HellAdmin Dashboard

Web UI for HellAdmin — AI agent firewall dashboard.

Alpha release. Protect mode is functional. Control mode is planned. APIs may change.

What it shows

Protect mode (single page, default):

• Protection status: Ready / Protecting, Landlock ABI version
• Protected paths with modes (read blocked / write blocked) — click to expand, quick allow buttons (1h/4h/8h)
• Network protection: blocked metadata IPs, allowed TCP ports
• Blocked commands: sudo, nc, mount, ptrace, etc.
• MCP Proxy: registered servers, request stats, API key usage
• Recent blocks feed
• Command history with source detection (ssh:user@ip, container:name, process:pid)

Control mode [planned]:

• Tabbed navigation: Events, Policies, Approvals, MCP Servers, Forensics
• Approval queue for unknown operations
• Policy editor with live preview
• Full event log

Control mode is not yet implemented. The features above are planned for a future release.

Quick Start

pip install helladmin-dashboard

Note: The dashboard works standalone for viewing, but Protect controls (mode, level, blocks) require helladmin-server. Install the full stack with pip install helladmin or add pip install helladmin-server separately.

Local (no TLS, no auth)

helladmin-dashboard
# → http://localhost:8888

Remote access

HELLADMIN_DASHBOARD_PASSWORD=mysecret helladmin-dashboard --host 0.0.0.0
# → https://0.0.0.0:8888 (auto-generated self-signed cert)

TLS

Auto-generated certificate (default for remote)

helladmin-dashboard --host 0.0.0.0

Self-signed cert at ~/.helladmin/dashboard-cert.pem. Browser shows warning — click through.

Your own certificate

helladmin-dashboard --host 0.0.0.0 \
  --ssl-certfile /etc/letsencrypt/live/example.com/fullchain.pem \
  --ssl-keyfile /etc/letsencrypt/live/example.com/privkey.pem

Behind nginx

server {
    listen 443 ssl http2;
    server_name dashboard.example.com;
    ssl_certificate     /etc/letsencrypt/live/dashboard.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dashboard.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8888;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

helladmin-dashboard --no-ssl

No TLS

helladmin-dashboard --host 0.0.0.0 --no-ssl

Only behind a TLS-terminating proxy or on a trusted network.

Authentication

Without --password, binds to localhost with no auth.

For remote access:

HELLADMIN_DASHBOARD_PASSWORD=mysecret helladmin-dashboard --host 0.0.0.0

Or configure users in config YAML:

auth:
  users:
    - username: admin
      password_hash: "<hash>"  # generate with: helladmin-dashboard hash-password
      role: admin              # admin | operator | viewer

API

Dashboard backend exposes REST API for the Protect UI:

GET  /api/protect/status     Protection state, Landlock ABI, counters
GET  /api/protect/paths      Protected paths with modes and categories
POST /api/protect/paths      Add custom protected path
GET  /api/protect/blocks     Recent blocked events
GET  /api/protect/network    Network protection config
GET  /api/protect/commands   Blocked commands list
GET  /api/protect/allows     Active temporary allows
POST /api/protect/allows     Create temporary allow (1h/4h/8h)
GET  /api/protect/history    Command execution history with source info
GET  /api/protect/proxy/servers   Registered MCP proxy servers with stats
GET  /api/protect/proxy/requests  Recent proxy audit log

CLI

helladmin-dashboard [OPTIONS]
helladmin-dashboard hash-password

Options:
  --host HOST             Bind host (default: 127.0.0.1)
  --port PORT             Bind port (default: 8888)
  --config CONFIG         Config file path
  --ssl-certfile FILE     TLS certificate
  --ssl-keyfile FILE      TLS private key
  --no-ssl                Disable automatic TLS
  --no-browser            Don't open browser on localhost

License

Apache-2.0