Administration

For whoever runs unv-server or looks after a team's vault. Each topic links to the page that has the detail.

Running the server

unv-server --port 8743, with --tls for a self-signed certificate (valid three years, fingerprint printed at startup) or --tls --cert fullchain.pem --key privkey.pem for your own. Clients pin the certificate fingerprint and never silently re-pin a changed one.
In Docker the server unlocks itself from UNV_PASSWORD. Watch /api/health: it reports liveness and lock state without leaking counts.
Memory: two worker threads by default (UNV_WORKER_THREADS); the container sets a 256 MB limit, enough for two concurrent Argon2id unlocks.

The owner holds the master password. Other users get their own login, optionally a second factor, and permissions written as expressions over projects, categories and entries.
A user can be limited to read, write or neither per scope, and strict-write mode refuses writes outside the grant. Details: security model.

unv backup export writes an encrypted .vaultbak under a separate backup password; unv backup archive copies the vault byte for byte including the salt. Restore into an empty vault to test it.
Recovery packages and the recovery key are the only way back from a lost master password. Set them up first.

unv doctor checks permissions, network filesystems and the hash-chained audit log. unv audit reads the log; entry and config history keep previous values.

Nodes deliver secrets to managed hosts with approvals signed on the owner's device.
unv update check finds a newer release; update the container with docker compose pull unv-server && docker compose up -d unv-server.