首页/ 文档/ 控制室（开关墙）

控制室（开关墙）

控制室把 NAS 上每天要按的高频操作收成一面开关：每个开关都是一个预先注册好的「动词」——立即备份、网络唤醒、重建索引、启停容器。可以先预演看影响再执行，结果用一句话说清做了什么。

6 个小节 · 约 4 分钟读完

它解决什么问题

这些动作原来散在不同页面：容器启停在 Docker 卡里、备份在设置里、唤醒在工具箱里、重建索引在文件搜索里。控制室把它们收成一屏，并且共用同一个后端执行入口——你在控制室点「立即备份」，和在设置里点备份走的是同一条链路，不存在第二套逻辑。

  • 一屏完成：不用在不同卡片和设置页之间来回找入口
  • 可预演：执行前先看会影响到什么，尤其适合容器操作
  • 结果是人话：回执形如「已停止容器 jellyfin」，不用自己解读返回值
  • 权限过滤：只列出你有权执行的开关，没权限的直接不出现
  • 全部计入操作日志，谁在什么时候按了哪一下都能查
控制室统一执行入口人点 / AI 触发POST /api/actions权限校验现有执行器审计日志
图：控制室与 MCP 都是同一入口的两种触发方式；执行器复用现有功能，不新造一套逻辑。

现有哪些开关

内置开关随程序发布（升级即更新），当前 8 个，按风险分三色：安全（不打扰任何服务）、有感（可逆但会短暂影响服务）、高危（不可逆或影响面大，本版本暂无内置项）。

开关风险要填什么它在做什么
停止容器 / 启动容器 / 重启容器有感容器名或 ID经 Docker Engine API 操作单个容器，只影响该容器自身
立即同步 Docker安全无扫描容器并把 Web 服务自动收进导航，黑名单里的容器跳过
立即备份配置有感无把当前导航与配置打包到 data/backups/，不动运行中的服务，只新增文件
发送测试通知安全SendKey（留空用已配置的）向 Server酱 微信通道推一条测试消息，占用一次推送配额
网络唤醒设备有感MAC 地址、广播地址（可留空）向局域网发送 WOL 魔术包；唤醒无法撤销，误唤醒请关掉目标设备
重建文件索引安全无后台立即重建本地文件搜索索引（SQLite FTS5），幂等操作

每个开关旁会显示它的风险色与最近一次触发时间；如果某项灰置不可点，旁边会写清原因（例如 Docker 未运行）。

控制室实拍截图
图：控制室实拍——8 个开关、风险色标注、参数输入、预演 / 执行双按钮与最近触发时间一目了然。右下角「重建文件索引」灰置并写明原因：本地文件搜索开关尚未启用。

预演与二次确认

开关上有两个按钮：「预演」和「执行」。预演不会真的动手，只告诉你影响范围——比如容器当前状态、这次操作会让它停多久；执行才会落地。

  • 安全级开关：点执行直接跑
  • 有感与高危级开关：先弹二次确认，确认框内自动带一次预演结果（爆炸半径），看完再决定
  • 执行失败只回一句人话原因，不会自动重试，避免反复冲击服务
  • 容器启停是同步阻塞调用（默认停机宽限期 10 秒，镜像可配更长），所以按钮会转一会儿才回——这是等引擎真做完，不是卡住
选开关填参数预演二次确认执行结果回执如容器名不动真格有感 / 高危才有失败不重试一句话说清
图：从选开关到拿回执的完整链路；安全级跳过中间两步直接执行。

在哪找到它

  • 控制台模板：左侧栏「控制室」视图
  • 桌面视图模板：程序栏 / 面板里的「控制室」窗口
  • 任何模板：设置弹窗内的「控制室」标签页
  • AI 助手：通过 MCP 协议触发同一批开关（见 MCP 接入）

三处入口看到的是同一份开关清单，权限口径也一致——不存在「这里能按、那里不能按」。

权限与审计

开关的权限沿用原有口径，没有另设一套：容器启停要求 Docker 操作权限，同步、备份、通知、唤醒、重建索引要求管理员。多用户（Pro）下，member 只会看到自己有权的开关。

  • 列表接口只返回你有权执行的项，无权限的开关不会以灰置形式泄露名称
  • 每一次触发都写操作日志，包含触发方式（人工 / MCP / 定时 / 事件）与参数（敏感字段脱敏后记录）
  • 执行入口有频率限制，防止脚本误刷
  • 访客与未登录状态完全看不到控制室

