Dashboard

System overview ·

Total Users

-

Registered accounts

Active Rooms

-

Message threads

Calls Today

-

Voice sessions

VoIP Tokens

-

Registered devices

Current Release

-

Live Activity

Loading activity...

Security Status

Server hardening and security posture

TLS Certificates

Public-facing HTTPS certificates served by the edge gateway. Auto-renewed via Let's Encrypt certbot timer. Green = more than 30 days. Amber = 8 to 30 days. Red = 7 days or fewer.

Domain	Issuer	Expires	Days remaining	Status
Click Refresh to load.

Who is told

Everyone on this list gets the warnings, the failures and the Monday note. If the list is empty the warnings still go out, to the address written into the watcher, with a line saying nobody is on the list yet. Silence is never an option.

Address	Added by	Added
Click Refresh to load.

Apple App Store Connect API

Health of the connection to Apple's developer API used for device registration, profile regeneration, and certificate management. Green = working. Amber = warning. Red = broken.

Click Refresh to load.

Backups

Daily automated backup to off-host S3 storage. Green = backup ran within last 24 hours. Amber = 2 to 3 days. Red = 4 days or more without a successful backup.

Click Refresh to load.

Services

SOLUS Location

Loading...

Infrastructure

Loading...

Users

Registered SOLUS accounts

Name	Username	Account Status	Last Active	App Registered?	App Version	Device Status	Manage Account
Loading...

Conversations

Conversations on the messaging server

Room ID	Members	Last Activity	Actions
Loading...

Call Log

Voice call history

Time	Caller	Recipient	Status	Duration
Loading...

Broadcast Message

Sent to everyone in the broadcast room as plain text. SOLUS phones do not show it: they hide every message that is not encrypted.

Subject Message

0 characters

Broadcast History

Loading...

App Releases

SOLUS iOS device distribution

Current Active Release

No active release

Upload New Release

.ipa File

Version

Release Notes (optional)

Required update (app will prompt all users to upgrade)

Release History

Version	Build	Size	Uploaded	By	Status	Actions
Loading...

Audit Log

Security event record, hash-chained and anchored off the server every hour

Time	User	Event	Category	IP Address	Outcome
Loading...

Device Keys

Devices added and removed, security keys set and replaced, approvals, and anything refused

Time	User	Device	Event	Detail	IP Address
Loading...

Vault

The vault is a locked safe that holds the most sensitive items SOLUS owns: the Apple signing certificate and password used to sign and release the iOS app. Storing these in the vault means no one (not even a system administrator) can read them directly from disk. The vault only opens when 3 of 5 unseal keys, held by separate trusted people, are entered together. In normal operation the vault stays open. It only locks itself when the server is restarted, and an administrator must open it again before iOS builds can be signed.

Is the vault open or locked?

Tells you whether the vault is currently open or locked. When it is locked, the SOLUS admin service cannot read the Apple signing items, which means new iOS builds cannot be signed or released.

Loading...

Sealed means locked. The contents are encrypted and unreadable, even by the server itself. The vault locks itself every time it is restarted. This is the safe state.

Unsealed means open. The vault will hand out the Apple secrets to the SOLUS admin service when asked. It stays open until the next restart.

Initialised: yes means the vault has been set up at least once with its master keys. This should always say yes. If it ever says no, the vault has been wiped and must be rebuilt from the backup copy below.

Unseal progress 1 / 3 shows how many keys have been entered toward opening the vault so far. Resets to 0 once fully open.

Top bar pill: green dot = open, amber dot = locked, red dot = unreachable.

Open the vault

Paste one unseal key, then click Submit key. Repeat with two more keys (different ones each time) until the vault is fully open. The five unseal keys live in the password managers of five separate trusted staff. No one person can open the vault on their own.

Test the secrets

Reads each of the Apple signing items from the vault to confirm they are stored correctly and the SOLUS admin service can read them. Run this after opening the vault to be sure everything works. Three rows showing OK means all good.

Backup copy

An extra encrypted copy of the Apple signing items, kept on disk separately from the vault itself. Used only for disaster recovery if the vault is ever destroyed and has to be rebuilt from scratch. The file is locked with a 50-character password held in a password manager. Without that password the file is useless to anyone who finds it.

