Status page and web console

What a satellite shows on port 8080, and how the detailed console is unlocked.

Public page

Port 8080 (PULSAR_WEB_PORT) serves one page for anyone who wonders where the scans come from: what the host is (an Asterion monitoring satellite) and the abuse contact — the tenant’s own contact for tenant satellites, else the system contact, else POLARIS_ABUSE_*. Nothing else.

Put TLS in front when the page is reachable over the internet, or do not publish the port. PULSAR_WEB_ENABLED=false switches the page off.

Web console

The detailed status (portal connection, plans, location, runs, queue) is locked. To open it:

1. In Polaris, Satellite → Web console (tenant admins, operators) shows a one-time password and the session length (15 minutes, 1, 4 or 8 hours).
2. Polaris sends the grant to the satellite over the signed websocket (or with the next heartbeat answer).
3. On the satellite page, enter the password.

The password is valid for POLARIS_CONSOLE_OTP_MINUTES (15), works once, and is burned after 5 wrong attempts. The session can be closed from Polaris at any time; Polaris shows when the console was used.