Application Overview

Centroid Sentinel gives risk operations teams real-time visibility into all risk server instances — portfolio performance, system health, and alerts — from a single browser interface.

Login & Authentication

The dashboard is protected by a shared password. A token is stored in your browser so you don't need to log in on every visit.

How to Sign In

1. Open the dashboard URL in your browser.
2. The Sign In overlay appears on first visit or after signing out.
3. Enter the dashboard password. Use the eye icon to toggle visibility.
4. Check "Remember on this browser" to persist your session for 30 days.
5. Click Sign in. The dashboard loads immediately after a correct password.

Signing Out

1. Click Sign out in the top-right of the header.
2. Your stored token is cleared and the login screen reappears.

User Management

Administrators can manage users, roles, and fine-grained permissions via the settings dropdown menu in the top-right corner.

Roles & Permissions

Fleet Ops

Fleet Ops lets authorised people group servers and run Ansible against them from the dashboard, without installing anything on the monitored servers. It is switched off by default; open it from the Settings (gear) menu at the top right; if the Fleet Ops item is missing from that menu, either the feature is not enabled on your installation or your account has no Fleet Ops permission.

Who Sees What

Fleet Ops permissions are set in User Management with the Fleet Ops preset list (a shortcut that ticks a set of boxes) or by ticking individual ops.* boxes. The list, the boxes and the Fleet Ops column only appear while Fleet Ops is enabled on your installation.

Besides ops.view, three permissions change what you see: ops.manage_groups (create groups, set members and grants), ops.manage_targets (edit SSH targets, flag and unflag servers) and ops.console (the Console tab).

Who May Grant Access

• You can only give or take away an ops.* permission that you hold yourself. Otherwise the save is refused with You can only grant or remove Fleet Ops keys that you hold yourself.
• You cannot change your own Fleet Ops permissions. Another ops admin has to do it.
• Every save that changes an ops.* box asks for your password first (see the step-up prompt below). So do disabling, deleting, changing the role of, or resetting the password of a user who has any ops.* permission.
• The emergency (break-glass) login can never grant Fleet Ops permissions or use Fleet Ops.
• The first ops admin of an installation is created by whoever runs the server, from its command line: python -m server.ops.grant_admin <username> (with Docker: docker compose exec api python -m server.ops.grant_admin <username>). It gives that existing user the ops_admin preset and records it in the audit log as done by cli.

How to Grant Access

1. Open User Management from the settings menu and edit the user.
2. Pick a Fleet Ops preset (or tick the ops.* boxes yourself) and save; confirm your password when asked. Only the boxes you changed are sent, so the user's other permissions are never touched.
3. Open Fleet Ops → Groups (needs ops.manage_groups), press Grants on a group and give the user a level: view, run or deploy.

A user without a grant on a group does not see that group at all. Disabling a user cuts all their Fleet Ops access, including an open console, at once. Removing any one of their ops.* permissions (not only ops.console) closes an open console too; after that, what they can see and do follows the permissions they still have — with ops.console left they can reopen the console with their password.

Targets

The Targets tab lists every server with its SSH host, port and user. A server can be managed only when an administrator has entered an SSH host for it here. The address the agent reports is never used, so a server without an SSH host is shown as no ssh_host and is not deployable. A flagged (Shelved or Terminated) server is shown as flagged and is also left out.

• Type the host, check the port (default 22) and user (default risk), then press Save.
• Clear the SSH host to take a server out of every inventory.
• Two servers cannot share one host and port; the second save is refused.
• The Inventory tab shows the exact Ansible inventory that results.

Groups

Groups decide which servers a run may touch. Names are lowercase letters, digits and underscores, starting with a letter; all, ungrouped and all_c24 are reserved.

1. Create a group with a name and an optional description.
2. Members: tick the servers. Servers marked no ssh can be members but are not deployable until they get an SSH host.
3. Grants: choose who may use the group and at which level.
4. Require approval / Drop approval stores whether future change jobs need a second person. It has no effect yet. Dropping approval (or creating a group without it) also needs ops.approve; without it the button is greyed out.

The Step-up Prompt

Every Fleet Ops change (creating a group, saving members, grants or an SSH target, flagging or unflagging a server, changing someone's ops.* permissions, opening the console) first asks you to re-enter your password. After a correct password you are not asked again for 15 minutes. If you cancel the prompt, nothing is changed. A wrong password shows Password not accepted and the change is abandoned — the prompt does not come back; just repeat the action. Too many tries in a minute shows Too many attempts, wait a minute. The prompt is a second check on top of your login, so a stolen session alone cannot touch a server.

The Console (Ops Admins Only)

The Console tab embeds the Ansible web interface. It needs ops.console, which only the Ops admin preset includes, and opening it asks for the step-up password. You work in your own account there (named dash- followed by your username) with full rights over the project, so treat it as an administrator tool. The console stays signed in until you close the browser, sign out of the dashboard, or 8 hours pass, whichever comes first; once it is open, changes made inside it do not ask for the password again. If your access is removed while it is open, it disconnects within about 30 seconds.

• Use the project menu on the left of the console: Task Templates, Inventory, Key Store.
• Key Store: add the SSH key used to reach the servers (type SSH key). The key is never kept in the code repository and must not be pasted anywhere else.
• Attach the key to the inventory: open Inventory, edit C24 (generated) and choose the key as its SSH key. The dashboard keeps the inventory's hosts up to date by itself and does not remove the key you attached. Choosing None detaches the key and the next run fails with Permission denied.
• Do not edit the host list in the inventory by hand: it is regenerated from Groups and Targets.