Loading...

Activity log

A permanent record of every time someone or something reads a secret from the vault. Used to spot unauthorised access. Each line shows the time and what was read. The actual secret values are never written to this log. Entries cannot be edited or deleted.

Click Refresh to load.

System Logs

Real-time service output

Loading logs...

Federation

Federation lets users on this SOLUS deployment send messages to and receive messages from users on another agency's SOLUS deployment, when both agencies have explicitly approved each other. This is how interagency communication works. It is controlled by a strict allowlist: only the named SOLUS deployments below can exchange messages with this one. Federation is disabled by default. Internal messaging between users on this deployment does not use federation and is unaffected by anything on this page.

Nothing on this page changes SOLUS. The console cannot read or change federation yet, so this is a preview kept in this browser only. Whether federation is on is set on the messaging server.

Preview

Loading...

SOLUS deployment	Agency	Added	Remove
No SOLUS deployments approved. Add one below.

Change your password

Enter your current password and the code your authenticator shows now. When it changes, you are signed out of the console everywhere else; this window stays signed in.

Settings

Agency configuration. All changes are logged to the audit trail.

Message Retention

The server keeps every message at least this long, and refuses a disappearing time shorter than this for any conversation.

Retention period

Minimum days to retain messages before deletion. 0 is none.

days

Presets

Fills in the period. Press Save Changes to keep it.

Kept on the server

How long the server keeps every message, in days. 0 keeps them for ever. A conversation with a disappearing time is deleted from the server too when its time runs out.

days

Message Lifetime

How long messages stay in a conversation. People choose a time for each conversation between the shortest and the longest. Where nobody has chosen, the default applies. Leave a box at 0 for none.

Default

Messages leave a conversation after this, unless someone there has chosen otherwise. 0 keeps them.

hours

Shortest

The shortest time anyone can choose. Never shorter than the retention period.

hours

Longest

The longest time anyone can choose.

hours

Backups

Storage

Storage quota

Total cap for this deployment.

GB

Alert threshold

Alert when usage exceeds this percentage.

%

✓ Saved

Global Message Permissions

The server refuses a delete or an edit as soon as it is turned off here.

Allow users to delete messages

When off, no user can delete any message.

Allow users to edit messages

When off, sent messages cannot be edited.

✓ Saved

Legal Hold

While a hold is on a person or a conversation, the server deletes none of its messages: no purge when their time runs out, no delete by a person, no conversation delete and no erase. A person's hold covers every conversation they are or were in. The apps still take a message off the screen when its time runs out, and delete their own copies.

Loading...

Regulatory Framework Preset

Select the regulatory framework that applies to your agency. The preset will suggest recommended settings. You must review and confirm before any changes are applied.

Framework

Select to view recommended settings.

Alert Contacts

Alert email

Security alerts are emailed here, as they go to the webhook. A single failed sign in is not emailed; a run of them is (Auth failure spike). Empty for none.

Webhook URL

Optional HTTPS POST with JSON payload on each alert. Its server must take TLS 1.3 with AES-256-GCM and P-384, and have a P-384 or RSA 3072 bit certificate signed with SHA-384 or stronger; nothing is sent to one that does not.

Scheduled audit export

Automatically POST audit data to the webhook on this schedule.

What is sent

Every failed or blocked sign in or request, and security events such as a person suspended or a certificate revoked, go to the webhook as they happen, and to the alert email, except a single failed sign in.

Auth failure spike

Alert after this many failed sign ins in a row to this console, by one account or from one address, with no success between. Sent to the webhook and the alert email; the count starts again after a success or after the alert.

✓ Saved

Incident Log

Loading...

Vulnerability Tracker

Log and track discovered vulnerabilities. Included in audit exports.

Loading...

Infrastructure Details

These values appear on the Containers page. Update them to reflect your deployment.

Cloud Provider

Region

Primary Domain

Admin Domain

Database

Admin Display Name

Shown as the sender of broadcast messages.

Stack

✓ Saved

App Policy

Every setting here reaches the iPhone and desktop apps from this console, over each device's certificate. Version 0.

Your organisation

Organisation name

Help contact

Shown when someone needs their administrator.

