Use Server System when an Owner needs to review the server-facing settings that affect browser access, HTTPS trust, notifications, logs and maintenance. Certificate setup is in Public host and HTTPS.
Record the effective host, port, HTTPS, notification and maintenance state with redacted values only. Verify settings on the target server, not against documentation examples.
What this surface controls
| Area | Operator action | Safe evidence |
|---|---|---|
| General | Manage generated-password policy, runtime log level, Quick Recovery, administrative tools, full-backup import, and service restart. | Password-policy summary, effective log level, tool availability, and redacted action time. |
| Access and HTTPS | Review public host, public port, managed HTTPS state and certificate package state. | Host shape with the real value replaced by <SERVER_HOST>, port and certificate subject/SAN summary. |
| Notifications | Confirm SMTP host, port, sender and test result when email notifications are enabled. | SMTP provider family, redacted sender domain and timestamp of the last test. |
| Maintenance and logs | Review where the database and logs are stored, migration import, and maintenance backups for one category. | Service state, redacted timestamps, and non-secret error messages. |
Server System is an administrative surface. Only Owners or approved server administrators should change these settings.
Access and HTTPS checklist
- Confirm the canonical browser URL before changing host or port.
- Confirm firewall and DNS routing for the target host and port.
- Use a trusted PFX/P12 certificate package for broad production access.
- Keep the package password out of screenshots, logs, tickets and docs.
- Save the configuration.
- Restart or reload only when VaultPilot asks for it.
- Open VaultPilot at the public host and port from a client machine and confirm the browser certificate state.
If the browser warns after HTTPS is enabled, use HTTPS certificate warning.
Notifications checklist
Use notification settings only for operational mail such as security, update or administrative alerts.
| Check | Healthy result |
|---|---|
| SMTP host and port | Match the approved mail relay. |
| Sender address | Uses an approved operational mailbox. |
| Credential handling | Passwords or app secrets are entered only in the UI and never shared in tickets or email. |
| Test result | Sends to an approved recipient without exposing vault data. |
Do not paste SMTP passwords, app passwords or message bodies with user data into tickets or support email.
General and administrative tools checklist
| Check | Healthy result |
|---|---|
| Password policy | Length is 16–128 and selected character classes and symbol profile match policy. |
| Runtime log level | INFO or narrower for normal operation; DEBUG only for a bounded investigation. Audit remains unchanged. |
| Quick Recovery | The .vpr.json file and its key are stored separately and documented as not being a full backup. |
| Backup Tool | VaultPilotBackupTool.exe reports its own 3.0.0 version; the full ZIP is offline and access-restricted. |
| Log Collector | VaultPilotLogCollector.exe reports its own 3.0.2 version; only a redacted support package is shared. |
| Restart | No unsaved draft exists, and a controlled window is used to apply only saved configuration. |
Logs and maintenance checklist
| Setting | Operator expectation |
|---|---|
| Runtime log | Effective DEBUG, INFO, WARN, or ERROR produces expected detail without secrets. |
| Audit | Independent of runtime log level and retains immutable event coverage. |
| Diagnostics | Redacted before leaving the environment. |
| Maintenance backup | Covers only audit, Discovery, or Executions records; never treated as a full server backup. |
Owner maintenance cleanup is a backup-first maintenance action, not routine troubleshooting. It can clear only audit, Discovery or Executions records, and VaultPilot refuses it unless a backup of that category is taken first.
When cleanup runs, VaultPilot saves a maintenance backup file before clearing the selected category. Restoring it affects only that category, and records created after the backup may change or be lost; VaultPilot warns you about this before the restore.
Maintenance cleanup does not target vault secrets, source files, service logs, databases, backups, certificates or customer data. Share maintenance backup JSON only privately with support@vaultpilot.io.
Safe support evidence
Collect:
- VaultPilot version and installed service name.
- Public host shape, with the real host replaced by
<SERVER_HOST>. - Configured port.
- HTTPS state and certificate subject/SAN summary.
- Notification test timestamp and non-secret error message.
- Effective runtime log level and maintenance category.
- Whether a restart was requested by the UI.
Do not collect:
- Certificate packages, private keys or certificate passwords.
- SMTP passwords, app passwords, cookies or API tokens.
- Raw logs that may contain secrets.
- Screenshots showing real users, internal URLs or secret records.