Management Server

The management server (apps/management) is the Bun/Elysia HTTP API that powers the dashboard and public API.

What it does

The management server handles user authentication (Better Auth with email/password, SSO, OAuth), organization and network CRUD, API key management, the REST API consumed by the dashboard, OAuth 2.0 device authorization for CLI login, SSH auth browser flows, and communication with the control plane via its internal admin API.

Running with Docker

docker compose up -d management

The management image is built from deploy/Dockerfile.management. It uses oven/bun:1 for building and oven/bun:1-slim at runtime. The workspace's full package.json graph is copied for correct lockfile resolution.

Running manually

bun run dev:management

Configuration

Variable	Default	Description
DATABASE_URL	-	PostgreSQL connection string (required)
BETTER_AUTH_SECRET	-	Auth signing secret, 32+ chars (required)
BETTER_AUTH_URL	-	Public URL of management or dashboard (required)
MANAGEMENT_PORT	3000	Listen port
MANAGEMENT_WEB_ORIGIN	http://localhost:5173	Dashboard origin for CORS
CONTROL_PLANE_ADMIN_URL	http://127.0.0.1:9091	Control plane admin API
TUNTUN_SERVICE_SECRET	-	Internal API shared secret (must match control plane)
TUNTUN_MANAGEMENT_URL	-	Management URL (for internal resolution)
TUNTUN_CONTROL_URL	-	Control plane URL
TUNTUN_MANAGEMENT_PUBLIC_URL	-	Public URL for enrollment tokens