Local Settings
Local Settings controls the current node's hostname, network addresses, TLS certificate, root access, SSH policy, and operating-system updates.
Where to find it: SDM root sidebar > Local Settings.
Available to: root.
What this page does
These settings belong to one server, not automatically to every cluster member. The page combines node identity and connectivity with high-impact security and maintenance controls so changes can be verified on the node that actually received them.
Before you start
Have console or alternate access before changing hostname, IP, SSH, root password, or TLS. Confirm firewall and DNS prerequisites, and take a backup before operating-system work.
Local tabs
| Tab | Controls | Verification |
|---|---|---|
| Hostname | Server hostname. | Confirm system hostname, panel access, TLS names, and peer identity where relevant. |
| Network | Add IPv4 address with prefix/netmask on an interface; delete non-primary addresses. | Confirm interface state, routing, firewall, and reachability before ending the session. |
| SSL | Certificate status, forced Let's Encrypt issue/renew, or upload certificate/fullchain, private key, and optional CA chain. | Check subject, issuer, expiry, hostname match, and a fresh HTTPS connection. |
| Password | Root password and confirmation, minimum 12 and maximum 72 bytes. | Test a new protected session without closing the current one. |
| SSH | Port and AllowUsers patterns/comments. | Open firewall first and test the new port/user rule. |
| Update System | Daily auto-update, kernel exclusion, immediate update, dry run, job status, and recent log tail. | Run dry mode first and review the job/log before a real update. |
Controls and fields
| Control, Field, Or Section | What It Does | What It Affects | Recommended Usage |
|---|---|---|---|
| Hostname tab | Loads the node hostname form and update action. | Affects how the node identifies itself in the panel, cluster context, and certificate workflows. | Use a stable hostname that matches DNS and certificate expectations. |
| Hostname | New server hostname value. | May affect panel identity, logs, monitoring labels, and SSL issuance. | Verify DNS and reverse DNS before changing it. |
| Update Hostname | Saves the hostname through the settings API. | Changes local node identity after backend validation. | Run during a maintenance window if external systems depend on hostname. |
| Network tab | Shows additional IP address controls for local interfaces. | Manages IPs attached to this node. | Use for secondary service addresses; main IPs marked as protected should not be removed. |
| IP Address | Address or range to attach to an interface. | Adds local network reachability for DNS/panel services depending on system routing. | Use only assigned addresses; coordinate with network/firewall policy. |
| Prefix or netmask | CIDR prefix or dotted netmask for the IP address. | Determines subnet membership and routing behavior. | Use the exact prefix from the network allocation. |
| Network Interface | Local interface that receives the additional IP. | Controls where the address is configured. | Select the interface connected to the target network. |
| Add IP Address | Adds the specified IP/prefix to the selected interface. | Changes local networking. | Keep an out-of-band access path before changing network configuration. |
| Remove IP Address | Deletes an additional non-main address from the interface table. | Can immediately remove reachability for services using that IP. | Confirm DNS, firewall, and cluster references before removal. |
| SSL tab | Shows certificate status and certificate management actions. | Affects secure browser access to the panel and related HTTPS endpoints. | Keep certificate validity monitored before customer-facing access is exposed. |
| Force renewal | Requests certificate renewal even if the current certificate still appears valid. | Can trigger ACME/certbot renewal attempts. | Use when certificate content changed or renewal troubleshooting requires a forced attempt. |
| Issue / Renew Certificate | Runs the Let’s Encrypt webroot certificate workflow. | Can replace the active certificate after successful validation. | Ensure the hostname resolves correctly and HTTP validation can reach the node. |
| Certificate / Fullchain | External certificate or fullchain PEM upload. | Provides the public certificate material for custom CA/provider certificates. | Upload the leaf certificate and chain exactly as provided by the CA. |
| Private Key | External private key matching the certificate. | Required for the server to present the certificate. | Never share this key outside secure administration; encrypted/unreadable keys are rejected. |
