Operator console
The operator console at console.autorune.xyz is where the operator looks after AutoRune: services, accounts, avatars, the game world and server metrics, for each environment. It is public on the internet but only the owner can use it: sign-in is Discord only, for one Discord account. Everyone else sees nothing but the sign-in button. How it is protected: Console security. How it is run: Console operations.
Environments
A TEST / PROD switch in the header changes every page between environments. The console reads its environments from a registry file; an environment that is not configured shows "PROD not set up" on every page. Adding production later means filling in its registry entry and secrets, nothing in the code.
Pages
| Page | Shows | Actions (each behind a confirm dialog, each audited) |
|---|---|---|
| Services | The environment's units (engine, friends server, gateway, API) and the shared ones (console, nginx, Postgres, Netdata): state, uptime, memory, CPU, restarts, the last 200 log lines and a live log follow | Start, stop, restart where allowed. The console itself, nginx and Postgres are view only. |
| Users & access | Every account: Discord name and ID, locked or not, allowlisted or not, avatars, live sessions, last sign-in. The environment's sign-in allowlist. | Edit the allowlist (saved with a backup, applied by a separately confirmed API restart). Lock or unlock an account. |
| Avatars & world | Every avatar of every owner: state, what it wants across restarts, activity or stop reason, the owner's AI provider and model, the current goal. The world: engine status and uptime, players online, Grand Exchange status, links to the app, hiscores and /market. | Start or stop an avatar. |
| Metrics | CPU, memory, load, network, disk I/O and disk space of the server from Netdata, over 10 minutes to 24 hours, and a link to the full Netdata dashboard. | None. |
| Audit log | Every sign-in, sign-out and action: who, what, which environment, when, from which address, and whether it worked, failed or was refused. | Sign out everywhere. |
What the actions do
- Restart the API: every running avatar logs out and saves, then resumes by itself when the API is back (usually within a minute). The confirm dialog says so.
- Stop an avatar: it logs out and stays stopped ("Stopped by the operator") until its owner presses Play or the operator starts it again.
- Start an avatar: like the owner pressing Play: it runs on the owner's AI provider and keeps running across restarts.
- Lock an account: its sessions end at once (API calls answer
401 account_locked), it can't sign in or refresh, and its running avatars are stopped ("Account locked by the operator"). Unlocking lets it sign in again; its avatars stay stopped until it presses Play. - Edit the allowlist: the console rewrites the environment's allowlist file from validated values (Discord IDs and usernames only) and keeps the previous version. The API reads it on its next start, so the page offers "Restart API to apply" until then.
There is no shell, no command box and no free-form operation anywhere: every button maps to one fixed, allowlisted operation.
Phone
The console is built for a desktop browser and works on a phone: tables scroll sideways, the logs open full screen.