常见问题

  • 问：开关灰置点不动？答：旁边写了原因，最常见是 Docker 未运行，或对应功能尚未启用。
  • 问：容器名去哪抄？答：Docker 监控卡或容器列表里的名称 / ID 都可以，控制室只操作单个容器。
  • 问：预演会真的停我的服务吗？答：不会。预演只查询状态并回报影响范围。
  • 问：能把自定义动作也做成开关吗？答：当前内置开关随版本发布，自定义开关系列在规划中，暂未开放。
  • 问：AI 通过 MCP 按开关，比我自己按多了什么风险吗？答：链路完全相同，同样受权限与频率限制约束，并记入同一份操作日志（触发方式标为 MCP）。

What it solves

These actions used to live on different screens: container controls on the Docker card, backup in Settings, wake-on-LAN in the toolbox, reindexing in file search. The Control Room collects them on one page behind a single shared endpoint — pressing Back up now here runs exactly the same path as pressing it in Settings.

  • One screen instead of hunting for entries across cards and settings
  • Dry run first: see what will be affected before anything happens
  • Human verdicts: results read like "container jellyfin stopped"
  • Permission filtered: switches you may not run are not listed at all
  • Every trigger lands in the operation log
Control RoomShared endpointhuman or AIPOST /api/actionsPermission checkExisting executorsAudit log
Diagram: the Control Room and MCP are two triggers of one entry point; executors reuse the existing features.

Switches available today

Built-in switches ship with the binary and update with it. Eight are available now, colour-coded by risk: safe (nothing is disturbed), noticeable (reversible but briefly affects a service) and high-risk (irreversible or wide impact — none built in yet).

SwitchRiskInputWhat it does
Stop / Start / Restart containerNoticeableContainer name or IDDrives one container through the Docker Engine API; affects only that container
Sync Docker nowSafenoneScans containers and folds web services into navigation, skipping blacklisted ones
Back up nowNoticeablenonePacks current navigation and config into data/backups/ without touching running services
Send test notificationSafeSendKey (blank uses saved)Pushes one test message to the ServerChan WeChat channel, consuming one quota
Wake device (WOL)NoticeableMAC address, broadcast (optional)Sends a Wake-on-LAN magic packet; waking cannot be undone
Rebuild file indexSafenoneRebuilds the local file search index (SQLite FTS5) in the background; idempotent

Each switch shows its risk colour and the last time it fired; a greyed-out switch states why right next to it (for example Docker is not running).

Control room screenshot
The Control Room in the Console template: eight switches with risk colours, parameter fields, the dry-run / execute pair and last-fired timestamps. Bottom right, rebuild-index is disabled and says why — local file search has not been switched on.

Dry run and confirmation

Every switch has two buttons: Dry run and Run. A dry run changes nothing — it reports the blast radius, such as the current container state and how long a stop will take.

  • Safe switches run immediately
  • Noticeable and high-risk switches open a confirmation sheet that already contains a dry run result
  • Failures return one plain sentence and never retry automatically
  • Container stop and restart are synchronous calls (10 s grace period by default, images may set longer), so the button spins for a while — it is waiting for the engine, not stuck
Pick switchDry runConfirmRunVerdicte.g. container namechanges nothingonly if riskyno auto retryplain sentence
Diagram: the full path from picking a switch to reading the verdict; safe switches skip the middle steps.

Where to find it

  • Console template: the Control Room view in the side rail
  • Desktop template: the Control Room window on the Dock
  • Any template: the Control Room tab inside the Settings dialog
  • AI assistants: the same switches over MCP (see the MCP guide)

All three entries show the identical list under identical permissions — nothing is clickable in one place and blocked in another.

Permissions and audit

Switch permissions reuse the existing rules rather than inventing new ones: container control needs the Docker operate permission, while sync, backup, notify, wake and reindex need admin. Under multi-user Pro, members only see switches they may run.

  • The list endpoint returns only what you are allowed to run — forbidden switches are not even revealed as greyed rows
  • Every trigger is logged with its origin (human, MCP, timer or event) and sanitised parameters
  • The invoke endpoint is rate limited so a stray script cannot hammer it
  • Visitors and signed-out sessions cannot see the Control Room at all

Questions

  • Greyed switch? The reason is printed beside it — usually Docker is not running or the feature is not enabled yet.
  • Where do I get the container name? Any name or ID from the Docker card works; each switch touches one container.
  • Does a dry run stop anything? No. It only reads state and reports the impact.
  • Can I add my own switch? Custom switches are planned but not open yet; built-ins ship with releases.
  • Is an AI pressing a switch riskier? Same path, same permissions, same rate limits, and the audit log marks the origin as MCP.