Skip to main content

Shared IP Address Groups

A shared IP address group is a set of public addresses, IPv4 and IPv6, that accounts' websites share. Every account belongs to one group, and the group decides two things about everything the account hosts: the addresses its websites' A and AAAA records point at, and the addresses its domains' SPF records authorize. Each group also gets a web server instance of its own.

The group's addresses are separate from the server's own, the one its hostname resolves to and its own services use. A server needs at least one group before it can have an account.

At install​

The addresses are configured on the machine first, one IPv4 (and one IPv6, if used) per group in addition to the server's own, and install.sh creates a group per --ip-group:

install.sh --ip-group 10.0.3.21,fd42:100:3::21 --ip-group 10.0.3.22,fd42:100:3::22

Each one is elpanctl ip_address_group:create with the addresses. Install a server has the whole sequence, including the NetworkManager side.

The screen​

Shared IP Address Groups, in the admin app's System menu, lists each group with its ID, its addresses, how many accounts use it, and when it was created. There is no name: a group is known by its UUID.

A group's page has:

  • General Information: the ID and the Systemd Service of the group's web server instance.
  • IP Addresses: the public addresses, copyable.
  • IP Certificates: one row per address, with its setting, the certificate pinned for it, and how the last provisioning round ended.
  • Accounts: the accounts assigned to the group.

IP certificates​

The panel gets a certificate for each address itself, so that a connection to the bare address is served with one. Edit on a row sets whether it does (Automatic, On or Off), the same setting as certificate:ip:set; a change acts at once, and an address that no longer asks loses its certificate at the edge and on disk. Certificates has the settings, the rounds and the badges.

The commands​

elpanctl ip_address_group:list
elpanctl ip_address_group:create <address> [<address>...]
elpanctl ip_address_group:refresh <group UUID>

ip_address_group:create takes the addresses separated by spaces, creates a row for each address the server does not know yet, and prints the new group's ID. ip_address_group:refresh rewrites everything that names the group's addresses: the group's web server configuration (its httpd instance and the nginx frontend), the name server's listening addresses, the outgoing-mail filter's map of local addresses, and the server's own DNS records.

An account is assigned to a group when it is created, and the group is the optional second argument:

elpanctl account:create <username> <group UUID>

Without it the account goes to the first group. The account holder never sees the group; they see its addresses in their generated records.

Add a group after install​

Configure the new addresses on the machine, as at install, then create the group and give its ID to the accounts you create from then on:

elpanctl ip_address_group:create 10.0.3.23 fd42:100:3::23
elpanctl account:create <username> <group UUID>

The group's web server instance and its certificates follow from the creation. Existing accounts stay where they are.

The address must be on the machine

The panel records the address and writes it into the web server configuration and the DNS; it does not configure the network interface. An address that is not configured on the machine is published in DNS and answers nothing.

The accounts' private addresses​

Beside the shared public addresses, every account has a private loopback address of its own, which the panel uses for the account's firewall rules. They are listed and regenerated with:

elpanctl account_ip_address:list
elpanctl account_ip_address:refresh <id> [<id>...]

Nothing public points at them, and nothing about them is a setting.