Files
ServerKit/docs
Juan DenisandClaude Opus 5 0bb7e4ab54 fix(install): derive the real client IP on a stock host install
install.sh wrote no TRUST_PROXY_HEADERS line at all, so the code default (False)
applied while every host install serves the panel through its own nginx. Per-IP
rate limits, the login brute-force throttle and every audit-log entry therefore
keyed on 127.0.0.1, which quietly weakened all three -- one abusive client shared
a bucket with everyone else. .env.example claimed true, so the two disagreed and
it looked configured.

Trusting X-Forwarded-For is only safe when nothing can reach gunicorn without
traversing a proxy we control, so the switch follows that condition rather than
assuming it. On a host install it holds: render_service_unit binds gunicorn to
127.0.0.1 and bootstrap_firewall opens SSH + 80/443 + PANEL_PORT and never the
backend port. backend_bind_host() is now the single source of truth for both the
systemd unit and the trust decision so the two cannot drift, and
backend_is_loopback_only() gates the setting.

- stock install: TRUST_PROXY_HEADERS=true, TRUSTED_PROXY_HOPS=1
- SERVERKIT_EXTERNAL_PROXY=1: true with 2 hops, unchanged
- SERVERKIT_BIND_HOST not loopback: false plus a warning. The port is directly
  reachable there, so the header is attacker-chosen, and a forged IP is worse
  than a wrong one because it defeats the throttles that consume it.

Re-runs backfill it into installs that predate this, via _env_default_key, which
fills a gap but never overrides an uncommented value -- flipping someone's
deliberate false back on would be the worst kind of surprise.

.env.example moves to false on purpose: that file is the Docker/manual path and
docker-compose.yml publishes 5000 on all interfaces, so true was the unsafe
default there. Host installs never read it. SECURITY.md claimed "the shipped
nginx deploy sets it", which was untrue until now.

T44 covers all six behaviours, each mutation-checked by line number: disabling
the branch, inverting it to trust an exposed port, and disabling the backfill
each fail exactly one assertion and no others.

Shell suite 121 passed. Backend suite 3542 passed, 48 skipped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-13 23:52:55 -04:00
..

ServerKit Documentation

Welcome to the ServerKit documentation. This guide will help you install, configure, and use ServerKit effectively.


Document Description
Installation Guide Complete setup instructions for Docker and manual installation
Architecture System design, request flow, and diagrams
Deployment Guide Production deployment, CLI commands, and configuration
Local Development Run the panel locally for development
API Reference REST API documentation with examples
Multi-Environment Guide Set up prod/dev WordPress pairs with shared database
Multi-Server & Agent Install the agent and connect remote servers (see also pairing)

Getting Started

1. Installation

Choose your preferred installation method:

2. Initial Setup

After installation:

  1. Access ServerKit at http://your-server-ip
  2. Create your admin account (first user becomes admin)
  3. Enable Two-Factor Authentication
  4. Configure Notifications

3. Start Managing

  • Add your first application from the Applications page
  • Configure domains and SSL certificates
  • Set up monitoring alerts
  • Enable security scanning

Feature Guides

Application Management

ServerKit supports multiple application types:

Type Runtime Process Manager
PHP / WordPress PHP-FPM 8.x Nginx
Python (Flask/Django) Python 3.x Gunicorn
Node.js Node 18+ PM2
Docker Containers Docker Engine

Each application includes:

  • Environment variable management (encrypted)
  • Log viewing and streaming
  • Start/stop/restart controls
  • Domain and SSL configuration

Multi-Environment Support

ServerKit supports multi-environment linking for WordPress and other applications:

  • Production/Development Pairs - Link apps as prod/dev environments
  • Shared Database - Both environments can share the same MySQL database with different table prefixes
  • Environment Badges - Visual indicators (PROD/DEV/STAGING) in the UI
  • Quick Navigation - One-click switching between linked environments
  • Credential Propagation - Automatically share database credentials between linked apps

Common use case: WordPress theme development

  1. Production WordPress serves live traffic
  2. Development WordPress shares the database (separate tables)
  3. Develop themes in dev without affecting production

See the Multi-Environment Setup Guide for detailed instructions.

Domain & SSL

  • Nginx Virtual Hosts - Automatic configuration generation
  • Let's Encrypt SSL - Free certificates with auto-renewal
  • Custom Certificates - Upload your own SSL certificates

Database Management

Supported databases:

  • MySQL / MariaDB
  • PostgreSQL

Features:

  • Create/delete databases
  • User management
  • Basic query interface

Monitoring & Alerts

Real-time monitoring includes:

  • CPU, RAM, disk usage
  • Network traffic
  • Server uptime history
  • Process monitoring

Alert channels:

  • Discord webhooks
  • Slack webhooks
  • Telegram bot
  • Generic HTTP webhooks

Security

  • Two-Factor Authentication - TOTP-based (Google Authenticator, Authy)
  • Malware Scanning - ClamAV integration
  • File Integrity Monitoring - Detect unauthorized changes
  • Firewall Management - UFW rule configuration

Scheduled Tasks

  • Visual cron job editor
  • Execution history
  • Enable/disable jobs
  • Common schedule presets

Configuration

Environment Variables

ServerKit is configured via environment variables. See .env.example for all options.

Required variables:

SECRET_KEY=your-secret-key
JWT_SECRET_KEY=your-jwt-secret

Database options:

# SQLite (default)
DATABASE_URL=sqlite:///serverkit.db

# PostgreSQL (production)
DATABASE_URL=postgresql://user:pass@localhost/serverkit

Notification Setup

Configure webhooks in Settings > Notifications or via environment:

DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
TELEGRAM_BOT_TOKEN=your-bot-token
TELEGRAM_CHAT_ID=your-chat-id

CLI Reference

ServerKit includes a management CLI:

# Service Management
serverkit start|stop|restart|status
serverkit logs [backend|frontend]
serverkit update

# User Management
serverkit create-admin
serverkit reset-password
serverkit list-users

# Database
serverkit init-db
serverkit migrate-db          # Apply schema updates
serverkit backup-db
serverkit restore-db <file>

# App Management
serverkit list-apps           # List all installed apps

# Cleanup Commands
serverkit cleanup-apps        # Delete all apps and containers
serverkit cleanup-apps --delete-volumes   # Also delete Docker volumes
serverkit factory-reset       # Complete reset (delete everything)

# Utilities
serverkit generate-keys
serverkit config

See Deployment Guide for complete CLI documentation.


API Reference

ServerKit provides a REST API for automation and integration.

Base URL: http://localhost:47927/api/v1

Authentication: JWT Bearer tokens

Quick example:

# Login
curl -X POST http://localhost:47927/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "password"}'

# Use token
curl http://localhost:47927/api/v1/system/stats \
  -H "Authorization: Bearer <token>"

See API Reference for complete documentation.


Troubleshooting

Common Issues

Container won't start:

docker compose logs backend
sudo lsof -i :47927

502 Bad Gateway:

sudo systemctl status serverkit
sudo tail -f /var/log/serverkit/error.log

ClamAV not working:

sudo freshclam
sudo systemctl restart clamav-daemon

See Installation Guide - Troubleshooting for more solutions.


Additional Resources


Support

  • Bug Reports: GitHub Issues
  • Feature Requests: GitHub Issues with enhancement label
  • Security Issues: Please report privately via GitHub Security Advisories

ServerKit Documentation
Version 1.6.7