vlozi/docs

Overview

Dashboard overview

Architecture, access, pages, and data scope of the Vlozi internal ops dashboard.

Staff only. This dashboard is gated by Cloudflare Access and only accessible to verified @vlozi.app staff emails. All access is logged.

The ops dashboard is a cross-tenant god-view at ops.vlozi.app — a Next.js frontend backed by a Hono Worker API. It surfaces platform health metrics, customer profiles, revenue, credit usage, and staff audit logs in a single interface.

Architecture

Staff browser
    │
    ▼
ops.vlozi.app  ← Cloudflare Access (Zero Trust gate)
    │
    ├─ /api/*  → logicspike-internal-api (Hono Worker)
    │                ├─ Reads: Core DB (read-replica, read-only)
    │                └─ Writes: Ops DB (audit log, notes, rollups)
    │
    └─ /*      → internal-dashboard (Next.js on Vercel)

Access

Two conditions must both pass:

  1. Cloudflare Access — login via Cloudflare One-time PIN or your Cloudflare account. The email must be a @vlozi.app address.
  2. STAFF_EMAILS allowlist — the verified email must be in the STAFF_EMAILS environment variable on the Worker.

Failing either gate returns a 403. There is no fallback, no override (except a dev-only bypass that still requires the allowlist).

Current staff list (env var, requires Worker redeploy to change):

founder@vlozi.app, hello@vlozi.app, starkdipanshu456@gmail.com

What you can see

Page URL What it shows
Overview / Platform KPIs: workspaces, MRR, trials, past-due, users, credits
Customers /customers All tenant workspaces with filters and search
Customer detail /customers/:tenantId Profile, plan, members, credit balance, spend, transactions, notes
Revenue /revenue MRR by plan, trials ending, past-due list, cancellations
Credits /credits Platform credit pool, spend by service, top consumers (7/30/90d)
Growth /growth User signups, workspace creation, waitlist, feedback inbox (7/30/90d)
Audit /audit Staff access log (who viewed which customer, when)

What data is excluded

The API explicitly excludes sensitive columns even though it reads the core DB:

  • No tenant database connection strings (tenants.databaseConfig)
  • No payment provider IDs (Razorpay/Stripe subscription or customer IDs)
  • No API keys or secrets of any kind

Units

All monetary values are in paise (Indian Rupees × 100). mrrPaise: 299900 = ₹2,999/month.

Credit values are in credit units (1 credit = ₹0.83 at current pricing).

Local development

  1. Start apps/internal-api on port 8797 (see its README)
  2. Create apps/internal-dashboard/.env.local: 
    INTERNAL_API_ORIGIN=http://127.0.0.1:8797
  3. Run pnpm --filter internal-dashboard dev
  4. Open http://localhost:3003

In dev, Cloudflare Access is bypassed by setting DEV_BYPASS_EMAIL in apps/internal-api/.dev.vars. The bypass email must still be in STAFF_EMAILS.

Internal Ops · OverviewEdit on GitHub