docs/Features/Admin-Panel/Admin-Panel.md
WeKan has an Admin Panel for managing the whole instance, reached from your member menu (top right corner) when you are an admin.
On the Source and Docker platforms the Admin Panel lets you:
Admin Panel → People has a Domains tab that lists the email domains in use across the instance together with the number of users on each domain.
The Organizations and Teams tabs under Admin Panel → People have per-organization / per-team toggle columns:
LDAP_SYNC_ORGANIZATIONS / LDAP_SYNC_TEAMS).When the global admin setting "Add board members only from the same Organization or
Team" (boardMembersFromSameOrgOrTeamOnly, default off) is enabled, a user can only
be added to a board if they share at least one Organization or Team with the inviter or
with an active board member. Site admins bypass the restriction. This is useful on
multi-tenant instances and is enforced server-side (both the invite action and the
user-search typeahead respect it).
The global Announcement banner can now be dismissed permanently per user — closing it stores the current announcement version on that user, so it does not reappear on reload or board switch. When an admin edits the announcement text, its version changes and the banner reappears for everyone.
A board setting "Restrict comment editing" (restrictCommentEditing, default off)
prevents board admins from editing or deleting other users' comments — only a comment's
author may edit or delete it. Enforced server-side. See
Comment replies and editing restriction.
Admin Panel → Features groups optional, instance-wide capabilities into categories in a side menu. Every toggle is a global setting, saved immediately when clicked, and defaults to off (current behaviour) unless noted.
all (every card is loaded into the browser, the default) or
lazy (each list loads only the currently visible cards plus a live count, for
very large boards). Also set by the CARDS_LOADING environment variable.Rich-text rendering hardening:
renderLinksAsPlainText) — all links (markdown
[label](url) and raw HTML <a href>) render as plain, non-clickable text in
every rich-text field (board and card titles, descriptions, comments, checklists,
…), so a link can never be clicked or hide a misleading target.alwaysShowCodeAsText) — rich text is
never rendered as markdown/HTML; the whole source is shown escaped, revealing HTML
comments (<!-- -->), the target of markdown links, JavaScript and any other code.
All code stays visible, not clickable, not running.Import / export privacy (all enforced server-side, so they cannot be bypassed from the client):
disableAllImport) / Disable all export
(disableAllExport) — master switches that turn off every import / export feature
(WeKan JSON, Trello, CSV/Excel, Jira, Kanboard, NextCloud Deck, OpenProject,
GitHub/GitLab/Gitea/Forgejo, board clone, single-attachment export). The matching
import / export menu options are also hidden in the UI.disableImportAvatars) — avatars are never imported,
from WeKan JSON import, Trello import, or external identity-provider sync on login
(LDAP, OIDC/OAuth2). Gated at the single localizeAvatarFromBuffer choke point.disableExportAvatars) — avatars are never included
when exporting (WeKan JSON and CSV export).anonymizeImportUsers) / Anonymize export users
(anonymizeExportUsers) — replace every user's username, full name and initials
with counter placeholders (user1, user2, …), drop their avatar, and rewrite
@username mentions plus the requested-by / assigned-by fields inside card and
comment content. The imported board / exported file then carries no real user
identity. The placeholder word "user" follows the language of the person
importing / exporting (e.g. käyttäjä1 in Finnish). Both export paths — the
in-memory build() and the streaming buildStream() — are covered.Privacy controls for deployments that must limit activity tracking, notifications or watching (e.g. to comply with local law or an organization's policy) (#5820), enforced server-side:
disableActivities) — activity-feed entries are
neither recorded nor shown anywhere (board sidebar and card activity tab). No
history of who did what is kept.disableNotifications) — WeKan never sends watch
notifications for any activity. Activities can still be recorded (unless also
disabled); only the notifications are suppressed.disableWatch) — the watch feature is turned off: users cannot
subscribe to boards, lists or cards, any watch-level change is rejected, and the
watch button is hidden.On Sandstorm, authentication (LDAP, passwordless email, SAML, GitHub and Google Auth) and SMTP are handled by Sandstorm. You add and remove users there, and WeKan, Rocket.Chat and other apps can be installed with one click.