# DedicatedServerMod Web Panel (/docs/schedule-1/web-panel)



import { Callout } from 'fumadocs-ui/components/callout';
import { Step, Steps } from 'fumadocs-ui/components/steps';

The S1 DedicatedServerMod ships an **optional web panel** — a browser-based admin interface separate from your XGamingServer panel. Two different things:

|                 | XGamingServer panel                                    | DedicatedServerMod web panel                     |
| --------------- | ------------------------------------------------------ | ------------------------------------------------ |
| What it manages | Server lifecycle, files, backups, billing, allocations | In-game world state and live admin               |
| Where it runs   | xgamingserver.com panel                                | On your server's listen port, served by the mod  |
| Typical use     | Start/stop, **File Manager**, **Console**, **Backups** | Live player list, world status, in-game commands |
| Auth            | Your XGamingServer account                             | **One-time launch token** + session cookie       |

Most day-to-day admin work is fine from the XGamingServer panel's **Console** tab. The web panel is useful when you want a live, visual view of the world that the XGS panel can't show.

<Callout type="warn">
  **Off by default.** When enabled it binds to localhost (`127.0.0.1`) only in v1 — there's no built-in support for public LAN or internet exposure. Access requires a tunnel.
</Callout>

***

Configuration block [#configuration-block]

In `server_config.toml`:

```toml
[webPanel]
webPanelEnabled = true
webPanelBindAddress = '127.0.0.1'
webPanelPort = 4051
webPanelOpenBrowserOnStart = true
webPanelSessionMinutes = 120
webPanelExposeLogs = true
```

| Field                        | Default        | Purpose                                                                                                                                            |
| ---------------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| `webPanelEnabled`            | `false`        | Master switch.                                                                                                                                     |
| `webPanelBindAddress`        | `127.0.0.1`    | HTTP listener address. v1 design is localhost-only.                                                                                                |
| `webPanelPort`               | example `4051` | HTTP port.                                                                                                                                         |
| `webPanelOpenBrowserOnStart` | —              | Auto-launches the default browser on server start. If the browser launch fails, the URL is logged instead so you can copy it from the **Console**. |
| `webPanelSessionMinutes`     | example `120`  | Session cookie lifetime in minutes.                                                                                                                |
| `webPanelExposeLogs`         | —              | Includes recent runtime logs in the bootstrap and live activity views.                                                                             |

***

Authentication model [#authentication-model]

The web panel uses a minimal localhost-trust model — no username/password fields:

1. On server start, the mod generates a **one-time launch token**.
2. It writes the token + URL to the server log (and optionally auto-launches your browser at that URL).
3. The token is consumed on first visit and a **short-lived session cookie** takes over.
4. Same-origin JSON API for everything after that.

Because v1 is localhost-only and the token is single-use, there's no shared password to leak. The trade-off is that you must be able to reach `127.0.0.1` on the server.

***

Enable the web panel [#enable-the-web-panel]

<Steps>
  <Step>
    Stop your server from the panel **Dashboard**.
  </Step>

  <Step>
    Open **File Manager** → edit `server_config.toml`.
  </Step>

  <Step>
    Set the `[webPanel]` block (see configuration table above). At minimum:

    ```toml
    [webPanel]
    webPanelEnabled = true
    webPanelBindAddress = '127.0.0.1'
    webPanelPort = 4051
    ```
  </Step>

  <Step>
    Save and start the server.
  </Step>

  <Step>
    Open the **Console** tab. On startup, look for a line like `Web panel ready at http://127.0.0.1:4051?token=...`. Copy that URL.
  </Step>
</Steps>

***

Reach the panel via SSH tunnel [#reach-the-panel-via-ssh-tunnel]

Since the panel binds to localhost, you need to tunnel from your machine to the server's loopback.

<Steps>
  <Step>
    In the XGamingServer panel, open **Settings** → find your **SFTP Details** (host, port, username).
  </Step>

  <Step>
    From your local terminal:

    ```bash
    ssh -L 4051:127.0.0.1:4051 <sftp-user>@<sftp-host> -p <sftp-port>
    ```

    Replace `4051` with whatever you set as `webPanelPort`.
  </Step>

  <Step>
    Watch the server **Console** for the launch token URL — copy the `?token=...` query string from it.
  </Step>

  <Step>
    In your local browser, open `http://localhost:4051/<paste-the-token-path>`.
  </Step>

  <Step>
    Once consumed, the token is replaced by a session cookie that expires after `webPanelSessionMinutes`.
  </Step>
</Steps>

***

Public exposure (not recommended in v1) [#public-exposure-not-recommended-in-v1]

v1 of the web panel is designed for localhost. If you genuinely need it reachable from outside, the safer pattern is:

* Keep `webPanelBindAddress = '127.0.0.1'`
* Run an HTTPS reverse proxy (Nginx / Caddy) elsewhere with its own auth layer on top

Binding the web panel directly to `0.0.0.0` exposes the launch-token URL to anyone scanning the port — and because the token is in the URL, it can leak through referrers, browser history, and logs. Don't.

***

When to skip the web panel [#when-to-skip-the-web-panel]

For 90% of day-to-day admin, the XGamingServer panel is enough:

| Task                   | XGamingServer panel | DedicatedServerMod web panel |
| ---------------------- | ------------------- | ---------------------------- |
| Start / stop / restart | ✅ Dashboard         | —                            |
| Edit config files      | ✅ File Manager      | —                            |
| Send commands          | ✅ Console tab       | ✅                            |
| Live player list       | —                   | ✅                            |
| Backup / restore       | ✅ Backups tab       | —                            |
| Scheduled tasks        | ✅ Schedules tab     | —                            |
| Resource graphs        | ✅ Dashboard         | —                            |

If you only need start/stop, file edits, and command-line admin, leave `webPanelEnabled = false`.

***

Related Guides [#related-guides]

* [Server Config Reference →](/docs/schedule-1/server-config)
* [Operators, Admins & RCON →](/docs/schedule-1/operators-admins)
* [Commands Reference →](/docs/schedule-1/commands-reference)