Panel settings

The hostname, panel certificate, panel port, login address, Cloudflare Tunnel, SSH port, and server restart are managed from the Settings page.

The Settings page

The Settings page is open to administrators only: Settings, near the top of the side menu. It manages the server's identity, how the panel is reached, and the server's power, so you do not need SSH for these tasks. Your own password, two-factor authentication, and sessions are not on this page; they are on the My Account page.

The page has five tabs:

• Server: SSH access (port and keep-alive).
• Nameservers (NS): optional. You present the server as an authoritative nameserver under your own brand (for example ns1.example.com). If the fields are left empty, nothing changes. The panel does not create the glue record at your domain registrar for you; the Check button only verifies through public DNS that ns1 and ns2 resolve to this server, and shows Verified or Not verified.
• Panel Access: the hostname, the panel certificate, the panel port, the login address, Cloudflare access (the proxy and the Cloudflare Tunnel), and the Sign in as a customer switches.
• Status Display: the access keys for the read-only status screen shown on a TV or monitor.
• Power: restarting the server.

At the top of the Panel Access tab, a How to Reach the Panel summary card shows the current panel address (Panel address) and badges: Cloudflare Tunnel (when the tunnel is on; the address then has no port), Cloudflare proxy, DNS only · server IP is visible or Direct IP (whether the address is served through Cloudflare or directly), Port (or External port closed), and Login path. If the panel port is not one that Cloudflare's proxy supports, a Cloudflare proxy · panel port not supported warning appears.

Hostname and panel certificate

In Panel Access → Panel Name & Certificate, you change the server's Hostname. Only lowercase letters, digits, and - are allowed; it can be a single name or a full domain name with dots. An IP address is not accepted as a hostname.

If the hostname is a real domain name (for example panel.example.com), the panel tries to get a certificate for that name in the background when you save. If the attempt fails, the panel keeps running with its self-signed certificate and nothing is blocked. You can also get the certificate yourself:

• The Get certificate button gets a Let's Encrypt certificate for the hostname. If the panel name's DNS is on Cloudflare or on this server, validation is done through DNS and port 80 is not needed; in the Cloudflare case, Cloudflare must be connected and the hostname's DNS zone must be in Cloudflare. Otherwise, if the name resolves to this server, validation is done over port 80.
• In the optional Notification email field, you can enter the address to which Let's Encrypt sends expiry warnings.
• When the certificate is issued, the panel restarts with the new certificate within a few seconds, and the page may stop responding for a moment. After that, https://<hostname>:<port> opens without a browser warning. Renewal happens on its own.

If the hostname is not a real domain name (for example, a name without a dot), a certificate cannot be issued; the current certificate is not renewed and browsers show a warning when it expires. The card reports this with a red notice. The Cloudflare choice for the panel name, Proxy on or Proxy off (DNS only), is on the Cloudflare Connection card of the same tab; if Cloudflare is not connected, or the domain is not active in the connected account, the card says so and the choice cannot be made. With the proxy off, the server's IP address is visible to everyone under that name.

Panel port and login address

The Panel Access → Address & Port card has two settings.

• Panel port. The default is 3252; because well-known ports are targets for bot scans, a high, random port is recommended. When you press Change, the panel opens the new port in the firewall, closes the old port, sets the SELinux label, and restarts on the new port a few seconds later; the page redirects you automatically. The port must be between 1 and 65535, must not be one that is reserved for another service (for example 22, 80, 443, or 3306), and must not be in use by another process at that moment. You can go back to the default 3252. Your SSH access is not affected.
• Panel login address. If left empty, the login page is at /login. If you enter a name (for example manage-x7), the login page opens only at /manage-x7 and /login stops working. The name must start with a lowercase letter or digit, contain only lowercase letters, digits, -, and _, and be 4 to 32 characters long; paths the panel itself uses cannot be chosen.

The login address reduces the noise from scans that target the well-known /login path; it does not replace access control. Write down the new address before you change it: after the change, the old address does not work.

If you can no longer reach the panel at all, you can change the port from the server with deckpa set-port (see Command line). There is no command that shows or resets the login address from the command line.

On the same tab, the Sign in as a customer card lets you switch on or off, separately, whether administrators and resellers can open the panel of the users they manage, as that user; there is also an Ask for password option. Turning a switch off also ends open sign-ins. Every action taken in these sign-ins is recorded under the name of the person who signed in.

Cloudflare Tunnel (panel tunnel)

A Cloudflare Tunnel lets the panel open at an address such as https://panel.example.com, without publishing the server's IP address and without a port number. It works only with Cloudflare; without Cloudflare, the IP address is public anyway. The tunnel is only for the panel's own address; it does not publish your sites through a tunnel.

