Access the deployment

This page tells how to find the web UIs of a hosting provider deployment, how to log in, and how to manage the users and the groups. It also tells how to see the containers and the services of a deployment, and how to read the logs of a deploy. On this page, <domain> is the domain of your hosting provider deployment.

Find the web UIs

Open https://<domain>/. This overview page shows a tile for each web UI of the deployment, with its address. The same page is at https://overview.<domain>/. The page itself has no login: each UI that it links to does its own login.

The overview page of a hosting provider deployment

The page shows only the UIs that the deployment deploys. For example, with an external NetBox, it shows no NetBox tile.

Log in

The UIs use single sign-on (SSO), with Authelia at https://auth.<domain>/. The first login asks for the user name and the password from the lldap directory of the deployment.

The deployment makes one administrator account, hosting-provider, if its configuration sets an administrator email address. This account starts without a password:

Open https://users.<domain>/reset-password/step1.
Enter hosting-provider.
Open the link in the email that the deployment sends to the administrator address.
Set a password.

This account is a member of lldap_admin. Authelia cannot set the password of an lldap_admin member, so its "Reset password?" does not work for this account. lldap and Authelia limit how frequently you can ask for a reset. If the deployment has no SMTP server, Authelia writes the email to the file notifications.txt in its state directory, on the authelia node.

Authelia does not accept the EU Digital Identity Wallet, because it has no OpenID for Verifiable Presentations (OpenID4VP) support. If an operator must accept the wallet, put a wallet verifier in front of Authelia as an OpenID Connect provider, and keep Authelia for the other logins.

Manage users and groups

The users are in lldap, at https://users.<domain>/. Add a user there, and give the user a group to give access:

Group	What a member can do
`authelia-users`	Log in through SSO. A user without this group cannot log in to any UI. This group alone does not give access to Incus, Grafana or the admin UIs.
`fediversity-staff`	Log in to Grafana with the Viewer role. Grafana shows the telemetry of all deployments.
`fediversity-admins`	Administer: administrator access to all Incus containers, the Admin role in Grafana, read access to the KV in OpenBao, and access to Windmill and to the UIs of Postgres (`pgweb`) and Valkey. The UIs of OpenBao, Postgres and Valkey are read-only, unless `ADMIN_UI_WRITE` is `1`, which gives full control of `secret/*` in OpenBao. The UI of Garage has no read-only mode, so it is served only when `ADMIN_UI_WRITE` is `1`.
`lldap_admin`	Manage users and groups in lldap.

A new user sets a password with "Reset password?" at https://auth.<domain>/. A member of lldap_admin uses https://users.<domain>/reset-password/step1.

See the containers

Incus is at https://incus.<domain>/. It shows each node of each deployment as an instance. The name of an instance is <namespace>-<node>, where <namespace> identifies the deployment.

Warning: Incus gives each user who logs in through SSO full administrator access. Incus does not limit its access to a group. Authelia limits this login to members of fediversity-admins. Give this group only to people that you trust with all containers.

Know which services an operator deployment uses

An operator deployment has its own nodes for its applications and for some services. For the other services, its nodes use the nodes of the hosting provider. A service is on the nodes of the hosting provider when one instance of it keeps the data of all deployments apart.

All nodes are on the same incus bridge and in the domain of the hosting provider. The node <node> of a deployment has the name <namespace>-<node>.<domain>. For all nodes on the bridge, the bridge dnsmasq resolves the names of the nodes of the hosting provider, for example smtp.<domain>, and the served domains of the hosting provider, for example auth.<domain>. core/components/hosting-provider/operator-reach.nix gives the ports that a node of a deployment can reach on the nodes of the hosting provider.

