admin

Production Status

Runtime controls for FleetPilot’s internal small-company deployment profile. This page is an operational readiness view, not a compliance certification.

Audit Trail

Runtime mode

Preparation mode

Set FLEETPILOT_PRODUCTION=true after the HTTPS reverse-proxy rollout has been tested.

Session protection

HTTP-compatible cookie

Enable secure cookies only after users access FleetPilot through HTTPS, otherwise browsers will not retain sessions.

Reverse proxy trust

Not enabled

Trust forwarding headers only for the local Nginx or HAProxy proxy that you administer.

CSRF protection

Staged rollout required

Enable after validating each state-changing form; legacy routes must include a valid CSRF token first.

Secret key

Configured

A persistent secret key is required for stable sessions across restarts and worker processes.

Audit records

0 events

State-changing requests are stored without passwords, tokens, SSH keys, or request bodies.

Identity readiness

  • Microsoft Entra ID: FleetPilot is designed to use OpenID Connect and Entra Conditional Access MFA once an application registration and stable HTTPS URL are available.
  • Linux / Active Directory: LDAP/LDAPS can be added for an existing directory with a least-privileged bind account and group-to-role mapping.
  • Local break-glass access: retain one local administrator with TOTP or registered security key before enabling SSO.