Skip to content
BILLETKnowledge Base

Restrict who can reach the console

Move administrator sign-in to a name of its own, and allow it only from your own networks, so the console is not there to find from the internet.

For
Administrators
Applies to
Billet 1.0
Updated

By default the console's sign-in answers on the portal's own name, from anywhere. Two settings narrow that. Both are read once, when the portal starts.

They restrict the operator door: the console sign-in at /console and the administration API under /admin/. People's sign-in and desktops are not affected, and a tenant administrator who signs in at /portal still reaches their tenant's console from anywhere.

Allow administrators only from your networks

Add to the portal's service (/etc/systemd/system/billet-portal.service), with your own addresses:

Environment=BILLET_OPERATOR_NETWORKS=10.0.0.0/8 203.0.113.7

Addresses and networks are separated by spaces or commas, IPv4 or IPv6. From anywhere else, the console sign-in answers 404, exactly as an address the portal does not have, so there is nothing to find.

  • The address checked is the one your reverse proxy reports in X-Forwarded-For. Behind Cloudflare, nginx must restore the real address first. See Put the portal behind a reverse proxy.
  • Administrators on a VPN arrive from the VPN's address, not their own. Look in nginx's access log to see what address you actually arrive from before you set this.

Warning: A value the portal cannot read closes the door to everybody, and the portal logs an error when it starts. That is deliberate: a typo must never open the console to everyone. If you lock yourself out, remove the setting on the server and restart the portal.

Give the console a name of its own

Environment=BILLET_CONSOLE_HOSTS=console.example.com
  • Naming one moves the door. The portal's own name stops serving the console sign-in. To keep it there too, list both: portal.example.com console.example.com.
  • Each name needs a DNS record (public or private), a server_name in your reverse proxy, and a certificate for it.
  • A console name is for administrators only: people's pages and the machines' addresses answer 404 there.

Apply and check

sudo systemctl daemon-reload
sudo systemctl restart billet-portal
journalctl -u billet-portal -b | grep 'console door:'

The log line says which names and networks the door is open to.