Docs/ORB Web Admin/Configuration

Configuration

All configuration lives in config.js (not escrowed).

Web Server

js
Config.WebPort  = 8080;       // HTTP port for the web panel
Config.Framework = 'auto';    // 'auto' | 'qbcore' | 'esx'

Accounts

The owner account is created with a one-time setup wizard on first launch — not in config.js. Leave Config.Users empty (the default) and the panel prompts you to choose your owner username and password the first time you open it. Passwords are stored hashed (scrypt), never in plain text.

js
Config.Users = []; // owner is created on first launch — leave empty

Additional staff are managed from the Accounts & Roles page in the panel. Existing installs that still have a plaintext password (in config.js or accounts.json) keep working and are upgraded to a hash automatically on the next successful login.

Advanced: you can still hardcode an account in `Config.Users`, but only with a **hashed** password — generate one with `node tools/hashpw.js "yourpassword"`. Never put a plaintext password here.

In-Game Menu

js
Config.InGame = {
    enabled: true,
    command: 'a',                 // opens the menu with /a
    keybind: '',                  // e.g. 'F3' — leave empty to disable the keybind
    keybindLabel: 'Open ORB Admin Menu',
};

Inventory Integration

js
Config.Inventory = {
    resource: 'ox_inventory',     // 'ox_inventory' | 'qb-inventory' | 'tgiann-inventory'
    imagesPath: 'web/images/',    // path to item images, relative to the inventory resource
};

Live Streaming

The live stream is a direct WebRTC connection between the player and the admin's browser. ICE servers are how the two ends find each other:

js
Config.Stream = {
    enabled: true,

    iceServers: [
        { urls: 'stun:stun.l.google.com:19302' },

        // Add a TURN server if admins on restrictive networks can't see streams:
        // {
        //     urls: ['turns:your-turn-host:443?transport=tcp', 'turn:your-turn-host:3478'],
        //     username: 'turnuser',
        //     credential: 'turnpassword',
        // },
    ],
};
  • STUN alone is enough for most home networks.
  • TURN is a relay for restrictive networks (corporate Wi-Fi, CGNAT, some VPNs). If an admin can't see any stream, add a TURN server — TURN over TCP/443 (turns:) gets through almost any firewall. The Live Streaming page has the full troubleshooting guide.

Actions

The actions available against a player (revive, heal, kick, ban, give item, set job, etc.) are defined in Config.Actions. Each action has a permission so you can gate it per role:

js
Config.Actions = [
    {
        name: 'revive',
        label: 'Revive',
        icon: 'heart-pulse',
        permission: 'action.revive',
        inputs: [],
    },
    // ... more actions
];

Optional Systems

js
Config.Systems = {
    reports: {
        enabled: false,           // in-game /report system
        command: 'report',
        cooldown: 60,             // seconds between reports
        maxOpen: 50,              // max open reports in the queue
    },
};

Security Recommendations

  • Passwords are stored hashed (scrypt) — a leaked accounts.json never exposes a usable password. There is no default credential: you create the owner account on first launch.
  • The login endpoint is rate-limited (5 attempts per 60 seconds per IP)
  • Sessions use HttpOnly cookies and expire after 24 hours
  • Consider placing the panel behind a reverse proxy with HTTPS if exposed publicly (forward WebSocket upgrades for /ws/stream so live streaming keeps working)