mirror of
https://github.com/MengMengCode/CLICD.git
synced 2026-08-04 21:31:23 +08:00
MengMengCode
38debab1aa
- Implement tests for custom KVM and LXC image creation, ensuring invalid sources and architecture mismatches are rejected. - Introduce access policy management in CLI, allowing configuration of allowed sources and trusted proxies. - Add NAT network configuration with validation for RFC1918 compliance and subnet parsing. - Create panel access policy management, including normalization and evaluation of access decisions based on client IPs and forwarded headers. - Develop middleware for enforcing access policies in the server, returning appropriate responses for allowed and denied requests. - Enhance custom image downloading and validation, ensuring integrity and security of downloaded root filesystem archives. - Include comprehensive tests for all new functionalities to ensure reliability and correctness.
48 lines
1.8 KiB
Markdown
48 lines
1.8 KiB
Markdown
# Configuration
|
|
|
|
After installation, CLICD runs as a systemd service. Runtime configuration and the database are stored locally on the host. The exact path may vary with installer options, but the default installation should mainly be checked under `/root/.clicd/`.
|
|
|
|
## Common Settings
|
|
|
|
| Setting | Description |
|
|
| --- | --- |
|
|
| Web port | Defaults to `8999`, listening on `0.0.0.0:8999`. |
|
|
| Administrator account | Used to log in to the web panel and manage API keys. |
|
|
| Database | SQLite storage for container metadata, sub-users, audit logs, API keys, and more. |
|
|
| NAT port range | Used for random ports and port mapping allocation. |
|
|
| IPv6 prefixes | Used when the host has routable IPv6 prefixes. |
|
|
| Security alerts | Policies such as automatic shutdown can be configured. |
|
|
|
|
## Service Commands
|
|
|
|
```bash
|
|
systemctl status clicd
|
|
systemctl restart clicd
|
|
journalctl -u clicd -n 100 --no-pager
|
|
```
|
|
|
|
## Panel Access Allowlist CLI
|
|
|
|
```bash
|
|
# Show the current policy
|
|
clicd access-policy show
|
|
|
|
# Allow selected addresses and networks; add reverse proxies when needed
|
|
clicd access-policy set \
|
|
--allow "203.0.113.10,192.168.1.0/24,2001:db8::/32" \
|
|
--trusted-proxy "127.0.0.1"
|
|
|
|
# Disable source restrictions
|
|
clicd access-policy disable
|
|
```
|
|
|
|
The same controls are available from the "Panel access allowlist" item in `clicd cli`. Both paths persist the setting and restart the running panel service automatically.
|
|
|
|
## Security Recommendations
|
|
|
|
- Do not expose the web panel directly to untrusted networks.
|
|
- Use a strong administrator password and rotate it regularly.
|
|
- Split API keys by purpose and avoid long-lived full-access keys.
|
|
- WebSSH and WebVNC tickets are short-lived credentials and should not be written to logs or shared publicly.
|
|
- Do not paste real IPs, passwords, API keys, or tickets into public docs, screenshots, or support tickets.
|