Security

Administrator Password

Phaeton's web UI and its API are protected by one local administrator account. You create it in the setup wizard; no setup code is needed.

• Finish the setup wizard right after installing. On a fresh installation, whoever opens Phaeton first creates the administrator account.
• Choose a unique password that you use nowhere else. An older installation that still uses the retired default password opens the wizard, so you can choose a real one.
• To change the password, open Settings → System → Access, enter the new one in Admin password and select Apply changes. Leave the field blank to keep the current password; the saved password is never shown.
• Keep Require sign-in on. With it off, anyone who reaches Phaeton can control charging and change settings.
• After five wrong passwords in a row, Phaeton makes each next attempt wait longer, up to 32 seconds.
• The account survives restarts, updates and damaged settings. If you forget the password, you can set a new one over SSH on the GX.

Forgotten administrator password

Network Exposure

Phaeton is meant for a trusted local network. It listens on these ports:

Over MQTT, Phaeton opens no port for the GX: it connects to the GX itself, and on another computer it uses the GX's encrypted port after pairing.

• Do not expose port 8088 or the EVCS Modbus port to the internet, and do not forward them on your router.
• Over Legacy Modbus, any device that reaches the EVCS Modbus port can change the charge mode, the current, Start/Stop and the charging station settings. A Victron charging station can restrict this to listed IP addresses; Phaeton cannot. Let only the GX reach that port, for example with a firewall on the computer that runs Phaeton, and prefer MQTT.
• Other websites cannot change Phaeton's settings through your browser, even when the browser has saved the Phaeton password. Phaeton accepts changes only from its own pages and from the addresses in Allowed CORS origins.
• Leave Allowed CORS origins (Settings → System → Access, in Advanced) empty unless a specific trusted integration needs it.
• An integration that uses the API signs in with HTTP Basic authentication over HTTPS, with the administrator username and password.

HTTPS Certificate

Phaeton creates its own HTTPS certificate on the first start, so your browser warns about it on the first visit. A plain http address on Phaeton's port moves to https by itself.

• Before you accept the certificate, compare the fingerprint the browser shows with the one in PHAETON-RESULT.html on the USB installer stick or in the output of the SSH installer. Phaeton's log also names it, after certificate SHA-256, each time the web server starts.
• The certificate stays the same after restarts and updates. It is part of the data directory, so a backup keeps it.
• VRM Control Panel presents its own HTTPS certificate; Phaeton's fingerprint does not apply there.

Remote Access Through VRM

• For access from outside your home, use VRM Control Panel. It runs through the GX's own connection to VRM and needs no port forwarding, no SSH and no Remote Support.
• Control Panel works only when the GX's VRM Portal setting is Full, and VRM decides who can open it. Phaeton still asks for its own administrator password.
• If you need remote access without VRM, use a trusted reverse proxy with end-to-end HTTPS. Never open port 8088 to the internet.

VRM Control Panel

Signed Updates

• Phaeton installs only releases signed with the Phaeton release key. It checks the signature, the checksum and the platform before installing, both for releases from a release repository and for an uploaded .phaeton-update package. A package that fails a check is not installed.
• Download packages only from the Phaeton downloads site.
• A package older than the installed version needs a second confirmation, so an older release cannot be installed by accident.
• An access token for a private release repository is sent only over HTTPS to that repository's server, never to a server a download redirects to.

UpdatesPhaeton downloads

Backups And GX Access

• A backup of the data directory holds the administrator password, charger credentials, the license and the certificate's private key. Keep it as private as a password.
• Phaeton runs with full privileges on the GX. It therefore keeps its state file and logs inside its own data directory and refuses other locations.
• Turn off SSH access on the GX when you no longer need it.

Backup and Restore