{{ define "admin-server-settings-content" }} {{ template "nav-sidebar" . }}
{{ template "navbar-user" . }}

Server Configuration

Manage and update the server configuration and options. Some changes require restarting the server such as TLS and server domain updates. This will cause disruptions for clients and network traffic.

{{ template "server-configuration" . }} {{ template "tun-options-configuration" . }} {{ template "socks-configuration" . }} {{ template "debug-configuration" . }} {{ template "openid-configuration" . }} {{ template "replication-configuration" . }}
{{ template "menu-toggle" . }}
{{ template "loading-dialog" . }} {{ end }} {{ define "server-configuration" }} {{ if .HasError "le" }}
{{ .Error "le" }}
{{ end }} {{ if .HasError "acme" }}
{{ .Error "acme" }}
{{ end }} {{ if .HasError "custom" }}
{{ .Error "custom" }}
{{ end }} {{ if .HasError "misc" }}
{{ .Error "misc" }}
{{ end }} {{ if .HasWarning "misc" }}
{{ .Warning "misc" }}
{{ end }}

Use this page to manage the domain name for the server hosting this Spokes instance.

Spokes prioritizes custom certificates uploaded to the server, followed by ACME protocol negotiation. ACME servers with external account bindings are tried first. If unavailable, Let's Encrypt and ZeroSSL will be used. If all methods fail, a self-signed certificate with an organization name matching the domain will be generated.

{{ if .HasError "domain" }}
{{ .Error "domain" }}
{{ end }}
{{ if .HasError "email" }}
{{ .Error "email" }}
{{ end }}

External ACME Bindings

Set up credentials to use an ACME service that requires credentials such as the paid subscriptions from ZeroSSL. ACME servers are commonly available in development environments and intranets as well.


Upload Custom Certificates

You can upload certificates from vendors like DigiCert, Entrust, or others, and self-signed certificates trusted in your environment.

To avoid accidentally removing custom certificates, select "Keep Existing Certificates" when making changes on this settings tab. It will be present when custom certificates where uploaded earlier.

{{ if .IsCustomCert }}
{{ end }}


An end-to-end connectivity test is performed to verify that the servers domain name will resolve to the host. This will ensure that using options such as Let's Encrypt or an ACME provider will function as expected.

{{ end }} {{ define "tun-options-configuration" }}

Customize server-side options for tunnels such as the max number of connections for tunneling data and the max number of ports that can be allocated to a tunnel. You can also enable automatic hostname assignment to tunnels. A wildcard subdomain will need to be set up for this option to function. Enabling monitoring for upstream tunnel services will allow you to view service status in the Status page for a tunnel.

{{ if .HasWarning "assignHostname" }}
{{ .Warning "assignHostname" }}
{{ end }}
{{ if .HasError "assignHostname" }}
{{ end }} {{ if .HasWarning "disableConnMetrics" }}
{{ .Warning "disableConnMetrics" }}
{{ end }}

{{ if .HasError "enableMonitor" }}
{{ .Error "enableMonitor" }}
{{ end }}
{{ if .HasError "monitorInterval" }}
{{ .Error "monitorInterval" }}
{{ end }}


Reset
{{ end }} {{ define "socks-configuration" }}

A SOCKSv5 server is built into Spokes and provides another means to access to TCP and HTTP services running on tunnels connected to the Spokes server. It can be used as a mechanism to provide network access but limit the ports that are accessible on the host.

The SOCKS server in Spokes can also be used to provide transport level encryption for dowstream applications hosted behind tunnels that don't natively support encryption (legacy systems). Connecting to a SOCKS server over TLS is not part of the standard protocol but clients do exist that provide this functionality.

{{ if .HasError "socksPort" }}
{{ .Error "socksPort" }}
{{ end }}
{{ if .HasError "tlsSocksPort" }}
{{ .Error "tlsSocksPort" }}
{{ end }}
{{ if .HasError "socksDestinations" }}
{{ .Error "socksDestinations" }}
{{ end }}

The values below can be hostnames or IP addresses in CIDR format. These values must be comma separated.


Reset
{{ end }} {{ define "updating-settings-content" }}

Updating configuration...

{{ end }} {{ define "debug-configuration" }}

Turn on additional debug logging and alerts on the system.

{{ if .HasError "logLevel" }}
{{ .Error "logLevel" }}
{{ end }}

Reset
{{ end }} {{ define "openid-configuration" }}

Configure an OpenID Connect provider such as Okta, Microsoft Azure Active Directory, and other providers.

{{ if .HasError "oidcProvider" }}
{{ .Error "oidcProvider" }}
{{ end }}
{{ if .HasError "oidcURL" }}
{{ .Error "oidcURL" }}
{{ end }}
{{ if .HasError "clientID" }}
{{ .Error "clientID" }}
{{ end }}
{{ if .HasError "clientSecret" }}
{{ .Error "clientSecret" }}
{{ end }}
Reset Remove
{{ end }} {{ define "replication-configuration" }}

Configure replication for this server. Master nodes are used to synchronize data to a set of replica nodes. Replica nodes will use this configuration and the key to perform HMAC-256 data verification. Keys on master and replica nodes must match.

{{ if .HasError "clusterHostname" }}
{{ .Error "clusterHostname" }}
{{ end }}
{{ if .HasError "clusterHMAC" }}
{{ .Error "clusterHMAC" }}
{{ end }}
{{ if .HasError "clusterMasterHostname" }}
{{ .Error "clusterMasterHostname" }}
{{ end }}
{{ if .HasError "clusterAPIKey" }}
{{ .Error "clusterAPIKey" }}
{{ end }}
{{ if .HasError "clusterInterval" }}
{{ .Error "clusterInterval" }}
{{ end }}
{{ end }}