This tutorial guides you through verifying secure remote access to the dstack VMM management interface. By default, the VMM API listens on 127.0.0.1:9080, which is only accessible from the server itself. HAProxy (configured in HAProxy Setup) proxies requests from vmm.dstack.yourdomain.com to the VMM API.

External Request                 Internal
┌─────────────────────────────────────────────────────────────────┐
│                                                                 │
│  vmm.dstack.yourdomain.com:443  →  HAProxy  →  localhost:9080   │
│                   (TLS)            (proxy)      (VMM API)       │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

The VMM API requires authentication tokens, providing an additional layer of security beyond TLS.

Before starting, ensure you have:

• Completed VMM Service Setup - VMM running on localhost:9080
• Completed HAProxy Setup - HAProxy installed and configured
• Completed SSL Certificate Setup - Wildcard certificate for *.dstack.yourdomain.com
• VMM authentication token (generated during VMM configuration)

The VMM API requires an authentication token for all requests. This token was generated during VMM Configuration and saved to ~/.dstack/secrets/vmm-auth-token. API requests include it via:

curl -H "Authorization: Bearer $(cat ~/.dstack/secrets/vmm-auth-token)" ...

Ensure your firewall allows HTTPS traffic:

# Check current rules
sudo ufw status

# Allow HTTPS if needed
sudo ufw allow 443/tcp

HAProxy is already configured to proxy VMM requests. Verify the configuration includes the VMM backend:

grep -A5 "vmm_backend" /etc/haproxy/haproxy.cfg

Expected output shows the VMM backend configuration:

backend vmm_backend
    mode http
    option httpchk GET /
    http-request set-header X-Forwarded-Proto https
    server vmm 127.0.0.1:9080 check

curl -s http://127.0.0.1:9080/ | head -5

Should return the VMM web interface HTML.

Test the management interface through HAProxy:

# Replace with your domain
curl -s -H "Authorization: Bearer $(cat ~/.dstack/secrets/vmm-auth-token)" \
  "https://vmm.dstack.yourdomain.com/prpc/Status?json" | jq .

Expected response:

{
  "vms": [],
  "port_mapping_enabled": true,
  "total": 0
}

Note: The vms list will be empty until you deploy CVMs in later tutorials. The key point is that you get a valid JSON response through HAProxy, confirming TLS termination, routing, and VMM authentication are all working.

Open in your browser:

https://vmm.dstack.yourdomain.com

You should see the VMM Management Console. API requests require the auth token in the Authorization header.

For detailed solutions, see the dstack Installation Troubleshooting Guide:

• 502 Bad Gateway
• Connection Refused
• DNS Not Resolving
• Authentication Failed
• Backend Marked as DOWN

With secure remote access configured, proceed to:

• Guest OS Image Setup - Download and configure guest images

• HAProxy Documentation
• Let's Encrypt Documentation