install.sh wrote no TRUST_PROXY_HEADERS line at all, so the code default (False) applied while every host install serves the panel through its own nginx. Per-IP rate limits, the login brute-force throttle and every audit-log entry therefore keyed on 127.0.0.1, which quietly weakened all three -- one abusive client shared a bucket with everyone else. .env.example claimed true, so the two disagreed and it looked configured. Trusting X-Forwarded-For is only safe when nothing can reach gunicorn without traversing a proxy we control, so the switch follows that condition rather than assuming it. On a host install it holds: render_service_unit binds gunicorn to 127.0.0.1 and bootstrap_firewall opens SSH + 80/443 + PANEL_PORT and never the backend port. backend_bind_host() is now the single source of truth for both the systemd unit and the trust decision so the two cannot drift, and backend_is_loopback_only() gates the setting. - stock install: TRUST_PROXY_HEADERS=true, TRUSTED_PROXY_HOPS=1 - SERVERKIT_EXTERNAL_PROXY=1: true with 2 hops, unchanged - SERVERKIT_BIND_HOST not loopback: false plus a warning. The port is directly reachable there, so the header is attacker-chosen, and a forged IP is worse than a wrong one because it defeats the throttles that consume it. Re-runs backfill it into installs that predate this, via _env_default_key, which fills a gap but never overrides an uncommented value -- flipping someone's deliberate false back on would be the worst kind of surprise. .env.example moves to false on purpose: that file is the Docker/manual path and docker-compose.yml publishes 5000 on all interfaces, so true was the unsafe default there. Host installs never read it. SECURITY.md claimed "the shipped nginx deploy sets it", which was untrue until now. T44 covers all six behaviours, each mutation-checked by line number: disabling the branch, inverting it to trust an exposed port, and disabling the backfill each fail exactly one assertion and no others. Shell suite 121 passed. Backend suite 3542 passed, 48 skipped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ServerKit Documentation
Welcome to the ServerKit documentation. This guide will help you install, configure, and use ServerKit effectively.
Quick Links
| Document | Description |
|---|---|
| Installation Guide | Complete setup instructions for Docker and manual installation |
| Architecture | System design, request flow, and diagrams |
| Deployment Guide | Production deployment, CLI commands, and configuration |
| Local Development | Run the panel locally for development |
| API Reference | REST API documentation with examples |
| Multi-Environment Guide | Set up prod/dev WordPress pairs with shared database |
| Multi-Server & Agent | Install the agent and connect remote servers (see also pairing) |
Getting Started
1. Installation
Choose your preferred installation method:
- Docker Installation (Recommended) - Get started in minutes
- Manual Installation - Full control over the setup
- One-Line Install - One-line installer for Ubuntu, Debian, Fedora, and RHEL/Rocky/AlmaLinux
2. Initial Setup
After installation:
- Access ServerKit at
http://your-server-ip - Create your admin account (first user becomes admin)
- Enable Two-Factor Authentication
- Configure Notifications
3. Start Managing
- Add your first application from the Applications page
- Configure domains and SSL certificates
- Set up monitoring alerts
- Enable security scanning
Feature Guides
Application Management
ServerKit supports multiple application types:
| Type | Runtime | Process Manager |
|---|---|---|
| PHP / WordPress | PHP-FPM 8.x | Nginx |
| Python (Flask/Django) | Python 3.x | Gunicorn |
| Node.js | Node 18+ | PM2 |
| Docker | Containers | Docker Engine |
Each application includes:
- Environment variable management (encrypted)
- Log viewing and streaming
- Start/stop/restart controls
- Domain and SSL configuration
Multi-Environment Support
ServerKit supports multi-environment linking for WordPress and other applications:
- Production/Development Pairs - Link apps as prod/dev environments
- Shared Database - Both environments can share the same MySQL database with different table prefixes
- Environment Badges - Visual indicators (PROD/DEV/STAGING) in the UI
- Quick Navigation - One-click switching between linked environments
- Credential Propagation - Automatically share database credentials between linked apps
Common use case: WordPress theme development
- Production WordPress serves live traffic
- Development WordPress shares the database (separate tables)
- Develop themes in dev without affecting production
See the Multi-Environment Setup Guide for detailed instructions.
Domain & SSL
- Nginx Virtual Hosts - Automatic configuration generation
- Let's Encrypt SSL - Free certificates with auto-renewal
- Custom Certificates - Upload your own SSL certificates
Database Management
Supported databases:
- MySQL / MariaDB
- PostgreSQL
Features:
- Create/delete databases
- User management
- Basic query interface
Monitoring & Alerts
Real-time monitoring includes:
- CPU, RAM, disk usage
- Network traffic
- Server uptime history
- Process monitoring
Alert channels:
- Discord webhooks
- Slack webhooks
- Telegram bot
- Generic HTTP webhooks
Security
- Two-Factor Authentication - TOTP-based (Google Authenticator, Authy)
- Malware Scanning - ClamAV integration
- File Integrity Monitoring - Detect unauthorized changes
- Firewall Management - UFW rule configuration
Scheduled Tasks
- Visual cron job editor
- Execution history
- Enable/disable jobs
- Common schedule presets
Configuration
Environment Variables
ServerKit is configured via environment variables. See .env.example for all options.
Required variables:
SECRET_KEY=your-secret-key
JWT_SECRET_KEY=your-jwt-secret
Database options:
# SQLite (default)
DATABASE_URL=sqlite:///serverkit.db
# PostgreSQL (production)
DATABASE_URL=postgresql://user:pass@localhost/serverkit
Notification Setup
Configure webhooks in Settings > Notifications or via environment:
DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
TELEGRAM_BOT_TOKEN=your-bot-token
TELEGRAM_CHAT_ID=your-chat-id
CLI Reference
ServerKit includes a management CLI:
# Service Management
serverkit start|stop|restart|status
serverkit logs [backend|frontend]
serverkit update
# User Management
serverkit create-admin
serverkit reset-password
serverkit list-users
# Database
serverkit init-db
serverkit migrate-db # Apply schema updates
serverkit backup-db
serverkit restore-db <file>
# App Management
serverkit list-apps # List all installed apps
# Cleanup Commands
serverkit cleanup-apps # Delete all apps and containers
serverkit cleanup-apps --delete-volumes # Also delete Docker volumes
serverkit factory-reset # Complete reset (delete everything)
# Utilities
serverkit generate-keys
serverkit config
See Deployment Guide for complete CLI documentation.
API Reference
ServerKit provides a REST API for automation and integration.
Base URL: http://localhost:47927/api/v1
Authentication: JWT Bearer tokens
Quick example:
# Login
curl -X POST http://localhost:47927/api/v1/auth/login \
-H "Content-Type: application/json" \
-d '{"username": "admin", "password": "password"}'
# Use token
curl http://localhost:47927/api/v1/system/stats \
-H "Authorization: Bearer <token>"
See API Reference for complete documentation.
Troubleshooting
Common Issues
Container won't start:
docker compose logs backend
sudo lsof -i :47927
502 Bad Gateway:
sudo systemctl status serverkit
sudo tail -f /var/log/serverkit/error.log
ClamAV not working:
sudo freshclam
sudo systemctl restart clamav-daemon
See Installation Guide - Troubleshooting for more solutions.
Additional Resources
- Main README - Project overview and quick start
- Roadmap - Development plans and upcoming features
- Contributing Guide - How to contribute
- GitHub Issues - Report bugs or request features
Support
- Bug Reports: GitHub Issues
- Feature Requests: GitHub Issues with
enhancementlabel - Security Issues: Please report privately via GitHub Security Advisories
ServerKit Documentation
Version 1.6.7