Console

A web UI for your instance: subgraph tables, webhook deliveries, sync status, archive coverage.

Start it

One more container, off by default:

docker compose --profile console up -d
secondlayer console   # opens http://localhost:3801/console

Port 3801, override with CONSOLE_PORT. It reads your instance over the compose network, so nothing leaves your box.

Screen	What you get
Overview	Instance health at a glance: tips, decoder lag, active subgraphs
Subgraphs	Every deployed subgraph, its status, and its version
Subgraph detail	Tables, row counts, and the reindex/backfill controls
Table browser	Paginated rows for any table, no `curl`
Subscriptions	Deliveries, failures, the dead-letter queue, requeue and replay
Status	Sync progress, service heartbeats, node reachability
Verify	Archive coverage for your instance, and the command to check it
Settings	Instance token, connection details

Deploys and edits stay in the CLI. The console reads and operates; it does not author.

Open on loopback, or when no token is set. Anything beyond that needs CONSOLE_TOKEN, which falls back to INSTANCE_TOKEN.

CONSOLE_TOKEN=<token>   # optional; INSTANCE_TOKEN is used when unset

The token gate is the floor, not the whole fence

If the console is reachable from the internet, put your reverse proxy's auth in front of it too. The console speaks plain HTTP behind the proxy.

Caddy, with basic auth (hash via caddy hash-password):

example.com {
  handle /console* {
    basic_auth {
      ops $2a$14$...hash...
    }
    reverse_proxy console:3801
  }
}

Alternative	How
Cloudflare Access	Put the `/console` path behind an Access policy; the origin stays token-gated underneath
Tailscale	Don't publish the port at all; bind to the tailnet and skip public exposure

Per-user console logins are deliberately not a feature. One instance, one token; your proxy decides who reaches it.