Administrator Guide

Create new user accounts (for when self-registration is disabled), optionally requiring a password change on next login

Edit name, email, and global role

Grant per-user features in the Feature Access table — including Create projects (off by default for non-admins; admins can always create projects) and Helpdesk (tickets)

Deactivate or reactivate accounts; soft-deleted users can be restored or permanently purged

Reset a user’s MFA (TOTP) or revoke all of their passkeys (the Passkey column shows who has one)

View last login time and last password change

Create and revoke API keys on behalf of any user (useful for metrics and backup service accounts)

View the full Login History for each user — every authentication and security-sensitive event with IP, client, timestamp, and the actor (blank for self-actions; admin username for admin-on-behalf actions)

View all projects, including archived and closed ones (Show closed toggle)

Create projects, and archive, close/reopen, restore, or permanently delete them

Change project ownership

Contracts — base hourly rate and optional time slots (see below)

Billing information — billing address, VAT number, and PO reference, printed on invoices

Contacts — informational contact persons (not user accounts)

Locations — named sites with address, contact details, and a standard travel distance; picking a location in time tracking auto-fills the entry’s distance (the value stays editable)

Invoices — generated from contract-linked time entries (draft → sent → paid, plus credit notes), with a PDF using the company details from Admin → Settings → Branding & Billing

Enable helpdesk access per user (Admin → People & access → Users → Edit → Helpdesk (tickets)); admins always have access.

SLA policies, Macros, and Checklist templates are in the Helpdesk group of the admin menu. An SLA policy can filter on priority, type, customer, and category (the most specific match wins), count in a business-hours calendar, warn at a threshold, and escalate to a group or user on breach.

Admin → Helpdesk → Ticket settings holds the impact × urgency priority matrix, the auto-close period for resolved tickets, whether a resolution code is required, the major-incident group, the ticket categories, and the resolution codes.

Admin → Helpdesk → Business hours defines working calendars with holidays; Add holidays adds a country’s public holidays for a year, like the button in time tracking.

Admin → Helpdesk → Service catalogue defines orderable services: request form, fulfilment group, task checklist, and approver group with the number of approvals needed.

Admin → Change & configuration → Change management sets the change advisory board group and the approvals needed for normal and emergency changes, and manages freeze windows.

Admin → Change & configuration → CMDB types manages the configuration item types.

Incoming Mail (IMAP) polls a mailbox and turns new mail into tickets; processed messages are moved to a Processed folder (or marked \Seen if the server lacks MOVE). Plain and OAuth2 (Google / Office 365) authentication are supported — OAuth2 client IDs and secrets go in the oauth2: block of warmdesk.yaml and need a restart.

Allow public registration — enable or disable self-registration on the login page

Session timeout — idle minutes before a user is logged out (default 60; 0 = no timeout)

Maximum password age — days after which users are asked to change their password (0 = never, the default)

Require MFA for all users — users are prompted to set up TOTP after their next login

Remember MFA on trusted devices — Disabled, 1 week only, or 1 week or 1 month (default); tightening it revokes existing trusted devices that no longer fit

API allowed IP addresses — comma-separated IPs/CIDR ranges allowed to use API keys (empty = no restriction). Browser sessions are never blocked. A wrong value locks all API-key clients out.

Company name — shown in the login screen branding panel and in report headers / PDF footers

Company logo — separate logos for light and dark backgrounds (JPG, PNG, GIF, WebP, or SVG), used on the login screen, reports, and PDFs

Show company branding on the login screen — splits the login page into a branding panel and the login form

Billing — company address, VAT and CoC numbers, IBAN/BIC, payment terms, default VAT rate, invoice number prefix, and a VAT-exempt toggle, all used on invoice PDFs

Initial columns and Initial labels — created for every new project (existing projects are not changed)

Scrum Story Points — shows a story-points field on cards

Completely restart (replace) — replaces the database and the upload directory with the backup’s contents. SQLite restores are live; no server restart needed.

Add to current data (merge) — uploaded files are copied in alongside existing ones; database rows are added only when their ID doesn’t already exist locally (SQLite only — on PostgreSQL/MySQL only the uploads are merged).

jwt_secret is still the default value change-me-in-production

jwt_secret is shorter than 32 characters

gin_mode is release and allowed_origins contains *

db_driver is mysql and db_dsn lacks parseTime=true (without it every timestamp read silently fails, showing up as misleading "invalid credentials" / "not found" errors)

app_mode or instance_mode has an unknown value

The in-process rate limiter is per-instance. In a multi-instance deployment, each instance has its own counter — a distributed brute-force attack can bypass the limit. Use a WAF or rate-limiting proxy for multi-instance deployments.

In the desktop (Tauri) app, JWT tokens are stored in sessionStorage (accessible to JavaScript). A proper fix requires routing API calls through the Rust layer — not yet implemented.

warmdesk_metrics_last_access_timestamp_seconds — Unix timestamp of the previous successful scrape (0 if never).

warmdesk_metrics_last_access_success — result of the previous scrape: 1 = success, 0 = failed (auth error), -1 = never scraped.