Skip to content

v2.0.0 — Security, Mail Deliverability, App Manager, Mobile

Choose a tag to compare

View all tags
@danhorntx danhorntx released this 11 May 05:33
· 40 commits to main since this release
v2.0.0
662a5ec

Major release. New security features, a complete mail deliverability stack,
in-panel database browser, Node/Python app manager, full backup restore,
comprehensive responsive design, and the refreshed user guide.

Added

Security

  • Two-Factor Authentication (TOTP) — RFC 6238, works with any standard
    authenticator app. New-IP login alerts. Disable requires current password.
  • API Keys — bearer tokens (dpk_…) for external automation, with
    admin and read scopes. Audit-logged. SHA-256 hashed at rest.
  • Audit Log UI — searchable, filterable view of every state-changing
    admin action.
  • Login attempt tracking — DB-backed brute-force lockout (5 fails / 15
    min) on top of the existing rate limiter.

Mail & Deliverability

  • Mail Health Probe — 11 deliverability checks (rDNS, HELO, MX,
    SPF, DKIM, DMARC, MTA-STS, TLS-RPT, TLS cert, RBL listings on Spamhaus /
    Barracuda / SpamCop / SORBS). Daily cron, alert on failure.
  • MTA-STS (RFC 8461) — policy file + mta-sts.<domain> Apache vhost +
    _mta-sts DNS record, auto-published per mail-enabled domain.
  • TLS-RPT (RFC 8460) — _smtp._tls.<domain> TXT auto-published.
  • DMARC Aggregate Report Processor — IMAP fetch from a configured inbox,
    parse XML (with .gz / .zip / raw decoding), store in
    dpanel_dmarc_reports keyed by (org_name, report_id).
  • Per-domain IMAP TLS via Dovecot SNI — local_name blocks managed in
    /etc/dovecot/conf.d/95-dpanel-sni.conf. ImapFlow client picks the right
    cert based on the user's email domain.
  • Subdomain mail provisioning — mail-enabled subdomains write records
    into the managed parent zone under prefixed names (mail.app,
    _dmarc.app, etc.).

Apps & Databases

  • Database Browser — phpMyAdmin-equivalent: paginated row view,
    structure (columns / indexes / engine), free-form SQL runner, audit-
    logged queries.
  • Node / Python App Manager — PM2-backed process management with
    Apache reverse proxy, auto port allocation in 3000–3999, live logs,
    Restart / Stop / Start / Destroy controls.
  • WordPress install via job queue — long-running install now async
    with progress reporting.

System

  • Domain Health Dashboard — per-domain aggregator: SSL, DNS, Mail
    Health, backups, disk usage, PHP version, Apache error count. Surfaces
    the worst status as the overall summary.
  • Backup Restore — restore files or databases from the UI with a
    RESTORE type-to-confirm guard, wipe-target / drop-recreate options.
    Audit-logged.
  • File Manager — chmod, archive extract, bulk delete + move, image
    preview    . Permissions column inline editor; supports .zip,
    .tar.gz, .tar.bz2, .tar.
  • Notifications — email alerts for SSL expiry (< 14 days), Mail
    Health probe failures, backup failures, new-admin-IP logins. Dedup'd
    for 24 hours. Logged to dpanel_notifications.
  • Job Queue — in-process queue with progress + log per job, polled
    via /api/jobs/:id. Currently powers WordPress install.

UX

  • Responsive / Mobile — sidebar collapses to off-screen below 768px
    with a hamburger toggle. Tables progressively hide low-priority
    columns at 1100/900/820/700/640/560/480px breakpoints. Modals turn
    into full-width bottom sheets on phones. Touch-target enlargement on
    (pointer: coarse) devices. DB Browser sidebar collapses above main
    pane on narrow screens.
  • Changelog modal — click the version pill in the sidebar.
  • User Guide link in the sidebar footer.

Changed

  • Atomic domain provisioning — routes/domains.js POST flow replaced
    with a 13-step reconciler in lib/state/domain.js. Each step has
    check, apply, and a rollback closure. On partial failure, all prior
    steps are rolled back in reverse.
  • Apache deleteVhost now also removes the certbot-generated
    -le-ssl.conf twin.
  • setupMailDns now writes MTA-STS / TLS-RPT records in addition to
    the existing MX/SPF/DMARC; correctly handles subdomain provisioning by
    walking up to the managed parent zone.
  • dns.js SERVER_IP — previously hardcoded to the production IP;
    now auto-detected via hostname -I, with DPANEL_SERVER_IP env var
    override.
  • WebSocket terminal session check — already used DB-backed sessions
    cleanly; no functional change.

Fixed

  • 🚨 Empty database backups (critical) — lib/mysql.js dumpDatabase
    invoked mysqldump ... \${name}` ...in a shell string, which the shell interpreted as command substitution.mysqldump` was running
    with no database argument and producing 20-byte empty gzip streams.
    Every database backup taken in production since the original release
    was affected.
  • Webmail / autoconfig vhost collision — the autoconfig vhost
    claimed webmail.<domain> as a ServerAlias, intercepting webmail
    traffic and returning 403 (Apache picked whichever vhost loaded first
    alphabetically). Fixed at the source + added a vhost collision guard
    that refuses new vhosts whose hostnames overlap an existing one.
  • Webmail vhost ACME exemption — the ProxyPass / directive
    swallowed Let's Encrypt http-01 challenges, silently breaking cert
    renewals. New webmail vhosts include an Alias + ProxyPass !
    exemption for /.well-known/acme-challenge/.
  • Maildir literal-brace bug — mkdir -p .../Maildir/{cur,new,tmp}
    was creating a literal directory named {cur,new,tmp} because
    execSync runs through /bin/sh (dash), which doesn't brace-expand.
  • Missing npm dependencies — helmet, dotenv, cookie,
    cookie-signature, geoip-lite, isbot were require()'d but not
    declared in package.json. Fresh installs crashed on boot.
  • Admin email reading deleted config.json — getAdminEmail()
    read from config.json (renamed to .migrated after the DB
    migration), so Let's Encrypt registrations used the admin@<newdomain>
    fallback. Now reads from dpanel_users.email.
  • Dovecot users file format — entries written with non-numeric UID
    columns; newer Dovecot rejects. Fixed format + Dovecot config uses
    override_fields for backwards compatibility with legacy entries.

Security

  • Disable-2FA endpoint requires the current password (anti-hijack).
  • API keys never returned by list endpoint — only the prefix is stored.
  • Bcrypt cost factor 12.
  • Session cookies set sameSite=strict, secure=true, httpOnly=true.

Migration notes

  • New env vars: DPANEL_SERVER_IP (recommended explicit set),
    DPANEL_MAIL_HOSTNAME (optional override for Postfix HELO),
    DMARC_INBOX_EMAIL/PASSWORD (DMARC processor, optional),
    DPANEL_SEED_<PROVIDER> + _PASSWORD (seed list deliverability test,
    optional).
  • Run npm install after pulling (new deps) and npm install -g pm2
    (required for the App Manager).
  • Existing webmail vhosts on production servers need an ACME exemption
    patch — see PROD_MIGRATIONS.md.
  • Existing database backups created before this release are likely
    empty; check find /opt/dpanel/backups -name "*_db_*.sql.gz" -size -100c and recreate any matches.
Assets 2
Loading