# Production server with no admin login?

**URL:** <https://discourse.nodered.org/t/production-server-with-no-admin-login/17331>\
**Category:** General\
**Created:** [30 October 2019 17:02 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331 "2019-10-30T17:02:21Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![petercutting](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/petercutting/32/13808_2.png) [@petercutting](https://discourse.nodered.org/u/petercutting)\
**Post date:** [30 October 2019 17:02 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/1 "2019-10-30T17:02:22Z")

</div>

I am new to NR. developed a simple flow on an RPI. I want to expose it to the internet. But I need to harden my env first. Tried to lock down Admin login using npm install node-red-auth-github but that crashed.  
So my next idea, is to avoid the whole Admin login issue, by serving a separate production app on a different port - _with no Admin login_. I assume this is possible but how?

I would update the prod server using a script that

1. copies the flow from the dev env to the prod env
2. restarts the prod server

Peter

---

<div class="post-metadata">

**Author:** ![ghayne](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ghayne/32/39_2.png) [@ghayne](https://discourse.nodered.org/u/ghayne)\
**Post date:** [30 October 2019 17:04 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/2 "2019-10-30T17:04:10Z")

</div>

> [@petercutting](#):
>
> with no Admin login

NOT recommended!

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [30 October 2019 17:15 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/3 "2019-10-30T17:15:02Z")

</div>

Hi @petercutting

> [@petercutting](#):
>
> Tried to lock down Admin login using npm install node-red-auth-github but that crashed.

One step would be to include details of what crash you saw so we can try to address it.

By 'no admin login' I assume you mean disabling the editor entirely, rather than not requiring a login.

You can disable the editor and admin api entirely by setting `httpAdminRoot` to `false` and `disableEditor` to `true` in your settings file. That leaves you with no way to edit the flows unless you have file-system access to either re-enable them, or to replace the flow file and restart NR.

---

<div class="post-metadata">

**Author:** ![petercutting](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/petercutting/32/13808_2.png) [@petercutting](https://discourse.nodered.org/u/petercutting)\
**Post date:** [30 October 2019 18:29 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/4 "2019-10-30T18:29:20Z")

</div>

it turns out I needed sudo to install node-red-auth-github (error message not very helpful). so I can continue down that path

yes, when I say no admin I mean having no editor access

But I want to have the editor for local development/test and have a separate production environment (on another port) without the editor. This is a common use case and should be straightforward - or?

Peter

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [30 October 2019 18:35 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/5 "2019-10-30T18:35:58Z")

</div>

Node-RED doesn't provide a way to run the editor on one port and the runtime on another port.

---

<div class="post-metadata">

**Author:** ![petercutting](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/petercutting/32/13808_2.png) [@petercutting](https://discourse.nodered.org/u/petercutting)\
**Post date:** [30 October 2019 18:47 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/6 "2019-10-30T18:47:28Z")

</div>

Running the editor and runtime on different ports would have solved my problem nicely. But OK, its not possible

so my solution is 2 instances of node red on same RPI

1. bog-standard development with editor on port X
2. production (no editor) on port Y (router port forward to internet)

so I need to find out how to setup 2) but the google is of no help for some reason

---

<div class="post-metadata">

**Author:** ![petercutting](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/petercutting/32/13808_2.png) [@petercutting](https://discourse.nodered.org/u/petercutting)\
**Post date:** [30 October 2019 18:53 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/7 "2019-10-30T18:53:47Z")

</div>

I should add that maybe I dont need a full blown node red environment for production (2). perhaps my flow is just a bunch of js/html/css files I can throw into a simple web server. Or?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [30 October 2019 19:10 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/8 "2019-10-30T19:10:15Z")

</div>

> [@petercutting](#):
>
> Running the editor and runtime on different ports would have solved my problem nicely. But OK, its not possible

Not currently possible but it actually shouldn't be that hard to implement I wouldn't think. Would need careful thought about backwards compatibility of course.

One to add to the ever lengthening list of futures? It would certainly be useful and could easily help with Node-RED security.

> [@petercutting](#):
>
> perhaps my flow is just a bunch of js/html/css files I can throw into a simple web server

At least, you could put your web app onto a different instance from everything else and let the admin instance push data to the user instance.

You could also easily create a simple web server of course if all you need is static assets. If you need your static assets to talk to Node-RED then uibuilder might also help - you can, if you need to, serve up uibuilder front-end assets from a different server, that was covered by me in another recent thread.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [30 October 2019 19:15 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/9 "2019-10-30T19:15:17Z")

</div>

You can run two instances of Node-RED by pointing them at different user directories using the -u command line parameter. They can then have their own settings files and flow files allowing them to run on different ports.

Alternatively, you could run multiple instances using docker, exposing them on different local ports.

---

<div class="post-metadata">

**Author:** ![petercutting](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/petercutting/32/13808_2.png) [@petercutting](https://discourse.nodered.org/u/petercutting)\
**Post date:** [31 October 2019 07:35 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/10 "2019-10-31T07:35:35Z")

</div>

thanks for the help. i ended up setting up HTTPS and a username/password on the editor like you suggest. with the excelent help from  
Richard Wenner [https://www.youtube.com/watch?v=z9a\_ztJqaII](https://www.youtube.com/watch?v=z9a_ztJqaII)

I am still wondering if it is straightforward to copy a "flow" and run it in a server like express.js

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [31 October 2019 07:49 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/11 "2019-10-31T07:49:42Z")

</div>

> [@petercutting](#):
>
> I am still wondering if it is straightforward to copy a "flow" and run it in a server like express.js

You need the Node-RED runtime to run a flow. It isn't just some html, js and CSS you can copy around.

---

<div class="post-metadata">

**Author:** ![namgk](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/namgk/32/4050_2.png) [@namgk](https://discourse.nodered.org/u/namgk)\
**Post date:** [7 January 2021 10:35 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/12 "2021-01-07T10:35:55Z")

</div>

Hi Nick, any reason disableEditor is required to be true while httpAdminRoot is false?

Would set httpAdminRoot to false be enough to disable the editor?

Thanks

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [7 January 2021 10:44 UTC](https://discourse.nodered.org/t/production-server-with-no-admin-login/17331/13 "2021-01-07T10:44:54Z")

</div>

Hi @namgk

setting `httpAdminRoot` to false will stop it from exposing the admin routes. It will not stop it doing all the internal work to create those routes.

Setting `disableEditor` to true will cause it to skip doing the work (including loading node html into memory) to create all the server-side editor resources.