Domains, Nginx & provider firewalls

Center owns the domain record, chosen Manager, provider profile, and visible deployment state. The assigned Manager performs the privileged Nginx apply or delete action on its own host. The current embedded Nginx provisioner targets Ubuntu with systemd and apt; do not assume that the rest of Manager’s Linux support makes this one host-changing workflow portable to RHEL-family systems or macOS.

1. Sign in to the intended Manager as an administrator through Center.
2. Open Settings > Server Registry and confirm the destination is enabled and reachable.
3. Set that server as the global Nginx default. This setting is global—not one default per LIVE or STAGING environment.
4. Verify that its public hostname or IPv4 address is the destination you want external DNS to reach.
5. Confirm ports 80 and 443 reach this host and no existing Nginx site will be displaced.

Administration → Domain Access (in Manager, at /settings/domains) adds a base-domain catalog and one access row per user. Administrators retain implicit full access; every other user gets none, all, or assigned domain access.

Assigned domains accept the base domain itself and its true subdomains only; there is no suffix-based lookalike match. Domain deletion and catalog or access-mode changes remain administrator-only.

1. Open Domains and choose Add Domain.
2. Enter the fully qualified public domain and one HTTP(S) upstream. For a load-balanced pool, enter up to 16 comma-separated URLs using the same scheme and no paths or query strings.
3. Add a real certificate email and the Nginx upload limit, such as 20m or 100m.
4. Read the route preview before submitting. Publish that A or CNAME record at the external DNS provider and wait until public resolvers return the assigned Manager.
5. Submit Add Domain. Center saves the record, marks it deploying, and calls the assigned Manager’s administrator-only Nginx endpoint.
6. Confirm active state, then verify HTTP redirect, HTTPS certificate, WebSocket behavior when used, and the upstream response from outside the server network.

dig +short A <domain>
dig +short CNAME <domain>
curl -I http://<domain>
curl -I https://<domain>

Center records pending, deploying, active, or failed state and keeps the last deployment error. A failed Center record does not prove that the host was unchanged; inspect Nginx configuration, certificates, package activity, and the public route before retrying.

1. Preserve the exact Center error and Manager journal output.
2. Run nginx -t before any reload and inspect the domain file under /etc/nginx/conf.d.
3. Verify DNS propagation and public reachability on ports 80 and 443.
4. Repair the narrow cause, restore the prior configuration if an active route regressed, then use Retry deployment.
5. When deleting, remember that Center removes the Nginx configuration and its registry record but does not remove external DNS.

sudo nginx -t
sudo systemctl status nginx --no-pager
sudo journalctl -u nginx -n 100 --no-pager
sudo ls -l /etc/nginx/conf.d/<domain>.conf
sudo certbot certificates

Server Registry supports AWS EC2 security groups, AWS Lightsail instances, DigitalOcean firewalls, Linode firewalls, and Proxmox firewall scopes. Provider credentials are accepted only by Center administrator routes, sealed with authenticated encryption before SQLite storage, and returned to the browser only as safe configured status and credential hints.

1. Edit the registered server and choose its hosting provider.
2. Enter the provider’s narrowly scoped API credential and exact firewall target, region, instance, or Proxmox scope.
3. Save and confirm the provider status reports configured.
4. Back up Center’s credential-encryption key separately from its database. A database backup without the matching key cannot decrypt the stored provider profiles.

1. Open the intended Manager and project in Center’s Shell workspace.
2. In Published ports, choose the firewall action beside the exact service and host port.
3. Review the provider and existing inbound rules before changing anything.
4. Choose the protocol and validated IP or CIDR sources. Use the public IPv4/IPv6 option only for deliberate internet-wide access.
5. Submit, inspect the provider result, and test from an allowed and a denied source.
6. Remove temporary access as soon as the operational task is complete.