Instance settings

The panel publishes itself through its host's proxy, so the address it answers on is a setting, not an install-time fact. setPanelUrl moves the route with the address and puts the old one back if the new address does not answer. instanceSettings.panelIpUrl is the address every instance also answers on straight on its own machine: not a setting, cannot be turned off, and the way back in when a domain or certificate broke.

Settings

instanceSettings

Instance admin only. Returns InstanceSettings.

This instance's own settings. A plain database read: it never dials a server, so it answers even when the fleet is down.

query {
  instanceSettings {
    panelUrl
    panelUrlSource
    gravatarEnabled
    logMaxDays
    version
  }
}

setGravatarEnabled

Instance admin only. Returns InstanceSettings.

Turn Gravatar profile pictures on or off for the whole instance. On, a person with no uploaded picture falls back to the one registered against their address, and each VIEWER's browser fetches it - the panel itself never dials out, so an instance with no egress still works. Off, no Gravatar address is emitted anywhere and nothing about anybody leaves the instance. Instance-wide because it is a property of this deployment's egress and policy, not of one team's taste.

mutation {
  setGravatarEnabled(enabled: true) {
    panelUrl
    panelUrlSource
    gravatarEnabled
    logMaxDays
    version
  }
}

setLogMaxDays

Instance admin only. Returns InstanceSettings.

Set how far back the log viewer's time range may reach, in days. It is a ceiling on the ranges the picker offers, not a retention policy: docker rotates a container's logs by SIZE, so nothing here makes a host hold more of them, and a window that comes back empty says the host rotated them rather than pretending the app was quiet. Clamped rather than rejected - the field is a number input with the same bounds, so a value outside them arrived from an API client, and the honest answer to "keep 900 days" is the ceiling.

mutation {
  setLogMaxDays(days: 30) {
    panelUrl
    panelUrlSource
    gravatarEnabled
    logMaxDays
    version
  }
}

Panel address and HTTPS

panelAddressImpact

Instance admin only. Returns PanelAddressImpact.

What moving the panel to this address would break: passkeys welded to the current hostname, sessions, deploy hooks already pasted into someone's CI, connected AI clients, invite links, servers still waiting for their install command, notification subscriptions. Counted live and instance-wide, and only meaningful when the address actually moves - an unchanged address answers all zeroes. A query, not a mutation: it reads the database and dials nothing.

query {
  panelAddressImpact(url: "https://deplo.example.com") {
    sessions
    passkeys
    deployHooks
    mcpConnections
    losesHttps
  }
}

setPanelUrl

Instance admin only. Returns InstanceSettings.

Set the address this Deplo answers on, or pass no url to fall back to DEPLO_PUBLIC_URL. A bare domain becomes https://. The value is validated as a hostname with no path, no credentials and no shell metacharacters, because it is interpolated into copy-and-run strings such as a server's install command. On a Deplo that publishes itself through its own proxy this MOVES the panel's route too, and puts the old one back if the new address does not answer; DNS still has to point at the server first.

mutation {
  setPanelUrl(url: "https://deplo.example.com") {
    panelUrl
    panelUrlSource
  }
}

panelDns

Instance admin only. Returns PanelDns.

Resolve the panel's own hostname and classify it the way a custom domain is classified: valid when its A records include this host's public IPv4, cloudflare when they are Cloudflare's anycast addresses and the origin cannot be read from DNS, misconfigured when it answers with something else, pending when it does not resolve, and unknown when there is nothing to check (a bare IP, or no host address on record). A mutation despite writing nothing, for the same reason panelHttps is one: it leaves the process.

mutation {
  panelDns {
    host
    status
    resolved
  }
}

panelHttps

Instance admin only. Returns PanelHttps.

Read how the panel is served off the proxy that publishes it, live. A mutation despite writing nothing, for the same reason serverCertificateAccounts is one: it dials a server.

mutation {
  panelHttps {
    enabled
    domain
    certificateTrusted
  }
}

setPanelHttps

Instance admin only. Returns PanelHttps.

Serve the panel over https, or over plain http. Turning it off is for a panel whose address cannot get a certificate - it does not resolve publicly yet, :80 is closed, the box is internal - where https means a browser warning on a page nobody has logged into yet. Three things move together: the route goes to the :80 entrypoint (with that entrypoint's redirect pinned below it), the stored panel address takes the new scheme, and the session cookie drops its __Secure- prefix, without which the panel would load over http and be impossible to log into. The host's proxy is recreated to pick it up, so sites on that server - this panel included - are unreachable for the few seconds it takes to come back. On a Deplo installed before it published its own route, the first change ADOPTS that route: Deplo writes one beside the container labels the installer left and outranks them, after proving from inside the network that it knows where the panel listens.

mutation {
  setPanelHttps(enabled: false) {
    enabled
    domain
  }
}

Updates

updateInfo

Any signed-in principal. Returns UpdateInfo.

Check the upstream repository for a newer Deplo release; cached for an hour.

query {
  updateInfo {
    current
    latest
    updateAvailable
  }
}

deploChangelog

Instance admin only. Returns DeploChangelog.

Deplo's published releases with their notes, newest first; cached for an hour and refreshed by checkForUpdates.

query {
  deploChangelog {
    releases {
      tag
      name
      publishedAt
    }
  }
}

checkForUpdates

Instance admin only. Returns UpdateInfo.

Re-run the upstream release check ignoring the cache, and expire the changelog beside it.

mutation {
  checkForUpdates {
    current
    latest
    updateAvailable
  }
}

Ownership

The instance owner is the tier above instance admin: the one account that can hand the instance over.

viewerIsInstanceOwner

Any signed-in principal. Returns Boolean.

Whether the viewer owns this instance (the tier above instance admin).

query {
  viewerIsInstanceOwner
}

transferInstanceOwner

Instance admin only. Returns Boolean.

Hand instance ownership to another instance admin. Owner-only; requires the caller's password. Returns true.

mutation {
  transferInstanceOwner(
    password: "correct-horse-battery-staple"
    userId: "user_9f1c2ab7d3e4f5a6"
  )
}

See also