External panel

The external panel is a dedicated control panel for working with a single project.

The external panel allows managing the following products:

• Cloud Servers;
• Managed Kubernetes;
• Managed Databases;
• File Storage;
• Cloud Load Balancers;
• Container Registry;
• Secrets Manager;
• Certificate Manager.

You can grant access to the external panel to service users or user groups. Users will be able to manage project resources according to their assigned role. For example, view, create, edit, and delete project resources. Users will not be able to manage tickets or view resource consumption.

You can brand the external panel:

• change the default domain to a custom domain;
• customize the external panel appearance.

The external panel is not subject to account access restrictions. Access to the panel is always allowed from any IP address.

How it works

The external panel is created automatically for each project and is accessible via a dedicated URL. The default domain format is <project_number>.selvpc.ru, where <project_number> is the project number. The domain is accessible over HTTPS with a *.selvpc.ru certificate. You can change the default domain to a custom domain.

For an end user (such as an employee at your company) to work in the external panel, you must grant them access to the external panel. To do this, create a service user with the required role that defines the available operations with the panel products. Then, provide the end user with the service user's login credentials to access the external panel.

Grant a user access to the external panel

1. Optional: set project quotas and limits.
2. Add a service user.
3. Provide login credentials for the external panel.

1. Optional: set project quotas and limits

You can set project quotas and limits to restrict resource creation in the external panel. Panel users cannot manage these restrictions.

2. Add a service user

Users can be added by the Account Owner or users with the iam.admin role.

We recommend adding a dedicated service user for each external panel end user.

The service user's capabilities in the external panel are determined by their role.

1. In the control panel, in the top menu, click IAM.

2. Go to the Service users section.

3. Click Add service user.

4. In the Service user details block:

   4.1. Enter a username. It will be used for authorization.

   4.2. Enter a password for the user or generate one. Once the user is created, you cannot view the password — you can only change it. The password must be at least 20 characters long and include at least:

   • one uppercase and one lowercase Latin letter (A-Z, a-z);
   • one digit (0-9);
   • one special character from the ASCII Printable 7-Bit Special Characters list:
     !"#$%&'()*+,-./:;<=>?@[]^_{|}~.

   4.3. Optional: enter a description for the user.

5. In the Access settings block, configure user permissions and groups. You can add permissions manually or import permissions of another user or group:

   Configure manually

   5.1. In the permission card, select:

   • scope. If you selected the Projects scope, select the required projects;
   • role. To add users with the member role, the account balance must have funds.

   5.2. Optional: to assign another permission to the user, click Add permission and repeat step 5.1.

   Import

   5.1. Make sure you have exported the permissions of another user or group.

   5.2. Click Import.

   5.3. Select the permissions file that you exported.

   5.4. Click Import.

6. Optional: select a group for the user.

7. Click Add user. It will be added to the list on the Service users page. The account will be active immediately.

3. Provide credentials to log in to the external panel

Provide the end user with the login credentials:

• the username and password of the service user you added in step 1;
• the external panel URL, which can be copied in the Control Panel: in the top menu, click IAM → Projects → External panel tab → Default domain field.

Change the default domain to a custom domain

Only a third-level subdomain of the primary domain can be used as a custom domain, for example, first.example.com for example.com. You cannot use the primary domain.

You can configure access to the external panel using a custom domain:

• via HTTP — without a TLS(SSL) certificate;
• or via HTTPS — using a TLS(SSL) certificate.

HTTP

1. Open the DNS resource record management for the domain you will use to access the external panel:

   • if you delegated the domain to Servercore, go to the Control Panel: in the top menu, click Products → DNS hosting → Domain zones section;
   • if the domain is managed by another DNS hosting provider, open the control panel of that DNS hosting provider.

2. Create a resource record. Specify:

   • record type — CNAME;
   • record name — subdomain in the format first.example.com;
   • value — the default domain. The domain can be copied in the Control Panel: in the top menu, click IAM → Projects → External panel tab → Default domain field.

3. Wait for the DNS records to propagate. This may take up to 72 hours.

4. In the Control Panel, click IAM in the top menu.

5. Go to Projects.

6. Open the project page → External panel tab.

7. In the Panel URL section, in the Custom domain field, click Add CNAME record.

8. Enter the domain for which you created the resource record in step 2.

9. Click .

10. Verify that the external panel is accessible via your domain.

HTTPS

1. Make sure you have a TLS(SSL) certificate. If you do not have one, when using Servercore DNS hosting, you can issue a free Let’s Encrypt® certificate.

2. Create a cloud server. You can choose the minimum possible configuration, such as a Shared Line fixed configuration with 1 vCPU and 512 MB RAM.

3. Configure inbound and outbound internet access via a public floating IP address on the cloud server.

4. Open the DNS resource record management for the domain you will use to access the external panel:

   • if you delegated the domain to Servercore, go to the Control Panel: in the top menu, click Products → DNS hosting → Domain zones section;
   • if the domain is managed by another DNS hosting provider, open the control panel of that DNS hosting provider.

5. Create a resource record. Specify:

   • record type — A;
   • record name — subdomain in the format first.example.com;
   • value — the public floating IP address of the server configured in step 3.

6. Wait for the DNS records to propagate. This may take up to 72 hours.

7. Install nginx on the cloud server. Learn more in the Servercore blog article Installing and configuring nginx.

8. Add a reverse proxy server block to the nginx configuration file:

   server {
       listen              443 ssl;
       server_name         <first.example.com>;
       ssl_certificate     </etc/nginx/ssl/cert.pem>;
       ssl_certificate_key </etc/nginx/ssl/privkey.pem>;
   
       location / {
       proxy_pass <project_url>;
       }
   }

   Specify:

   • <first.example.com> — name of the subdomain where the external panel will open;
   • </etc/nginx/ssl/cert.pem> — path to the certificate file. If you are using a Let’s Encrypt® TLS(SSL) certificate, the file is named cert.pem.
   • </etc/nginx/ssl/privkey.pem> — path to the certificate private key file. If you are using Let’s Encrypt®, the file is named privkey.pem.
   • <project_url> — login link for the external panel in the format https://<project_number>.selvpc.ru, where <project_number> is the project number. The domain can be copied in the Control Panel: in the top menu, click IAM → Projects → External panel tab → Default domain field.

9. Upload the TLS(SSL) certificate and private key to the cloud server into the directories you specified in the nginx configuration file in step 8.

10. In the Control Panel, click IAM in the top menu.

11. Go to Projects.

12. Open the project page → External panel tab.

13. In the Panel URL block, in the Custom domain field, click Add CNAME record.

14. Enter the domain for which you created the resource record in step 5.

15. Click .

16. If a warning appears when adding the domain We could not detect the DNS record..., ignore it.

17. Verify that the external panel is accessible via your domain.

Customize external panel appearance

You can customize the external panel appearance to use your corporate colors and logos.

1. In the Control Panel, click IAM in the top menu.
2. Go to Projects.
3. Open the project page → External panel tab.
4. In the Panel appearance section, click Edit appearance.
5. If you want to change the panel fill color, specify a value in the Fill color field in the format #FFF or #ABC123.
6. If you want to add a logo, click Upload and select a file to upload. The logo can be uploaded in JPEG, SVG, or PNG format. The maximum logo file size is 64 KB.
7. Click Save appearance.