Web GUI

Since v1.25.0. The administration GUI runs in the browser at https://<host>/app, served by the worker next to the API. It covers the day-to-day work; the CLI at /cli stays available.

Page	What you can do
Dashboard	\"Is it listed?\" check for any IP, network, domain or URL (with its GeoIP country); Indicator counts in total, per type and per source; alerts for sources whose last fetch failed and for scheduled sources not fetched for over two days.
Sources	Filter (name/URL, kind, format, tag, fetch status, visibility) and sort; create a group from the listed sources in one click; create and edit feeds, import-only and manual sources (URL, schedule, format, tags, private, options JSON); fetch now; delete. The last-fetch column flags failed and suspiciously shrunk fetches (message in the tooltip).
Indicators	Search (domain, URL, IP), filter by source, type, permanent flag and GeoIP country (a flag column; click to filter); add values by hand (manual sources first); toggle permanent; delete.
Groups	Table with search, a "uses source" filter and sorting; create and edit groups (members, whitelist and blacklist values and sources, tag filters per source, GeoIP country filter); copy the export URL and the tis-pull.sh call for the customer's machines.
Tokens	Create, edit (role, ACL), rotate and delete tokens; the secret is shown once with a copy button.
Export	Preview any export (public, selected sources, group) with format/type/tag/whitelist/countries, download it, copy its URL or tis-pull.sh call.
Audit log	Every change through the API, the GUI or the CLI – who, what, when, from where; filter by target, who, channel, action and dates, sort by any column.

The colour scheme follows the system by default; the header menu switches to light, dark or back to system.

Signing in

1. Authentik – offered when OIDC is configured (CONFIG_OIDC_ISSUER, CONFIG_OIDC_CLIENT_ID). Authorization Code flow with PKCE; the same CONFIG_OIDC_ALLOWED_GROUPS rule as the CLI applies.
2. Admin token – the name and secret of a token with role admin (always available).

Signed-in users act as admins. The session lasts CONFIG_SESSION_TTL seconds (default 24 h) and ends with Sign out in the account menu.

Authentik setup for the GUI

The CLI uses the device-code flow; the GUI uses the authorization-code flow and needs a redirect URI. In the TIS provider (Applications → Providers → edit):

• Redirect URIs: add https://<host>/api/v1/auth/oidc/callback (strict).
• Client type: public works (PKCE). With a confidential client set CONFIG_OIDC_CLIENT_SECRET.
• Keep the scopes incl. groups if you use CONFIG_OIDC_ALLOWED_GROUPS.

TIS builds the redirect URI from the request (X-Forwarded-Proto/Host of the reverse proxy). If the proxy doesn't forward them correctly, pin it with CONFIG_API_PUBLIC_URL=https://<host> – see Configuration.

Errors return to the login page: not in an allowed group, took too long (more than 10 minutes in Authentik) or sign-in failed (details in the worker log).

Security

• The browser never holds an API token: sign-in sets an httpOnly, SameSite=Lax session cookie (Secure behind https), stored in Redis (in memory without Redis – sessions are then lost on restart).
• Requests that change data must carry the X-TIS-Client: web header, which other sites can't add – protection against cross-site request forgery.
• The API keeps accepting tokens as before; a token always wins over a session cookie.