Hub — settings reference

Settings (/settings) is a tabbed page: one tab per block, grouped under four headings by what an operator is trying to do. The tab is in the URL (/settings/backups, /settings/logging, …), so a link lands on the right one and /settings alone opens the first. This page tours the tabs in strip order.

Group	Tabs
Certificate issuance	Renewal Profiles · Certificate Providers · DNS providers · ACME accounts
Scouts and alerting	Scout connectivity · Notifications
Hub posture	Internal CA
Data and recovery	Backups · Data retention · Logging

Certificate issuance

Renewal Profiles

The list of reusable issuance-and-renewal bundles — name, contact email, issuance method, and environment per profile — with New Profile opening the editor. Profiles are what you assign to endpoints in Manage. Full reference: Renewal profiles.

Certificate Providers

The public ACME CAs renewal profiles can issue through. Pick a provider to see its directory URLs, CAA issuer domain, EAB state, ARI support, duplicate-certificate limits, and key-type constraints, and to set or clear its EAB credentials; Add custom provider registers any other ACME CA by directory URL. Full reference: Certificate providers.

DNS providers

The DNS credentials the Hub uses to publish DNS-01 challenge records. Add one entry per DNS service or account — AWS Route 53, Cloudflare, or Google Cloud DNS — each with a DNS provider ID you choose and a display name. Credentials are health-checked live before they are accepted, so a bad one is refused at save time rather than discovered mid-renewal.

Each entry shows which renewal profiles select it, offers Test to re-run the health check, and Remove, which is refused while a profile still names it. Re-saving an existing ID replaces that provider's credentials in place — the way to rotate a key without touching the profiles.

A Hub default (legacy) block appears when this Hub still holds the single provider that earlier releases stored. It is what every renewal profile that has not chosen a provider of its own uses, so removing it stops DNS-01 for all of them.

Field-by-field detail, and how a profile picks between entries: Renewal profiles → The DNS provider.

Three things about this panel are worth knowing before you fight it:

• A rejected save reports itself inside the panel, next to the button that raised it. On builds before 2026-08-22 every error rendered once at the bottom of Settings, below Backups — so a DNS credential refused at the top of the page put its message far below the fold, and six consecutive AWS rejections read as an inert button.
• Secret fields carry a Show/Hide toggle. An AWS secret is 40 pasted characters, and as dots a truncated paste is indistinguishable from a wrong policy. The toggle reveals what you have just typed into the form — never anything the Hub has stored.
• Known credential shapes are validated in the browser: Route 53 hosted zone ID (Z plus 9–31 uppercase alphanumerics), AWS access key ID, Cloudflare zone ID (32 hex). Values are trimmed on submit, so a trailing newline off a copy-paste no longer reaches a signed request. A one-character-short hosted zone ID used to reach AWS and come back a silent 404.

⚠️ The health check proves the Hub can read the zone, not write to it. A read-only credential passes here and fails at the first renewal.

ACME accounts

The CA accounts this Hub holds. You do not create them here: one is registered automatically the first time a renewal profile issues, keyed by that profile's contact email, provider, and environment — profiles sharing all three share an account. Each entry shows which profiles use it (an account used by none is an orphan; nothing will renew through it) and offers one action, Re-register, which replaces the account key.

Re-register discards the account's history

Re-registering exists for recovery — chiefly after a CA-passphrase rotation leaves stored account credentials undecryptable. The existing account key is replaced and its history with the CA is lost.

Under the Domains sub-heading sits the ACME domain allowlist — the backstop list of domains this Hub may order public certificates for, with Add domain and a per-entry remove. You rarely tend it by hand; renewing and adding endpoints maintain it automatically. See Renewal profiles → The domain allowlist.

Scouts and alerting

Scout connectivity

The addresses this Hub hands to Scouts and installers:

Field	Meaning
Scout REST URL	Where Scouts reach the Hub's REST surface — hub.example.internal:8443 on a default (plain-HTTP) install; use an https:// URL only where TLS is terminated in front of that port
Scout NATS URL	The NATS broker Scouts connect to for commands and reports, e.g. tls://hub.example.internal:4222
NATS monitoring URL	Optional. The NATS server's HTTP monitoring endpoint (conventionally port 8222). After enrolment the Hub only ever sees Scouts through the broker, so this is what enables the "Connected from" address on each Scout's page.
Advertised hosts	Comma-separated hostnames the Hub advertises about itself; the line beneath shows where the current value came from.

