Server and security

A control panel is a remote way into the machine, so cpleks is built to hold as little power as it can in the part that faces the internet. The web panel runs as an unprivileged account; a separate daemon does the privileged work and accepts only a closed list of typed operations, never a command or a file path. Every configuration file is generated whole, checked, and swapped into place in one step, so a mistake is refused before it can take a service down. This chapter covers what you see of that: the Server screen, your own sign-in, and the record of what was done.

The Server screen

An administrator's Server screen reads the machine each time it opens; nothing on it is remembered from an earlier visit.

The machine: processor, load, memory and disk, with a short history. A reading the panel could not take is drawn as a gap, never as zero.
Alerts: what is broken right now and when the last check ran, and who was told.
Services: every service cpleks manages, as systemd reports it: running, stopped, failed or not installed, whether it starts at boot, and Reload where a reload is safe for that service. Under cplex itself: the panel's own daemons, their restart counts, and when the certificate renewal check last ran.
Repair this server: recreates any missing account, re-asserts every site's folders, owners and permissions, renders every configuration file again from the panel's database, and reloads what changed. It is safe at any time. Repair, including every file also walks every file inside the sites' folders, which is slow on a full server; use it when uploads arrived with wrong permissions.
Service logs and the Mail queue: mail this server is holding for somewhere else, with the reason and Try all again now. Messages are removed one at a time; there is no button that empties the whole queue.

The Server screen with charts of processor, load, memory and disk, and the Alerts card after a check: nothing open. — The Server screen of the test machine, with nothing open. Its example data has a PostgreSQL database, which the weekly rehearsed restore checks and does not load (Backups and restore); that is not a failure, so it raises no alert. A part that does fail the rehearsal raises a critical alert here.

The Services panel listing each managed service with its state, and the cplex daemons. — Services, as systemd reports them right now.

The security baseline

The same screen checks, line by line, the protections the installer applied:

Firewall: inbound traffic is denied by default, and only the ports the panel opens are reachable.
Temporary files: /tmp cannot be used to run programs, which is the usual second step after a website is broken into.
Kernel settings: accounts cannot watch or interfere with each other's processes or follow each other's symbolic links.
SSH sign-in: Not measured, on purpose. The panel is kept out of the machine's SSH configuration and never edits it, so it cannot say whether passwords are accepted; the line gives the command to check it yourself.
Off-machine activity log: whether the record of changes is also sent to a syslog server somewhere else.

The security baseline on the Server screen: Firewall, Temporary files and Kernel settings In effect, SSH sign-in Not measured, and a warning that the off-machine activity log is not in effect. — The baseline on the test machine. The one red line is the off-machine activity log, which nobody has set up there.

Every firewall change made from the panel (switching mail, FTP or SFTP on or off) is armed with a ten-minute rollback. The Server screen then shows Keep this firewall: you are reading the page over the network, which proves the new rules did not lock you out. If nobody presses it, the previous firewall comes back on its own.

Your own sign-in

On Settings ▸ Sign-in, for every role:

Your password: at least 12 characters. Changing it signs out every other session.
Two-factor authentication: press Turn on, scan the code with an authenticator app (Google Authenticator, Authy, 1Password, Bitwarden) and type the six-digit code it shows. You then get ten recovery codes, shown once; keep them somewhere that is not the phone.
Security keys: a hardware key or a passkey, alongside or instead of the app. They work only when the panel is opened by its name, not by an IP address; opened by an IP address, the card says so instead of offering Add a security key.
Where you are signed in, with Sign out per browser and Sign out everywhere else.
API tokens for scripts: each has a name, a scope and an expiry, is shown once, and can be revoked. A token that can do everything is not offered.

The Sign-in section of Settings: the password form, two-factor authentication OFF with Turn on, security keys NONE with Add a security key, and below them the panel address panel.example.test:8443. — Settings: your password, two-factor authentication and security keys. The test machine's panel was opened by a name, so the security key card offers its button.

An administrator can also require a second factor for administrators, or for administrators and resellers, under Sign-in policy, with a grace period. The panel refuses to turn on a policy you could not meet yourself.

Notifications

Settings ▸ Notifications sends alerts to a webhook: an ntfy topic, or a receiver of your own. Send a test shows whether the receiver accepted it; a channel is never drawn green until one has. While something stays broken you are reminded at the interval you choose, and a recovery is always sent. Email alerts are not in this release.

Activity

Activity lists every change made through the panel and every attempt that was refused, with who and when. Entries are chained by digests, so an edit shows. Download the record gives the whole chain, which you can check anywhere with cplexctl audit-verify. No password, key or token is ever written to it.

Logs

Logs shows the last lines of a site's logs, 200 by default: Errors (what the web server says when it cannot serve a page, and what PHP writes when one dies), Requests (one line per request, with its status and how long it took) and PHP, with a follow switch that keeps adding lines as they arrive. Customers see the logs of their own sites.

Other settings

Time: choose the server's time zone, or leave the clock alone.
How the internet reaches this server: the public address and the nameservers (DNS).
Panel version and Licence (Updates, Your licence).