NICo Debug WebUI
NICo Debug WebUI
NICo includes a built-in administrative web interface intended for operational debugging and inspection. It is served at the /admin path of the NICo API server and provides read-oriented views of infrastructure state alongside a limited set of administrative actions.
Hardcoded Basic Auth has been removed as of NICo v0.7.0.
Previously, if SSO was not configured, the WebUI defaulted to basic authentication with a hardcoded credential. This fallback has been removed to resolve a P0 security vulnerability.
- Production / secure deployments: Enable OIDC/SSO (
CARBIDE_WEB_AUTH_TYPE=oauth2). See Azure OIDC for Infra Controller Web UI for setup instructions. - Development / lab environments: The WebUI operates with no authentication by default. Bind the service to localhost or restrict access using a network ACL or auth proxy (for example,
mod_proxy).
If your current workflows rely on the default basic auth credentials, transition to an OIDC provider or proxy-based authentication before updating to v0.7.0 or later.
Authentication
Authentication mode is controlled by the CARBIDE_WEB_AUTH_TYPE environment variable.
OAuth2 (Entra) Configuration
When CARBIDE_WEB_AUTH_TYPE=oauth2, the following environment variables are required:
Sessions issued via the standard PKCE flow are persistent for the browser session. A client credentials flow is also supported for automated access (for example, CI pipelines); sessions granted via this flow expire after 10 minutes.
For step-by-step Entra registration and secret management instructions, see Azure OIDC for Infra Controller Web UI.
Available Views
The WebUI exposes views grouped by entity type. All views are read-only unless noted.
External tool links (for example, links to Grafana dashboards or UFM) configured in the NICo operator configuration are surfaced in the “Tools” sidebar and do not have fixed paths.