Running Ping with a Limit

1. In the console open Task Templates and press run on Ping.
2. Fill in the Limit field with a group name (for example canary) or one server's alias.
3. Run it. A healthy server answers in a few seconds with its hostname, Python version, disk space and a C24 check.

The limit is mandatory on purpose. Before anything touches a server, an empty limit is refused with This playbook must be run with a host limit, and a limit of all, * or all_c24, or one made only of exclusions (!canary), is refused with This playbook must be run with a limit naming specific groups or hosts; 'all', '*', 'all_c24' or exclusions alone would touch the whole inventory.

The Audit Tab

The Audit tab lists Fleet Ops actions, newest first, with the columns At, Actor, Action, Target and Details. With ops.audit (in the ops_admin preset) you see everyone's actions; with only ops.view you see your own. Recorded actions include permission changes (with the keys added and removed), user disable/delete, group, member, grant, SSH-target and flag changes, duplicate merges and console opens. Press Load older for earlier entries. The log cannot be edited from the dashboard.

Messages You May See

Unified UI Skeleton

The dashboard follows a strict, unified layout skeleton for architectural consistency. Every view is composed of the same five functional regions.

Header Actions

Summary View

The default landing screen — a command-centre showing aggregate stats, health hotspots, and portfolio performance rankings across all instances at a glance.

Core Widgets

How to Use

1. This is the default screen after login. Return any time via the brand logo or Summary button.
2. Scan Global Overview for live vs. stale counts.
3. Check High CPU/RAM/Disk widgets to catch infrastructure problems early.
4. Review Top/Bottom performers for portfolio profitability insights.
5. Click any instance name in any widget to jump to its Detail View.

Cards View

A responsive card grid where every instance is a self-contained card. Ideal for control-room simultaneous surveillance across many servers.

Filter Sidebar

Server Card Anatomy

How to Use

1. Click Cards in the view toggle.
2. Use the Filters sidebar to narrow results. Collapse it with the arrow for full-width grid.
3. Stale servers always appear at the top of the grid.
4. Click a different tab on a card (e.g. Resources) to switch its data block.
5. Click the instance name on a card to jump to the Detail View.

Detail View

A full deep-dive panel for one selected server — portfolio data with trend charts, system resources, service health, PropShield stats, and a complete alert history.

Left Sidebar (Instance List)

Detail Panel Cards

How to Use

1. Click Detail then select a server from the sidebar — or click an instance name from any other view.
2. Scroll down in the right panel to see all metric cards and the alert history table.
3. Use the Delete button (trash icon) to remove a server record after confirmation.
4. Use the Acknowledge button in the alert history to mark an alert with an optional comment.

IP Groups View

A dense row-list that groups servers by public IP. Maximum information density — monitor 30+ instances on a single screen scroll.

IP Groups Row Columns

How to Use

1. Click IP Groups in the view toggle.
2. Use the dropdown filters at the top to narrow by Status, Type, or Trading Platform.
3. Use the Search box to find a specific server by name, hostname, or IP.
4. Servers are grouped by Public IP for easy co-location identification.
5. Click any instance name to jump to its Detail View.

Allocation Overview

A physical infrastructure view grouping instances by their public IP address. Designed for operations and hardware planning.

VM Table Column Details

Table View

An AG-Grid powered data table with sortable, filterable columns. All instances displayed as rows for structured, cross-column analysis and reporting.

Available Columns

How to Use

1. Click Table in the view toggle. AG-Grid initialises on first access.
2. Click any column header to sort ascending or descending.
3. Hover a column header and click the filter icon to add per-column text or number filters.
4. Click the Reset button in the toolbar to clear all active filters at once.
5. Right-click a column header to toggle column visibility.
6. The table theme switches automatically to match your selected dark/light theme.

Alerts View

A searchable, filterable audit log of every alert triggered across all servers. Supports inline acknowledgement with comments.

Alert Grid Columns

How to Use

1. Click Alerts in the view toggle. Grid loads the full history.
2. Click Refresh to reload latest alert data from the API.
3. Sort by Triggered At to see the most recent outages first.
4. Filter by Status column to see only Active alerts.
5. Click Acknowledge on an active alert, enter an optional comment, and confirm. Saved to the database.

History View

A time-travel browser that replays the state of all servers at any historical point. Select a datetime and the dashboard renders a frozen snapshot of every instance at that exact moment.

Toolbar Controls

How to Use

1. Click History in the view toggle.
2. Use the datetime picker to choose the date and time to inspect.
3. Click Replay. The grid loads a frozen snapshot — historical P/L, resources, and status.
4. Review the cards. This is historical data, not live.
5. Click Live to return to the real-time feed.

Compare View

A side-by-side ranked comparison of all instances by any selected financial metric for Today or Month-to-Date. The fastest way to see who's winning and who needs attention.

Toolbar Controls

The table ranks all instances from highest to lowest by the selected metric. Positive values in green, negative in red. A relative bar in each row shows the instance's rank within the group.

How to Use

1. Click Compare in the view toggle.
2. Select a Period — Today or Month-to-Date.
3. Select the Metric (e.g. Net P/L).
4. The table instantly re-ranks all instances — highest at top, lowest at bottom.
5. Toggle between metrics to compare performance across different book types.

Freshness Indicators

Every server card shows two freshness indicators — Push (agent-to-server latency) and Redis (trading data source age). Both use the same colour system.

Themes

Three display modes — selection is saved per browser and persists across sessions.

The AG-Grid in Table and Alerts views automatically switches between ag-theme-alpine-dark and ag-theme-alpine to match your selected theme.

Glossary

Key terms used throughout the application and this guide.