Deployment Overview of Webmin on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the following requirements must be met:

• Operating System: Debian or Ubuntu (for apt based systems) or CentOS, Rocky Linux, or AlmaLinux (for yum based systems).

• Privileges: Root or sudo access is required for all installation steps.

• Ports:

• Port 10000/tcp: Used by Webmin internally.

• Port 443/tcp: External HTTPS access via the reverse proxy.

FQDN of the final panel on the hostkey.in domain¶

The application is accessible via a specific subdomain template based on the server ID.

Application installation process¶

The installation method depends on the operating system of the server:

Debian and Ubuntu Systems¶

1. The system removes any conflicting legacy Docker sources or keys to prevent package manager conflicts.

2. Essential dependencies such as gnupg2, curl, and wget are installed via apt.

3. The Webmin GPG key is added to the system's trusted keys.

4. The official Webmin repository is added to the APT sources list.

5. The package manager cache is updated, and any unnecessary dependencies are removed.

6. The webmin package is installed via apt.

RHEL-based Systems (CentOS, Rocky Linux, AlmaLinux)¶

1. A repository installation script is downloaded from the official Webmin GitHub repository to /tmp/setup-repos.sh.

2. The script is executed to configure the necessary repositories.

3. The webmin package is installed using the yum package manager.

Post-Installation Configuration¶

After the core application is installed, several configuration steps are performed:

1. Webmin's internal SSL is disabled in /etc/webmin/miniserv.conf.

2. The host parameter in /etc/webmin/miniserv.conf is updated to match the public FQDN of the server.

3. The Webmin service is restarted to apply changes.

Access Rights and Security¶

Security is managed through system firewalls:

• Ubuntu/Debian: ufw is used to allow incoming traffic on port 10000/tcp.

• RHEL/CentOS/Rocky/AlmaLinux: firewalld is configured to allow incoming traffic on port 10000/tcp in the public zone.

Docker Containers and Their Deployment¶

The deployment utilizes a Docker container to handle SSL termination and reverse proxying via Nginx and Certbot.

Nginx-Certbot Container¶

• Image: jonasal/nginx-certbot:latest

• Network Mode: host

• Restart Policy: unless-stopped

• Environment Variables:

• CERTBOT_EMAIL: [email protected]

• Volumes:

• nginx_secrets:/etc/letsencrypt (External volume for SSL certificates)

• /data/nginx/user_conf.d:/etc/nginx/user_conf.d (Configuration directory)

The container is managed using a compose.yml file located in /root/nginx/.

Custom Scripts and Additional Setup¶

Several automated actions are performed to finalize the environment:

• Repository Cleanup: A script is used during RHEL installation to automate repository setup.

• Proxy Configuration: The system modifies Nginx configuration files in /data/nginx/user_conf.d/ to ensure that proxy_pass points correctly to http://127.0.0.1:10000 and includes necessary headers (Host and X-Forwarded-Proto) for proper SSL termination.

• Nginx Reload: After configuration changes, the Nginx process inside the container is reloaded using docker compose exec -T nginx nginx -s reload.

Application Update Instructions¶

To update the Webmin application:

• On Debian/Ubuntu: Use the package manager to upgrade the installed package:

  apt-get update && apt-get install --only-upgrade webmin
  

• On RHEL-based systems: Use the yum command:

  yum update webmin
  

Location of configuration files and data¶

Available ports for connection¶

• Internal Webmin Port: 10000 (Accessible locally or via proxy).

• External HTTPS Port: 443 (Standard web access).