Admin domain
The Admin domain tab of the System screen. It moves the admin panel onto a different domain. The same tab holds the Cloudflare origin port — the single port Cloudflare uses to reach your server.
This tab is shown only to administrators with the system-management permission.
Open the port in your firewall first
The port your server accepts outside connections on must be open in the host's inbound firewall. Which port that is:
- Direct mode — ports 443 and 80. The panel is served on 443; port 80 is where the Let's Encrypt certificate is issued and later renewed automatically. The automatic check below covers 443 only, so a shut port 80 passes it quietly and then fails the certificate — open both at once.
- Via Cloudflare mode — the port shown in the Cloudflare origin port section further down this tab.
You do not have to check this by hand. Before switching, Qubix probes the port from the outside, from the internet. If the port is shut, the domain change is refused and the screen shows the port number together with ready-made commands — run the one that matches your firewall on the host:
ufw allow 443/tcp
firewall-cmd --permanent --add-port=443/tcp && firewall-cmd --reload
iptables -I INPUT -p tcp --dport 443 -j ACCEPT
For port 80 run the same command with 80 in place of 443.
The check cannot be turned off from the panel: a shut port means you would lose access to the panel right after the switch. Open the port and repeat the change. The check is not a guarantee: if the check itself cannot run, the domain change goes ahead without it — so open the port beforehand either way.
How to move the panel
- Open System → Admin domain. The current domain and serving mode are shown above the form.
- Enter the new domain.
- Choose how it is served — through Via Cloudflare or Direct.
- Confirm. Qubix checks the port, re-points the panel, reusing the same machinery as the initial install, and returns a new login link on the chosen domain.
Changing the admin domain ends the current session — the panel stops being served on the old address. Open the new login link and sign in again. If the new domain is unreachable, its port is shut or its certificate is not ready yet, the change is reported as an error and nothing is moved.
Cloudflare origin port
The Cloudflare origin port section sits under the domain-change form. It shows the current port and lets you pick another of the ports Cloudflare reaches an origin on: 443 (recommended), 2053, 2083, 2087, 2096 and 8443. There is one such port for the whole server — every domain served through Via Cloudflare uses it, a domain has no port of its own.
- Pick a value in the Origin port field.
- Press Change port.
- Qubix probes the new port from the outside, moves the server onto it and re-points every Cloudflare zone to the new port.
If some Cloudflare zone did not update, the panel names its domain: those domains stay on the old port and will not open until you repeat the port change.
If Cloudflare cannot reach your server on this port, the visitor sees a Cloudflare page with error 521 instead of your site: the origin server is unreachable. The cause is almost always the same — the port is shut in the host's inbound firewall. Open it with the command above and make sure the Cloudflare origin port section names the same port the server listens on.