Service	Node	Name that the nodes of the deployment dial	Identity	Reason
OpenBao secrets	`openbao` of the hosting provider	`openbao.<domain>:8200`	The secrets of the deployment are under `vars/operator-deployments/<namespace>`. The KV instance of a service of an operator group is `<group>-<instance>`.	One store keeps the secrets of all deployments on different paths.
OpenBao PKI	`openbao` of the hosting provider	`openbao.<domain>`, `:443` and the CA fetch port	The private CA of the hosting provider signs the certificates of the nodes.	All nodes on the bridge trust one CA.
SPIRE	`spire` of the hosting provider	`spire.<domain>`	Each node gets an SVID in the trust domain of the hosting provider.	All nodes are in one trust domain.
PostgreSQL	`postgresql` of the hosting provider	`postgresql.<domain>:5432`	Each application has the database `<group>-<app>-<namespace>`.	One server keeps the databases of all deployments apart.
Garage	`garage` of the hosting provider	`garage.<domain>`, `:3900` for S3 and `:443` for the web buckets	The names of the buckets of the deployment start with `<namespace>-`.	One cluster keeps the buckets of all deployments apart.
DNS, DHCP and the Nix cache	The hypervisor	The bridge address, `:53`, `:67` and `:5000`	None	The bridge gives these to all nodes.
Valkey	`<namespace>-valkey` of the deployment	`<namespace>-valkey.<domain>`	`<namespace>-valkey.<domain>`	A valkey ACL cannot keep apart two deployments of the same application, because they use the same key names.
lldap	`<namespace>-lldap` of the deployment	`<namespace>-lldap.<domain>`	The base DN comes from `ldap.<domain>`. The URL in the mails and pages of lldap is `https://users.<domain>`, the web UI of the lldap of the hosting provider.	Each deployment has its own users. No service reads the directory of a different group.
Authelia	`<namespace>-authelia` of the deployment	`auth.<domain>`, which the bridge resolves to `authelia` of the hosting provider	The issuer of `<namespace>-authelia` is `https://auth.<domain>`. Its certificate comes from the private CA, because `auth.<domain>` is a served domain of the hosting provider.	Each deployment has its own users and OIDC clients.
Mail relay	`<namespace>-smtp` of the deployment	`smtp.<domain>:587`, which the bridge resolves to `smtp` of the hosting provider	The hostname of maddy on `<namespace>-smtp` is `smtp.<domain>`.	Each deployment has its own mail accounts and sends through the smarthost of the operator group.
Telemetry	`telemetry` of the hosting provider	`telemetry.<domain>:443`	The nodes send their journal and their host metrics to `/otlp/deployment/<namespace>` on the ingest name, with a credential that the deployment publishes to OpenBao. The Grafana node of the deployment reads its metrics from `/metrics-query/<namespace>` on the same name, with a credential that the deployment publishes to OpenBao.
Grafana	`<namespace>-grafana` of the deployment	`grafana.<domain>`, from the browser of the operator	The issuer of its login is `https://auth.<domain>`. The node has only the metrics of the deployment.

The names of Authelia, of the mail relay and of the lldap web UI of a deployment are names of the hosting provider. Thus the applications dial the authelia and smtp nodes of the hosting provider, not <namespace>-authelia and <namespace>-smtp. The OIDC clients and the mail accounts of the applications are only on the nodes of the deployment.

A deployment in a Kubernetes cluster has no address on the bridge. Set CLUSTER_SOURCES on the deployment of the hosting provider to the addresses from which its pods connect, as a comma-separated list of addresses or CIDRs. When the cluster translates the pod addresses, these are the addresses of the cluster nodes. The gate of each node of the hosting provider then lets these sources reach the same ports as an operator deployment, and the PostgreSQL node accepts them. Deploy the hosting provider again after a change.

The network of the cluster must route to the addresses of the nodes. The hosting provider does not set up this route.
All pods of a cluster that use one address get the same access, including the pods of other deployments.
Do not put an address of ADMIN_SOURCES in CLUSTER_SOURCES. The gate limits that address to the operator ports too.

Read the logs of a deploy

Windmill runs the deploys that the panel starts. It is at https://jobs.<domain>/, for members of fediversity-admins only. In the fediversity workspace, the runs of the scripts f/fediversity/deploy and f/fediversity/destroy show the log of each deploy and each destroy.