Skip to content

v1.29.0 — Tuxxin Services, remote S3 backups and security hardening

Choose a tag to compare

View all tags
@Tux82 Tux82 released this 24 Oct 23:46
· 2 commits to main since this release
v1.29.0
3d7466a

Tuxxin Services, remote S3 backups and security hardening

Remote S3 backups

Backup archives can now be copied to any S3-compatible bucket: AWS S3, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces, MinIO or Garage. Uploads run in the background after each nightly backup, retry on their own, apply remote retention to this server's own uploads only, and raise a warning in the panel header if they keep failing. Set it up on the Backups page, or use inetp s3_backup from the shell.

Tuxxin Services

Optional integrations under Settings → Tuxxin Services, with a master switch and one switch per module. A module that is off never runs and sends nothing anywhere. Each works on its free tier; a key adds coverage or raises its limits.

  • External Security Audit (qsa.sh): Firewall → Exposure Scan now runs in the background with live progress, supports Full and Deep tokens (a Deep token is never scheduled), recognises a scan cut off at a time limit, and explains every open port it finds.
  • IP Intelligence (worldip.io): click any IP on the Firewall and Logs pages, plus a "This Server on the Internet" card on the Dashboard.
  • Domain & Certificate Watch (issued.live): registration and certificate expiry for each site, with warnings on the Accounts list.
  • Site Screenshots (webshot.site): a weekly thumbnail of each hosted site.
  • Malware & Phishing Scan (whack.sh): on-demand site scans. Needs a free whack.sh key.
  • Site details on the Accounts page and in the client portal, and alerts to Discord, Slack, ntfy or any webhook.

New installs start with the modules on, except the whack.sh scan, which needs a key first. An upgrade adds them switched off.

Security

  • The panel's database and state are now private to the panel, including from Apache, which serves the hosted sites. Apache restarts once after the update to apply this.
  • Keys, the qsa.sh token and webhook URLs are stored root-only instead of in the panel database.
  • inetp harden_panel re-applies these settings at any time, and inetp audit checks them.

Upgrade notes

  • If you monitor exposure with a qsa.sh token, monitoring pauses until you run one scan by hand, so the panel can confirm the token is Full rather than Deep.
  • New CLI commands: inetp tsvc, inetp s3_backup and inetp harden_panel.
Assets 5
Loading