Each field saves independently with its own button. See Scout → Transport for what Scouts do with these.

Notifications

An operator-supplied notification hook command — a local command the Hub executes for events, never a URL it fetches (the server refuses a URL outright) — plus a Notify me about severity floor: Errors only, Warnings and errors, Warnings, errors and completions, or Everything (very noisy). The panel's status lines state whether a hook is configured and what the current floor means.

Hub posture

Internal CA

Read-only: the Hub CA's Subject and a one-line Crypto summary of the runtime — "Standard OpenSSL … mode" on a standard build; a validated provider build names the provider, its version, and its CMVP certificate. Running in FIPS mode is a request, not evidence, so only a validated provider ever changes this line. Managing the CA itself (issuing, the chain, OCSP/CRL) lives on the Internal CA page, not here.

Data and recovery

Backups

Scheduled, encrypted Hub backups:

Field	Meaning
Backup directory	Where backup files are written
Run backups on a schedule	Enables the timer
Every (hours)	Schedule interval
Backups retained	How many files to keep
Passphrase	Encrypts every backup. Write-only — leave blank to keep the stored one. Required before any backup can be written.

Status lines report the schedule state and the last backup (or last failure). Back up now runs one immediately. Restore from a backup takes a backup file path and the word RESTORE typed back. The full procedure is Back up and restore the Hub.

Restore replaces the whole database

Restoring replaces this Hub's entire database with the chosen file's contents. There is no partial restore from this panel.

Changing the backup passphrase strands old backups

Backups are encrypted under the passphrase current when they were written. Setting a new one leaves every existing backup readable only with the old passphrase — keep it somewhere safe until those backups have aged out.

Data retention

Bounds scan history per hostname per vantage: Scans kept per hostname per vantage and Remove surplus older than (days). The newest observations are always kept — including the newest one carrying a certificate — so a quiet endpoint never loses the proof behind its posture; only the surplus beyond the keep count, once past the age cap, is removed. The panel shows when retention last swept.

Logging

Where this Hub's logs go, at what level, and what the operator has done lately — three things the Hub could not tell you before 2026-08-26.

Hub. The sink is the systemd journal when systemd captures the service's output (the tab prints the exact journalctl -u <unit> to run), otherwise standard output. Level is the cyphers_hub level in effect; Boot filter is the RUST_LOG the process started with, and Active filter the directives currently applied.

Hub log level changes the level in the running Hub — immediately, without a restart, and only until the next one: the env file's RUST_LOG stays the boot default, and nothing is persisted. The change is audited (settings_log_level_set, with the from → to levels). Pick debug to chase a problem and put it back afterwards; trace is very loud. A Hub that started without a reloadable subscriber says so here instead of offering the control — set RUST_LOG in the env file and restart.

Scouts log on their own hosts, never to the Hub: journalctl -u cyphers-scout and the structured file /var/log/cyphers-scout/scout.log, with the level set per Scout by its --log-level flag. See Scout — logging.

Recent operator actions lists the newest audit rows a signed-in user produced — settings changes, fleet mutations (adopt, stop managing, delete, wildcard host add/remove), refusals — with who, when, and the recorded detail. This is the place to answer "who changed this?": every operator mutation on Manage leaves a row here, and the Hub's journal carries one manage action line per request (actor, endpoint, verb, outcome) besides.

Secrets discipline

Credentials entered on this page are write-only: EAB HMAC keys, DNS provider credentials, and the backup passphrase are accepted, encrypted, and never displayed again — no read API returns them. EAB and DNS credentials are encrypted under the CA passphrase, and a DNS configuration must additionally pass a live health check before it is stored. The Show/Hide toggle on a secret field is not an exception: it reveals the characters you have typed into the form in this browser, before submission, and has no way to read a stored value. The recovery consequences of rotating that passphrase are covered in Certificate providers → Secrets discipline.