Security Notice

A clear overview of how RaidMan keeps your Unraid server safe, and what you can do to protect your configuration.

RaidMan is built from the ground up to respect your privacy and protect your infrastructure. Because managing a server requires high levels of trust, we use a "defense-in-depth" approach.

This document explains in simple, non-technical terms how RaidMan secures your server, how our optional plugin operates, and the best practices you should follow to keep your server safe.

1. Direct Connection (No Cloud)

Most mobile tools route your data through their own cloud servers. RaidMan does not do this.

  • Direct Tunnel: Your mobile app communicates directly with your Unraid server's IP address or domain name.
  • Zero Intermediary Servers: There are no middle-man cloud servers routing, reading, or caching your credentials, server data, or commands.
  • No Analytics or Telemetry: The app does not collect, log, or upload usage information or server configurations to any external server.
  • Safe Local Storage: Your connection details and API keys are stored securely on your phone using standard device-level encryption (like iOS Keychain) and can be protected behind Face ID or Touch ID.

2. Secure Access via API Keys

RaidMan communicates with your Unraid server using API Keys.

  • Encrypted Transmission: All data sent between the mobile app and your server inherits the HTTPS security and SSL encryption configurations of your Unraid web page.
  • Granular Permissions: You do not have to give RaidMan complete control of your server. Unraid allows you to customize what each API key is allowed to see or do:
    • Monitoring-Only: You can restrict the API key to only read CPU/Memory stats and view container/VM lists.
    • Control: You can allow the key to start/stop containers or virtual machines.
    • System Operations: Privileged commands like server shutdown, reboot, or spawning terminal shells require highest administrator rights.

3. How the Optional Plugin Works

While RaidMan can connect to your server automatically to check basic stats, you can install the RaidMan Plugin to enable advanced features (like terminal access, log streaming, and remote VM VNC screens).

How the Plugin Protects Itself

When you install the plugin, it runs a lightweight background program on your Unraid host. It is built to be secure:

  • Hidden from the Internet: The plugin's program is locked to listen only inside the server itself (localhost). It cannot be reached directly from the network or internet, even if someone knows its port number.
  • Follows API Key Permissions: The plugin daemon does not bypass Unraid's security levels. It verifies the permissions of the incoming API Key for every action. If a key is configured with read-only access on Unraid, the plugin will block any attempts to start/stop containers or access the host terminal.
  • Clean & Lightweight: The plugin is written in Go, which is highly optimized. It uses less than 15MB of RAM and remains completely silent (0% CPU) when you are not actively using the app. It does not modify your core Unraid operating system files.
  • Audit Trails: Every command, connection reload, or terminal request handled by the plugin is written to a simple local text file at /var/log/raidman.log. You can easily open this file at any time on your server to inspect exactly who connected and what commands were sent.

Open Source and Public

We believe you should never install closed-source software on your private server. The entire companion plugin is 100% open-source and hosted publicly on GitHub at github.com/routecore/raidman-plugin. You can inspect the installer package script, the server daemon codebase, and the compile workflow configurations to ensure they are safe and unmodified.

4. Security Controls You Can Adjust on Unraid

You can configure advanced safety settings for RaidMan directly from the Unraid web interface by navigating to Settings > Utilities > RaidMan.

[!TIP] Adjusting these two settings is highly recommended to tailor the plugin to your security preferences:

Restrict API Keys (Whitelist)

By default, the plugin will allow connections from any valid API key defined on your Unraid server. You can lock this down:

  1. Set Restrict to Specific API Keys to Yes (Restrict).
  2. Select only the specific API key allocated to your mobile device.
  3. Effect: Even if another API key on your server is compromised or shared, the plugin will block it from executing advanced operations.

Disable Host Terminal Access

If you do not plan to use the command-line terminal shell from your phone:

  1. Set Host Terminal Access to Disabled.
  2. Effect: The plugin will completely refuse to open terminal shells, eliminating host terminal access capabilities entirely.

5. Practical Best Practices for Server Owners

To ensure your Unraid server remains fully protected, we recommend following these simple habits:

  1. Do Not Port-Forward: Never expose your Unraid web administration page directly to the public internet by port-forwarding ports 80 or 443 on your home router.
  2. Use a VPN for Remote Access: If you want to monitor your server when you are away from home, connect your phone to your home network using a secure VPN tunnel, such as WireGuard or Tailscale.
  3. Use Specific API Keys: Create a dedicated API key for RaidMan instead of reusing keys assigned to other services, and give it only the permissions it needs.
  4. Inspect Connection Logs: You can review the plugin log file /var/log/raidman.log from your Unraid terminal or log viewer to verify that only authorized devices are communicating with the companion plugin.