Applications

Route: /application · Menu: Management › Applications · Page permission: application:R

An application in Merak is a published service. It carries two endpoints:

What you can do here

• As an administrator, I want to see every published service and its state, so that I can manage endpoints and availability.
• As an administrator, I want to register a new service, so that people can reach it through Merak.
• As an administrator, I want to grant access to members and organizations while creating it, so that setup is done in one pass.
• As an administrator, I want to activate, deactivate or delete an application, so that I can control availability.
• As an administrator, I want a visual topology of an application and its members, so that I can grasp the access relationships quickly.
• As an administrator, I want to publish a service to browsers with no Agent installed, so that contractors and unmanaged devices can be served.

1. The application list

1.1 Columns

Hidden columns can be turned on from the column settings gear in the action column header, which also lets you drag columns into a different order. The setting is stored per browser and survives sign-out.

1.2 Statuses

1.3 Filtering and sorting

Clicking a sortable header cycles: unsorted → ascending → descending → removed.

1.4 Paging

10 / 20 / 50 / 100 per page, default 20. The footer shows 共 {total} 筆, plus / 上限 {limit} when a service quota is in force.

1.5 Row shortcuts

Double-click a row to open its detail. Single-clicking a row body toggles selection only once you are already in selection mode (at least one checkbox ticked).

2. Row actions

Deactivate before you delete. Delete is offered only on an inactive application. If the delete is refused because linked resources still exist, you get an error message and no force-delete option — clear the links first. (Members are the only resource with a force path.)

3. Creating an application

Route: /application/create · Permission: application:C

A three-step wizard plus a result step.

3.1 Step 1 — Basic information

3.2 Step 2 — Service endpoint

Endpoint collision detection

Each endpoint is checked as a pair — address and port together. Changing either half re-runs the check for that pair, so a message never lingers from a stale value.

Why the two differ. A duplicate virtual domain is a genuine conflict: two applications intercepting the same name and port cannot be told apart at the member’s DNS stage. A duplicate service endpoint is legitimate topology: one backend commonly hosts many sites on the same IP:port, separated by HTTP Host header or TLS SNI. Merak models that correctly as “one application per site, each with its own virtual domain, all sharing one service endpoint”. Blocking it would mean such a backend could carry only one application.

If the collision check itself fails (for example the routing layer is temporarily unreachable), it is treated as “no collision” and does not block you; the backend validates again on submit.

3.3 Step 3 — Access

Both are optional — an application with no grants at all is a valid thing to create.

Each field needs permission on both sides

Granting access writes to the application and to the thing being granted, so each field requires both:

The two fields are judged independently — you may well be able to edit one and not the other. A field you cannot fully edit is shown read-only with an explanation, and submits as empty — it will never smuggle a pre-ticked seed value past your permissions. The application itself is still created; only that association is skipped.

This is deliberate: you should never make an authorization decision on somebody else’s resource without holding the permission to make it.

3.4 Step 4 — Result

The application record is created first; member and organization associations are then attached one by one on a best-effort basis. Only a failure to create the application itself turns the result page red — an individual association that fails does not abort the rest.

4. Copying an application

Entries: list row → /application/create/:id · detail toolbar → /application/:id/create · Permission: application:C

Why the ports behave differently. The virtual domain port is a pure uniqueness variable — +1 is still valid. The service port is where a real backend actually listens — +1 would plant a value pointing at nothing, which is worse than a duplicate. Copying the source port and leaving the choice to you is the honest option.

Why only directly assigned members are copied. Indirect access comes along automatically with the organizations you copy. Copying it twice would produce a member with a direct grant that survives them leaving the organization.

Being able to seed a field is not the same as being able to edit it — the read-only rules in §3.3 still apply, and a read-only field still submits empty.

5. Application detail

Route: /application/:id · Permission: application:R

5.1 What is shown

5.2 Toolbar

6. Editing an application

Editing is inline on the detail page — the pencil icon at the top right of the card switches to save/cancel icons. The whole edit affordance is hidden without application:U.

6.1 The one-time protocol-type backfill

Records that have neither an L4 nor an L7 protocol stored (legacy rows, or some imports) show a TCP / UDP radio group in edit mode so the value can be filled in once. Once filled, the control disappears and the type is fixed again. This is a one-way operation.

Saving with the endpoints unchanged never collides with the application itself — the check excludes the record being edited.

7. Managing who may reach an application

Use the Members and Organizations cards on the detail page.

7.1 Quick-select: copying another application’s member set

In edit mode the member picker offers three search modes, mirroring the member-side picker described in 02 · Members §8.1:

The same three safety rules apply: organization-inherited members are excluded in both directions, a confirmation dialog lists the exact names before anything changes, and applying only changes local ticks — you still have to confirm the picker and save. A Clear all button empties every togglable tick through the same dialog.

8. Agentless access (browser-based)

Flag-gated.

Agentless is not a separate resource — it is an advanced access mode of an application. Turning it on lets members open the service in a browser with no Agent installed.

8.1 Turning it on

1. Open the application’s detail page and enter edit mode.
2. Switch Agentless on and save.

Once provisioning finishes, the detail page shows:

8.2 The three gates on turning it on

Turning agentless on is blocked unless all three hold. Turning it off is always allowed, so you can always release quota or clear bindings.

While any of the three is still being checked, the switch stays closed — Merak fails safe rather than letting you turn something on it cannot yet verify.

8.3 Alias conflicts

The alias must be unique within the tenant, and only the backend can check that. If it clashes, the error asks you to rename the application — not to pick a different alias, because the alias is derived and you never see or type it.

8.4 Authorizing members

The Agentless authorized members card binds individual members to this application’s agentless access. Binding is the real access control: an unbound member cannot reach the endpoint even if the application has agentless on.

• Only directly assigned members can be bound.
• Each candidate row is gated by that member’s own seat: a member without a seat is disabled with a tooltip, and a banner at the top of the panel says how many still need one. Grant seats from the member side first — see 02 · Members §6.
• Binding does not consume a seat. Seats are granted on the member record.

9. The topology chart (Flow Chart)

Route: the Flow Chart button on the detail page.

A two-layer graph: the application node and the member nodes attached to it.

10. Bulk work

Applications support Export, multi-select batch actions (activate, deactivate, delete) and CSV import in both create and modify modes. Application import will not silently change a status or a protocol you left blank — a blank cell in modify mode is skipped, never defaulted.

Full instructions: 09 · Bulk Operations.

11. Permission summary

Next

• Grant access by team instead of person by person: 04 · Organizations
• Make sure a routing node covers the network: 05 · Merak Nodes