Z

Zecurix Control Plane

Secure SaaS Infrastructure Manager

Default: admin / ZecurixAdmin@2024 — change on first login
Z
Zecurix
Control Plane
7 servers
◆ Vault
A
admin
Overview
◈DashboardLive
▣Server Fleet7/7
Installation
◎Setup WizardPh 4
⬡HA Upgrade
⬢Cluster / K3s
Services
🔐VaultOK
◉Keycloak
⟳API Gateway
◈Monitoring
Tenants
◫Tenants0
◇Licenses
Security
◆HardeningAudit
◇Certificates
▲Firewall
≡Audit Log
Admin
◑Users
⚙Settings
Dashboard
Loading...
▣ Server Health
◎ Setup Progress
≡ Recent Events
Server Fleet
7 nodes · Real-time SSH metrics
Enter real IPs in ⚙ Configure IPs, upload your SSH key in Settings, then test connectivity before running any wizard phase.
SSH Session History
TimeUserServerCommandDuration
Installation Wizard
Step-by-step guided setup — real script execution via SSH
Configure all 7 server IPs and upload your SSH key in Settings before running phases. Each phase runs the real installation script over SSH.
HA Upgrade Path
High-availability extensions — guided, real execution
Complete all 10 wizard phases before starting HA. V1.5 requires 2 additional VMs provisioned on OpenStack.
Cluster Manager
K3s / Kubernetes deployment and node management
K3s cluster setup requires V2 HA complete. Minimum 6 additional VMs (3 control + 3 workers).
K3s Deployment Steps
1
Provision 3 control plane VMs (4vCPU/8GB) on OpenStack: openstack server create --flavor m1.large --image ubuntu-24.04 k3s-cp-{1,2,3}
2
Run OS hardening on all K3s nodes (reuse Phase 0 script)
3
Initialize K3s on CP1: curl -sfL https://get.k3s.io | sh -s - server --cluster-init --tls-san VIP_IP
4
Join CP2 and CP3 with cluster token from /var/lib/rancher/k3s/server/node-token
5
Join worker nodes: K3S_URL=https://CP1:6443 K3S_TOKEN=token curl -sfL https://get.k3s.io | sh -
6
Install Kong Ingress Controller: helm install kong/kong --set ingressController.enabled=true
7
Migrate services: run kompose convert on each docker-compose file → apply Helm charts
8
Install CloudNativePG operator for declarative PostgreSQL HA + backup to OpenStack Swift
Control Plane Nodes
Worker Nodes
Vault Manager
HashiCorp Vault · prod-control-secrets-01
Secret Paths
PathEngineAction
Actions
Command output appears here...
Keycloak Manager
SSO · Realms · Clients · Users · Themes
Keycloak admin console available at https://auth.yourdomain.com — open in new tab for full management.
Realms
RealmThemeUsersAction
Connect Keycloak to load...
OAuth2 Clients
Client IDFlowRealm
Connect Keycloak to load...
Actions
API Gateway
Kong 3.6 · Services · Routes · Plugins · Rate limits
Registered Services
ServiceUpstreamPluginsRoutesStatusAction
Loading from Kong API...
Consumer Groups (Plan-based Rate Limits)
PlanReq / minReq / dayAction
Startup301,000
Business20010,000
Enterprise1,000Unlimited
Monitoring
Prometheus · Grafana · Loki · Alertmanager
Alert Rules
AlertConditionSeverityState
ServerDownup==0 for 2mCriticalOK
VaultSealedvault_unsealed==0CriticalOK
DiskCriticaldisk>90%CriticalOK
DiskWarningdisk>75%WarningFIRING
HighMemorymem>90% 5mWarningOK
CertExpiringcert_days<14WarningOK
Service Status
ServicePortStatus
Prometheus9090Running
Grafana3000Running
Loki3100Running
Alertmanager9093Running
Tenant Manager
Multi-tenant provisioning · Schema isolation · Kong consumers
Tenant Registry
CompanySlugPlanDB SchemaStatusCreatedActions
Loading...
License Manager
Generate and validate enterprise customer licenses
Each enterprise customer who clones the Zecurix setup gets a license key. The control plane validates this on first boot.
Issued Licenses
License KeyCustomerPlanMax TenantsValid UntilStatus
Loading...
Validate a License
Security Hardening
Live checks via SSH · CIS-aligned · Auto-remediation
Click Run Full Audit to check all servers via SSH.
Certificate Manager
Internal CA · Per-service TLS · Let's Encrypt
Certificate Inventory
ServiceTypeIssuedExpiresDays LeftStatusAction
Firewall Manager
UFW rules per server · Live verification
Audit Log
All actions · SSH sessions · Tenant events · Vault access
TimeUserActionResourceIP
Loading...
User Management
Control plane users · Roles · Access
These are users of this control plane app. After Keycloak setup, SSO login will be available — configure in Settings → Keycloak SSO.
UsernameRoleEmailLast LoginActions
Loading...
Settings
Server config · SSH key · SMTP · Keycloak SSO
⚙ Server IP Configuration
🔑 SSH Private Key
Paste your SSH private key. It is stored encrypted on this server only and never transmitted to clients.
📧 SMTP Configuration
🔐 Keycloak SSO (enable after infra setup)
Enable Keycloak SSO Login
🌐 Domain & Network
⚠ Change Admin Password
SSH Command
Output appears here...
Provision New Tenant
Server IP Configuration
Enter your 7 server IPs. Go to Settings to upload your SSH private key.
Initialize Vault
⚠ This runs ONCE. Save the 5 unseal keys in a secure offline location — they cannot be recovered if lost.
Vault must be running (Phase 2 complete) before initializing.
Output will appear here...
Unseal Vault
Enter 3 of your 5 unseal keys one at a time. Each call progresses the unseal counter.
Output...
Generate SSH Certificate
Certificate output...
Register API Service in Kong
Inject X-Tenant-ID from JWT
Generate Enterprise License
K3s Cluster Deployment
Requires 6+ new VMs. Run Phase 0 (OS hardening) on all new nodes first.
Output...
Account
Logged in as: admin
Create Control Plane User
Add UFW Rule
Add Cluster Node
Renew Certificates
Internal certs are valid 365 days from initial setup. Let's Encrypt auto-renews via certbot.timer.
Output...
Create Keycloak Realm
⚠ Seal Vault
Sealing Vault will immediately block all secret access. All services depending on Vault will fail. Unseal requires 3 of 5 keys.
Rotate AppRole Secret IDs
Generates new secret IDs for all AppRole roles and distributes them to the relevant servers. Old IDs are immediately revoked.
Output...