How to expose Incus to the network¶

By default, Incus can be used only by local users through a Unix socket and is not accessible over the network.

To expose Incus to the network, you must configure it to listen to addresses other than the local Unix socket. To do so, set the core.https_address server configuration option.

For example, to allow access to the Incus server on port 8443, enter the following command:

incus config set core.https_address :8443

To allow access through a specific IP address, use ip addr to find an available address and then set it. For example:

user@host:~$ ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever2: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 00:16:3e:e3:f3:3f brd ff:ff:ff:ff:ff:ff inet 10.68.216.12/24 metric 100 brd 10.68.216.255 scope global dynamic enp5s0 valid_lft 3028sec preferred_lft 3028sec inet6 fd42:e819:7a51:5a7b:216:3eff:fee3:f33f/64 scope global mngtmpaddr noprefixroute valid_lft forever preferred_lft forever inet6 fe80::216:3eff:fee3:f33f/64 scope link valid_lft forever preferred_lft forever3: incusbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000 link/ether 00:16:3e:8d:f3:72 brd ff:ff:ff:ff:ff:ff inet 10.64.82.1/24 scope global incusbr0 valid_lft forever preferred_lft forever inet6 fd42:f4ab:4399:e6eb::1/64 scope global valid_lft forever preferred_lft forever

user@host:~$ incus config set core.https_address 10.68.216.12

All remote clients can then connect to Incus and access any image that is marked for public use.

Authenticate with the Incus server¶

To be able to access the remote API, clients must authenticate with the Incus server. There are several authentication methods; see Remote API authentication for detailed information.

The recommended method is to add the client’s TLS certificate to the server’s trust store through a trust token. To authenticate a client using a trust token, complete the following steps:

On the server, enter the following command:
```
incus config trust add <client_name>
```
The command generates and prints a token that can be used to add the client certificate.
On the client, add the server with the following command:
```
incus remote add <remote_name> <token>
```

Note

If your Incus server is behind NAT, you must specify its external public address when adding it as a remote for a client:

incus remote add <name> <IP_address>

When generating the token on the server, Incus includes a list of IP addresses that the client can use to access the server. However, if the server is behind NAT, these addresses might be local addresses that the client cannot connect to. In this case, you must specify the external address manually.

See Remote API authentication for detailed information and other authentication methods.