Skip to main content
The control plane and campaign plane follow different trust paths. Switch between them to trace authentication, authorization, and workload creation.
1

Open the dashboard

The operator opens the loopback dashboard over HTTPS.
2

Proxy the API request

Frontend nginx proxies /api requests to the admin backend.
3

Authenticate the session

The backend authenticates the opaque server-side session cookie.
4

Authorize the route

Route-level authorization checks the user role and resource ownership.
5

Read or update state

The backend reads or updates SQLite and campaign storage.

​
Collection

Campaign-local clients send bounded, validated records to private collection routes. The campaign service forwards authenticated events to the admin backend, which owns persistence. The dashboard later reads those records through its authenticated API.
Last modified on August 28, 2026