Configuration

After installation, CLICD runs as a systemd service. Runtime configuration and the database are stored locally on the host. The exact path may vary with installer options, but the default installation should mainly be checked under /root/.clicd/.

Common Settings

Setting	Description
Web port	Defaults to 8999, listening on 0.0.0.0:8999.
Administrator account	Used to log in to the web panel and manage API keys.
Database	SQLite storage for instance/data-disk metadata, sub-users, audit logs, API keys, task stage logs and metric history.
NAT port range	Used for random ports and port mapping allocation.
IPv6 prefixes	Used when the host has routable IPv6 prefixes.

Service Commands

Terminal task history is retained for up to 30 days/1,000 records and metric history for up to 7 days. Full instance backups contain guest disks and instance settings; back up the database separately for panel accounts, API keys, grants and history.

systemctl status clicd
systemctl restart clicd
journalctl -u clicd -n 100 --no-pager

Panel Access Allowlist CLI

# Show the current policy
clicd access-policy show

# Allow selected addresses and networks; add reverse proxies when needed
clicd access-policy set \
  --allow "203.0.113.10,192.168.1.0/24,2001:db8::/32" \
  --trusted-proxy "127.0.0.1"

# Disable source restrictions
clicd access-policy disable

The same controls are available from the "Panel access allowlist" item in clicd cli. Both paths persist the setting and restart the running panel service automatically.

Security Recommendations

• Do not expose the web panel directly to untrusted networks.
• Use a strong administrator password and rotate it regularly.
• Split API keys by purpose and avoid long-lived full-access keys.
• WebSSH and WebVNC tickets are short-lived credentials and should not be written to logs or shared publicly.
• Do not paste real IPs, passwords, API keys, or tickets into public docs, screenshots, or support tickets.