A self-hosted server management dashboard for Datalix VPS services. Bring your own API key, manage all your servers from one place.
Disclaimer: CloudDeck is an independent, community-built project. It is not affiliated with, endorsed by, or sponsored by Datalix (datalix.eu). All functionality is built on top of the publicly available Datalix API. "Datalix" is a trademark of its respective owner.
- Server Management -- Start, stop, restart, shutdown, reinstall, and extend your VPS instances
- Live Monitoring -- Real-time CPU, RAM, and network stats with traffic history charts
- Network Management -- View IPs, set reverse DNS, manage IPv4/IPv6
- Backup & Cron -- Create/restore backups and manage cron jobs
- noVNC Console -- Browser-based console access to your servers
- Role-Based Access Control -- Granular per-server permissions with bitmask flags (View, Power, Console, Network, Backup, Cron, Reinstall, Extend)
- Multi-User -- Admin and user roles with role templates (Viewer, Operator, Manager)
- Encrypted API Keys -- AES-256-GCM encryption, keys never leave the server
- Docker Ready -- One command to deploy with Docker Compose
| Layer | Technology |
|---|---|
| Frontend | Next.js 16 (App Router), React 19, TanStack Query |
| Styling | Tailwind CSS 4, Radix UI, Lucide Icons |
| Backend | Next.js API Routes (BFF proxy to Datalix API) |
| Database | PostgreSQL 16 with Prisma ORM |
| Auth | NextAuth v5 (JWT sessions, bcrypt passwords) |
| Monorepo | Turborepo with npm workspaces |
- Node.js 22+
- Docker (for PostgreSQL)
- A Datalix API key from your Datalix account
git clone https://github.com/itsmylife44/clouddeck.git
cd clouddeck
npm installThe easiest way -- starts PostgreSQL in Docker, syncs the database schema, and launches the dev server:
chmod +x dev.sh
./dev.shThe app will be available at http://localhost:3001.
On first visit, you'll be guided through creating an admin account and adding your Datalix API key.
# Copy and configure environment variables
cp .env.example .env
# Edit .env with your values (see Environment Variables below)
# Start PostgreSQL
npm run docker:dev
# Sync database schema
npm run db:push
# Start dev server
npm run dev| Variable | Required | Description |
|---|---|---|
DATABASE_URL |
Yes | PostgreSQL connection string |
DB_PASSWORD |
Yes | Database password (used by Docker Compose) |
NEXTAUTH_SECRET |
Yes | JWT signing secret |
NEXTAUTH_URL |
Yes | App base URL (e.g. http://localhost:3000) |
ENCRYPTION_SECRET |
Yes | 64 hex chars for AES-256 API key encryption |
PORT |
No | Server port (default: 3000) |
NODE_ENV |
No | development or production |
Generate all secrets automatically:
chmod +x setup-env.sh
./setup-env.shThis creates a .env file with cryptographically secure passwords and secrets. Use ./setup-env.sh --force to regenerate.
# 1. Generate production secrets
./setup-env.sh
# 2. Edit .env -- set NEXTAUTH_URL to your domain
# NEXTAUTH_URL=https://cloud.yourdomain.com
# 3. Build and start
npm run docker:prodThis starts PostgreSQL and the Next.js standalone server in a security-hardened configuration:
- Read-only filesystem with tmpfs for caches
- All Linux capabilities dropped (except NET_BIND_SERVICE)
no-new-privilegessecurity option- Non-root user inside container
- Health checks on both database and app
- Database not exposed to host network
./setup-env.sh
npm run build
cd apps/web && npm startCloudDeck uses a bitmask-based RBAC system for granular server access control:
| Flag | Value | Description |
|---|---|---|
| View | 1 | See server details, status, IPs, monitoring |
| Power | 2 | Start, stop, restart, shutdown |
| Console | 4 | noVNC browser console access |
| Network | 8 | Set reverse DNS, manage IPs |
| Backup | 16 | Create, restore, delete backups |
| Cron | 32 | Manage cron jobs |
| Reinstall | 64 | Reinstall operating system |
| Extend | 128 | Extend service lifetime, hide server |
Role templates for quick assignment:
| Template | Flags | Mask |
|---|---|---|
| Viewer | View | 1 |
| Operator | View, Power, Console, Backup | 23 |
| Manager | All | 255 |
Admins have full access to all servers. Regular users see only servers they've been granted access to.
clouddeck/
├── apps/web/ # Next.js application
│ ├── src/
│ │ ├── app/ # Pages and API routes
│ │ │ ├── (dashboard)/ # Protected dashboard pages
│ │ │ └── api/ # BFF API routes
│ │ ├── components/ # React components
│ │ ├── hooks/ # TanStack Query hooks
│ │ └── lib/ # Utilities, auth, encryption
│ └── prisma/ # Database schema
├── packages/
│ └── datalix-client/ # Typed Datalix API client
├── docker-compose.yml # Production setup
├── docker-compose.dev.yml # Development setup
├── setup-env.sh # Generate production secrets
└── dev.sh # One-command dev startup
| Command | Description |
|---|---|
./setup-env.sh |
Generate production secrets into .env |
./dev.sh |
Start everything (Docker DB + dev server) |
./dev.sh down |
Stop all containers |
./dev.sh reset |
Reset database to clean state |
npm run build |
Build all packages |
npm run lint |
Lint all packages |
npm run db:push |
Sync Prisma schema to database |
npm run db:studio |
Open Prisma Studio GUI |
npm run docker:prod |
Production deploy |
- API keys are encrypted with AES-256-GCM before storage -- never stored in plaintext
- All Datalix API calls are proxied server-side -- keys never reach the browser
- Passwords hashed with bcrypt (12 rounds)
- User roles re-validated from database on every API request (no stale JWT bypass)
- Per-server permission checks with bitmask flags on all 13 API routes
- Server-side admin layout guard on all
/adminroutes - Production Docker uses read-only filesystem, dropped Linux capabilities, and non-root user
- Input validation with Zod on all API endpoints
- Generated secrets use
opensslwith cryptographic randomness
CloudDeck is an independent, open-source project. It is not affiliated with, endorsed by, or sponsored by Datalix (datalix.eu) in any way. This project uses the publicly available Datalix API. All product names, trademarks, and registered trademarks are property of their respective owners. Use of this software is at your own risk.
MIT