The UI¶
Stronghold's pages in Cockpit (D4), and the same pages in the standalone
UI (stronghold-ui). This note is how they are laid out; each area's
note says what its page does.
Status: done (18 October 2026), as below: the Zones tab is gone into
Firewall, DHCP, DNS, VPN and High availability follow the config, the
load balancer is a section of Interfaces (20 October 2026), and so are
the proxies (Interfaces › Proxies, proxy.js, always shown: they are
service functions, turned on there or in Features), System has
its sections with Features first (features.js),
dynamic DNS is on the DNS tab, UPnP is a part of Firewall › NAT (its
mappings listed there, a tile on Overview), and Overview and Troubleshoot know the
functions (below).
Tabs that follow the config¶
A tab shows when its area is in use, and the config says so, not a setting of the UI: what the CLI or Ansible turned on shows for every admin, and turning it off is a change like any other.
| Tab | Shown |
|---|---|
| Overview, Interfaces, Networks, Firewall, System, Troubleshoot | always |
| DHCP | DHCP here, or elsewhere through the box's relay |
| DNS | the resolver or the local zones here or elsewhere, or dynamic DNS on |
| VPN | WireGuard tunnels, Tailscale or headscale on |
| Interfaces › Load balancer (a section) | virtual servers on |
| High availability | a pair |
| Wi-Fi | the box has a radio |
A home box with DHCP and DNS has eight tabs; the always-shown core is six.
Firewall with its zones¶
A zone is a group of networks, the firewall the policy between zones: one tab. It starts with the zones (their names and types, which networks are in each, a new one), then the zone matrix, NAT, objects, IDS and the history. A network's zone is also set on the Networks tab.
System, in sections¶
System is the box's settings, in sections rather than one long page:
| Section | What it has |
|---|---|
| Features | what the box does (below) |
| Updates | updates and their window (the image, or dnf's packages in package mode) |
| Backups | the config in git, backups and their schedule |
| Access | identity and roles; web access (the API over HTTPS, single sign-on); API tokens (made, re-roled and removed in Cockpit, where the box's socket is: the standalone UI says to use Cockpit or the CLI) |
| Secrets and certificates | secrets (OpenBao), the box's certificates |
| Alerts | the channels and the log |
Dynamic DNS moves to the DNS tab, where it is looked for. With the resolver elsewhere the DNS tab says so ("Clients use 9.9.9.9") and shows the resolver's settings as kept, not in use.
Features¶
One card per area, what the box does (functions.md, "Enabling a
function"):
- A service function (DHCP, the DNS resolver, local zones, router advertisements, IDS, headscale, dynamic DNS, ACME, BGP) is off, elsewhere (an address: "clients use 10.0.0.53") or here; here shows how it runs (container or host, with a choice only where the box offers both, and why not otherwise: "image mode: containers only") and its state (running, restarts, the last error). Here on a box from packages without the function installs it first (its packages through PackageKit, or its containers when the box runs functions in them), with its progress on the card, then shows the change; there is no separate Install button. Nothing is installed until then.
- A host feature (WireGuard, Tailscale, the load balancer, high availability) is on or off.
- On writes the area's section with defaults from the box's networks; off removes it, asking first when it holds config; both go through commit-with-confirm, so they can be undone.
- A fresh box's Overview points here: "Choose what this box does".
It replaces the "Service functions" card of today's System tab, whose state moves onto the cards.
Overview¶
- What this box does: a chip per area in use (here, elsewhere with its servers, a problem), leading to Features; on a box that neither hands out addresses nor answers DNS, "Choose what this box does".
- Tiles: DHCP and DNS say "elsewhere" (and where) when they are; a Services tile counts the functions' programs running, and names those that aren't.
- IPsec: a tile with the tunnels up; it warns when a tunnel with
certificates has none given, one that expires within 14 days or has
expired, or a revocation list that could not be had (
vpn.md). - OpenVPN: a tile with the servers running and their clients; it warns for a certificate that is out or expires within 14 days, or a revocation list that could not be had.
- Daemon: how the box was installed (an image or packages) and
SELinux's mode (
GET /v1/status).
Troubleshoot¶
- Tools follow the box: the resolver's (flush, statistics) while it is here, the upstream test also for the servers elsewhere, DHCP's while the box serves it, a relay log while it relays.
- Look up a name also asks the DNS servers elsewhere (the resolver's, the local zones'), directly.
- Functions: each program, where it runs and whether it does.
- Rule hits: each cell's rules' hit counters, the default's last
(
firewall.md, "Hit counters"), optionally from one zone: which rule a connection met, which never match. - IPsec: the tunnels' associations and states, and, with certificates, what libreswan's database holds: the certificates and the revocation lists.
- OpenVPN: the servers' log: who connected, whose certificate was refused and why.
- SELinux denials: what SELinux refused since the box started, from the journal (the box has no auditd).
- Services and logs list the box's own services and the functions' programs in use; a program in a container shows its container's.
Order¶
Done in that order: the functions' elsewhere and their installs
(functions.md, phase 8), then this layout as one change. Later System
may be a Cockpit menu entry of its own (D4: a set of Cockpit plugins).