Semurg · Cluster

Cluster admin console

The operator control plane — add / monitor nodes, ingest, KG & RAG — runs on a private, loopback-only listener, separate from this public site. It is fail-closed: never exposed unauthenticated on the network.

The admin control plane is enabled on this node (loopback, fail-closed).

On the node itself

Open the console directly on the box (or a desktop with access to it):

https://127.0.0.1:4610/cluster

It is served with a self-signed certificate; your browser will ask you to trust it once.

From your laptop (SSH tunnel)

Forward the loopback port over SSH, then open it locally — nothing is exposed on the public network:

Run:

ssh -N -L 4610:127.0.0.1:4610 @one.semurg.io

Then open:
```
https://localhost:4610/cluster
```

Signing in

Use the one-time admin credential and add the TOTP enrollment (authenticator app) that the installer / container printed in its success banner at first run. The credential is shown once and stored only as a PBKDF2 hash; the session is bound to your network address and times out.

The console is bound to 127.0.0.1:4610 and refuses to serve without a provisioned PBKDF2 secret + TOTP seed. Lost the credential? See the operator docs for re-provisioning on the box.