The panel's own address
Where the dashboard answers, the certificate it uses, and what changing it affects.
What it is
Moving it is a real operation with real consequences, which is why it has its own page.
Settings -> Deplo, instance admins only.
How it works
The panel is routed by the host's Traefik like anything else, but through a file provider entry rather than container labels. That's deliberate: a panel published by labels could never change its own route, because changing it would need the panel.
It is served over HTTPS and nothing else, and it is never reachable at
http://<server-ip>:3000: that port is published on 127.0.0.1 only. A panel on
an open port is a login page on the internet with no TLS in front of it.
Two routers point at it, always:
- Your domain, when you gave one, with a Let's Encrypt certificate.
- A generated
deplo-<hex>.nip.iohost, which resolves to this server with no DNS to set up. It is the address that still answers when your domain, its DNS or its certificate is what broke, and it cannot be turned off.
The address is also used for more than serving pages:
- It is baked into the install command printed for new servers.
- It is where git provider webhooks deliver.
- It is the origin passkeys are bound to.
- It sets the cookie
secureflag.
Change the address
Point DNS at this server
Point the new hostname's DNS at this server first. The page shows the exact record.
Open the panel address setting
Settings -> Deplo, find Panel address, click Change address.
Enter the new address
An impact check runs and tells you what it found: passkeys that stop working, sessions that end, or a DNS record that does not resolve here yet. An IP address is refused: no certificate authority issues for one.
Save
The certificate issues on the first request to the new address.
The generated deplo-<hex>.nip.io address keeps working throughout, so the panel
stays reachable while DNS moves. See
ports, networks, and files.
HTTPS is not optional
There is no switch to serve the panel on plain http from the General tab, and no
way to reach it on <server-ip>:3000. The one exception lives under
Settings -> Deplo -> Advanced, Serve the panel over plain HTTP, and it
exists for one case: a panel on an internal network that no certificate authority
can reach. Turning it on sends every password and every session cookie across the
network in clear, and passkeys stop working entirely, so the confirm says so.
The generated address serves a certificate the browser does not know
No public authority issues for a nip.io hostname, so the installer mints a
self-signed one into /opt/deplo/traefik/certs/ and the browser warns once. It is
minted once and kept, so accepting it holds: Traefik's own default certificate
is regenerated at every start, which would make the warning come back after each
restart and break the certificate an enrolling agent pins. Set your own domain to
get one the browser trusts. Deplo does not send HSTS on that address, precisely so
the warning stays skippable.
The certificate account email
Certificate account email, on the same page, is the address Let's Encrypt has on file for this instance's ACME account. It is where expiry warnings go.
Limits and gotchas
- The install command for a new server carries
-kwhile the panel's certificate is the self-signed one. The agent is unaffected: it pins the certificate's fingerprint at enrollment either way. - Every passkey breaks when the address changes. They are bound to a hostname by the standard. They show Not usable here, the password still signs people in, and everyone re-registers a passkey on the new address. Warn your team before you do this.
- Webhooks must be re-pointed. Deplo re-registers what it can, but a provider that cannot reach the new address stops delivering, and pushes stop deploying.
- The install command changes. Servers already enrolled are unaffected, new ones use the new address.
- An IP address is refused as the panel address. Let's Encrypt does not issue for bare IPs, and Deplo generates a
nip.iohostname instead. DEPLO_PUBLIC_URLin/opt/deplo/.envis the other half. If you edit the environment by hand, keep them consistent.
If it does not work
If it does not work
A certificate warning on the new address, a panel unreachable after the change, or "No server accepted the change": see Domains and TLS troubleshooting.
See also
Did this page help you?