Changelog

0.3.34

Features

• A website can skip ModSecurity for chosen paths, such as /wp-admin, including everything under that path. Other paths and other websites stay protected. Open Rule exceptions and save the paths.

0.3.33

Features

• A MySQL or MariaDB user can connect from this server only, from any IP, or from specific IP addresses. Localhost stays allowed so the website and phpMyAdmin keep working.

0.3.32

Features

• Nginx forwards the visitor scheme, host, and Cloudflare headers to Apache and to a reverse proxy target. Use Rebuild configs once after upgrading so existing sites pick this up.

0.3.31

Features

• WordPress tools have a Cron switch. Off stops scheduled tasks. On runs them every minute from the system and stops the cron that runs on each visit.

0.3.30

Fixes

• WordPress user lists and other WP-CLI commands skip an encoded theme, so a theme that cannot be decrypted no longer replaces the command result.

0.3.29

Fixes

• WordPress tools skip an encoded theme that cannot be decrypted from WP-CLI, and pass the site domain so the loader sees the same host as the website.

0.3.28

Features

• File Manager accepts files and folders dropped onto the file list and uploads them into the open folder.

Fixes

• WordPress tools run WP-CLI with the website's PHP and its ionCube Loader, so the site title is not replaced by the loader error.
• A broken apt source stanza is removed instead of failing every package update.
• The Docker test machine no longer relocates a source checkout that was never moved.

0.3.27

Features

• Laravel tools can use an app directory you choose. Leave it empty to detect artisan in the document root or the folder above it.

0.3.21

Features

• The homepage screenshots use example domains.
• The README no longer includes the public website deploy steps.

0.3.20

Features

• Setup does not install software. The first admin sign-in recommends Nginx, Apache, MariaDB or MySQL, Redis, Let's Encrypt, and FTP. Install or skip.
• Hosting users manage ModSecurity from Security: turn the account on or off, and disable a rule on one website.
• A hosting user's local backup directory must stay inside that user's home. Other users' destinations stay hidden.
• ModSecurity rule 920450 (charset not allowed) is off by default.

0.3.19

Features

• File Manager Calculate measures each folder on its own. A folder that takes longer than one minute stops and shows the size found so far, prefixed with >.

0.3.18

Features

• Security shows a live log while PHP Antimalware Scanner is running. The progress line updates in place until the scan finishes.

0.3.17

Fixes

• PHP Antimalware Scanner reads the text report and shows infected files. A scan that stops shows the PHP error instead of a missing JSON report. The scan uses the PHP CLI config, so it does not inherit a site memory limit.

0.3.16

Fixes

• PHP Antimalware Scanner reads the JSON report AMWScan writes, including infected files. The logo banner is no longer shown as a finding. A scan that does not finish shows the timeout or PHP error.

0.3.15

Features

• Path fields can be chosen from the File Manager. Browse covers antivirus scan paths, document roots, Composer, Git deploy, FTP home, backup, cache, NFS, Supervisor, mount points, and FFmpeg.

0.3.14

Features

• Build and upload a release tarball from this machine with scripts/release-local.ps1 or scripts/release-local.sh. Credentials stay in a gitignored .r2.env.

0.3.13

Features

• PHP Antimalware Scanner shows findings and the scan log as tables. ClamAV’s last scan log uses the same table.

Fixes

• AMWScan no longer fails with an empty error. The panel reads the JSON report path AMWScan actually writes and lists canonical findings.

0.3.12

Fixes

• ModSecurity WAF disables XSS rules 941100 and 941160 by default. They false-positive on WordPress admin and HTML editors. Existing installs apply this on agent start.

0.3.11

Features

• Security scanners include WPScan. Findings are listed in a summary table.
• Antivirus can run PHP Antimalware Scanner (AMWScan) on site files. Report-only, with a findings table.

0.3.10

Features

• Service Status can start or stop a service, not only restart it.
• File Manager text editor has Save & Exit.

Fixes

• Extracting a .tar.gz in File Manager works on BusyBox tar, which does not accept --no-absolute-names.
• WAF turns off the data-leakage pack by default. RESPONSE-951 was exceeding PCRE limits on large WordPress admin pages. PCRE match limits are raised for remaining rules.

0.3.9

Fixes

• An existing WAF config now turns off scanner, session fixation, IP reputation, and GeoIP/DoS packs on agent start. 0.3.8 left those packs on because it treated the saved file as already migrated.

0.3.8

Features

• Service Status shows RAM and process count for each listed service, from systemd and cgroup usage.

Fixes

• ModSecurity WAF defaults skip scanner, session fixation, IP reputation, and GeoIP/DoS packs. Windows CMD and PowerShell RCE rules stay off. Non-ASCII URLs and missing Accept headers from crawlers are not blocked. Existing installs apply this once and can turn packs back on.

0.3.7

Fixes

• Installing ionCube Loader no longer fails with "php-config --extension-dir failed" when PHP-dev is not installed. The panel reads the extension directory from that PHP version, and installs the CLI package if it is missing.

