diff --git a/deploy/truenas/core/static/wilddragon-webrtc.html b/deploy/truenas/core/static/wilddragon-webrtc.html
new file mode 100644
index 0000000..209fa9b
--- /dev/null
+++ b/deploy/truenas/core/static/wilddragon-webrtc.html
@@ -0,0 +1,482 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Dragon Fork — WebRTC Admin</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<style>
+  :root {
+    color-scheme: light dark;
+    --fg: #e7e7ea;
+    --bg: #0d0e12;
+    --accent: #ff6633;
+    --muted: #8b8e98;
+    --good: #5dd29c;
+    --warn: #ffb45e;
+    --bad:  #ff6470;
+    --panel: #1a1c22;
+    --border: #232530;
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    font: 14px/1.5 -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+    background: var(--bg);
+    color: var(--fg);
+    min-height: 100vh;
+    display: flex;
+    flex-direction: column;
+  }
+  header {
+    padding: 1.25rem 1.5rem;
+    border-bottom: 1px solid var(--border);
+    display: flex;
+    align-items: baseline;
+    gap: 0.75rem;
+    flex-wrap: wrap;
+  }
+  header h1 {
+    margin: 0;
+    font-size: 1.05rem;
+    letter-spacing: 0.02em;
+  }
+  header h1 .accent { color: var(--accent); }
+  header .subtitle { color: var(--muted); font-size: 0.85rem; }
+  header .spacer { flex: 1; }
+  header .nav a {
+    color: var(--muted);
+    text-decoration: none;
+    margin-left: 1rem;
+    font-size: 0.85rem;
+  }
+  header .nav a:hover { color: var(--accent); }
+
+  main {
+    padding: 1.5rem;
+    max-width: 1200px;
+    width: 100%;
+    margin: 0 auto;
+    flex: 1;
+  }
+
+  .panel {
+    background: var(--panel);
+    border-radius: 10px;
+    padding: 1.25rem;
+    margin-bottom: 1rem;
+  }
+  .panel h2 {
+    margin: 0 0 0.75rem 0;
+    font-size: 0.9rem;
+    text-transform: uppercase;
+    letter-spacing: 0.06em;
+    color: var(--muted);
+  }
+
+  .row {
+    display: flex;
+    gap: 0.75rem;
+    align-items: center;
+    flex-wrap: wrap;
+  }
+
+  label {
+    display: block;
+    margin-top: 0.5rem;
+    color: var(--muted);
+    font-size: 0.78rem;
+    text-transform: uppercase;
+    letter-spacing: 0.06em;
+  }
+  input[type=text], input[type=password] {
+    width: 100%;
+    padding: 0.55rem 0.7rem;
+    margin-top: 0.25rem;
+    background: var(--bg);
+    border: 1px solid #2a2c36;
+    border-radius: 6px;
+    color: var(--fg);
+    font: inherit;
+  }
+  input[type=text]:focus, input[type=password]:focus {
+    border-color: var(--accent);
+    outline: none;
+  }
+
+  button {
+    padding: 0.55rem 1rem;
+    border: none;
+    border-radius: 6px;
+    background: var(--accent);
+    color: #000;
+    font-weight: 600;
+    cursor: pointer;
+    font: inherit;
+    font-weight: 600;
+  }
+  button:disabled { opacity: 0.4; cursor: not-allowed; }
+  button.secondary { background: #2a2c36; color: var(--fg); }
+  button.danger { background: rgba(255,100,112,0.20); color: var(--bad); }
+  button.small { padding: 0.35rem 0.7rem; font-size: 0.85rem; }
+
+  .pill {
+    display: inline-block;
+    padding: 0.1rem 0.55rem;
+    border-radius: 999px;
+    font-size: 0.75rem;
+    background: #2a2c36;
+  }
+  .pill.good { background: rgba(93,210,156,0.18); color: var(--good); }
+  .pill.warn { background: rgba(255,180,94,0.18); color: var(--warn); }
+  .pill.bad  { background: rgba(255,100,112,0.20); color: var(--bad); }
+
+  .process-list { display: flex; flex-direction: column; gap: 0.6rem; }
+  .process {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    gap: 0.5rem 1rem;
+    padding: 0.9rem 1rem;
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: 8px;
+  }
+  .process .id {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-weight: 600;
+    word-break: break-all;
+  }
+  .process .meta {
+    color: var(--muted);
