Skip to content

CommyPanel 0.8.0-rc.1 (release candidate)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Nov 16:31
v0.8.0-rc.1
b8e8387

Release candidate for testing. Not for production. This build has not yet been run end to end on a real server. If you try it, please use a test server and tell us what breaks.

Install this candidate (the normal one-line installer only installs the latest stable release):

curl -fsSL https://github.com/CommyPanel/panel/releases/download/v0.8.0-rc.1/install.sh | sudo bash -s -- --version 0.8.0-rc.1

Upgrade an existing install to it:

sudo commypanel upgrade --version 0.8.0-rc.1

Most useful to check: the upgrade itself, nginx reloads and the new nginx editor, a first Let's Encrypt certificate, a deploy with a release command, deploy on push from your Git host, and the live usage figures against docker stats.

CommyPanel 0.8.0

This release adds three things: the panel in seven languages, alerts that tell you when something needs attention, and backups that cover more: restore over an existing database, restore a volume, nightly volume archives and a look into your off-server copies. Please read Before you upgrade.

CommyPanel is still pre-1.0.

What's new

The panel in your language

  • English, French, German, Spanish, Russian, Ukrainian and Turkish, all installed with the panel. The first-run setup page has a language box (it starts with your browser's language when it is offered), and that becomes the first admin's language.
  • A language for every person. When you add a user you choose their language, and it starts as your own. Everyone changes theirs from the language menu in the top bar or under Settings → Appearance; it affects only their account. The login page uses the browser's language, with a box to change it for that visit.
  • About 1,660 sentences are translated, with the permission names and explanations, status names, messages and Laravel's own form errors. Dates, numbers and durations follow the language. English is the fallback, so a sentence that is not translated yet shows in English.
  • The translations are drafts, not yet reviewed by native speakers: see lang/README.md. Corrections and new languages are welcome as pull requests (one JSON file per language, checked by npm run i18n:check); see Translating the panel in CONTRIBUTING.md.

Alerts

  • Settings → Notifications now has a list of targets (up to 10): Slack (also Mattermost and Rocket.Chat), Discord, Microsoft Teams, ntfy, Telegram or a generic JSON webhook. Each target has its own events, can be switched off, and has a Test button; the page shows when its last message arrived or why it failed. Email is not supported.
  • Events: a deployment failed, was rolled back automatically, or succeeded; an app stopped answering or is back; a certificate could not be issued or renewed, or is about to expire; the disk reached 85% or 95%; a backup failed; a database server stopped or runs again. New targets start with the problems turned on.
  • Messages are sent when something changes, not on every check: an app is called down after three failed checks in a row (one message), and one more when it answers again. Apps that are stopped, being deployed or watched after a release are not reported.
  • An "Alerts for this app" switch on each app's Settings tab mutes one app.
  • Your earlier single webhook became a target called Default, with the same address and format.
  • Addresses are stored encrypted and never shown again, every address must be https and may not be this server or a reserved range, redirects are never followed, and messages never hold logs or secrets. See docs/notifications.md.

Backups that cover more

  • Restore over an existing database. Next to Restore (into a new database), Restore over… replaces an existing database with a dump. It shows which apps use it, asks you to type its name and confirm your password, first takes a safety dump of the database as it is, then drops and recreates it and loads the dump. If loading fails, the safety dump is put back. The dump's engine must match the server. It is recorded in the audit log as a high-risk action.
  • Restore a volume. Next to a volume archive, Restore stops the app, replaces the volume's files (a safety archive is taken first, the archive is unpacked next to the folder and swapped in at the end), and starts the app again, also when it failed. The agent restores only archives it made itself.
  • Nightly volume archives. A switch per volume (off by default) archives it every night at 03:30 and keeps the newest 3; failures raise a backup.failed alert.
  • Copies on remote storage. With the S3 copy on, Settings → Backups lists what is in your bucket and lets you download a file through the panel (password, audited). Nothing is restored from it automatically; the docs show how to recover a lost server.

Before you upgrade

  • The upgrade adds tables and columns (alert targets and states, an alerts switch per app, a language per user, a nightly switch per volume) and moves your webhook into the new target list. It needs the agent from this release too: sudo commypanel upgrade.
  • Volume archives made before 0.8.0 cannot be restored from the page, because the agent now records its archives. Make a new archive, or unpack an old one by hand as the docs describe.
  • Existing users keep English until they choose another language.
  • No new ports and no new permissions. notifications.manage covers all of the notification targets, and the per-app switch needs apps.update.
  • The panel contacts the outside only for what you add: your alert targets, plus what it already did (update checks, the S3 copy, the address lookup).

Security notes

  • Restoring a dump over a database and restoring a volume are new, privileged agent actions. Both accept only files the agent made itself (checked against its own record), validate every name, run one heavy job at a time within limits, and the volume restore refuses while any container uses the volume. The database restore runs the engine's fixed SQL with names and passwords validated, as before.
  • A compromised panel still cannot make the agent load someone else's SQL or files: a downloaded copy from remote storage is never restored automatically.
  • Alert addresses are secrets: encrypted at rest, never sent to a page, never in the audit log.

Known limitations

  • Alerts have no email, and targets are not chosen per app (an app can be muted).
  • The translations are unreviewed drafts, and text saved by background work (deployment errors and build logs, rollout notes) and the command line stay in English.
  • Restoring from remote storage onto a new server is manual: the agent loads only what it made on this server. Keep a copy of APP_KEY from /etc/commypanel/env, since backups never hold it.
  • A restore over a database makes linked apps see errors while it runs.

Requirements

Unchanged: Ubuntu 24.04 or 26.04, or Debian 13 or newer, with systemd; amd64 or arm64; root access; at least 1 GB of RAM.

# Install
curl -fsSL https://github.com/commypanel/panel/releases/latest/download/install.sh | sudo bash

# Upgrade
sudo commypanel upgrade
Assets 5
Loading