Secure Remote Control Socket Access via Dedicated Mutual TLS Listener

This snippet configures a network-bound administrative control listener secured with Mutual TLS client certificate authentication. Unit exposes its internal management API on an IP-bound TCP port, validating incoming administrative client certificates against a trusted local Certificate Authority bundle before processing JSON control commands.

This deployment pattern is required in distributed infrastructure environments where centralized configuration orchestration tools like Ansible, Terraform, or internal management control planes must manage Unit instances remotely without local SSH socket forwarding or agent installation.

Securing the control interface with mTLS protects host nodes from unauthorized configuration modifications and arbitrary code deployment risks. Certificate Revocation Lists CRLs or short-lived certificates should be enforced to prevent compromised administrative keys from maintaining long-term control plane access.

> System.Execute()

curl -X PUT -d '{
  "pass": "routes",
  "tls": {
    "certificate": "control-plane-cert",
    "verify": true,
    "ca": ["internal-ca-chain"]
  }
}' --unix-socket /var/run/control.unit.sock http://localhost/config/listeners/10.0.0.5:8443

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-596FAD32ADAC