Server settings

The server's Settings page holds everything that isn't about one app.

#Panel address

Move the panel to a domain you own, like panel.example.com. Point the name at the server first. The panel checks public DNS, waits until the certificate is issued, then switches. The old address redirects to the new one.

#Apps domain

The base of every app's free address. With your own domain, every app gets <app>.apps.example.com; it needs one wildcard DNS record, *.apps.example.com. The old addresses keep redirecting.

#Access

Who can reach the panel at all:

• Anyone: with your password plus a code from your authenticator app.
• Only some addresses: yours is filled in.
• Tailscale only.

Blocked requests stop at Caddy and never reach the panel. GitHub's webhook always gets through, so deploys keep working. A list that would lock you out is refused, and if you lose access anyway, layer access reset on the server undoes any list.

#Builds

How many projects can build at the same time, 1 to 4. A build can use twice its app's memory limit, so on small servers, one at a time is safest.

#GitHub

The GitHub App this server created under your account. Its private key never leaves the server. Install it on more repositories from here.

#Account

• Change your password. That signs out every other session.
• Make new recovery codes. The old ones stop working.
• See where you're signed in, and sign out the others.

Five failed sign-ins lock out that address and that account for 15 minutes.

#Version and repair

The panel's version, the agent's and the server's, with Check for updates and the switch for the automatic checks every 6 hours. When a newer release is out, you can update from here or from Update available in the sidebar. Repair puts back files edited by hand. See Updates and repair.

#Firewall

The server's Firewall page shows the firewall's rules and fail2ban's SSH jail: who is banned now, and how many failures so far. Editing rules from the panel is coming.

ufw status verbose
fail2ban-client status sshd

#Activity

The server's Activity page lists every change the agent made, in words, newest first: what it did, which app it was about, the result, how long it took and when. A change that failed says why. Reads aren't listed, only changes.

tail -f /var/log/layer/audit.jsonl