Requirements. The Panel tunnel section of the Panel Access → Cloudflare Connection card checks the following conditions in order, and shows a mark next to each: done, failed or not checked yet. The check stops at the first failure, and the later ones stay unchecked. The Set up tunnel button appears only when all four are met:

• Cloudflare is connected: the Cloudflare token of the first administrator account must be connected on the DNS → Cloudflare page.
• Domain is active in your Cloudflare account: the hostname's domain must have an active DNS zone in the connected account.
• Panel certificate covers this name: get a certificate for the hostname first with Get certificate; the default self-signed certificate does not cover the name.
• Token can set up tunnels (edit permission): the token needs the Cloudflare Tunnel:Edit permission (Account › Cloudflare Tunnel › Edit). The token form the panel opens selects this permission too. If it is missing, add it to the token in the Cloudflare dashboard; you do not need to paste the token again.

In addition, the hostname must be a real domain name (for example panel.example.com); for an IP address or a single-label name, the card says "A tunnel requires the panel name to be a real domain name" and the tunnel cannot be set up. The panel port must be between 1024 and 65535.

Setup. Press Set up tunnel and confirm the dialog. In the background, the panel does the following in order:

• Creates a tunnel in Cloudflare for this hostname with a name that starts with deckpa-; if a tunnel with that name already exists, it uses it.
• Sets the tunnel's target to the local panel address (https://127.0.0.1:<port>).
• Installs the cloudflared program. The version the panel pins is downloaded, and it is not installed at all if its checksum (SHA-256) does not match the value built into the panel. cloudflared does not update itself; the version changes only with a Deckpa update.
• Starts the deckpa-cloudflared.service system service under a separate unprivileged user (cloudflared). If the service exits, it restarts by itself after 5 seconds.
• Waits up to 90 seconds for the tunnel to show as healthy in Cloudflare. If it does not, DNS is not touched at all and the panel says "The tunnel was installed but could not connect to Cloudflare. DNS was not changed. Retry or remove the tunnel."; the hostname keeps working as it was.
• Once the tunnel is healthy, it points the hostname's Cloudflare record to the tunnel: any A, AAAA and differently targeted CNAME records at the same name are first saved on the server, then deleted, and a proxied CNAME that points to the tunnel (<tunnel ID>.cfargotunnel.com) is written in their place. If the CNAME cannot be written, the deleted records are written back.

If setup stops halfway, the same button continues from where it stopped. On success the card says "Tunnel set up". While the tunnel is on, the How to Reach the Panel card shows the Cloudflare Tunnel badge and the address is written without a port. The previous records are kept on the server and are written back when you remove the tunnel.

Behind the tunnel, the panel takes the visitor's real IP address from Cloudflare's Cf-Connecting-Ip header, and only for connections that come from the server itself (from cloudflared). As a result, the sign-in rate limit, the audit log, sessions and the IP allowlist see the real visitor address instead of the server's local address; the header on a connection that arrives from outside is ignored.

State of an installed tunnel. The card shows the health (Healthy, Partly connected, Disconnected, Not connected yet or Status unknown), the number of connections, and the cloudflared version. If the state cannot be read, the card says "Tunnel status could not be read. Reload the page in a moment."

The IP:port address stays open as a backup. After setup, the panel port stays open in the firewall. If the tunnel stops working, you can open the panel with the server's IP address and port (for example https://203.0.113.10:3252); the browser may show a certificate warning.

Closing and opening the external port. If you want the panel to open only through the tunnel, the Close external port button closes the panel port in the firewall, and the IP:port address stops working. The button appears only when the tunnel is healthy, has at least one connection, the cloudflared service is running, the external port is currently open, and the hostname record is not broken. Just before closing, the panel also tests that it really reaches the panel at the hostname through Cloudflare; if it does not, it leaves the port open and says "The panel does not respond on the tunnel address yet ... so the external port was not closed. Try again in a few minutes." It also refuses when the tunnel is unhealthy ("The tunnel is not working properly, so the external port was not closed"). After closing, the page redirects you to the tunnel address. While the external port is closed, the How to Reach the Panel card shows an External port closed badge, the card shows an Open external port button, and opening is always allowed.

While the external port is closed, changing the panel port is refused ("The panel port cannot be changed while the external port is closed. Open the external port first."), because a port change opens the new port in the firewall and would silently undo the tunnel policy. If you change the port while the tunnel is on and the external port is open, the panel first moves the tunnel's target to the new port (the tunnel may return an error for a short time); if the port change fails, it moves the target back to the old port.

