The control panel¶

The web control panel is the machine's local user interface, served by the machine-services daemon forgectrl over HTTPS. This page describes its address, the login, its tabs, and the HTTP routes an operator uses.

The address¶

Open https://<ip>/. The serial console prints the addresses at its login banner, and your router lists the machine by the name it sends with its DHCP request: forgefirm-<xxxx>, where xxxx is the last four hex digits of its WiFi MAC address.

A network that publishes DHCP names in its own DNS also answers https://forgefirm-<xxxx>/. Use the bare name. The panel refuses a name that carries your network's domain, because a name with a domain on it can be registered by anyone, and refusing it is what stops a DNS-rebinding attack (Access).

The panel is served over HTTPS with a certificate the machine makes at its first start. The browser warns once; accept the warning. The certificate's SHA-256 fingerprint is on the System tab's Setup card. Compare it with what the browser shows. To check it before you accept the warning, open http://<ip>/cert (plain HTTP, no login, no redirect): the page shows the fingerprint, the names on the certificate, and its validity, and offers the certificate itself at http://<ip>/cert.pem for a browser or a device that should trust it. The certificate lives under the machine's data directory and survives updates.

Plain HTTP on port 80 serves only the read-only routes, for a Grbl sender's camera view and other readers (Access).

Login¶

The first run of the panel creates one account, a name and a password (Setup). After that the panel asks for a login. The session is a cookie, sent over HTTPS only, and it expires after 12 hours idle. Five wrong attempts from one address lock the login for 30 s. The Sign out button in the header ends the session. The same name and password open SSH (System).

Forgot the password? Hold the machine's button while you turn the machine on, for ten seconds, until the button blinks amber. The setup then asks for a new account (Setup).

The page¶

The panel is a self-contained single page (no external assets) on Bootstrap, carrying the OpenGlow visual identity in a light and a dark theme (the header toggle: light, dark, or the system preference). Every settings field on every tab shares one save bar: it appears while anything is unsaved, posts every change in one request, and leaving a tab or the page with unsaved changes asks first. Each card and field has a "?" that opens its help, with a link into this documentation site.

All settings controls disable, with a banner, while the machine is not idle or while a diagnostic, a setup wizard, the dose-curve recorder, an update job, or an extension package has the machine; the banner names it. While an extension package keeps the Grbl sender out, a banner on every tab names it, with Let the sender back in to end that at once. If the package stops while it keeps the sender out, a notice names it until you dismiss it: the head may not be where a job expects it, so check before you start one (A package keeps the Grbl sender out). The header identifies the machine by its factory identity (the factory hostname derived from the serial in the fuses), whatever cloud identity override is set.

Once the guided run of the setup has ended, a Setup not finished banner above every tab names each step the setup still recommends, with a link to continue the setup (What the setup recommends). You can dismiss it. This browser keeps the dismissal for the recommendations the banner showed, each one a step and its reason. The banner comes back when a step is recommended anew, or for a new reason, for example after a part change.

Units are a display-only preference (ui_units): the machine stores and exchanges metric values, and the panel converts at its edge.

The tabs¶

Status¶

The live controller-mode selector (it switches through the supervisor, and the setting persists for boot; see Modes), live operational status (motion state and position, coolant temperatures and fan tachometers, safety-switch states, system summary), plus a scaled lid-camera snapshot that switches to the live stream on demand (Cameras).

Position always shows. It is painted red while the machine is unreferenced and shown normally once a homing cycle anchors it (Homing). The laser latch row is labeled commanded, with the sensed emission row beside it: the latch is the commanded state of the kernel lock, and the emission line shows whether the laser output was on in the last second. The switch card shows the safety-chain readbacks; HV enable is the readback of the chain's HV_ENABLE output, on only while a run feeds the charge-pump watchdog with the lid closed (The safing chain).

The Jog card. While the GRBL controller runs, the Status tab carries a Jog card: four arrows, Z up and down for the lens, a square that stops a jog in progress, a step size, a speed, and the position, which reads out live while a jog runs. Each press moves the head one step. The steps are round numbers in the unit on display (0.1, 1, 10, 50 mm, or 0.005, 0.05, 0.5, 2 in), and the speeds are 600, 3000, and 6000 mm/min. The arrows are as you stand at the front of the machine: up is toward the back (Y-), down is toward the front (Y+). The long steps are not offered to the lens, whose whole travel is a few millimeters. The page does not lock, and shows no busy banner, for a jog of its own.

