Admin Guide

The Overview tab is the first thing you see after logging into `/admin`. It shows the metrics that matter: registered users, active groups, indexed PDFs, indexed pages, and a quick server-status indicator.

Below the counters you will find a donut chart breaking down storage by file type and a list of the top directories by volume. These are useful sanity checks: if a single folder suddenly grows, you will spot it here before users complain about slow loads.

• Use the donut chart to confirm your storage mix matches expectations.
• Top directories help you find where to add index scopes or retention rules.
• Server status tells you whether all services are healthy before you start maintenance.

Identity & Access is where the human side of security happens. The Users tab lists everyone with an identifier, full name, email, status, and assigned roles. Click a user to edit their profile, assign groups, or attach inline Shield policy rules.

Groups collect users by role or department. Each group shows its name, type (system or custom), member count, and attached Shield policies. It is usually cleaner to attach policies to groups and put users in groups than to write per-user exceptions.

• Deactivate a user instantly without deleting their audit history.
• System groups are managed automatically; custom groups are yours to maintain.
• Inline rules override group policy for that specific user — use sparingly.

Shield is the policy engine that decides who can do what. Policies are JSON documents made of statements, each with an effect (Allow or Deny), a list of actions, and resource URNs.

Action categories cover VFS operations like `ListDirectory`, `Read`, `DownloadFile`, `UploadFile`, `CreateFolder`, and `Delete`, plus admin actions like `StorageManage`, `StorageBrowsePhysical`, `ShieldManage`, `ShieldView`, and `AuditView`. You can also enforce 2FA inside an Allow block.

• Start restrictive: default Deny, then Allow exactly what each role needs.
• Use resource URNs to scope rules to specific folders or file paths.
• Require 2FA for sensitive Allow blocks, especially DownloadFile and Admin actions.

IP Rules give names to networks — single addresses or CIDR blocks — and change how Aegis treats connections from them. Each rule can bypass the Turnstile challenge, bypass the second factor, or auto-assign a role and a Shield policy to anyone connecting from that network. It is the building block for trusted office networks and VPN ranges.

The page detects and refreshes the server's own public IP for you, and a built-in test tool shows which rules match a given address before you activate anything. Rules toggle active or inactive without being deleted.

• Bypassing 2FA or the CAPTCHA lowers the barrier — only do it for networks you physically control.
• Auto-assignment is the fastest onboarding: anyone connecting from the office range lands with the right role and policy.
• Test a rule against a few known addresses before enabling any bypass.

Beyond the organization-wide Shield policies, each folder can carry its own access control list: grant or deny specific actions to a user or a group, with optional expiration. Folder ACLs are the surgical tool — use them for exceptions without touching the global policy.

Entries inherit down the folder tree by default, and a folder can break inheritance to start with a clean rule set. The security view shows both the folder's own entries and the inherited ones, so effective access is never a guess.

• Deny wins over allow — use it sparingly and document why.
• Set expirations for temporary access (audits, external reviews) so access closes by itself.
• Break inheritance only when the folder truly needs a different rule set.

The Activity Log is a forensic audit trail. Every entry has a timestamp, actor, IP address and country, event type, affected resource, and a metadata JSON blob. You can filter by sort order, date range, user, and event type, and export the result to CSV.

The heatmap shows activity density over time, which is handy for spotting unusual spikes. Each resource link lets you open the file in the viewer or jump to the folder that contains it.

• Export CSV before running incident response so you have an offline copy.
• Use the user filter to trace a single person's actions across all resources.
• Resource links save time when you need to verify what was actually viewed.

Storage Management maps physical paths into the Virtual File System. To add a new mount, give it a label and a physical path; the interface also shows detected volumes as chips you can click to autofill common paths.

The mounts table shows label, path, status, and actions. You can configure index rules with strict-prefix include/exclude lists, and force a structural sync when the underlying filesystem changes outside Aegis.

• Always verify the physical path before saving; a typo here affects the whole VFS.
• Include/exclude rules prevent the indexer from wasting time on temporary or system folders.
• Force structural sync sparingly; it can be I/O intensive on large volumes.

The License page shows your instance ID (a UUIDv7 hardware identifier), contract status, expiry date, and tier. If you have an activation key in the format `AEGIS-XXXX-XXXX-XXXX`, enter it here to link the server.

If you need to move the deployment to new hardware or decommission it, use the deactivate/unlink option. The platform will degrade to read-only if the lease expires, so keep an eye on the expiry date.

• Copy the instance ID when opening a support ticket.
• Activate before the expiry window to avoid read-only interruption.
• Deactivate before migrating to new hardware to avoid license conflicts.

Administration is mostly about visibility and restraint: give people the least access they need, watch the logs, and keep storage and licensing healthy. For a hands-on walkthrough, request a demo.