+    font-size: 0.8rem;
+  }
+  .process .actions {
+    display: flex;
+    gap: 0.4rem;
+    align-items: flex-start;
+    flex-wrap: wrap;
+    justify-content: flex-end;
+  }
+  .process .whep-url {
+    grid-column: 1 / -1;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.78rem;
+    color: var(--accent);
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    padding: 0.4rem 0.6rem;
+    word-break: break-all;
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+  }
+  .process .whep-url a {
+    color: var(--muted);
+    text-decoration: none;
+    margin-left: auto;
+    flex-shrink: 0;
+  }
+  .process .whep-url a:hover { color: var(--accent); }
+
+  .empty {
+    color: var(--muted);
+    text-align: center;
+    padding: 2rem 0;
+  }
+
+  .log {
+    margin-top: 1rem;
+    max-height: 180px;
+    overflow-y: auto;
+    background: var(--bg);
+    border: 1px solid var(--border);
+    padding: 0.6rem 0.8rem;
+    border-radius: 6px;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 0.78rem;
+    line-height: 1.4;
+    white-space: pre-wrap;
+    word-break: break-word;
+  }
+  .log .ts { color: var(--muted); }
+  .log .lvl-bad { color: var(--bad); }
+  .log .lvl-good { color: var(--good); }
+  .log .lvl-warn { color: var(--warn); }
+
+  /* Login screen takes the full panel by itself */
+  #login-panel { max-width: 420px; margin: 4rem auto 0; }
+</style>
+</head>
+<body>
+  <header>
+    <h1>Dragon Fork <span class="accent">WebRTC Admin</span></h1>
+    <span class="subtitle">enable / disable WebRTC egress per process</span>
+    <span class="spacer"></span>
+    <nav class="nav">
+      <a href="/">Restreamer</a>
+      <a href="/whep-player.html">WHEP Player</a>
+      <a href="/api/swagger/index.html">API</a>
+      <a href="#" id="logout-link" style="display:none">Sign out</a>
+    </nav>
+  </header>
+
+  <main>
+    <!-- LOGIN PANEL -->
+    <section id="login-panel" class="panel">
+      <h2>Sign in</h2>
+      <p style="color: var(--muted); margin: 0 0 0.75rem 0;">
+        Use the same credentials as Core's API
+        (<code>API_AUTH_USERNAME</code> / <code>API_AUTH_PASSWORD</code>).
+      </p>
+      <label for="login-user">Username</label>
+      <input id="login-user" type="text" autocomplete="username">
+      <label for="login-pass">Password</label>
+      <input id="login-pass" type="password" autocomplete="current-password">
+      <div class="row" style="margin-top: 1rem;">
+        <button id="btn-login">Sign in</button>
+      </div>
+      <div id="login-log" class="log" style="margin-top: 1rem;" aria-live="polite"></div>
+    </section>
+
+    <!-- ADMIN PANEL -->
+    <section id="admin-panel" class="panel" style="display:none">
+      <div class="row" style="justify-content: space-between; margin-bottom: 0.75rem;">
+        <h2 style="margin: 0;">Processes</h2>
+        <div class="row" style="gap: 0.4rem;">
+          <button id="btn-refresh" class="secondary small">Refresh</button>
+        </div>
+      </div>
+      <div id="process-list" class="process-list">
+        <div class="empty">Loading...</div>
+      </div>
+      <div id="admin-log" class="log" style="margin-top: 1rem;" aria-live="polite"></div>
+    </section>
+  </main>
+
+  <script>
+  // --- tiny state -------------------------------------------------
+  const $ = (id) => document.getElementById(id);
+  const TOKEN_KEY = 'dragonfork-admin-token';
+  let authToken = null;
+
+  function log(panel, line, level = 'info') {
+    const ts = new Date().toLocaleTimeString();
+    const div = document.createElement('div');
+    div.innerHTML = `<span class="ts">${ts}</span> <span class="lvl-${level}">${escapeHTML(line)}</span>`;
+    panel.prepend(div);
+  }
+  function escapeHTML(s) {
+    return String(s).replace(/[&<>"']/g, (c) => ({
