Running a server

Administration and settings

The admin page, delivering sign-up codes (SMS and email), server settings, backups and security — a reference for operators.

The server includes an admin page that you open in a browser. It shows the server's status, lets you decide how sign-up and sign-in codes are delivered, and manages users and bots. This page is a reference that gathers the admin page and the server's settings in one place. If you still need to install the server, see Server installation first.

The admin page's interface is in Korean. Below, each tab, button and setting is given with an English name, followed by its Korean label as it appears on screen.

Opening the admin page

The admin page is at /admin/ on the management HTTP port (8080 in the production setup), and it's open only on the server itself (127.0.0.1). Operators get in through an SSH tunnel.

# On your computer (leave it running)
ssh -N -L 8080:127.0.0.1:8080 <user>@<server>
# Browser: http://localhost:8080/admin/

# The token (on the server)
sudo cat /srv/pabal/pabal_server/data/admin-token

Enter the token and click Open (열기). The browser remembers the token; remove it with Clear token (토큰 지우기) at the top right. To choose the token yourself, set TELEGRAM_ADMIN_TOKEN (16 or more characters) — the file is then not written.

What each tab shows

Dangerous actions (signing out, blocking, cancelling a code) only run when you click twice.

Sign-up and sign-in codes

When someone enters a phone number in the app, the server creates a code and sends it by the method chosen in the Settings (설정) tab.

• With the email method, a new sign-up can use any address, and that address becomes the account's sign-in email (로그인 이메일). Existing accounts receive codes only at their registered sign-in email — this stops people from getting into someone else's number by entering their own address. Existing accounts without a sign-in email get their code by SMS (if configured) or through the admin page instead. You can add a sign-in email in the Users (사용자) tab.
• Sending happens in the background, so the app goes straight to the code screen. The result of sending (success or failure, with the reason) appears in the Sign-up codes tab.
• Signing up (entering a name) is possible only after entering the right code. Wrong codes are accepted only up to the allowed number of tries; after that, even the right code is refused.

Settings — sign-up and sign-in

Settings — SMS

The message text (문구) can include {code} (the code) and {minutes} (how long it's valid). Default: [파발] 인증 코드: {code} ("[Pabal] Verification code: {code}"). After saving (저장), check it with Send test (테스트 발송).

Settings — email (SMTP)

The sender address (보내는 주소) must be one the SMTP account is allowed to send from. You can use {code} and {minutes} in the subject (제목) and body (본문) as well.

Managing users

• Sign out all devices (모든 기기 로그아웃): cuts off every sign-in (auth key) of that account. Use it for users who have lost a device.
• Block number (번호 차단): that number can no longer receive codes, and its account is immediately signed out on every device. It's the same as the Block phone numbers (전화번호 차단) list in the Settings (설정) tab.
• Sign-in email (로그인 이메일): needed for an existing account to sign in by email when the email method is used.
• @BotFather is a bot inside the server, so it can't be signed out.

Managing bots

The Bots (봇) tab shows how each bot connects — whether it's connected over MTProto, whether it called getUpdates over HTTP within the last minute, and what its webhook address is and whether it's currently failing (with the reason). If the number of waiting updates keeps growing, the bot program has stopped or its webhook is failing. Deleting a bot or issuing a new token is done by the bot's creator at @BotFather.

Environment variables

The server reads its settings file (server-config.json) and then overrides it with environment variables. The production compose file sets the values below, so usually you only need to edit .env.

Data files

Security notes

• Don't expose the management port directly to the internet. In the production setup, Caddy blocks management paths such as /admin, /health and /metrics with a 404.
• Every admin data request needs Authorization: Bearer <token>, and pages on other sites can't read it.
• SMS and SMTP secrets exist only in operations.json; the screen and the API only tell you that a value is "saved" (저장됨). If you save with a secret field left empty, the existing value is kept.
• Tokens and secrets are never written to the logs, and phone numbers in the logs are masked. Bot API addresses (which include the token) aren't logged either.
• The auth keys are in the DB, so anyone who can access the DB can decrypt users' traffic. Guard the DB and backups as carefully as the RSA key.

Limitations

• Pending codes and recent activity are held in memory, so they're lost when the server restarts (people just request a code again in the app).
• Actual delivery through an SMS provider has to be verified with each provider's account. The server builds its requests as described in each provider's documentation.
• Not available yet: deleting accounts, force-deleting bots, reading messages, viewing logs, graphs.