Setup & installation

Platforms

Platform	Support
Windows 10 / 11	Primary target.
Linux / X11	Secondary. Placement depends on the window manager.
Linux / Wayland	Refused — the agent runs and serves the UI but will not arm commands.
macOS	Development host only, never a deployment target.

Access

Panes serves its web UI at https://127.0.0.1:31077 — loopback only, HTTPS on by default. No firewall rule is added; the UI is not reachable from other machines.

On first start Panes seeds one admin account (default email admin@panes.local) with a random 16-character password written to admin.password in the data dir (0600 on Linux). Sign-in forces a password change on first use — there is no fixed default password.

Data directory

• Windows: C:\ProgramData\Panes
• Linux: /var/lib/panes

It holds the SQLite store (panes.db), the TLS cert/key (tls/), per-monitor Chromium profiles (profiles/), and daily-rolling logs (logs/panes.log). It is machine-level on purpose (not per-user).

caution

Uninstalling leaves the data directory in place so you don't lose your wall configuration. Delete it by hand if you want a clean slate.

Windows install (MSI)

The MSI installs to a fixed C:\Program Files\Panes (per-machine) and installs two binaries:

• panes-agent.exe — the windowless background agent (run by the logon task).
• panes.exe — a console CLI (--reset-admin, --install-logon-task, --uninstall-logon-task).

Instead of a Windows Service, Panes registers a Task Scheduler logon task named "Panes Agent" that runs in the interactive user session (a service would be stuck in Session 0 and unable to place windows). The task triggers ~10 seconds after logon to let the display churn settle, and never times out.

Updating is just installing a newer MSI over the old one — it force-closes the running agent first, so no reboot prompt.

MSI properties

Property	Default	Meaning
PANES_TASK_USER	(empty)	Pin the logon task to one account, so it fires only when that user logs on. Use for a kiosk autologon account: msiexec /i panes.msi PANES_TASK_USER=KIOSK01\signage. Empty = the task fires for whichever user logs on, in their own session.
PANES_RUNLEVEL	leastprivilege	Run level for the agent. highest requests elevation — but a standard MSI build rejects it by design (elevation is a separate signed build).

Inspect or run the task manually:

schtasks /Query /TN "Panes Agent" /V /FO LIST
schtasks /Run   /TN "Panes Agent"

Linux install (.deb)

The .deb installs the panes binary to /usr/bin, a systemd user unit (panes.service, WantedBy=graphical-session.target), and an XDG autostart entry. State lives in /var/lib/panes owned by the panes group.

sudo apt install ./panes_*.deb
sudo usermod -aG panes "$USER"          # write access to the data dir
systemctl --user enable --now panes.service

For a locked-down kiosk image, enable it for all users with systemctl --global enable panes.service.

HTTPS certificate

In the default (auto) mode Panes generates a self-signed certificate with SANs for localhost, 127.0.0.1, and panes.local, and persists it under tls/ in the data dir.

On Windows the installer trusts it in the machine root store, so the browser loads the UI without a warning. On Linux/macOS the certificate is not added to any trust store, so the browser shows a one-time warning you accept for 127.0.0.1.

You can supply your own certificate with the PANES_TLS=manual mode plus PANES_TLS_CERT and PANES_TLS_KEY, or turn TLS off with PANES_TLS=off.

Users & roles

Accounts are local (passwords hashed with argon2id). Three roles:

• Admin — everything, plus user management, config import, and the public-API allowlist.
• Operator — edit monitors and commands, run/stop/apply.
• Viewer — read-only.

You cannot delete the last admin or your own account. If you are locked out, recover from the host with panes --reset-admin, which writes a fresh password to admin.password.

Configuration backup (import / export)

The whole configuration exports and imports as a single JSON document — the seam for managing a fleet of machines. Import applies commands only; monitors are discovered hardware and are never imported. See the Public API for the endpoints.