+      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+    })[c]);
+  }
+
+  // --- auth -------------------------------------------------------
+  function setAuth(token) {
+    authToken = token;
+    if (token) {
+      try { localStorage.setItem(TOKEN_KEY, token); } catch (e) {}
+      $('login-panel').style.display = 'none';
+      $('admin-panel').style.display = '';
+      $('logout-link').style.display = '';
+      refreshProcesses();
+    } else {
+      try { localStorage.removeItem(TOKEN_KEY); } catch (e) {}
+      $('login-panel').style.display = '';
+      $('admin-panel').style.display = 'none';
+      $('logout-link').style.display = 'none';
+      $('process-list').innerHTML = '<div class="empty">Not signed in.</div>';
+    }
+  }
+
+  async function login() {
+    const user = $('login-user').value.trim();
+    const pass = $('login-pass').value;
+    if (!user || !pass) {
+      log($('login-log'), 'username and password required', 'bad');
+      return;
+    }
+    $('btn-login').disabled = true;
+    try {
+      const r = await fetch('/api/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ username: user, password: pass }),
+      });
+      if (!r.ok) {
+        const body = await r.text();
+        throw new Error(`HTTP ${r.status}: ${body || r.statusText}`);
+      }
+      const data = await r.json();
+      const token = data.access_token || data.accessToken || data.token;
+      if (!token) throw new Error('login response missing access_token');
+      log($('login-log'), 'authenticated', 'good');
+      $('login-pass').value = '';
+      setAuth(token);
+    } catch (err) {
+      log($('login-log'), 'login failed: ' + err.message, 'bad');
+    } finally {
+      $('btn-login').disabled = false;
+    }
+  }
+
+  $('btn-login').addEventListener('click', login);
+  $('login-pass').addEventListener('keydown', (e) => { if (e.key === 'Enter') login(); });
+  $('login-user').addEventListener('keydown', (e) => { if (e.key === 'Enter') login(); });
+  $('logout-link').addEventListener('click', (e) => { e.preventDefault(); setAuth(null); });
+
+  // Restore session if we have a stashed token. The first /process call
+  // will fail with 401 if it's expired; we catch that and bounce back to
+  // the login panel rather than asking the user to clear localStorage.
+  try {
+    const cached = localStorage.getItem(TOKEN_KEY);
+    if (cached) setAuth(cached);
+  } catch (e) {}
+
+  // --- API helpers ------------------------------------------------
+  async function api(method, path, body) {
+    const headers = { 'Authorization': 'Bearer ' + authToken };
+    const init = { method, headers };
+    if (body !== undefined) {
+      headers['Content-Type'] = 'application/json';
+      init.body = JSON.stringify(body);
+    }
+    const r = await fetch(path, init);
+    if (r.status === 401) {
+      // Stale token. Bounce to login.
+      log($('admin-log'), 'session expired, please sign in again', 'warn');
+      setAuth(null);
+      throw new Error('unauthorized');
+    }
+    if (!r.ok) {
+      const text = await r.text();
+      throw new Error(`${method} ${path} → ${r.status}: ${text || r.statusText}`);
+    }
+    if (r.status === 204) return null;
+    return r.json();
+  }
+
+  // --- process list -----------------------------------------------
+  $('btn-refresh').addEventListener('click', refreshProcesses);
+
+  async function refreshProcesses() {
+    if (!authToken) return;
+    $('process-list').innerHTML = '<div class="empty">Loading...</div>';
+    try {
+      // The list endpoint paginates via ?id=&filter=&order=. Without
+      // params it returns up to a server-side cap which is plenty for
+      // a 1-5 stream deploy. ?filter=config keeps the response small.
