Run the dashboard

Blitz Relay Dashboard is a browser-based interface for monitoring and managing relays. It serves static files and sends administration requests directly from your browser to the selected relay. It does not proxy requests through a dashboard backend.

Before you start, you need the following:

• A running relay with its HTTP API enabled and reachable from your browser. Use relay 1.4.0 or later for all dashboard features.
• The relay’s BLITZ_RELAY_HTTP_ADMIN_TOKEN value. A room host token or UDP connection key is not a substitute.
• Docker to run the provided image or a web server to host the static build.
• A browser that supports Web Crypto and allows site storage.

Start the dashboard

The image is abdelfattahradwan/blitz-relay-dashboard on Docker Hub. To serve the dashboard on port 8080, start a container:

docker run -d --name blitz-relay-dashboard -p 8080:8080 --read-only --cap-drop ALL --security-opt no-new-privileges:true abdelfattahradwan/blitz-relay-dashboard

On the same computer, open the dashboard at localhost:8080. The container serves HTTP and runs as an unprivileged user. It does not start a relay or need your relay’s admin token as an environment variable.

For remote access, put the dashboard behind an HTTPS reverse proxy. Its encrypted connection storage uses Web Crypto, which requires a secure context. HTTP on localhost works for local use; plain HTTP on a remote hostname or LAN address does not provide the required context.

The GitHub repository includes a Docker Compose file and instructions for building from source.

Prepare the relay

Start the relay without --disable-http and set its admin token in the relay process’s environment. The HTTP API listens on port 7771 by default. Keep the UDP port, normally 7770, for game traffic.

Every browser using the dashboard must be able to reach the relay’s HTTP API. Container hostnames and private addresses that work only from the dashboard server are not sufficient. In a relay URL, localhost refers to the computer running the browser.

For a remote HTTPS dashboard, expose the relay API over HTTPS too. The relay itself serves plain HTTP, so use a TLS-terminating reverse proxy. Browsers block mixed-content requests from an HTTPS page to a remote HTTP API.

If you restrict cross-origin resource sharing (CORS), allow the dashboard’s origin, methods, and headers. For example, save this configuration as cors.json on the relay machine:

{
  "allowedOrigins": ["https://dashboard.example.com"],
  "allowedMethods": ["GET", "POST", "PATCH", "DELETE"],
  "allowedHeaders": ["Authorization", "Content-Type"],
  "allowCredentials": false
}

Replace the example origin with the dashboard’s scheme, hostname, and port. Do not include a page path. Start the relay with the configuration file:

./BlitzRelay --cors cors.json

Without a custom CORS file, the relay allows any origin, method, and request header. CORS does not replace bearer-token authentication. For the complete policy rules, see CORS configuration.

Add a connection

1. Open the dashboard. If no connections are saved, it opens Add a connection. To add another relay, click Connections, then click Add connection.

2. In the Name box, enter a name for the relay, such as Production.

3. In the Relay URL box, enter the HTTP API’s base URL, such as https://relay.example.com. For local testing with the default relay port, use http://localhost:7771. Do not append /health or /rooms.

4. In the Admin token box, enter the relay’s BLITZ_RELAY_HTTP_ADMIN_TOKEN value without changing its case.

5. Click Add connection. The dashboard checks /health, saves the connection in this browser, and makes it the active relay.

6. On the Home page, check that room statistics load without an authentication error. A Healthy status alone does not validate the admin token: /health does not require authentication.

Protect the operator's browser

Saved connections include the admin token, which authorises every protected relay endpoint. The dashboard encrypts these values in browser storage, but anyone who can use that browser profile can still use the saved connections. Do not treat encryption as a dashboard login or an access-control boundary.

To change relays, click Switch connection, then click a saved connection’s name. On a narrow screen, click Open menu, then click a connection’s name. To edit or delete saved entries, click Connections.

Continue with Manage rooms in the dashboard. For storage details and connection errors, see the dashboard reference.