All articles

Getting Started

What is CICDoo Getting started: the onboarding wizard The Dashboard and Infrastructure Map

Concepts

Production, staging and development stages Domains, subdomains and SSL Odoo versions and editions (Community vs Enterprise) Workspaces and team collaboration

Servers

Adding a server Server domains and DNS Using a load balancer Connecting through a jump server Server actions: deploy, logs and charts Deleting a server

Projects & Git

Creating a project Connecting GitHub Project GitHub settings and webhook Connecting GitLab Branches and instances Tagging and filtering projects High availability with app nodes Project environments, extensions and deletion

Instances & Console

Creating an instance Restarting, stopping and removing an instance Merging branches between stages Web IDE and remote access SSH access to instances Instance settings explained Deployments and the job queue

Agent Tasks

What agent tasks are Setting up agent tasks Running a task and reviewing the result Agent time and top-ups Agent insights and task filters

Monitoring & Backups

Monitoring your instance Backups and restore S3 storage, uploads and bulk backup actions Alert notifications (email and SMS)

Workspaces & Permissions

Inviting workspace members Member permissions and resource access A member cannot see or use a resource Audit log and server activity

Account & Security

Two-factor authentication (2FA) Profile and integrations settings Passwords and account recovery Instance security score and checks The Security page: every instance and member at a glance

Billing & Plans

Plans and pricing Upgrading and managing your subscription If a project subscription goes unpaid The channel partner program Onboarding a client as a partner

Support & Tickets

Opening a support ticket Getting help from the CICDoo team

Troubleshooting

Troubleshooting: cannot connect a server Troubleshooting: a deployment failed Troubleshooting: git push fails with 403 after moving a repository Troubleshooting: my instance is down or slow Troubleshooting: domain or SSL problems

Servers

Connecting through a jump server

How to add a server that CICDoo can only reach over SSH through a jump server (bastion), what the jump server must allow, and what the error messages mean.

When to use a jump server

Use a jump server when your server is on a private network and the only way in over SSH is through a bastion host. CICDoo's runners SSH to the jump server first, and from there to your server. Nothing is installed on the jump server.

The jump server is used for SSH only. Your server still fetches its scripts and reports back to CICDoo over HTTPS, so it needs outbound internet access. That can go through NAT. Your domains, DNS records and websites work exactly as without a jump server.

Setting it up

  1. Add or edit the server as usual. On the Domain step, keep the server's public address and, if you use one, the Connectivity IP.
  2. On the Access step, turn on "Connect through a jump server".
  3. Fill in: - Jump server address: the hostname or public IP of the bastion. Add :port if its SSH port is not 22. - Jump server username: the account CICDoo logs into on the bastion. - Address of this server from the jump server: usually its private IP, for example 10.0.0.12. A port on it (10.0.0.12:2222) sets the server's SSH port. - Jump server authentication: "Our public key" (the same key shown under Public Key Authentication) or "Private key", where you paste a key the bastion accepts. Password and two-factor logins are not supported on the jump server.
  4. Save. The server's normal SSH login (username and Authentication Method on the same step) is still what CICDoo uses on the server itself.

What the jump server must allow

  • SSH from every CICDoo runner address. The form lists them under "Before you save".
  • TCP forwarding: AllowTcpForwarding yes in its sshd configuration.
  • SSH from the jump server to your server's address and SSH port.

The server's outbound address

When the server reaches the internet through NAT, its calls to CICDoo come from the NAT address, not its own. Add that address to Connectivity IP (comma-separated after any address already there). If you don't know it, save anyway: after the first refused call, the server page shows the address it called from, and you can trust it there.

Until that address is trusted, deployments can start but never report finishing, and the server shows as offline.

Error messages

  • Could not connect to jump server: the bastion's address or port is wrong, it is down, or it does not allow SSH from the CICDoo runners.
  • Jump server refused the login: wrong jump username or key, or the bastion wants a password or a two-factor code.
  • Jump server refused to forward the connection: set AllowTcpForwarding yes on the bastion.
  • Jump server could not reach this server: the address from the jump server or the SSH port is wrong, or a firewall between them blocks SSH.
  • Reached the server through the jump server, but it refused the login: the server's own username or key is wrong. This is the same check as without a jump server.

User SSH access

If User SSH Access is on, the commands on an instance's Access tab include -J for the jump server. Each user's own key must also be accepted by the jump server, which its administrator sets up outside CICDoo.

Related: Adding a server, Server domains and DNS, Troubleshooting: cannot connect a server.

If you get stuck, open a support ticket from the Tickets page or the chat widget.

Previous Using a load balancer Next Server actions: deploy, logs and charts

Still stuck? Open a ticket from the app or talk to an engineer.