+      const procs = await api('GET', '/api/v3/process?filter=config,state');
+      renderProcesses(procs);
+    } catch (err) {
+      if (err.message === 'unauthorized') return;
+      log($('admin-log'), 'list processes: ' + err.message, 'bad');
+      $('process-list').innerHTML = '<div class="empty">Failed to load processes.</div>';
+    }
+  }
+
+  function renderProcesses(procs) {
+    const list = $('process-list');
+    list.innerHTML = '';
+    if (!Array.isArray(procs) || procs.length === 0) {
+      list.innerHTML = '<div class="empty">No processes configured. Create one in the Restreamer UI.</div>';
+      return;
+    }
+    procs.sort((a, b) => (a.id || '').localeCompare(b.id || ''));
+    for (const p of procs) {
+      list.appendChild(renderProcess(p));
+    }
+  }
+
+  function renderProcess(proc) {
+    const el = document.createElement('div');
+    el.className = 'process';
+
+    const cfg = proc.config || {};
+    const webrtcEnabled = !!(cfg.webrtc && cfg.webrtc.enabled);
+    const state = (proc.state && proc.state.exec) || (proc.state && proc.state.state) || 'unknown';
+    const stateKlass = state === 'running' ? 'good' : (state === 'failed' ? 'bad' : 'warn');
+
+    // Left side: id + meta
+    const left = document.createElement('div');
+    left.innerHTML = `
+      <div class="id">${escapeHTML(proc.id || '(no id)')}</div>
+      <div class="meta">
+        <span class="pill ${stateKlass}">${escapeHTML(state)}</span>
+        WebRTC: <span class="pill ${webrtcEnabled ? 'good' : ''}">${webrtcEnabled ? 'enabled' : 'disabled'}</span>
+        ${cfg.reference ? '· ref: ' + escapeHTML(cfg.reference) : ''}
+      </div>
+    `;
+    el.appendChild(left);
+
+    // Right side: action buttons
+    const actions = document.createElement('div');
+    actions.className = 'actions';
+    const toggle = document.createElement('button');
+    toggle.className = webrtcEnabled ? 'danger small' : 'small';
+    toggle.textContent = webrtcEnabled ? 'Disable WebRTC' : 'Enable WebRTC';
+    toggle.addEventListener('click', () => toggleWebRTC(proc.id, !webrtcEnabled, toggle));
+    actions.appendChild(toggle);
+    el.appendChild(actions);
+
+    // Bottom row: WHEP URL with copy and "open in player"
+    if (webrtcEnabled) {
+      const whepURL = location.origin + '/api/v3/whep/' + encodeURIComponent(proc.id);
+      const playerURL = '/whep-player.html?url=' + encodeURIComponent(whepURL);
+      const w = document.createElement('div');
+      w.className = 'whep-url';
+      w.innerHTML = `
+        <span>${escapeHTML(whepURL)}</span>
+        <a href="#" data-copy="${escapeHTML(whepURL)}">copy</a>
+        <a href="${escapeHTML(playerURL)}" target="_blank" rel="noopener">open ↗</a>
+      `;
+      const copyLink = w.querySelector('[data-copy]');
+      copyLink.addEventListener('click', (e) => {
+        e.preventDefault();
+        navigator.clipboard?.writeText(whepURL).then(
+          () => log($('admin-log'), 'WHEP URL copied', 'good'),
+          () => log($('admin-log'), 'clipboard write failed (no permission?)', 'warn'),
+        );
+      });
+      el.appendChild(w);
+    }
+
+    return el;
+  }
+
+  // --- toggle webrtc.enabled --------------------------------------
+  async function toggleWebRTC(id, enabled, btn) {
+    btn.disabled = true;
+    btn.textContent = enabled ? 'Enabling...' : 'Disabling...';
+    try {
+      // Read the current full process config and patch only the webrtc
+      // block. The PUT /process/:id endpoint replaces the entire
+      // config, so partial payloads would silently drop other settings.
+      const cfg = await api('GET', '/api/v3/process/' + encodeURIComponent(id) + '/config');
+      cfg.webrtc = cfg.webrtc || {};
+      cfg.webrtc.enabled = enabled;
+      await api('PUT', '/api/v3/process/' + encodeURIComponent(id), cfg);
+
+      // Restart the process so the new RTP output legs take effect.
+      // Without this the toggle takes effect on the next manual restart
+      // only — surprising behaviour for a "Enable" button.
+      try {
+        await api('PUT', '/api/v3/process/' + encodeURIComponent(id) + '/command', { command: 'restart' });
+        log($('admin-log'), `webrtc ${enabled ? 'enabled' : 'disabled'} on ${id} (restarted)`, 'good');
+      } catch (cmdErr) {
+        // Process may not have been running; the config update still applied.
+        log($('admin-log'), `webrtc ${enabled ? 'enabled' : 'disabled'} on ${id}, restart skipped: ${cmdErr.message}`, 'warn');
+      }
+
+      // Refresh the list to pick up the new state + WHEP URL.
+      await refreshProcesses();
+    } catch (err) {
+      if (err.message === 'unauthorized') return;
+      log($('admin-log'), `toggle ${id}: ${err.message}`, 'bad');
+      btn.disabled = false;
+      btn.textContent = enabled ? 'Enable WebRTC' : 'Disable WebRTC';
+    }
+  }
+  </script>
+</body>
+</html>
