Status
what is happening on the machine right now
Source code
Components deploy/compose.yml
| Service | Image | State | Details |
|---|
Operation
A panel runs on every node and manages only its own machine.
Whatever it learns about the others, it only reads: if a peer is
unreachable, this panel keeps working.
Nodes
| Node | Link | Version | Deployed | Components | Memory | Clock |
|---|
Log
Machine
Disks
| Mount | Used | Free |
|---|
What is using memory processes grouped by name, the biggest first
| Process | Memory |
|---|
What is using disk
| Directory | Size |
|---|
What can be freed
A mistake here cuts the machine off entirely, so changes that can do that are made with a way back: the panel holds the previous address or route for two minutes and returns to it unless you confirm the connection is alive. What the panel did not add itself — docker addresses, the address you are connected over — it will not remove.
Routes where traffic leaves this machine
| Destination | Through | Interface |
|---|
Addresses
| Address | What it is for | Goes out through | Interface | Kind |
|---|
These are accounts of the server itself, not of the panel.
Membership in sudo or docker is equivalent to root: docker
mounts the whole disk. Hand them out as carefully as the root password.
Host accounts of the machine
| Login | Access | Shell | Rights |
|---|
Which user runs which service read only
| Service | Kind | User | Where it is set |
|---|
Panel users separate from the Pulu database
| Login | Role | Access | Last seen |
|---|
Roles named bundles of permissions
| Role | Kind | Users | Permissions |
|---|
Sessions where this account is signed in
| From | Client | Started | Expires |
|---|
The panel keeps the intent and rebuilds the nginx configuration from it. Editing the generated file by hand is pointless — the next save from the panel overwrites it.
Sites
| Domain | Target | Certificate | Pulu routes |
|---|
A copy is what stands between a mistake and a lost machine.
What goes into a copy
Scheduled copies
| Name | When | What | Where | Last run |
|---|
Where copies go
| Name | Kind | Where | Keep |
|---|
Copies on this machine the two latest are kept here
| Archive | When | Size |
|---|
Emergency envelope one file for the safe
The copy goes to storage, and the keys to that storage lie inside the copy — on a bare machine that is a circle. The envelope breaks it: the encryption key and every destination in one small file, for the safe rather than for this machine.
History last 50 runs
| When | Task | Result | Size | Where |
|---|
Websites live here — a landing page, docs, a status page next to the service. They run in a container, away from Pulu itself: a hole in a small site must not reach the service’s data. Names, certificates and renewal are the same machinery as everywhere else in the panel; files and PHP are what stays inside.
Hosting environment
Disk for sites
Users with hosting
| User | Home directory | Size | SFTP keys | Sites |
|---|
Scheduled jobs
| User | Schedule | Command | Description |
|---|
Databases
| Database | User | Database user | Added |
|---|
Hosting sites
| Domain | User | PHP | Certificate | Document root |
|---|
Running now
Components of the server
| Package | State | Version | Ports / Disk |
|---|
A connected zone is edited here: records, mail, certificates. The panel keeps its own records in order — MX and DKIM for mail, TXT for wildcard certificates, which can be validated only through DNS and only on every renewal. Records it did not create are left alone.
Domain zones
| Zone | Provider | Registered until |
|---|
DNS
Turns off the check of who owns a domain one level up or down when a site is created.
A certificate is an object of its own, not a property of a domain. One pool for the whole machine — the same certificate can serve several services.
Unfinished orders waiting for DNS records
| Domains | Started |
|---|
SSL certificates one pool for the whole machine
| Name | Kind | Primary domain | Alternative names | Valid until |
|---|
Mail domains
| Domain | Default forwarding | Certificate | Mailboxes | Managed by |
|---|
Mailboxes
| Address | Quota | Aliases | Forwarding |
|---|
Settings for mail clients phone, Thunderbird, Outlook
Webmail address
Mail settings server name, webmail, what the mail server refuses
Loft node
Client snippet YAML for loft on the client
Overlay network
Managed routes pushed to members, like ZeroTier managed routes
| Destination | Through | Note |
|---|
VLANs broadcast domains inside the overlay
| VLAN | Name | CIDR | Peer visibility |
|---|
Switch rules first match wins; empty fields are wildcards
| Action | Source | Destination | Proto | Ports |
|---|
Members
| Id | Name | Sticky IP | VLAN | Authorized | Session limit | Key |
|---|
All conversations
Two different locks. The interface decides which socket the panel
binds to; an allowed name decides which Host it agrees to answer.
While no name is listed the panel answers on anything — that is the window to close.
Certificate
Panel addresses
| Address | Direct access | Certificate | Language |
|---|
Active sessions who is signed in right now
| Login | From | Client | Started | Expires |
|---|
Security what the panel enforces on sign-in
Guardian who gets locked out, and by what rule
Trusted addresses the Guard never touches these — no block, no tarpit, no drop
One address or subnet per line (IP or CIDR).
Blocked addresses
The lock is inside the panel: a blocked address is refused at its door.