Firewalls · Control Plane

Operator workspace

Your edge, in formation.

A single operating picture across cloud networks, server firewalls, DNS edges, and remote UFW nodes.

Provider posture

Connected surfaces

Recent activity

Audit stream

Operational pulse

Policy health

nominal

06:0012:0018:00Now

99.8%policy availability

0.18smedian sync latency

Cloud & storage

Hetzner Console.

Manage each project with its own credentials, including your migrated Storage Boxes.

Policy operations

Firewall surfaces.

See the owning account and protected instance IPs before editing cloud or server firewall rules.

Oracle Cloud operations

Instances.

Manage compute capacity, tenancy accounts, MFA recovery, Block Volumes, boot volumes, and provider backups from each OCI profile.

Always Free estimator

Capacity by OCI profile

Home-region usage · live from Oracle

Compute inventory

Virtual machines

DNS operations

Domain zones.

Cloudflare zones belong here because they manage domain DNS, not ingress and egress firewall policy.

Cloudflare edge traffic

Domain analytics.

Choose a Cloudflare domain to inspect live requests, transfer, cache performance, visitors, threats, countries, and status codes.

Resell.biz registrar

Customers & domains.

List customers, register domains, change nameservers, and read your reseller balance over the LogicBoxes HTTP API.

Customers

Customer accounts

Domains

Registered domains

Resell.biz promotions

Promo offers.

Active LogicBoxes registration promos with your real reseller cost, customer list price, and days left.

Resell.biz catalog

Domain prices.

Sellable TLD cost prices from Resell.biz, with promo cost when an offer is active.

Automated acquisition

Domain drop catcher.

Monitor registry lifecycle, preflight every dependency, and submit a paid Resell.biz registration only for explicitly armed domains.

Catch tactics

Monitoring cadence and registration attack

The worker accelerates checks as the drop approaches, starts two seconds early, and repeats guarded registration attempts until an order is verified or the configured window closes.

Live acquisition flow

1MonitorRDAP + WHOIS lifecycle
2Confirm freeRegistry + Resell.biz
3PreflightPrice, funds, contacts, NS
4Lock requestOne paid call at a time
5RegisterImmediate provider request
6VerifyOrder ID or safe retry

Provider topology

Profiles & accounts.

Add independent credentials and scopes without mixing tenancy state.

Global defaults

Settings.

Configure shared values used by automated workflows across the control plane.

Central source of truth

Remote UFW nodes.

Store desired policy, snapshot before change, and keep remote status visible.

Before adding a server

How UFW onboarding works

Nothing touches the remote firewall until you explicitly confirm the protected Apply step.

Prepare the target firstAuthorize the matching public SSH key, keep the SSH port reachable, and allow the selected user to run sudo -n for UFW checks.

1Local only
Register endpoint
Store name, hostname, SSH port, user, and private-key reference. Version 1 is created from your saved default template.
No SSH connection and no firewall change
2Local only
Review the draft
Inspect management CIDRs, Cloudflare access, defaults, and disabled legacy rules. Adjust the server-specific policy.
Saved only when you choose Save version
3Read-only SSH
Run verified preview
Resolve the host, connect over SSH, detect the controller source, confirm the SSH listener and UFW status, then show exact commands.
Reads status only; no UFW write
4Remote write
Apply with protection
Create local and remote snapshots, schedule a two-minute rollback, reset UFW, and apply the verified command sequence.
Requires a separate explicit confirmation
5Automatic
Verify or recover
Open a fresh SSH connection and verify UFW. Success cancels rollback; failure leaves the timer to restore the previous files.
Result is versioned and audited

New-server baseline

Editable default template

Edit and save the exact local draft that every new server receives. Registration never changes the remote firewall.

Traffic defaultsIncoming, outgoing, routed SSH management accessTrusted CIDRs and emergency option Cloudflare web edgeNetworks and protected ports Reusable rulesEnabled per saved template

Recovery surface

Backups.

Every provider write starts with a local point-in-time snapshot. Hetzner firewall snapshots are portable across synchronized accounts.

Traceability

Audit log.

A clear record of sign-ins, reads, writes, syncs, and failures.

Automation interface

Control Plane API.

Use every dashboard capability through one stable, scoped REST API—from firewalls and cloud compute to Cloudflare, domains, Drop Catcher, UFW, settings, notifications, and audit.