| CA Chain | Optional intermediate CA bundle when separate from the fullchain. | Completes the trust chain for clients. | Upload only when the certificate file does not already include intermediates. |
| Upload External SSL | Validates certificate/key pairing, tests the web server configuration, writes files atomically, and reloads the service. | Replaces active SSL material if validation succeeds. | Use for commercial certificates or customer-managed CA workflows; confirm certificate subject and expiry after upload. |
| Refresh Status | Reloads current certificate subject, issuer, validity, and status. | No configuration change. | Use after renewal/upload to confirm the panel is serving the expected certificate. |
| Password tab | Loads root password controls. | Affects break-glass/root access for the node. | Restrict to trusted administrators and store credentials according to customer policy. |
| Root Password / Repeat Password | New root password and confirmation. | Changes root authentication after both values match and pass validation. | Use generated strong values; avoid reusing customer or staff passwords. |
| Generate Password | Creates a strong password candidate in the password fields. | Does not save until Change Password is clicked. | Use it for new deployments and emergency rotations. |
| Show Password | Temporarily reveals or hides the password fields. | Only affects visibility in the browser. | Use in a private screen-share environment only. |
| Change Password | Saves the new root password. | Immediately changes root credentials. | Confirm password storage and emergency access before saving. |
| SSH tab | Loads SSH port and AllowUsers controls. | Controls shell access exposure on the node. | Coordinate with firewall rules and support access policy. |
| SSH Port | Port used by the SSH daemon. | Changes where administrators connect for shell access. | Verify firewall allows the new port before saving. |
| Change SSH Port | Applies the configured SSH port. | Can affect remote shell access immediately. | Keep an active recovery session until the new port is tested. |
| AllowUsers pattern | SSH username or user@host pattern permitted to log in. | When configured, users not listed are denied SSH. | Add all required emergency/admin users before enabling restrictive patterns. |
| AllowUsers comment | Reason or owner note for the SSH allow rule. | Improves future audit and cleanup. | Use ticket/customer context. |
| Allow User | Adds the SSH allow rule and restarts/reloads SSH where needed. | Restricts future SSH access according to the list. | Avoid locking out current administrators; test immediately. |
| Update System tab | Controls local operating system update policy and one-off update execution. | Affects packages on this SDM node, not DNS zone content directly. | Use dry run first in production. |
| Daily Auto Update | Enables or disables scheduled daily OS package updates. | Controls unattended node package maintenance. | Enable only when the customer accepts automatic OS maintenance. |
| Exclude Kernel packages | Prevents kernel packages from being included in automatic or one-off updates. | Reduces reboot-risk from kernel updates. | Recommended when reboot windows are tightly controlled. |
| Save Auto Update | Stores automatic update policy. | Changes future scheduled update behavior. | Record the policy in support handover notes. |
| Dry Run | Runs update check without applying package changes. | Shows expected changes while keeping packages unchanged. | Keep enabled before first production update. |
| Update System | Queues a one-off OS update worker using the selected dry-run/kernel options. | May update packages and restart affected services depending on mode. | Run during maintenance if dry run indicates meaningful changes. |
| Refresh Status | Reloads update worker state, start/finish times, exit code, command, updates-available flag, and recent log tail. | No package change. | Use while the worker is running or after failure. |
| Recent Log Tail | Shows the latest update worker output. | Provides support evidence for update success/failure. | Capture relevant lines before retrying failed updates. |
Safety notes
- Changing network, SSL, SSH, or OS update settings can affect access to the panel. Confirm a recovery path before saving.
How to use it
- Select the one local tab that owns the change.
- Read current values and prepare rollback/alternate access.
- For updates, run Dry Run; for TLS, refresh status; for network/SSH, verify firewall and routes.
- Save or start the operation and wait for completion.
- Test the node from a new connection and inspect relevant logs.
Result and next check
The current node reports the intended local configuration and remains reachable through the expected network, HTTPS, and administrative paths. Other cluster members do not change merely because this node did.
Theme color