Skip to content

CommyPanel 0.6.0-rc.1 (release candidate)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 22:33
· 24 commits to main since this release
v0.6.0-rc.1
82aa5ea

Release candidate for testing. Not for production. This build has not yet been run end to end on a real server. If you try it, please use a test server and tell us what breaks.

Install this candidate (the normal one-line installer only installs the latest stable release):

curl -fsSL https://github.com/emrecanful/commypanel/releases/download/v0.6.0-rc.1/install.sh | sudo bash -s -- --version 0.6.0-rc.1

Upgrade an existing install to it:

sudo commypanel upgrade --version 0.6.0-rc.1

Most useful to check: the upgrade itself, nginx reloads and the new nginx editor, a first Let's Encrypt certificate, a deploy with a release command, deploy on push from your Git host, and the live usage figures against docker stats.

CommyPanel 0.6.0

This release adds four things: opening a database in phpMyAdmin or Adminer, API tokens for scripts and CI, deployment messages to a chat, and a one-click GitHub connection. Please read Before you upgrade: the database tools need a new port open in your firewall.

CommyPanel is still pre-1.0.

What's new

Database tools

  • A phpMyAdmin / Adminer button next to each database (phpMyAdmin for MySQL and MariaDB, Adminer for PostgreSQL). It starts a short-lived container, shows progress while it pulls and starts, and opens the tool in a new tab by itself.
  • You are logged in as that database's own user, never as the administrator, and the password never reaches your browser or the tool's container.
  • A session ends after 15 minutes without use (4 hours at most) and the container is removed; at most 6 run at once. The page tells you this before you open one.
  • The tools are served on port 2053 (COMMYPANEL_TOOLS_PORT), a port of their own, because a browser treats another port as another origin: a flaw inside a tool cannot read the panel's pages. 2053 is one Cloudflare also proxies, for panels behind Cloudflare.
  • New permission databases.tools, password confirmation, and an audit entry for every opening. Treat it like the database's password.

API tokens

  • Settings > API tokens creates tokens for scripts and CI: list apps, start a deployment and follow it. Abilities are apps:read and apps:deploy; a token can be limited to chosen apps and lasts 1 to 365 days. It is shown once, only a hash is stored, and it is checked against its owner's current permissions on every call.
  • Failed attempts are counted before the token is looked up, a token gets 60 calls a minute, and there is no CORS. See docs/api.md, which has a GitHub Actions example.

Deployment messages

  • Settings > Notifications sends the result of a deployment to Slack (and Mattermost, Rocket.Chat), Discord or any webhook as JSON: only failures, or every result. Messages hold the app, commit and reason, never logs or secrets. The address is stored encrypted and must be https; this server, reserved ranges and the cloud metadata address are refused. New permission notifications.manage. See docs/notifications.md.

GitHub

  • Settings > GitHub creates a GitHub App for the panel through GitHub's manifest flow: no tokens or deploy keys to paste. New apps can pick a repository from a list; each clone uses a read-only token for that one repository that expires after an hour.
  • Deploy on push is a switch on each such app's Settings tab. It is off by default and asks you to confirm turning it on or off.
  • New permission github.manage. Anyone who may create apps can deploy any repository the GitHub app may read, so give it access only to what should be deployable. See docs/github.md.

Before you upgrade

  • Open port 2053 in your firewall (next to 80, 443 and 8443) if you want to use the database tools. The installer prints the reminder.
  • The upgrade adds a column to apps, rewrites the agent's service file (a second socket for the tools) and the panel's nginx site. Back up /var/lib/commypanel as usual and upgrade with sudo commypanel upgrade.
  • New permissions: databases.tools, notifications.manage and github.manage. The built-in admin role gets them; give them to other roles on purpose.
  • The panel contacts the outside in more cases, all started by you: api.github.com and github.com when you use the GitHub page, create an app from it or deploy one, and your chat's webhook address once you switch messages on. Update checks, your S3 copy and the address lookup are as before.

Security notes

  • The database tools' proxy is the security boundary: single-use ticket (60 s), a cookie limited to its own session path, only the tool's own cookies forwarded, redirects kept inside the session, no WebSocket upgrades, a body limit. The agent chooses the tool image and network; a request cannot.
  • API tokens, deployment messages and the GitHub App keep their secrets encrypted and never show them again. The GitHub return works once, bound to your session, within ten minutes; its webhook accepts only this app's signed pushes.

Known limitations

  • Cookies ignore ports, so a script running inside a database tool could still fill the cookie jar of the host and read cookies that are not HttpOnly. A separate host name for the tools (planned with wildcard certificates) is the real fix.
  • Deployment messages are one webhook for the whole panel, and not email. GitHub Enterprise Server is not supported, and GitLab, Gitea and Bitbucket stay on deploy keys.
  • Not in this release: wildcard certificates.

Requirements

Unchanged: Ubuntu 24.04 or 26.04, or Debian 13 or newer, with systemd; amd64 or arm64; root access; at least 1 GB of RAM.

# Install
curl -fsSL https://github.com/emrecanful/commypanel/releases/latest/download/install.sh | sudo bash

# Upgrade
sudo commypanel upgrade
Assets 5
Loading