Dashboard Tour¶
A visual reference for every screen in the tunlx dashboard. If you are looking for "what does that dialog do?", it is on this page.
All screenshots are from a live instance running two standard proxies, one composite catalog and one Xtream service. Addresses shown are RFC 5737 documentation values.
Signing in¶
Session cookies are signed with sessionSecret. The login endpoint is rate
limited hard on purpose — roughly one attempt every two seconds — so
brute-forcing the dashboard is not practical. Repeated failures simply queue.
The overview¶
Two bands of cards sit above the proxy list:
- Counts — active, inactive and total proxies, plus aggregate bandwidth. A proxy is marked inactive when it has moved no data recently; that is normal for an idle lineup and is not an error.
- Host health — CPU, memory and outbound bandwidth for the machine tunlx is running on, each with a trend chip.
Below that, the proxy list has filter tabs (All / Active / Inactive / MediaFlow) and a search box bound to the / key.
Simple and Advanced modes¶
Simple mode drops the composite cards, Xtream service editing, the config editor, import/export and the MediaFlow filter, while keeping Standard proxies, Xtream service cards, and the Regional IPTV Wizard. It is the right default for a host that runs a couple of standard proxies. Everything hidden is still configured and still running — only the controls are hidden. See Dashboard Modes.
Dark mode¶
The theme toggle lives in the navbar and persists per browser.
Expanded proxy cards¶
Cards expand independently. Each type exposes a different action set — a composite proxy has Categories but no upstream account, an Xtream service has Categories and Users but no target server.
Host, target, egress route, EPG state, per-proxy logging, the collapsible upstream account and connection panels, and live bandwidth and RPS.
Category and channel counts, active viewers, a content-type summary, and the Categories and Users managers in place of an upstream account.
Creating and editing proxies¶
Choosing a blueprint¶
Add Proxy always starts here. See Step 3 of Getting Started for how to choose.
Standard proxy¶
Target server, bind host and port, upstream Xtream credentials, egress route, MediaFlow, EPG schedule and the anti-block options. The Auto-fill button parses a pasted M3U URL and fills the fields it can infer.
Composite proxy¶
A composite proxy has no target of its own — it borrows categories from proxies
you already have, behind one set of client credentials. categoryPrefix labels
merged categories so viewers can tell sources apart.
Xtream service¶
Identity, bind port, and delivery options — including Remux HLS streams to
MPEG-TS, which uses ffmpeg to copy (not re-encode) .m3u8 sources into
transport-stream segments for legacy devices.
Managing content¶
Categories¶
Categories are split by content type — Live, Movies, Series — each with its own count. The overflow menu on each tab offers Import M3U, Import from iptv-org and a bulk delete.
Category and channel IDs must be numeric
The Xtream Codes API represents category_id and stream_id as numbers.
tunlx assigns numeric IDs automatically when you create things through the
dashboard, but if you hand-edit config.json and give a group an ID like
grp-news, that group is silently skipped from the API — clients see an
empty category list while the dashboard still shows it. A warning is logged.
Stick to numeric IDs when editing JSON directly.
Channels¶
Per-channel: enable toggle, edit, delete, and a drag handle that sets the order players see. The All / Enabled / Disabled filter carries live counts. Reordering is disabled while a filter is active, since a partial list cannot express a full ordering.
Viewers¶
Each viewer of an Xtream service gets their own login, expiry date and connection limit. Passwords are bcrypt-hashed. Deactivating a viewer keeps the record but refuses their logins.
Composite category selection¶
Pick which categories from which source proxies make up the merged catalog.
Importing channels¶
From iptv-org¶
Search the public iptv-org catalog by name, country and category, then import a selection straight into one of your categories. The catalog is cached in memory with a visible refresh timestamp.
From an M3U playlist¶
Paste a URL or upload a file. tunlx parses #EXTINF metadata — channel name,
logo, tvg-id and group — and maps it onto its own channel model.
Networking¶
Inbound and outbound¶
Sets both directions globally, with the current WireGuard and Tailscale status
shown inline. Per-proxy route overrides the outbound choice.
WireGuard¶
Two modes. Manual takes a WireGuard config you paste or point at on disk. Provider mode drives Mullvad directly: tunlx fetches the server list, keeps it refreshed on a schedule, and can filter by country, city or hostname. See WireGuard / VPN.
Tailscale¶
tunlx embeds a tsnet node, so it joins your tailnet as its own device without
needing Tailscale installed on the host. It can also select an exit node for
outbound traffic. See Tailscale Access.
Operations¶
Stream health tests¶
Probes channels asynchronously across HLS, MPEG-TS, MP4 and Matroska.
These are shallow probes
A test fetches metadata from the head of the stream (up to 512 KB). It proves the upstream answers and looks like the media it claims to be. It does not walk every segment, so a pass is not a guarantee that the whole stream is intact. See Stream Health Tests.
Activity and telemetry¶
Request-by-request activity per proxy and per viewer, filterable and
exportable to CSV. Which actions get recorded is governed by
userActivityPolicies, so you can log stream starts without logging every
guide poll. See Activity & Telemetry.
The OpenAPI explorer¶
Every proxy publishes a Swagger UI describing its own Xtream endpoints, with that proxy's real base URL already filled in — useful for checking exactly what a client will receive. See the Xtream API reference.
Configuration¶
The config editor¶
Advanced mode only. Edits config.json in place, with Validate JSON to
check before saving.
Viewing the effective config¶
A read-only view of the running configuration, handy for support and for copying a proxy definition between hosts.
Secrets are encrypted at rest
sessionSecret and other sensitive fields are AES-256 encrypted in
config.json with the enc:v1: prefix, using a key auto-generated at
config.key in the same directory as the config file. Back up
config.key alongside config.json and never commit either — a config
without its key cannot be decrypted.
Wizards¶
The setup wizard is reachable any time from the navbar, not just on first run. It links out to the WireGuard, Tailscale and routing dialogs, and can hand off to the friendly service builder.
The TV-helper flow builds a working Xtream service from the iptv-org catalog — pick a country and some categories and it creates the categories, channels and a demo viewer for you. Full walkthrough in Setup Wizards.
The web player¶
Browse by content type and category, then play in the browser. It is the fastest way to answer "is this a tunlx problem or a client problem?" — if a stream plays here, tunlx is serving it correctly.
Xtream services prompt for one of their viewer logins first; standard and composite proxies open straight into the browser. The full walkthrough — entry points, playback controls, EPG timeline, mobile layout — is in Web Player.