Overview and Needs attention

The overview is the dashboard’s front page. Above the traffic tiles and chart it lists what needs attention right now, and for a new instance, the first steps still to take.

The overviewSample data. The attention list names the chart's 5xx spike, a certificate close to expiry and a scanner sweep the WAF stopped.DemoNothing you change here is saved

Welcome back, Avery

1h12h24h7d30d

Needs attention

3 items

• git.example.com had a burst of 5xx errors280 errors, 6% of its requests, from 6:00 AM to 7:58 AM.
  WarningAcknowledge
• Certificate media.example.com expires in 6 daysValid until Feb 17, 2026. If Caddy manages it, being this close to expiry means its renewal is failing.
  WarningAcknowledge
• 312 requests to git.example.com/wp-login.php were stoppedAll by the WAF in the last 24 hours.
  InfoAcknowledge

Get started

Hide

3 of 5 done

1. Serve a domain with a valid certificatecompleted

   Done
2. Add your first proxy hostcompleted

   Done
3. Turn on analyticscompleted

   Done
4. Invite a second user

   So you are not the only one who can sign in.

   UsersIgnore
5. 5

   Set up single sign-on

   Sign in through an OIDC provider or an LDAP directory.

   Sign-in settingsIgnore

11of 12

Proxy hosts

9

Certificates

3

Access lists

Requests68,620

Server events17

5xx responses282

4xx responses1,566

Bandwidth out2.6 GB

Blocked requests412

All metrics

View analytics

Server log

All metrics

Search the server log

Time	Status	Description
12:00:00 PM	200	GET media.example.com/library/sections/2/all 48 KB · HTTP/2.0 ·203.0.113.24
11:59:59 AM	update	Enabled the WAF on grafana.example.comavery · proxy_host
11:59:58 AM	200	POST git.example.com/avery/infra/git-upload-pack 1.2 MB · HTTP/2.0 ·2001:db8:6e21:9a40:d1c3:57fe:2b08:4419
11:59:56 AM	update	Added upstream http://app-2:8080 to app.example.comavery · proxy_host
11:59:55 AM	502	GET app.example.com/v1/devices/sync 0 · HTTP/1.1 ·10.0.2.51
11:59:51 AM	403	GET status.example.com/.env 512 B · HTTP/1.1 ·2001:db8:a0b::62
11:59:50 AM	create	Created L4 proxy host postgres (5432/tcp)avery · l4_proxy_host
11:59:48 AM	304	GET home.example.com/static/frontend_latest/app.js 0 · HTTP/3.0 ·10.0.2.14
11:59:46 AM	renew	Issued client certificate backup-runnersystem · certificate
11:59:44 AM	200	GET grafana.example.com/api/dashboards/uid/caddy 96 KB · HTTP/2.0 ·203.0.113.88
11:59:42 AM	delete	Removed old-laptop from the Staging access listavery · access_list

Requests from traffic_events in ClickHouse, changes from the audit log. Only the requests need access logging.

Traffic (24h): 68,620 · Blocked 0.6%

Needs attention

Each item says what is wrong, how serious it is (critical, warning or info) and links to where it is dealt with. The worst come first, up to 50; anything past that is counted. The checks are:

Check	What makes an item
Certificates	An imported certificate, or one Caddy manages, that has expired or has fewer days left than the certificate alert threshold (Settings → Email, 14 by default). A managed one must also be in the last quarter of its life, so Caddy’s short-lived internal certificates never show; one this close means its renewal is failing. A certificate read from a file on an agent whose last read failed.
Caddy	The last configuration Caddy refused, on one agent or all of them, until one loads again.
Agents	An agent gone for more than two minutes after it had connected, and an agent whose Caddy build, optional services, L4 port change or log access failed.
Traffic	With analytics on: 5xx bursts (critical while still going on), a host answering 5% or more of at least 20 requests with 5xx, spikes in stopped requests against the 7-day average, and 50 or more requests stopped on one path.
LDAP	A directory that cannot be connected to, bound to or searched. Each is checked at most every five minutes.
Accounts	An account being made to wait after failed sign-ins, and one disabled after too many.
L4 ports	L4 ports waiting for the Caddy container to be recreated, or a port change that failed.
CRS plugins	A plugin switched off because Caddy would not load the WAF with it.
GeoIP	The last GeoIP database update failed.
Security	The global WAF only detects, or blocked countries, continents or networks are not enforced because Caddy lacks the Geo Blocking module.

Every check has four seconds. One that takes longer, or fails, is left out and the list says so, so an empty list with a skipped check is “unknown”, not “all clear”. With analytics off there are no traffic items at all, which is not the same as no traffic problems.

Administrators see every item. An operator sees the items about the proxy hosts and agents their groups grant: a certificate on one of their hosts, their hosts’ traffic, their agents. Users and viewers see none.

A host’s own page lists the items about that host alone; see the reverse proxy page.

Setup checklist

Administrators also get a short checklist for a new instance:

1. Serve a domain with a valid certificate.
2. Add a first proxy host.
3. Turn on analytics.
4. Invite a second user.
5. Set up single sign-on, through an OIDC provider or an LDAP directory.

Each step ticks itself once the instance has it. A step can also be marked done by hand, for instance when single sign-on is deliberately not wanted, and the whole list can be hidden. Both are stored once for the instance, not per administrator, and both are recorded in the audit log.

Over the API

The GraphQL API has the same list as attention (with proxyHostId for one host’s items), the checklist as setupChecklist, and the setSetupStepDone and setSetupChecklistHidden mutations. Like the rest of the API, they are for administrators.