KVM with web management via Cockpit: Deployment Overview on Server¶

Prerequisites¶

The following conditions must be met for the system to operate correctly:

• Operating System: Ubuntu.

• Internet access to obtain Let's Encrypt certificates and install packages.

• Open ports: 443 (HTTPS) and 80 (HTTP, used temporarily by Certbot).

FQDN of the final panel on hostkey.in domain¶

The following domain name template is used to access the web management interface:

Application Installation Process¶

Deployment includes the installation of the KVM virtualization environment and the Cockpit management panel. Key stages:

1. Installation of system packages (QEMU, Libvirt, Cockpit).

2. Configuration of the network bridge and virtualization services.

3. Obtaining Let's Encrypt SSL certificates to ensure secure access via HTTPS.

4. Integration of certificates into the web management interface (Cockpit).

Access Rights and Security¶

System security is ensured by the following measures:

• root user login to the Cockpit interface is allowed (configured in /etc/cockpit/disallowed-users).

• Certificate file permissions restriction: owner is root, group is cockpit-ws, permissions are 640.

• Use of container runtime mode with restricted access to system resources.

Databases¶

Databases are not used in this configuration.

Docker Containers and Execution¶

A Docker container is used for SSL certificate management:

Application Update Instructions¶

Updates are performed via pull and container restarts or by updating system packages through the apt package manager.

Permission Settings¶

The following permissions are set for the Cockpit certificate directory:

• Directory /etc/cockpit/ws-certs.d: owner root, group root, mode 0755.

• .crt and .key files: owner root, group cockpit-ws, mode 640.

Configuration Files and Data Locations¶

Primary file paths:

• Nginx configurations (via Docker): /data/nginx/user_conf.d

• Let's Encrypt certificates: /etc/letsencrypt/live/{FQDN}/

• Cockpit certificates: /etc/cockpit/ws-certs.d/

• Nginx-Certbot configuration (env): /data/nginx/nginx-certbot.env

Available Connection Ports¶