Add console app in docs

Author: akclace

docs/content/_index.md

@@ -28,7 +28,7 @@ cascade:
 
 <!-- prettier-ignore --> {{< hextra/feature-card title="Motivation" icon="flag" subtitle="<br>OpenRun is built with these goals:<br><br>➣ Declarative deployments made simple<br>➣ Start on single-node, scale to Kubernetes if needed<br>➣ Make auth and RBAC easy for internal tools<br>➣ Easy SAML support without paying the SSO tax<br>➣ Run thousands of apps - zero idle resource usage" class="openrun-feature-card openrun-feature-card-dark" >}}
 
-<!-- prettier-ignore --> {{< hextra/feature-card title="OpenRun Features" icon="light-bulb" subtitle="<br>Some of the unique features of OpenRun are:<br>➣ Create and manage apps declaratively<br>➣ Easily upgrade from single-node to K8S <br>➣ Domain based or path based routing, with auto-TLS<br>➣ OAuth/OpenID/SAML/Cert auth, with RBAC<br>➣ Scales idle apps down to zero<br>➣ Staged deployment, for code and config changes<br>➣ Atomic (all or nothing) updates across apps" class="openrun-feature-card openrun-feature-card-dark" >}}
+<!-- prettier-ignore --> {{< hextra/feature-card title="OpenRun Features" icon="light-bulb" subtitle="<br>Some of the unique features of OpenRun are:<br>➣ Create and manage apps declaratively<br>➣ Easily upgrade from single-node to K8S <br>➣ Domain based or path based routing, with auto-TLS<br>➣ OAuth/OpenID/SAML/Cert auth, with RBAC<br>➣ Scales idle apps down to zero<br>➣ Staged deployment, for code and config changes<br>➣ Atomic (all or nothing) updates across apps<br>➣ Auto SQLite data replication using Litestream" class="openrun-feature-card openrun-feature-card-dark" >}}
 
 {{< /hextra/feature-grid >}}
 

docs/content/console-tour.md

@@ -9,7 +9,10 @@ a secret, binding an app to it, deploying a containerized app from a git
 repo, and the operational pages. Then the RBAC flow: enabling role based
 access control from the console and working with team-scoped grants.
 The screenshots follow the site theme - toggle light/dark to see the
-console in the other theme.
+console in the other theme. A live [demo](https://utils.demo.clace.io/console/)
+of the console is available. See
+[console install]({{< ref "docs/installation/#install-the-console-app" >}})
+for installing the console on your own server.
 
 ## Overview
 

docs/content/docs/Installation.md

@@ -205,3 +205,35 @@ This will create an app at /disk_usage with the example disk_usage app. The disk
 To access the app, go to [https://localhost:25223/disk_usage](https://localhost:25223/disk_usage). Use `admin` as the username and use the password previously generated.
 
 The code for the disk usage app is in [GitHub](https://github.com/openrundev/openrun/tree/main/examples/disk_usage/app.star). app.star is the Starlark config and app.go.html is the html template. The other files are generated files and are created during app development.
+
+## Install the Console App
+
+The [management console]({{< ref "/console-tour" >}}) is a web UI for managing the OpenRun server: apps, syncs, service bindings, containers, audit logs, server configuration and the AI app builder. A live [demo](https://utils.demo.clace.io/console/) of the console is available. The console is itself an OpenRun app, installed from the [openrundev/console](https://github.com/openrundev/console) repo:
+
+```shell
+openrun app create --approve --auth system \
+    --param enable_all_features=true --param enable_updates=true \
+    github.com/openrundev/console /console
+```
+
+Open https://localhost:25223/console and log in as `admin`, using the password printed during the OpenRun installation.
+
+Since the console performs management operations, it should always run with an auth type that requires login. Using `system` auth is recommended: it needs no additional setup, the `admin` account with the password printed during installation is used to login. `system` is the server's default auth type, the `--auth system` option makes the choice explicit. OAuth/OIDC/SAML based [authentication]({{< ref "configuration/authentication" >}}) can also be used. Do not use `none` auth for the console: management operations are blocked for anonymous users.
+
+The console features are controlled through app params, set with `--param name=value` during create:
+
+| Param                 | Default | Description                                                                             |
+| --------------------- | ------- | --------------------------------------------------------------------------------------- |
+| `enable_updates`      | `false` | Enable write operations (create/update/delete). Without this, the console is read-only. |
+| `enable_container`    | `false` | Enable the containers area                                                              |
+| `enable_config`       | `false` | Enable the server configuration area                                                    |
+| `enable_builder`      | `false` | Enable the AI app builder area                                                          |
+| `enable_all_features` | `false` | Enable all the areas above; write operations still need `enable_updates`                |
+
+The default install (no params) is a read-only console covering apps, syncs, bindings, the overview and audit logs. A disabled area registers no routes and requests no plugin permissions.
+
+Params can be changed after install. Enabling a new area adds plugin permissions, which require re-approval; the change is staged and goes live on promotion:
+
+```shell
+openrun param update --promote enable_builder true /console
+```

