---
title: Security
description: Protect the admin console with two-factor authentication and IP allow-lists, manage administrator roles, and configure customer sign-in: passkeys, Google and GitHub, captcha and blocked e-mail domains.
url: https://nexcmp.com/docs/administration/security/
applies_to: NexCMP 1.6.1
updated: 2026-11-02
---

# Security

> **Where in the admin:** System › Admin › Console security (`/account`), Admin users (`/users`); System › Settings › Customer logins (`/settings/login`).

## Admin console

### Two-factor authentication (TOTP)

The console is reachable from the Internet, so turn on TOTP.

1. Open **System › Admin › Console security**.
2. Under **Two-factor authentication (TOTP)** click **Start setup**.
3. Scan the QR code with Google Authenticator, Authy, 1Password or Bitwarden, then enter the 6-digit code.

### Allowed console IP ranges

Under **Allowed console IP ranges** enter one IP or CIDR (IPv4 or IPv6) per line. **Empty means anywhere.** Outside the range both sign-in and the admin API are blocked.

::: warning Do not lock yourself out
The page shows your current IP and requires that the new list includes it. Use **+ Add my IP**. If you are locked out anyway, use the [emergency access](https://nexcmp.com/docs/getting-started/cli-reference/#emergency-access) from the server.
:::

### Change password

Fill **Current password**, **New password** and **Confirm new password**. Use a long, unique password (12 characters or more; the setup wizard enforces 12 for the first administrator).

### Administrator accounts and roles

Open **System › Admin › Admin users** and use **+ Create account**.

| Role | Access |
|---|---|
| `admin` | Full access to the admin API |
| `staff` | Read-only across the whole system |
| `user` | Read-only view of one customer's resources |

The root account is the one created in the [setup wizard](https://nexcmp.com/docs/getting-started/setup-wizard/). Row actions: **Edit**, **Reset PW**, **Key**, **Delete**. Passwords are stored as salted hashes; changing or locking an account ends its sessions at once.

## Customer sign-in

Open **System › Settings › Customer logins**.

| Setting | What it does |
|---|---|
| **Google sign-in** | Enable, then enter the OAuth client ID and secret. Copy the **Callback URL** shown on the page into *Google Cloud Console › APIs & Services › Credentials › OAuth client ID › Authorized redirect URIs*. Use **Test configuration**. |
| **GitHub login** | Same, with *GitHub › Settings › Developer settings › OAuth Apps › Authorization callback URL* |
| **Passkey** | Fingerprint, PIN or hardware key login; on by default. Passkeys are bound to the domain; each reseller domain works on its own. Enter an old domain in *Legacy passkey Domain* after a rebrand so customers get a helpful hint |
| **Reauthenticate when adding sign-in methods** | Ask for the password again before adding a passkey or linking Google/GitHub (off by default) |
| **Captcha** | Cloudflare Turnstile or Google reCAPTCHA on sign-up: enable, choose the provider, enter the site key and secret key |
| **Block e-mail domains** | One domain per line (max 2000). Matching addresses are rejected on sign-up with `email_domain_blocked` |

![The Customer logins page showing Google sign-in with its callback URL](https://nexcmp.com/docs/images/administration/security-01-customer-logins.webp)

### Built-in policies

| Policy | Value |
|---|---|
| Customer password | At least 10 characters, letters and digits |
| Customer session | 30 days; "login as customer" sessions last 1 hour |
| E-mail verification | Required before creating a VM when *require e-mail verified* is on in the sales settings |
| Anti-carding | Accounts with less than the minimum top-up can create only a limited number of VMs |

## Server hardening

- Port 3000 is closed after setup and TLS; see [Installation](https://nexcmp.com/docs/getting-started/installation/#the-panel-port-3000).
- The service runs as the unprivileged `nexcmp` user with a restricted systemd sandbox.
- API keys, payment credentials and SMTP passwords are stored encrypted; the master key is in `/var/lib/nexcmp/secrets` — protect [backups](https://nexcmp.com/docs/getting-started/backup-and-restore/).
- Releases are verified with SHA-256 and an Ed25519 signature before installation.