The jog goes through the controller beside your Grbl sender, so the sender stays connected and goes first: a line from it stops a jog in progress, and right after one a jog is refused. Its status polling does neither. A jog never fires the laser, whatever the sender last commanded. The controller refuses a jog during a program, in an alarm, while the motors are released, and past the soft limits once the machine is homed; the panel shows the reason beside the pad for a few seconds. While the X and Y motors are released the Motion card says so in red (Homing).

The Status tab shows a standing banner while any cooling gate is turned off (Cooling and fans), and a compatibility warning when the Glowforge service has moved past the firmware version cloud mode is tested against (Cloud mode). While the setup's gate holds the controllers (a required step of the setup is not done), the tab shows a banner that says which, with a link to the setup (Setup). While the motion check waits for the lid or the interlock to close, the tab shows a banner that says so, and the button blinks amber (Modes).

Machine¶

Shared settings: display units, the homing method and the post-homing position calibration, the X and Y motor release with the manual home beside it (Homing; both shown while the GRBL controller runs), the lens, the crumb tray, the stepper drive (the X and Y microstep mode, Settings), and the cooling tunables. The cooling cards are the coolant loop, flow verification, and the airflow gates (Cooling and fans).

The crumb tray. While the GRBL controller runs, the Lens card says whether the tray is in or out, with a button that switches it. Take the tray out for taller work: Z is then the height above the floor of the machine instead of above the tray. Switching moves nothing. Floor below the tray is how far that is (1.35 in by default); change it with the tray in. The setup's laser burns need the tray in. The Status tab shows the mode beside the lens reach.

GF Cloud¶

The tab exists only while cloud mode is turned on (cloud_enabled, Setup). Glowforge web-service overrides: machine identity (serial and password; blank means the factory fuse identity), the homing-session timeout, the print-pause counts, and the job-size guards (Cloud mode).

GRBL¶

Controller connection information and the GRBL-mode tunables the controller reads from the shared settings: the laser arm window (button wait, disarm grace), the laser dose and the dose-curve recorder, the lid and interlock policy, the motor-rail settle time, and the lid lamp (GRBL mode, Settings).

Extensions¶

The tab exists only while extensions are on (Extension packages). It holds a card for each package that is turned on and has a page of its own. The card's heading is the panel's: the package's name, its trust tier, and its id. The page follows the panel's light or dark theme. The pages run only while the tab is open, except one you let keep running (A package's own page).

Setup¶

Every step of the setup, with the version it completed at, what the machine recommends and why (not run yet, this release asks for it again, or the reason the machine gives), and a link to run each step but the advisories and the account (What the setup recommends). The What changed? menu names a replaced part or a service, and the steps that depend on it are recommended again (What changed). Below them, the cooling tools that take the hardware over (the active controller is suspended through the supervisor for the duration): verification and calibration (Diagnostics).

Logs¶

Per-logger disk and remote log levels (applied at the next reboot), the remote syslog target, a live log viewer, and the log export (sanitized by default) for issue reports (Logging).

System¶

Firmware slots (A/B boot selection), ForgeFIRM updates, image install and restore, the WiFi regulatory region (power save is kept off), and reboot. A newer ForgeFIRM release shows an alert above every tab, with the release dialog behind it. Updating, Back to the factory firmware, and Recovery describe the update and restore tools.

Four more cards. Remote access turns SSH on until the next reboot: SSH is off at every boot, and a development image keeps it on. It opens with the panel account's name and password; root has no password and works at the serial console only. The machine's SSH host keys are made at the first start and kept on /data, so its fingerprint stays the same across updates. Extensions and API tokens are described below (Extensions, Extension packages, API tokens). Setup shows the state of the setup (in progress, set aside with steps still recommended, or complete) and the certificate fingerprint, with a link to run a step again, the printable summary of the record, and the record itself as a download (Setup).

Extensions¶

An extension is a part of the machine you turn on. It has settings of its own, a place in the panel, and things it provides, such as a way to home or a controller mode. The card lists the ones that are part of the image, with whether each is on and which of the things it provides is selected.

