SQL-admin vhosts — dedicated subdomains, xtras gates, IP-allowlist protection

BOA serves its browser-based database and monitoring tools — Adminer, sqlbuddy and the Collectd Graph Panel — each from its own subdomain vhost, shipped in the static template set and installed on demand by the xtras keywords. This page covers those install gates and the access model that guards each vhost: an IP-allowlist include plus a crawler drop, with no Nginx basic-auth and no Ægir SSO. The template set these vhosts ship in is on Config templates; the hosted-operator view of the same Adminer tool is DB GUI tools.

The nginx_sql_*.conf files are dedicated subdomain server blocks, not path routes under the Octopus URL. xtra.sh.inc copies each template into ${_mtrNgx}/vhost.d/<tool>.<front> (_mtrNgx=/var/aegir/config/server_master/nginx) and rewrites the *_name server_name placeholder to a subdomain of the frontend FQDN:

Subdomain vhost	Tool	Xtras token	Install gate
`adminer.<front-fqdn>`	Adminer	`ADM` (also matched by `ALL`)	auto-installed in `_EASY_SETUP=LOCAL`; not auto in the default `PUBLIC`
`sqlbuddy.<front-fqdn>`	sqlbuddy	`BDD` (explicit — not in `ALL`)	only when `BDD` is listed in `_XTRAS_LIST`
`cgp.<front-fqdn>`	Collectd Graph Panel	`CGP`	when `CGP` is listed
`chive.<front-fqdn>`	Chive — retired	(legacy)	see Discontinued features

The gates come from xtra.sh.inc: Adminer matches [[ "${_XTRAS_LIST}" =~ "ALL" ]] || [[ "${_XTRAS_LIST}" =~ "ADM" ]], while _if_install_sqlbuddy matches only [[ "${_XTRAS_LIST}" =~ "BDD" ]].

The ALL wildcard expands to ADM/CSF/FTP/IMG only (per barracuda.sh.cnf), so _XTRAS_LIST="ALL" does not install sqlbuddy — BDD must be listed explicitly. The default install is _EASY_SETUP=PUBLIC, under which Adminer is not auto-installed.

Protection model

Each admin vhost is protected by an IP allow/deny include plus a crawler drop — there is no Nginx basic-auth and no Drupal/Ægir SSO layer. The shipped nginx_sql_*.conf contain:

NGINX

if ($is_crawler) { return 444; }
include /var/aegir/config/includes/ip_access/sqladmin*;

The sqladmin* include is generated by ip_access.sh from the validated xtras IP list (allow <ip>; … deny all;). Authentication beyond the IP allowlist is the tool's own DB-credential login.

The only real /sqladmin/ path route in BOA is a separate proxy vhost in aegir/tools/system/conf/ssl_proxy.conf, which uses the same ip_access include — it is not one of the nginx_sql_*.conf set, and there is no /sqlbuddy/ or /sqlchive/ path route.

Config templates — the static template set that ships the nginx_sql_*.conf vhosts and the nginx_compact_include.conf body they pull in.
DB GUI tools — the operator-facing view of Adminer and sqlbuddy: the /sqladmin entry point, the access model, and where to log in.
Site IP access — the ip_access.sh generator that emits the sqladmin* allow/deny fragment, with its anti-lockout logic.
Abuse guard — the $is_crawler scraper map the admin vhosts drop on.
Discontinued features — Chive, whose vhost lingers but is retired.