Locked settings. While the tunnel is on, the hostname field is read-only, the Save button is disabled, and the Cloudflare proxy choice is replaced by this note: "While the tunnel is on, the record always stays proxied through Cloudflare, so this setting and the panel name are locked. To change them, remove the tunnel first." A change request sent straight to the server is also refused, with "The panel name and the Cloudflare proxy setting cannot be changed while the panel tunnel is on". The hostname's tunnel record shows locked with a Panel tunnel badge on the DNS → Cloudflare page and on the site's DNS tab; it cannot be deleted or changed, and its proxy cannot be turned off. This record lives only in Cloudflare; it is not copied to the panel's own DNS server and is not counted as a conflict during sync.

If cloudflared is not running. The card shows "The cloudflared service is not running, so the panel cannot be reached through the tunnel." in red. The service is installed so that it restarts by itself when it exits. If the external port is open, you can keep opening the panel at the IP:port address; the Close external port button does not appear while the service is not running. If the external port is closed, first open the port with the SSH command above.

If the DNS record breaks. If the hostname's record in Cloudflare is deleted or changed to something other than the tunnel, the card shows "panel.example.com no longer points to this tunnel; the record may have been deleted or changed in Cloudflare. The panel cannot be reached at this address." and Close external port does not appear. If the panel cannot read the record from Cloudflare, it does not count that as broken.

• Repair record: after you confirm, it points the hostname's record back to the tunnel as a proxied CNAME; any other A or AAAA record with the same name is deleted. If the CNAME cannot be written, the deleted records are written back. If the record is already healthy, it does nothing. This action needs the DNS edit permission on the token (Zone › DNS › Edit); if it is missing, the panel says so. Repair does not change the saved copy of the records from before the tunnel.

Removing the tunnel. The confirmation text of Remove tunnel reads: "The DNS record will be restored, cloudflared will stop, and the tunnel in Cloudflare will be deleted." The panel does the following in order:

• If the external port is closed, it opens it first. If it cannot, it stops without touching anything else.
• Deletes the tunnel CNAME and writes back the previous records saved at setup (A, AAAA and differently targeted CNAME); it does not touch a record that is already the same.
• Stops the cloudflared service.
• Deletes the tunnel in Cloudflare and clears the tunnel record on the server.

If a step fails, the tunnel record on the server is kept; an error is shown and you can retry. If you are connected through the tunnel address, your connection may drop; the page redirects you to the direct address. If the record from before the tunnel was proxied and the panel port is not one of the ports that Cloudflare's proxy supports, the redirect goes to the server's IPv4 address (for example https://203.0.113.10:3252) instead of the hostname; that address shows a browser certificate warning but works. Removal needs both the tunnel and the DNS edit permission on the token.

Other error messages: "Connect Cloudflare first.", "The panel certificate does not cover this hostname. Get a certificate first.", "The hostname's domain is not active in the connected Cloudflare account.", "The Cloudflare token cannot create tunnels (it can read but not edit)." and "The tunnel permission could not be checked because Cloudflare did not respond. Try again shortly."

SSH port

The Server → SSH access section has three fields: Port, the Keep-alive switch, and Interval (s). When you press Apply, a confirmation dialog opens and the SSH service is restarted.

• The panel validates the new configuration with sshd -t and restores the old configuration if it is invalid.
• If the port changes, the SELinux label and the firewall rule are set automatically. The old port is left open in the firewall so that you do not lose access.
• Keep-alive prevents the idle connection of an SSH client such as WinSCP from dropping: the server sends a liveness packet at every interval. The interval is between 15 and 3600 seconds; values outside that range are moved to the nearest limit. The default interval is 60 seconds.
• If another file under /etc/ssh/sshd_config.d overrides the value the panel saved, the panel reports it with a notice.
• If the SSH port recorded in the configuration drifts from the real port, you can bring them back in line from the server with deckpa fix-ssh-port.

IPv6

The IPv6 setting is not on the Settings page. It is the ipv6_enabled key in /etc/deckpa/config.yaml on the server, and it is off by default. While it is off:

• Applications on the server try IPv4 first when they connect outward (the panel writes this to /etc/gai.conf).
• New sites do not get an AAAA record.

If you set the key to true, that preference block is removed, and if the server has a global IPv6 address, new sites get an AAAA record. The change takes effect when the panel services are restarted with deckpa restart. IPv6 is never disabled in the kernel. If your provider assigns an IPv6 route but does not carry the traffic, an AAAA record can cause access problems for visitors; while the key is on, Health Check measures whether the server can connect outward from its IPv6 address and shows the result in the IPv6 Usage row.

Restarting the server

The Restart button in Power → Restart Server restarts the server within about 3 seconds after you confirm in the dialog. All services, including the panel, are unreachable for a few minutes, and sites do not respond during that time. A restart is also how an updated Linux kernel takes effect.

If you can log in to the server over SSH, deckpa reboot does the same job. After the restart, open the panel at its usual address; the panel's two system services start on their own when the server boots.