Glowforge cloud mode is one. It is turned on and off in the cloud step of the setup (Setup), with the step's typed acknowledgment. While it is off, its tab is not shown and nothing it provides can be selected. Turning it off takes the homing method and the controller mode back to the machine's own.

Extension packages¶

The card below it is for packages, which are not part of the image: whether extensions are on at all, what is installed, and the upload that installs one. Each package shows who signed it, what it says it does, what it may do (and which of that you granted), and how it is doing right now: running, frozen while a job is armed, turned off, or set aside after it kept ending. The buttons turn one package off or on and remove it, and where a package has a hold, a menu says whether that hold is dropped or stands when the package cannot speak for itself. A package with a page of its own links to it on the Extensions tab.

Turning extensions on shows you the Extensions advisory and takes the typed phrase. Installing takes the consent of the package's tier: the login for an official package, the typed phrase for a community one, and the machine's button held for an unverified one. Extensions is the page for all of it.

Keys you trust¶

Below it, the keys this machine trusts besides OpenGlow's own. A package signed with one of them reads as Community instead of Unverified. Adding a key takes the machine's button held, because what you add is what the machine will trust from then on (Extensions).

API tokens¶

A token is a password for one program that is not a browser, such as a script that tells you when a job ends. It reaches only what you tick when you make it (read the status, follow the events, see a camera, jog the head with the laser off, run jobs) and never the settings, the controller mode, an update, or another token. A job it runs still waits for the button on the machine, like any job.

Name the token after what will use it, tick what it needs, and press Create token. The token is shown once: copy it into the program then. The machine keeps only a fingerprint of it and cannot show it again. Revoke stops a token at once. Give each program its own, so one can be revoked without the others; the list shows when each was last used. A machine holds sixteen.

The program sends the token over HTTPS. A token sent over plain HTTP is refused, and should be revoked: it has crossed the network in the clear. A camera viewer that cannot send a header takes a token in its URL instead, and that token must hold cameras and nothing else: make it one of its own. The remote API is the page for whoever writes the program.

The WiFi region (wifi_country) sets the radio's allowed channels and transmit power. Automatic follows the country the access point advertises, else the world rules; a selected country pins it. The setting applies immediately and at every boot.

Every machine tunable, shared, cloud-override, and GRBL-mode, has a home in one of these tabs, with three exceptions: cool_laser_heat_cw and cool_laser_heat_density are bench-measured coefficients set by hand in the settings file, and cool_aa_offset_counts is written by the air-assist offset diagnostic's Apply button.

The routes an operator uses¶

POST /cool/state is the active controller's job-state report to the cooling engine, not an operator route; it answers the running controller and nothing else (The cooling engine).

Position in /status comes from the kernel step counters anchored at the last completed homing. The Grbl TCP socket is never queried, because a connection there would displace the sender's session.

Other route families have their own pages: the camera routes (Cameras), the log routes (Logging), the diagnostics routes (Diagnostics), and the update and slot routes (Updating).

Access¶

The panel has two listeners. HTTPS on port 443 serves everything. HTTP on port 80 serves only the read-only routes to your network. Those are GET /status, the camera routes, /settings, /grbl/settings, /mode, /cool/status, /diag/status, /curve/status, /curve/ladder.gcode, /slots, /update/status, /wiz, /wiz/advisories/press, and /advisories/<id>. A request over HTTP that changes state is answered only from the machine itself; every other client is redirected to HTTPS.

Every route that changes machine state needs a login session, and a browser request must not be cross-site. That is what stops a hostile page in another tab from reaching your machine. The panel also answers only to its own addresses and to its own bare name (forgefirm-<xxxx>), never to a name with a domain on it: a hostile page that points its own domain at your machine gets nothing back. The read-only routes answer any client on your network by default, so a Grbl sender or a stream viewer can read the camera without a login. The setting panel_open_reads=0 closes them to logged-in sessions and to the machine itself (Settings).

A script that runs on the machine can use the panel token instead of a session. It reads /data/forgefirm/panel.token and sends it in the X-ForgeFIRM-Token header. A script on the network needs a login session too, except on a development image.

Two things need the physical button held as well as the login: reading the fuse identity (GET /fuse-identity, which returns the serial, the derived hostname, and the password) and installing an unsigned firmware image.