philipp/incus-backup-ui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added https for client and managment

Browse Source
This commit is contained in:
Philipp
2026-05-21 15:11:05 +02:00
parent 0046156e58
commit e5bcce5dbb
8 changed files with 129 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment.md
+22 -1
View File
@@ -14,13 +14,33 @@ sudo npm start
Important `.env` values:
```env
HOST="0.0.0.0"
PORT=3000
API_TOKEN="long-random-token-at-least-32-characters"
HTTPS_ENABLED=true
TLS_CERT_FILE="/etc/incus-backup-agent/tls.crt"
TLS_KEY_FILE="/etc/incus-backup-agent/tls.key"
ALLOWED_MANAGEMENT_IPS="management-server-ip"
```
`API_TOKEN` is required and must be at least 32 characters long. If `ALLOWED_MANAGEMENT_IPS` is set, the agent only accepts requests from those comma-separated IP addresses.
For private networks such as NetBird, the agent can serve HTTPS directly with an internal CA. Create one CA and sign one certificate per agent. The certificate must contain the NetBird IP or internal DNS name as a SAN:
```bash
sudo install -d -m 700 /etc/incus-backup-agent
openssl genrsa -out agent-ca.key 4096
openssl req -x509 -new -nodes -key agent-ca.key -sha256 -days 3650 -out agent-ca.crt -subj "/CN=Incus Backup Agent CA"
openssl genrsa -out tls.key 4096
openssl req -new -key tls.key -out tls.csr -subj "/CN=incus-node-1"
printf "subjectAltName=IP:100.127.0.10,DNS:incus-node-1.netbird\n" > tls.ext
openssl x509 -req -in tls.csr -CA agent-ca.crt -CAkey agent-ca.key -CAcreateserial -out tls.crt -days 825 -sha256 -extfile tls.ext
sudo install -m 600 tls.key /etc/incus-backup-agent/tls.key
sudo install -m 644 tls.crt /etc/incus-backup-agent/tls.crt
```
Copy `agent-ca.crt` to the management server and set `AGENT_CA_FILE` there.
Install systemd service:
```bash
@@ -52,9 +72,10 @@ DATABASE_PATH="./management.sqlite"
CORS_ORIGINS="https://backup.example.com"
SESSION_COOKIE_SECURE=true
ALLOW_INSECURE_AGENT_HTTP=false
AGENT_CA_FILE="/etc/incus-backup-management/agent-ca.crt"
```
`AUTH_PASSWORD` is required for the first start when the user database is empty. `CORS_ORIGINS` must list the frontend origins that are allowed to use cookie-authenticated API calls. Agent URLs must use `https://`; only set `ALLOW_INSECURE_AGENT_HTTP=true` for local development.
`AUTH_PASSWORD` is required for the first start when the user database is empty. `CORS_ORIGINS` must list the frontend origins that are allowed to use cookie-authenticated API calls. Agent URLs must use `https://`; only set `ALLOW_INSECURE_AGENT_HTTP=true` for local development. `AGENT_CA_FILE` should point to the CA certificate that signed the internal agent certificates.
Reset an existing password: