a test file so you know it works end to end. This is not tenants' lab storage; that is Storage quotas.

LabStore

Connects the platform to a LabStore so admins can browse and install apps: the store's address and key, a switch to show apps from unverified community publishers, and Test connection.

Email

Field	Meaning
Send mail via	Don't send email, SendGrid (API) or SMTP server
From address	Must be verified with your mail provider, or mail is silently dropped
SendGrid key, or SMTP host, port, username and password	For the method you chose

Send a test to me sends a test message to your own address only.

Security

Admin shell into lab containers turns on the root shell on each instance's admin page. It is off by default on customer platforms. See Labs and instances.

Services

Admin Panel → Platform → Services (/admin/services)

Starts and stops the optional backend services the platform runs, such as the managed databases users create accounts on. The banner shows how many are running. The table lists each Service, its state and an Action: Start or Stop. Core services show "protected" and cannot be stopped here.

Stop has no confirmation

Stop acts immediately and removes the service's container, so it stays stopped after a reboot until you click Start. Every user who depends on that service loses it at once.

Changes are audited. The panel cannot install new services or update existing ones. (The footer mentions editing display names under Config (Advanced); that editor no longer exists.)

Config (Advanced)

Admin Panel → Platform → Config (Advanced) (/admin/config)

A raw editor for the platform's configuration, for power users. The badge says whether the platform uses a custom or the default configuration. The Config drift card at the top lists settings that are missing or overridden, or says there is no drift.

On a production platform the web app usually cannot write the configuration file. A warning says so, and most fields here are then read-only; you change them on the server.

A partial save may show no message

This page shows "Configuration saved successfully" only when everything saved. If only some fields saved, you may see nothing at all. Reload the page to check.

The Edit History table at the bottom shows the last 20 saves from this page, the Settings pages, Plans and Cheat Detection: when, who, which section, and what changed.

Tabs

Tab	What is there
General	Guides blog address, the names of the point and hint systems, organization name, and the Home Buttons table (title, address, icon)
Environment	Addresses for each environment the platform runs in. Infrastructure: change only with your engineering team.
Cron Workers	The background jobs console. See below.
Storage	Older object-storage settings. Prefer Settings → Object Storage.
Cloudflare	Managed DNS zones and blocked names. Usually read-only on production.
OAuth / GitLab	The same sign-in settings as Settings → Sign-in & Auth, in raw form. Prefer Settings.
Roles & Plans	Information tables only; nothing saves. Its description of faculty access does not match this release.
Database	Connection details (read-only) and log, cache and events locations. Changes need an application restart.
Plans	A card per plan and Edit Plans (JSON)
Advanced	Development mode and development users; the default VPN address range with Apply range; the billing portal address and token

Two controls that act rather than save

• Apply range on the Advanced tab rewrites the default VPN address range and seeds its address pool. It is locked once any VPN device exists.
• Save Plans writes plan definitions inside the application, where the next platform update may replace them. Check with your engineering team before relying on a plan edit made here.

Cron Workers

The platform runs background jobs ("workers") on a schedule: expiring idle labs, enforcing plan downgrades, measuring storage, cleaning up leftovers, sending notifications and more. This tab is a monitoring console, not an editor.

The counts at the top show how many workers are scheduled, on-demand only, drifted and missing. Workers are grouped by category: Lifecycle, Labs runtime, Storage, Fleet, Analytics, Community and Housekeeping. For each you see its cadence, status, and when it last ran and who ran it.

Status	Meaning
Scheduled	Runs automatically
On-demand only	Runs only when someone clicks Run now
Not running	Should be scheduled but is not. Features that depend on it quietly stop working.
File missing	The worker is listed but cannot be found

Run now runs a worker straight away and shows the result on the page. Restore (or Restore all) puts a core worker back on the schedule when it has dropped off. Both are audited. There is deliberately no way to switch a worker off here.

Workers marked "destructive"

Some workers stop labs or delete data: expiring labs, enforcing plan limits, reclaiming dormant accounts and their storage, and cleaning up orphaned uploads, instances and devices. Run now on one asks you to confirm first, and it acts on real users immediately.

If the Dashboard shows Cron workers missing or Cron drift, this is where you fix it.

Modules

Admin Panel → Platform → Modules (/admin/modules)

Modules decide what the platform offers. Switching one off hides it from every user and hides its group from the admin sidebar.

Gamification master switch

At the top of the page. Turning it off:

• freezes all Zeal and Jolt transactions (balances are kept)
• opens every earn-to-unlock gate, so nothing needs currency
• switches off quizzes, Code Arena, Learn AI, CTF missions, clans, events and leaderboards
• stops challenge labs from being deployed

Streaks keep working.

Module cards

Each card shows Enabled or Disabled and one switch per feature. The switches show each feature's short name.

Module	Features	What users lose when off
CTF Missions	missions, clans, events	Challenge labs, clans and CTF events; also hides the admin CTF & Events group
Discuss	discussion, discussion_ai, for_you	Discussions, AI answers in discussions, the personalised feed; also hides the admin Community group
Evaluate	quiz, code	Spot Quiz and Code Arena; also hides the admin Evaluation & Arena group
Instances	instances	The Instances page, where people build and run their own lab templates. A core module: the panel cannot switch it off; use Nav access level below to decide who sees it.
Labs	labs, mcp	Labs are always on. mcp controls the AI connector.
Learn	learn_ai, roadmaps, syllabus	Learn AI, roadmaps and syllabi; also hides the admin Education group
Portfolio	portfolio	Public portfolios

Under each feature, a "via …" line shows what decided its current state. A switch marked pinned on disk is fixed by the server and disabled here.

Every switch asks you to confirm and warns that it may affect what users are entitled to. The change applies immediately to everyone and the page reloads. Module changes are audited.

Nav access level (Instances card only) sets who sees Instances in their navigation: Admins only (default), Paid plans or Everyone. It applies without confirmation.

Why is a tile missing?

Open Tile visibility at the bottom. It explains, tile by tile, why each home-page tile is shown or hidden. A tile can be hidden by its module, by the Home mode in Settings → General, or by the server. An explicit on here shows the tile whatever the home mode.

Themes

Admin Panel → Platform → Themes (/admin/themes), headed "Theme Submissions".

Users can design visual themes and submit them. Tabs: Pending Review, Approved, Rejected, All Submissions, Everything. Each card shows a thumbnail, name, status, whether it is public, author, date, votes and reward.

Action	What happens
Preview	Opens the theme in the theme editor
Approve	Set a Jolt Reward and an optional note. The Jolt is credited at once and the author is notified. There is no undo.
Reject	Give a reason. The author is notified and the reason is shown on the card.
Fork on / Fork off	On approved themes: whether others may copy it

Notification Templates

Admin Panel → Platform → Notification Templates (/admin/notification_templates)

A read-only list of every notification the platform can send, grouped by type. Expand one to see its title, subtitle, message, icon, action link, whether it stays until dismissed, grouping interval and help link. Changing the wording needs a platform update from your engineering team; the page says so.

First-run setup

A new platform opens a setup wizard at /setup.

1. Create the first administrator. Username, email and a password of at least 12 characters, then Create administrator. This form is available only until that account exists.
2. Configure. Sections for branding, object storage, mail, sign-in, AI features, networking, modules and services. Values fixed by the server are marked. Save settings as you go.
3. Finish setup.

Afterwards everything in the wizard is also on the Settings pages above. Admins can reopen /setup; everyone else gets "Not found".

Next

• Admin guide overview — how settings pinned by the server behave
• Access control — Gate Rules
• Economy