Classification label

Shown as a banner in both apps, and carried by every records export. Leave empty for no banner.

Rules enforced

Ready-made pack

Fills in the frameworks and the choices below. You can change any of them after.

Frameworks enforced

None by default. Each algorithm below must meet every framework ticked.

Encryption

When an app cannot run an algorithm chosen here

Lenient: the app keeps its own and says so. Strict: secure messaging stops on that app until it is updated.

Enforce withdrawal dates

On: an algorithm is refused from the date an enforced framework withdraws it. Off: it is allowed, and this page warns.

Device certificate key

FIPS mode

Only FIPS 140-3 validated modules and NIST approved algorithms.

Desktop app's lowest TLS version

A revoked server certificate

Warn, the starting value: the iPhone tells the person and stays connected. Refuse: it does not connect, and tells the person why. Either way only a certificate its issuer says is revoked counts; no answer is not revoked.

Server keys

The keys the apps trust for each server, as this policy gives them: each server's current key and its spare. A retired key is no longer trusted. Each app also trusts the keys built into it, unless this policy retires them.

None yet: the apps trust only the keys built into them.

Replace a server's key

Without a new app, in four steps. 1. Make a spare: a new key, kept in the SOLUS vault, trusted by every app from the next policy, before any server uses it. 2. Request a certificate for the spare, and have it issued for that server. 3. Install the spare's key (from the SOLUS vault) and its certificate on that server. This is done on the server, never here. 4. Make the spare current, once the server presents it: its old key is retired, so the apps stop trusting it, and a new spare is made.

Loading...

Calls

Call relays

Starts empty: calls use this server's own relay. Up to 8 more. One to one calls take the nearest of this server's relay and these. Group calls use this server's relay, or the first relay here ticked for group calls. Each app checks every address before it uses it, and skips one it cannot trust.

Relays a phone ignored

A phone ignores a listed relay it cannot trust, and says so here. Newest first.

Loading...

App versions

Lowest iPhone app version

Below it, the app asks to be updated.

Lowest desktop app version

Devices

Screen capture on the iPhone

The desktop app is not affected: screenshots always work there.

Lock after (minutes)

How long the iPhone stays open untouched before it locks: 1 to 15 minutes, or Never. It still locks when SOLUS comes back after a minute in the background. With Never, only the lock on coming back from the background and the 12 hour limit apply, which does not meet the ISM's 15 minutes.

Erase the app after this many failed unlocks

0 for never; anything from 1 to 9 counts as 10. Only a wrong typed password counts, never Face ID or Touch ID; the phone warns from the third.

Face ID or Touch ID at unlock

On: the iPhone asks for Face ID or Touch ID each time it is unlocked, with the account password instead. Off: the account password only, and Face ID is never asked. Failed unlocks count either way.

People may register in the app

Send crash reports to this console

Off, the starting value, sends nothing. On, an iPhone that crashed sends what it noted (the error's name, its reason and where in the app) to this console at its next start, and nowhere else. Each is kept in the audit log.

A password change in the app signs out other devices

Off, the starting value, keeps the person's other phones and desktops signed in when they change their password on an iPhone. On signs them out, so each signs in again with the new password.

Messages

Disappearing messages

Disappear from devices after (hours)

The default for allowed, the lifetime for enforced. The server deletes the messages too when the time runs out.

What each conversation says when enforced

{lifetime} becomes the lifetime, such as 7 days.

Files

Types of file people may send

Blank, the starting value: any type, as before. Otherwise the file name endings allowed, such as pdf, docx, xlsx, one per line or separated by commas. The iPhone refuses any other type before it is sent, and a file whose contents are not what its name says. Photos, videos and voice messages are not files here.

Records

Records capture

Above off, every person in every conversation is shown your notice, and disappearing messages are blocked.

The archive's name, as people see it

The notice people see

People whose records are permanent

One per line, as @name:server.

When something goes wrong

The starting value keeps SOLUS working and tells people what is wrong.

When someone's SOLUS app uses older encryption

Messages are always end to end encrypted. Always connect sends them and asks that person to update; Refuse holds them until they do.

