Web panel
A self-hosted dashboard served by the plugin itself — profiles and audit entries in a browser, no cloud involved.
Argus v1.1.1Paper · Purpur · Folia-safe1.21 – 1.21.x
Argus can serve a small dashboard straight out of the plugin, using the JDK's built-in HTTP server. There is no cloud service, no account and no subscription: it is a port on your own machine.
Enabling it
web-panel: enabled: true port: 8787 bind: "0.0.0.0" token: ""Restart, then open:
http://your-server-ip:8787/?token=YOUR-TOKENLeave token empty and Argus generates one at startup and prints it to console. Copy it from there
on the first run, or set your own.
| Key | Default | Notes |
|---|---|---|
enabled | false | Off unless you turn it on. |
port | 8787 | Must be free and, if you want remote access, open in your firewall. |
bind | "0.0.0.0" | 127.0.0.1 restricts it to the machine itself — see below. |
token | "" | The only credential. Empty means "generate one and log it". |
Endpoints
| Path | Returns |
|---|---|
/ | The dashboard — an inline HTML page, no external assets |
/api/profiles | Every monitored member with score, stars and signal breakdown, as JSON |
/api/audit | Audit chain entries as JSON |
Both API endpoints require the same ?token= parameter. They are useful if you want to pipe Argus
data into something you already run — a status page, a Grafana table, a Discord bot of your own.
Securing it
The token is a bearer credential in a URL. Treat it accordingly.
Do not expose port 8787 to the internet as-is
Plain HTTP means the token travels in clear text and sits in browser history and proxy logs. On a public interface, put it behind something.
The setup worth doing, in order of effort:
1. Bind to localhost and tunnel. The simplest secure option — no firewall rule, no certificate.
web-panel: bind: "127.0.0.1"ssh -L 8787:127.0.0.1:8787 user@your-serverThen open http://127.0.0.1:8787/?token=… on your own machine.
2. Reverse-proxy with TLS. If several admins need access, put nginx in front and give it a real certificate:
server { server_name argus.example.com; listen 443 ssl; location / { proxy_pass http://127.0.0.1:8787; proxy_set_header Host $host; }}Keep bind: "127.0.0.1" so the raw port stays unreachable from outside.
3. Rotate the token whenever somebody leaves the team. Change it in config.yml and restart.
What it is good for
- Reading the audit log without being in-game.
- Handing a colleague a link to one investigation instead of screenshots.
- Pulling the data into your own tooling through the JSON endpoints.
What it is not
It is not a control panel. The panel is read-only — freezing, clearing and kicking still happen in the in-game GUI. That is deliberate: the panel is protected by a single shared token, and a token in a URL is not a credential you want attached to destructive actions.
Filters and evidence export are on the roadmap.