Operator credentials

Your API keys

Loading keys…

Quick start

Server-to-server REST API

Base URL

https://firewalls.strogleapp.com/api/v1

Authentication

Authorization: Bearer fw_live_…

Write safety

Idempotency-Key: unique-operation-id

Retry result

Idempotency-Replayed: true

Version 1

Endpoints

JSON

GET/status

Validate the key and API availability.

any scope

GET/capabilities

Discover every public command, required scope, mutation status, and whether the current key may use it.

any scope

POST/commands/{command}

Invoke any allowlisted dashboard function. Read commands need only JSON; writes additionally require an idempotency key.

per command

GET/firewalls

List OCI, Hetzner, Infomaniak, and managed firewall resources. Optional ?provider=oci.

firewalls:read

GET/firewalls/{resource_id}

Read live rules. Infomaniak returns its original rules in rules.native.

firewalls:read

PUT/firewalls/{resource_id}/rules

OCI/Hetzner replacement after a backup. Body: {"rules":{"ingress":[],"egress":[]}}. Infomaniak uses individual native commands.

firewalls:write

POST/firewalls/bulk-ip

Allow or block one IP/CIDR across selected OCI/Hetzner profiles.

firewalls:write

POST/providers/sync

Refresh provider inventory. Optional body: {"profile_id":1}.

providers:sync

GET/backups

List recent pre-change snapshots.

backups:read

GET/backups/{backup_id}

Read one complete backup payload.

backups:read

Complete coverage

Functions and scopes

Every area below is callable through POST /commands/{command}. The live GET /capabilities response lists every exact command name.

23 scopes

Firewalls

Inventory, live rules, complete rule replacement, bulk IP allow/block.

firewalls:read · firewalls:write

Profiles & providers

List, create, update and delete profiles; synchronize provider inventory.

providers:read · providers:write · providers:sync

OCI, Hetzner & Infomaniak compute

Instances, launch options, storage, backups, IAM, limits, reset, WOL, rDNS and Infomaniak VPS start/shutdown/reboot.

compute:read · compute:write

Infomaniak native firewall

Use infomaniak.firewall.get, then save, delete or set_enabled. Writes require the live fingerprint and exact resource name. Native backups precede each write; no full replacement or bulk-IP.

firewalls:read · firewalls:write

Cloudflare

Zones, DNS, analytics, DNSSEC, cache, settings and email routing.

cloudflare:read · cloudflare:write

Domain Registrar

Customers, pricing, registration, renewal, WHOIS, nameservers, privacy, locks and ownership.

registrar:read · registrar:write · secrets:read

Drop Catcher

Inspect, watch, preflight, arm, disarm, refresh, delete and simulate.

dropcatch:read · dropcatch:write

Remote UFW

Nodes, templates, previews, versions, snapshots, protected apply and restore.

ufw:read · ufw:write

Backups

List and inspect snapshots, restore UFW, or transfer Hetzner firewall rules between accounts.

backups:read · backups:write

Settings

Read and update shared automation defaults, including the website IP.

settings:read · settings:write

Notifications & audit

Read alerts, acknowledge notifications and inspect the operational audit trail.

notifications:read · notifications:write · audit:read

Example

List firewalls

curl -sS 'https://firewalls.strogleapp.com/api/v1/firewalls' \
  -H 'Authorization: Bearer YOUR_API_KEY'

Credential handbook

Provider setup guides.

Follow the provider console steps, then copy each value into Add profile.

Oracle Cloud Infrastructure

Create an API signing key

OCI authenticates API calls with a public key uploaded to your user and the matching private key stored in this dashboard.

Official OCI guide

1
Open your OCI user
In OCI Console, open the profile menu, choose User settings, then open API keys.
2
Add an API key
Select Add API key. Generate a key pair in OCI, or upload a public key that matches a private PEM key you already own.
3
Copy the configuration preview
From the new fingerprint menu choose View configuration file. Copy the tenancy OCID, user OCID, fingerprint, and region into our OCI form.
4
Paste the private PEM key
Open the downloaded private .pem file and paste its complete contents, including BEGIN and END lines. Add the passphrase only if that key is encrypted.
5
Confirm IAM and Identity Domain access
The OCI principal needs permission to inspect compartments, limits, compute, networks, availability domains, and to manage the intended Block Volumes, boot volumes, and backups. Tenancy-account actions additionally require a User Administrator or Identity Domain Administrator role in the selected Identity Domain. VM writes require launch/terminate, VNIC, and boot-volume permissions in the intended compartments.