When some people in a group cannot be reached

Send to those reachable sends to everyone who can be reached now; All or nobody sends only when everyone can be.

When a device is signed out by the server

Sign in again asks the person to sign in; Erase removes SOLUS and its messages from the device.

Where the app's unlock is checked

On the phone works without a connection, with the key the phone holds for Face ID or its passcode. By the server: unlocking needs the network. Someone with no signal can't open SOLUS.

When an app's encryption is not FIPS validated

Warn lets people keep working and tells them why; Block stops secure messaging on that app. No app's encryption is FIPS validated yet, so Block stops it on every phone, and the console asks before saving it.

When the iPhone cannot keep SOLUS out of screenshots

Show with a banner keeps SOLUS open and says screenshots can include it; Hide the app keeps it covered.

Calls from a device not yet approved

A device not yet approved does not take calls unless you choose Ring.

When an app finds signs its device has been tampered with

Warn lets people keep working and tells you; Block stops secure messaging on that device.

Policy key

Every device checks the policy and every wipe order with this key, from the SOLUS vault. When you change it, the old key signs over to the new one, and devices follow.

Key in use

✓ Saved

Session Management

Idle timeout

A session ends after this many minutes without use, 1 to 15; 15 to start. Signing in again needs the password and the authenticator.

minutes

Incident: open things up

For an incident only. While on: no phone lockout (wrong passwords are counted, not acted on), one time and spare codes work whether or not they have run out, no suspension for no use, no given password prompt, and no wipe after failed unlocks. Encryption, certificates, revocation and the audit are never relaxed. It turns itself off after the hours below; every administrator is emailed when it goes on and off.

Incident lasts

Hours before the incident switch turns itself off, 1 to 72; 12 to start.

hours

Session ends after

However busy, a session ends this many hours after signing in, 8 to 12; 12 to start. The page stays as it was and asks you to sign in again over it.

hours

Break glass passwords are shown

Whole, the starting value, to one custodian to seal; Split in two, as two halves to two custodians.

Releasing a break glass password

One administrator, the starting value, with their password, code and a reason; Two person, once a second administrator approves within 15 minutes. Every administrator is told either way.

TLS key exchange

For connections to this server. Quantum-safe uses ML-KEM with X25519 or a NIST curve. Required refuses any app or browser that offers no quantum-safe group.

New devices a day

Starts at 5. How many new device certificates this server issues in a day, 1 to 100. Renewing a certificate that is still valid never counts.

New devices need a one time code

Off, the starting value, lets a person's new device get its certificate once they sign in. On asks the new device for a one time code you make for that person on the Users page (Enrolment code). Renewing a certificate never needs one.

Spare codes last

A spare code is a one time code you print or seal for a person or their supervisor, one per person, for adding a device when nobody can issue a code. Every use is emailed to every administrator. 1 to 90 days; 30 to start.

days

Refuse older device certificates and call tokens

Off, the starting value, still takes a device certificate made before certificates named their device, and a call token from an older app, checking the person but not the device. On refuses both, so every request is checked against its own device. Turn it on once every phone has renewed its certificate and updated the app.

Sign in needs the device certificate

Off, the starting value: a person signs in with their password, and a new device then gets its certificate. On: signing in also needs a SOLUS device certificate already on the device, so a stolen password is no use on another phone or computer. A new device then signs in with a one time code you give the person, so "New devices need a one time code" must be on first.

Phone sign in lockout

Starts at 0, off: wrong passwords are only slowed down. 3 to 5 locks a SOLUS account out of new sign ins after that many wrong passwords in a row. Phones already signed in keep working. It takes effect when the web server reloads.

wrong passwords

Phone account locked for

Starts at 15. How long a locked account waits before it can sign in again, 15 to 1440 minutes.

minutes

Tokens only from their own device

Off, the starting value, as before. On refuses a sign in token used with any certificate but its own device's, and any token with no device. It takes effect when the web server reloads.

Device revocation list

The relay signs a standard revocation list of device certificates every hour, each good for 7 days, and you are alerted if it is not renewed for 2 hours. Warn, the starting value: the relay checks each phone against it and records any on it, refusing no one for it. Revoked devices are still refused by the web server's own lists. Refuse: the web server also checks it, and refuses every phone if it runs out. Off: no list. It takes effect within a few minutes.

