Operator console

Quikcast includes a web console for watching your station and taking quick actions. It is built into the program, so enabling it is a config change, not an install. It is off by default.

Turn it on

[ui]
enabled = true
mode = "private"
username = "admin"
password_file = "secrets/ui-password"

Create the password file with something strong. It needs at least 15 characters; very simple passwords are refused.

openssl rand -base64 24 > secrets/ui-password

Check and start as usual, then open /ui on either address:

• http://127.0.0.1:9090/ui (the private admin address, which is the safest place to use it)
• https://your-server/ui (the public address, if you have HTTPS)

Use HTTPS if the console is reachable from the internet

Sign-in cookies are marked Secure by default, so browsers only send them over HTTPS. On the localhost admin address that is fine. For throwaway testing over plain HTTP elsewhere, set secure_cookie = false.

What you can see and do

The private console has pages for:

• Overview: server state, uptime, sources, listeners.
• Mounts: every stream with its format, source and listener count, and a detail page for each.
• Relays and HLS: the state of your relays and HLS streams.
• Listeners: who is connected to a mount, 100 at a time.
• System: limits and server details.

Actions available (each asks for confirmation): disconnect a source, disconnect one listener, reconnect a relay, and start a graceful drain of the server. Configuration changes, passwords and HLS publishing are not available in the console on purpose.

The page refreshes every three seconds while visible.

Public status page

Want a small "is the station live?" page that anyone can see? Use public mode:

[ui]
enabled = true
mode = "public"
public_mounts = ["/radio.mp3"]

It shows the station state, uptime and listener count, and lists only the mounts you name in public_mounts. Everything else stays hidden: no IP addresses, no settings, no controls, and no login. A mount that is listed but offline still appears (as unavailable), so only list mounts you are happy to disclose.

/ui/status returns the same information as JSON in either mode, without signing in. This is useful for a status widget on your website.

Sign-in protection

• One operator account, separate from the encoder and management credentials.
• Sessions last one hour, in memory. Restarting signs everyone out.
• Five attempts per second per address, with protection against brute-force bursts.
• Changing the password, username or mode invalidates existing sessions after the next reload.

Update and reload

Console settings reload with the rest of the config (kill -HUP). Updating the console itself means installing a newer Quikcast, since it is part of the binary.