docs/content/docs/QuickStart.md

@@ -77,7 +77,19 @@ openrun app create --approve github.com/openrundev/apps/utils/bookmarks /book
 
 Open https://localhost:25223 to see the app listing. The bookmark manager is available at https://localhost:25223/book.
 
-## Application Types
+### Install the Console App
+
+The [management console]({{< ref "/console-tour" >}}) is a web UI for managing the OpenRun server: apps, syncs, service bindings, containers, audit logs, server configuration and the AI app builder. A live [demo](https://utils.demo.clace.io/console/) of the console is available. The console is itself an OpenRun app; to install it, run
+
+```shell
+openrun app create --approve --auth system \
+    --param enable_all_features=true --param enable_updates=true \
+    github.com/openrundev/console /console
+```
+
+The console is available at https://localhost:25223/console. Log in as `admin`, using the password printed during the OpenRun installation. Using `system` auth (the server default) is recommended for the console; management operations are blocked for anonymous users, so do not use `none` auth. The `enable_*` params control which feature areas are enabled — the default install is a read-only console. See [console install]({{< ref "installation/#install-the-console-app" >}}) for the full param list.
+
+## App Types
 
 OpenRun allows easy management of multiple apps on one OpenRun server installation. There are three main types of OpenRun apps:
 
@@ -115,41 +127,6 @@ openrun app create --spec container --approve \
 
 See [containerized apps]({{< ref "container/overview/" >}}) for details.
 
-## Action Apps
-
-For use cases where an existing CLI application or API needs to be exposed as a web app, actions provide an easy solution. First, define the parameters to be exposed in the form UI. Create a `params.star` file with the params. For example,
-
-```python {filename="params.star"}
-param("repo", description="The GitHub repository to look up", default="openrundev/openrun")
-```
-
-The app defines a run handler which calls the GitHub API for the specified repository, using the [http plugin]({{< ref "docs/plugins/overview" >}}), and returns the stats as text.
-
-```python {filename="app.star"}
-load ("http.in", "http")
-
-def run(dry_run, args):
-   repo = http.get("https://api.github.com/repos/" + args.repo).value.json()
-   out = ["Stars: %d" % repo["stargazers_count"], "Forks: %d" % repo["forks_count"],
-          "Open Issues: %d" % repo["open_issues_count"]]
-   return ace.result("Repo info for " + args.repo, out)
-
-app = ace.app("Repo Info",
-   actions=[ace.action("Repo Info", "/", run, description="Show the GitHub stats for the specified repository")],
-   permissions=[
-     ace.permission("http.in", "get", ["regex:^https://api\\.github\\.com/.*"]),
-   ],
-)
-```
-
-The app, when accessed, shows a form for the params, with the action output displayed below it:
-
-<picture  class="responsive-picture" style="display: block; margin-left: auto; margin-right: auto;">
-  <source media="(prefers-color-scheme: dark)" srcset="/images/action_dark.png">
-  <source media="(prefers-color-scheme: light)" srcset="/images/action_light.png">
-  <img alt="Repo info action app" src="/images/action_light.png">
-</picture>
-
 ## Managing Applications
 
 Multiple applications can be installed on an OpenRun server. Each app has a unique path and can be managed separately. The app path is made up of domain_name:url_path. If no domain_name is specified during app creation, the app is created in the default domain. The default domain is looked up when no specific domain match is found. See [app routing]({{< ref "applications/routing/" >}}) for details about routing.