Firewall inbound threshold

Starts not set (0), which keeps the server's own value. 5 to 100000: a request scoring this much is refused. A lower number refuses more. It takes effect when the web server reloads.

Authenticator algorithm

For authenticators set up from now on. Everyone already set up keeps theirs.

Administrator accounts

Turn off unused accounts after

Starts at 0, which turns nothing off. An account with no sign in for this many days is turned off and signed out. The last System Administrator is always kept.

days

Access ends unless revalidated after

Starts at 0, which never ends anyone's access. An account not revalidated by another System Administrator for this many months is turned off and signed out. Revalidating turns it back on.

months

Administrator rights last

Starts at 0, which keeps the rights standing. 5 to 480: a System Administrator can only look until they ask for the rights at the top of the page, with their password, code and a reason, for this many minutes.

minutes

Passkeys and security keys

Off signs in with the authenticator code. Allowed lets a passkey or security key stand in for the code. Required signs in only with one; add your own on Change password first.

Refuse breached passwords

Off checks length only. On also refuses any new password on the console's built-in list of passwords known from breaches, in any case. Nothing is looked up online.

Refuse breached SOLUS passwords

The same list, for passwords people choose on their phones and desktops. Off, the starting value, checks length only. On also refuses a new SOLUS password on the list, or one shorter than the shortest SOLUS password, before the messaging server sees it. It takes effect when the web server reloads.

Given SOLUS passwords must be changed

Off, the starting value: a password you give someone, for a new account or a reset, stands until they change it. On: at sign in their app asks them to choose their own, with Later. Calls and messages carry on either way.

Ask again after

When someone chooses Later on a password you gave, their app asks again after this many hours, 1 to 24. 24 to start.

hours

Tell people when their password or authenticator is reset

Off tells nobody. On emails the person's own address whenever their console password, console authenticator or SOLUS password is reset or changed, saying when and by whom.

End sessions when an authenticator is reset

Off leaves the person signed in to the console. On signs them out everywhere when their authenticator is reset, by you or by them. Password resets always sign them out.

Re-enrolment revokes certificates

Off, the starting value: Force re-enrolment clears push tokens and the certificates the person holds stay valid until they expire. On: it revokes every certificate their devices hold now and signs those devices out, after your reason, password and code.

Lock after

Starts at 0, which keeps the number set at install (5, and never more than 5). 3 to 5 wrong attempts lock the account.

attempts

Locked for

Starts at 0, which keeps the time set at install (30 minutes).

minutes

What counts towards the lock

Wrong passwords counts those only. Every failure also counts wrong authenticator codes, refused passkeys and wrong passwords on every other form.

Shortest password

Starts at 15. Every password typed into the console, a console account's or a new SOLUS account's, must be at least this long. Long passphrases are accepted in full.

characters

Shortest SOLUS password

Starts at 15, the least allowed. Every password a person chooses for their SOLUS account in the app must be at least this long. The messaging server takes a change at its next restart.

characters

Suspend unused SOLUS accounts after

Starts at 0, which suspends none. An account not used on any device for this many days is suspended, as Suspend does; Reactivate brings it back. 45 or fewer meets the ISM. Messaging server administrators are left alone.

days

First passwords

Typed by you keeps you typing a new account's first password. Made by the console chooses a random one, shown to you once, for new SOLUS and console accounts, as a reset does.

Administrator passwords

Chosen, the starting value: each administrator types their own new password. Generated: the console makes every new administrator password, on Change your password, after a reset and on the sign in screen's reset, and shows it once to its owner.

Authenticator setup

After their password shows a person with no authenticator their setup key once their password is right. Only with a setup code also asks for a one time code another administrator gives them, from the list below.

Who can use the key store backup

Any System Administrator, as before, or only those named backup administrators in the list below. Another administrator names them.

Sign in only from

Addresses or ranges, one per line, such as 203.0.113.0/24. Empty, the starting value, lets a sign in come from anywhere. Make sure your own address is in it before you save.

Sign in only between

Two times such as 07:00-19:00, in the time zone below. Empty, the starting value, lets a sign in happen at any time.

