Keep the admin panel private

By default the admin panel is served at /admin on the same address as the app. That's convenient and the panel is well protected, but if you don't need it on the internet, take it off. Pick one:

FRAME_ADMIN_LISTEN and FRAME_ADMIN=local can be combined for belt and braces. Restart after changing frame.conf (sudo systemctl restart frame, or docker compose up -d).

A local address and an SSH tunnel

Serve the panel only on the server's loopback address:

FRAME_ADMIN_LISTEN=127.0.0.1:8081

From your laptop, open a tunnel to it:

ssh -N -L 8081:127.0.0.1:8081 you@your-server

Then open http://localhost:8081/admin/. Nothing about the panel is exposed to the internet, and because browsers treat localhost as a secure context, this works without HTTPS. The first-run setup link also uses this address while FRAME_ADMIN_LISTEN is set.

With Docker, publish the admin port on the host's loopback only: add "127.0.0.1:8081:8081" to the ports: of the frame service, and set FRAME_ADMIN_LISTEN=:8081 in frame.conf. The SSH tunnel is the same.

Only from this machine

FRAME_ADMIN=local keeps /admin on the main address but answers only clients on loopback or in the FRAME_TRUSTED_PROXIES networks. Behind a reverse proxy, the real client IP counts, not the proxy's.

Turn it off

FRAME_ADMIN=off removes the web panel and the admin API. Manage the server with sudo frame-admin (or docker compose exec frame frame-server admin …). The server logs a warning if FRAME_ADMIN_APP=on is also set, because off wins.

Keep Server admin in the apps

By default (FRAME_ADMIN_APP=auto), making the panel private also removes the Server admin menu from the apps, so the apps don't open a new way in. To keep it in the apps while the web panel stays private:

FRAME_ADMIN_LISTEN=127.0.0.1:8081FRAME_ADMIN_APP=on

The apps reach the admin API through the normal app API on the main address, with a step-up unlock (your password and two-factor code) bound to the app session. Two-factor setup, password changes and backups stay in the web panel. More in Server admin in the apps.