SoAI Core does not register host-management routes. SoAI OS adds privileged routes under /api/v1/os
for networking, storage, drivers, SSH, Linux-user synchronization, and Debian package updates.
Host authority is a separate action
SoAI OS host routes require SoAI OS administration (HOST_MANAGEMENT_ADMIN). A signed-in user, including an administrator
without that action, cannot use them. The default access policy grants the action to Administrators, but access
policy changes can alter that. Limit it to people trusted to change the appliance itself.
Individual controls add their own requirements. The SSH and Drivers tabs require
an administrator and SoAI OS administration (HOST_MANAGEMENT_ADMIN). The Users tab also requires
User administration (USER_ADMIN). The Power page instead requires an administrator with
System power control (SYSTEM_POWER). That action is separate from the SoAI OS host-management action.
When SoAI OS creates its managed soai.service unit, it runs as root and starts
soai_os/soai_os.sh. This permits controlled use of NetworkManager, APT, systemd, and storage tools.
Protect administrator accounts, retain backups, and keep a console recovery path.
Controls have their own safeguards
Storage formatting and partition creation require the latest device fingerprint and reject root or mounted filesystems. Network activation and SSH disable can use timed safe-apply workflows: an explicit commit keeps the change, while an expired deadline restores the previous state. Drivers, storage operations, and package work run as tasks with a terminal state that can be reviewed in the WebUI.
Harden the network edge
The default HTTP and discovery bind addresses are 0.0.0.0, and TLS is disabled. Review
SERVER.HTTP.NETWORK.HOST,
SERVER.HTTP.NETWORK.DISCOVERY_HOST, and SERVER.HTTP.SSL.TLS_ENABLED
before connecting another device. Keep the appliance inside the boundary defined in
Security hardening.
To change these values in the SoAI WebUI, an administrator with Configuration changes (CONFIG_PATCH) selects the
Settings button at the right of the header, then Settings, then the page header's
Advanced control. Select the configuration group that contains the field, make the change, and use
Save. Select Restart SoAI when the WebUI reports that a restart is
required. Use explicit browser origins in
SERVER.HTTP.CORS.ALLOWED_ORIGINS
instead of a wildcard. Pair TLS with
SERVER.HTTP.SECURITY.REQUIRE_SECURE_TRANSPORT
and SERVER.WEBUI.COOKIE_SECURE.