Dashboard Overview
🌐
Total Sites
–
Managed by NGINX
🔒
SSL Enabled
–
With certificates
⚠️
Expiring Soon
–
Within 30 days
🔴
Expired
–
Action required
Recent Sites
Loading…
Site Management
SSL Certificates
Auto-renew active
Auto-Renew Threshold
Certs are renewed automatically when this many days remain
days before expiry
Notification Contacts
Notification Logs
Loading…
Firewall Administration
UFW Status
Loading…
Default Incoming
–
Default Outgoing
–
Quick Presets
Quick IP Block
Fail2ban Protection
🛡️
Active Jails
–
🚫
Total Banned IPs
–
⚠️
Total Failures
–
Manual Ban / Unban
Fail2ban Log
Loading…
Web Application Firewall
Loading…
Rules Active
–
Countries Blocked
–
Block Rules
–
Log Rules
–
Active Rules
Pattern matching applied via NGINX config — UA, URI path, IP/CIDR, HTTP method
No rules. Click Load OWASP Presets to add recommended rules.
Edge Gateway Status
Edge Gateway
192.168.12.2
Public: 154.0.8.35
Checking…
NGINX · WAF · Fail2ban · Rate Limiting · Certbot
Active Sites
–
Proxied domains
SSL Certificates
–
Let's Encrypt managed
Edge Gateway Architecture
This server sits directly at the internet edge — there is no upstream firewall between it and the internal web servers.
NGINX itself is the perimeter firewall: WAF rules, Fail2ban, UFW, rate limiting, and country blocking all enforce access control
before traffic reaches any backend.
🌍 Internet
→
🌐 DNS
A 154.0.8.35
A 154.0.8.35
→
🛡 EDGE GATEWAY (THIS SERVER)
154.0.8.35 → 192.168.12.2
NGINX Reverse Proxy
WAF · Fail2ban · Rate Limits
UFW · Country Blocking
SSL Termination · Certbot
WAF · Fail2ban · Rate Limits
UFW · Country Blocking
SSL Termination · Certbot
→
INTERNAL WEB SERVER
192.168.12.x
HTTP/HTTPS backend
INTERNAL WEB SERVER
192.168.12.x
HTTP/HTTPS backend
+ more servers via Site Management
⚠ No upstream firewall — NGINX is the perimeter. Keep WAF, Fail2ban and UFW active at all times.
Public IP NAT
| Public IP | Internal IP | Ports Forwarded | Role |
|---|---|---|---|
| 154.0.8.35 | 192.168.12.2 | 80, 443 | Edge Gateway |
DNS Record
nginx.sky-web.co.za IN A 154.0.8.35 ; Edge Gateway
; Point each proxied domain's A record to 154.0.8.35 ; NGINX will route by server_name to the correct internal backend
; Point each proxied domain's A record to 154.0.8.35 ; NGINX will route by server_name to the correct internal backend
Security & 2FA
Two-Factor Authentication
Loading…
Change Password
User Management
| Name | Role | 2FA | Status | Last Login | Actions | |
|---|---|---|---|---|---|---|
| Loading... | ||||||
📨 Invite History
| Recipient | Invited By | Action | Email Sent | When |
|---|---|---|---|---|
| Loading... | ||||
Communications Settings
📧 Email SMTP
📱 SMS via Twilio
💬 WhatsApp via Twilio
Uses your Twilio account. The sandbox from-number is whatsapp:+14155238886. For production, use your approved WhatsApp sender number.
💬 WhatsApp via Meta Business API
Direct Meta Cloud API. Requires a verified Meta Business account and approved phone number.
Microsoft 365 SSO (Entra ID)
Azure App Registration steps:
1. portal.azure.com → App registrations → New registration
2. Supported account types: Accounts in this organizational directory only
3. Redirect URI (Web):
4. Certificates & secrets → New client secret → copy the Value
5. API permissions → Add:
6. Copy Directory (tenant) ID and Application (client) ID from the Overview page
1. portal.azure.com → App registrations → New registration
2. Supported account types: Accounts in this organizational directory only
3. Redirect URI (Web):
https://nginx.sky-web.co.za/api/auth/microsoft/callback4. Certificates & secrets → New client secret → copy the Value
5. API permissions → Add:
openid, profile, email, User.Read, GroupMember.Read.All → Grant admin consent6. Copy Directory (tenant) ID and Application (client) ID from the Overview page
Port Forwards
How it works:
nginx listens on the selected port and proxies all traffic to the backend host/port you configure.
Configs are written to the nginx-configs volume and automatically synced to Node 2 via lsyncd.
For Sage Payroll / self-signed backends, set Backend Protocol → https and leave Verify Backend SSL off.
Configured Forwards
No port forwards configured. Click + Add Forward to get started.
Web Server Deployment Wizard
Deployment History
No deployments yet. Click + New Deployment to start.
Production Web Server Certs
Servers
–
Registered
Total Certs
–
Tracked
Expiring Soon
–
Within 30 days
Expired
–
Action required
Remote Servers
Loading…
Cloudflare DNS Manager
Database Backup
Manual pg_dump Backups
Backups are stored on this node's volume. Run on Node 1 (primary DB). Files are compressed .sql.gz — restore with
gunzip -c file.sql.gz | psqlService Monitor
Loading…
Log Viewer