Your Server,
Your People,
Your Rules.

Leyr Control is where you run your Leyr: who gets in, what they can ask for, the settings behind your library and the tools that fix it when something goes wrong. It comes with every Leyr, and every change made in it is recorded.

Take a look inside Install Leyr

Built into self-hosted Leyr. Open /control on your server from your home network.

A look inside

Everything behind the music, in one place

People, requests, health and the record of every change sit side by side, so running a server never means opening a shell.

Control · Evening Records Step-up active · 52 min left

People

Approval required
  • RRowanOwner · two-factor onControl
  • SSamListener · last seen todayApproved
  • AAlexSigned up 10 minutes agoApproveReject

Requests

Approve all from Sam
  • Low TideHarbour Lights · asked by SamMatched
  • Paper SatellitesNight Office · asked by AlexTwo editions

Pick the right edition when a release is ambiguous, or reject the request.

Health

Check all now
  • Library folderReadable · checked 2 minutes agoOK
  • MusicBrainzAnswering · checked 2 minutes agoOK
  • Bandcamp importSign-in expired · needs attentionCheck

Audit log

Chain verified
  • Rowan approved AlexFrom 192.168.1.24 · succeeded
  • Rowan stepped upPassword and authenticator code · succeeded
  • Rowan changed the allowed networksAdded 10.8.0.0/24 · succeeded
  • Two-factor reset for SamFrom the host, by system user leyr · succeeded

An illustration with example data. It is not connected to any server.

What it does

The jobs of running a music server

What used to need an admin account and a terminal now has a page of its own.

People and approvals

Approve new accounts, decide who is an admin and choose who gets Control.

Requests

See what people ask for, approve or reject it, and pick the right match when a release has more than one edition.

Settings and connectors

Server settings and the services your library talks to, managed from the same place.

Library repair

Rematch a release, reconcile imports and recheck what the catalogue is missing, without touching files by hand.

Health checks

See which connections are working, and run a check on demand when something looks wrong.

Recovery

Find requests that never arrived, see why, preview the fix and reconcile them back into the library.

Security

Powerful, and hard to misuse

Control can change everything on your server, so it is given carefully, asked for again and written down.

Given one at a timeBeing an admin is not enough. Only someone with Control can give it, and the last holder can't be removed, so your server is never left without one.
Two-factor, every timeControl asks for your password and an authenticator code, then lasts up to an hour, or until 15 minutes pass without a Control action.
Home network onlyBy default Control answers only from your home network and tailnet. You can change the list, and Leyr refuses one that would lock you out.
A log nobody can rewriteEvery action is recorded: who, when, from where and what happened. Entries are chained, so an edit to the database shows. Secrets are never stored.

Break-glass

Locked out? Fix it from the host

Lost an authenticator, or need to take Control away in a hurry? Anyone with a shell on the machine running Leyr can do it without the web app. These commands never answer over the network, and each one is recorded in the audit log with the name of the system user who ran it.

# Who has Control, and give it to someone
leyr-server control list
leyr-server control grant rowan

# Reset a lost authenticator
leyr-server control reset-2fa sam

# End every Control session now
leyr-server control end-elevations

# Check that nobody has altered the log
leyr-server control audit verify

Where it runs

Included with every Leyr

Control is part of Leyr itself. There is nothing extra to install or pay for.

Free

Self-hosted

Built into your Leyr

  • Open /control on your own Leyr address
  • Answers from your home network and tailnet
  • The first account on a new install gets Control
  • Break-glass commands on the host

IncludedDocker or Podman, a few minutes to set up

Install guide

Leyr Cloud

Hosted for you

  • Online Control for your own instance
  • The server behind it maintained by Leyr
  • The same people, settings and audit log

ComingCustomer Control is in development

Join the Cloud waitlist

Questions

Before you open Control

Is Control a separate app?

No. It is part of Leyr, at /control on your own server. Updating Leyr updates Control.

Who gets Control on a new server?

The first account. On an existing install, the earliest admin has it after the upgrade. From there, only someone with Control can give it to another person.

Can I use it away from home?

By default Control answers only from your home network and your tailnet. You can change the allowed networks in Control. Leyr refuses a list that would shut out the address you are using.

What if I lose my authenticator?

Someone with a shell on the server runs leyr-server control reset-2fa with your username, and you set it up again. The reset is recorded in the audit log.

Does the audit log keep passwords?

No. Passwords, tokens and keys are never stored. A short fingerprint shows that a secret changed without showing what it is.

Is the preview on this page live?

No. It is an illustration with example data, and the page never contacts a Leyr server.

Run your Leyr your way

Install Leyr on hardware you already have, and Control comes with it.

Install Leyr Try the demo