Input checks

Lenient, the starting value, as before: a field a request should not carry is ignored. Strict refuses it, and refuses a request not sent as JSON where JSON is expected.

Content security policy

Current, the starting value, as before. Strict lets this page load and send only what it uses, and nothing from anywhere else. It takes effect within 15 seconds.

Session cookie

Opaque, the starting value, as before: a random id. Signed adds a signature under the console's own key and refuses any cookie without a good one. Everyone signs in again once after you choose Signed.

Messaging server logins

Shared, the starting value, as before: the console makes every change on the messaging server with one login. Own gives each administrator a messaging server login of their own, made when they sign in and ended when they sign out, so the server's records show who made each change. Nothing is kept. It takes effect straight away.

Service secrets from

The settings file, the starting value, as before. The vault has the console, the relay and the messaging server read their secrets from the vault each time they start, and wait while it is sealed. Set up the vault first (docs/vault/README.md). It takes effect when each one next starts. This console's started from: the settings file.

Error detail

Full, the starting value, as before. Plain answers every server error, and any error that names the database, with one plain sentence; the console's log keeps the details.

Sign in banner

Empty, the starting value, keeps "Authorised personnel only. All access is logged." Text here is shown in its place on the sign in screen, up to 2000 characters.

Email marking

None, the starting value, marks nothing. Otherwise every email this console sends carries the marking at the end of its subject and in its X-Protective-Marking header.

security.txt

Security contact

Empty, the starting value, publishes no security.txt. A mailto: or https address publishes /.well-known/security.txt on this console and on the messaging address, so people can report a weakness.

Disclosure policy

Optional. An https address.

Valid for

Starts at 365 days, the most the standard allows.

days

Malware scanner for uploads

Empty, the starting value, scans nothing. host:port of a ClamAV daemon, such as clamav:3310, scans every app release and backup uploaded here before it is used. A find, or a scanner that cannot be reached, refuses the upload.

Time zone for those hours

Starts as Australia/Sydney.

✓ Saved

Central log server

Off, the starting value, sends nothing. On, every service's log, this server's sign in and audit logs and the console's audit records go to your log server as they happen, as JSON with UTC times to the millisecond. The connection is TLS 1.3 with AES-256-GCM only, P-384 key exchange and certificates both ways, and your CA's revocation list is checked. If your server cannot be reached, records wait on this server's disk and are sent once it can. Sending starts when you turn it on; earlier lines stay in each service's own log here. Every service's own logs stay here too, so Logs keeps working.

Log server

A host name or IPv4 address, such as logs.example.gov.au. Its certificate must name it.

Port

6514 is syslog over TLS.

Key exchange

P-384, the starting value. The other also offers the post-quantum ML-KEM-1024 hybrid first, and uses P-384 with a server that does not have it.

CA certificate

PEM. The CA that signs your log server's certificate.

This server's certificate

PEM, P-384 or RSA 3072 bits or more, its own certificate first. Your log server checks it.

Its private key

PEM, unencrypted. Kept only on this server, never shown again. Leave empty to keep the one already held.

Revocation list

PEM. Your CA's CRL. Paste the new one before it runs out: with an old list, sending stops until it is replaced.

✓ Saved

Dashboard

Live Activity

Security Status

TLS Certificates

Who is told

Apple App Store Connect API

Backups

Services

Infrastructure

Users

Conversations

Call Log

Broadcast Message

Broadcast History

App Releases

Upload New Release

Release History

Audit Log

Device Keys

Vault

Is the vault open or locked?

Open the vault

Test the secrets

Backup copy

Activity log

System Logs

Federation

Preview

Approved SOLUS deployments

Add a SOLUS deployment

Change your password

Settings

Admin Console

Dashboard

Live Activity

Security Status

TLS Certificates

Who is told

Apple App Store Connect API

Backups

Services

Infrastructure

Users

Conversations

Call Log

Broadcast Message

Broadcast History

App Releases

Upload New Release

Release History

Audit Log

Device Keys

Vault

Is the vault open or locked?

Open the vault

Test the secrets

Backup copy

Activity log

System Logs

Federation

Preview

Approved SOLUS deployments

Add a SOLUS deployment

Change your password

Settings