Remote service management

RADKit Service can expose its own management interface (the Web UI / HTTP API) as an device, so that a designated remote user can manage the Service remotely — through the cloud — using the same device interaction mechanism that is used for any other managed device.

Overview

When remote service management is enabled, the Service advertises a single device:

Name: radkit-service
Device type: RADKIT_SERVICE
Capabilities: HTTP, Swagger only (Terminal, NETCONF, SNMP are not available on this device)
Target: the Service’s own HTTPS management interface

The remote user can then issue HTTP or Swagger requests against this device to drive the Service management API.

Enabling remote management

Remote service management is disabled by default. To enable it, set the service.remote_management_user setting to the username of the remote user that should be allowed to manage this Service:

[service]
remote_management_user = "jane.doe@example.com"

The setting can also be changed at runtime through the Web UI or the HTTP API, as well as via the environment variable RADKIT_SERVICE_REMOTE_MANAGEMENT_USER or the --setting service.remote_management_user command-line option.

When the setting is empty (None), remote management is disabled and the radkit-service device is not accessible.

Access control

Access to the radkit-service device is gated entirely on the service.remote_management_user setting:

Only the exact user configured in remote_management_user may verify a session, verify a user, or start an interaction with the device. All other users are denied.

Because the setting is evaluated continuously, changing or clearing remote_management_user while a session is active immediately revokes that session — no Service restart is required.

Security considerations

Remote management is off by default and must be explicitly enabled.
Only a single, explicitly named user can be granted access at a time.
The device targets the Service’s own management interface using the superadmin credentials internally; the remote user never needs those credentials directly.
Clearing remote_management_user is sufficient to instantly revoke remote access.