0.3.6

Features

• System tools → Disk can create a software RAID array with mdadm. Unused disks are listed. RAID 0, 1, 5, and 10 are supported. The system disk is not offered. After the array is created, format it if needed and mount it on the same page.

0.3.5

Fixes

• File Manager opens a symlink to a folder as a folder. Clicking names such as public_html no longer shows "path is a directory". Calculate follows that folder for its size.

0.3.4

Features

• File Manager has Calculate on the Size column. It measures each folder in the current directory.
• A running rclone transfer can be cancelled from Backup → rclone.

Fixes

• A DirectAdmin SSH migration of a large website no longer stops with "SSH command timed out" after 45 minutes. Packing can run up to 8 hours and the download up to 12 hours while the remote command is still working.

0.3.3

Features

• Before a migration copies any files, it shows the website size and the database size. Confirm those sizes to start the copy.
• Apache access logs, error logs, and ModSecurity record the visitor IP instead of 127.0.0.1.

0.3.2

Features

• A DirectAdmin migration brings the website's databases and FTP users. FTP passwords are reset because DirectAdmin only stores a hash. Open FTP to see the new passwords.
• The migrate connection is saved on this server: host, port, username, and private key. Leave a secret blank to keep the saved one.
• Changing a website's primary domain also renames its folder and moves the files with it.
• When a website has more than one domain, Let's Encrypt lets you choose which names go on the certificate. The primary name stays included, up to 100 names.

0.3.1

Features

• A migrated website is downloaded to /home/tmp, and the unpacked copy stays there until the import finishes.

Fixes

• Importing that download no longer stops with "restore path is not allowed". The agent log records the download directory, the archive path, and the reason when an import fails.

0.3.0

Features

• Migration packs each website into a tar file on the DirectAdmin server before downloading it. Temporary files are written on the disk with the most free space.

Fixes

• Creating an account succeeds when a group with that name already exists.

0.2.100

Features

• Migrate a DirectAdmin server over SSH as root, or as a user that can sudo. The website list and the copy use that connection.
• SSH login accepts a PuTTY PPK file or an OpenSSH private key. An encrypted key uses its passphrase. The password is still used for sudo when the account is not root.

0.2.99

Fixes

• After an update, a script left over from the previous build reloads the page instead of failing the file editor. A missing file under /assets is a 404, so the browser does not receive the HTML page as JavaScript.

0.2.98

Features

• Migrate websites from DirectAdmin. Choose the sites, then watch each one. The transfer runs in the background and keeps going if you leave the page. Files, databases, and the account are imported. Mail, DNS, and certificates are not.

0.2.97

Features

• After an update, the page waits until the agent answers before it refreshes. A missing agent socket no longer reloads the panel into an error.

Fixes

• PHP-FPM pool numbers can be edited freely. Save checks them first and refuses a dynamic pool whose start servers are outside min spare and max spare.
• WordPress users lists both administrator and editor accounts. The previous query kept only the last role, so a site with no editor showed an empty list.

0.2.96

Features

• Web server and database optimize show the current value until Optimize for RAM is changed. Changing the RAM amount fills the preset for that amount.
• Redis settings include I/O threads and I/O threads read. One thread keeps reads on the main thread. The Redis tab can start Redis or Valkey, and a process that answers PING counts as running.
• WordPress users lists only administrator and editor accounts. Site title, URL, plugins, and WP-CLI commands are cached for 1 hour. Refresh loads that part again.

Fixes

• A dynamic PHP-FPM pool cannot set start servers outside min spare and max spare. That combination stopped PHP 7.4 with exit status 78. Reloading PHP-FPM tests the config first, and a stopped service is started after a valid write.

0.2.95

Features

• Deleting a file in the file manager moves it to Trash for 15 days. Restore puts it back at the original path. Delete and Empty Trash remove it immediately. The agent deletes items older than 15 days on startup and every 6 hours. Account trash stays in the home, so it still counts toward disk quota.
• ionCube Loader is labeled php_ioncube on the PHP page, next to OPcache and SSH2.

Fixes

• Redirect HTTP to HTTPS stays off until that switch is turned on. A new site uses the local certificate, and HTTP keeps working. A site that already uses Let's Encrypt keeps that certificate. After upgrading, use Rebuild configs so existing sites drop a redirect that was turned on automatically.

0.2.94

Features

• PHP extensions include OPcache, SSH2, and ionCube Loader. OPcache and SSH2 install from apt. SSH2 can also install from PECL. ionCube downloads the official loader for the selected PHP version, writes zend_extension at priority 00 so it loads before OPcache, and enables it for that version. Install the PHP version first, then open PHP and choose the version.

0.2.93

Features

• Updating MySQL or MariaDB dumps every database first. The file is /var/backups/siroc/db-upgrade and ends in .sql.gz. The newest 3 dumps are kept. The database has to be running. If the dump fails, the packages are not changed.

Fixes

• A MariaDB update no longer disables the service before apt. After the packages change, the datadir stays on the directory that already holds ibdata1, including Ubuntu’s /var/lib/mariadb. AppArmor is reloaded so that path and /siroc can be read. If MariaDB still does not start, the install log includes the error from the journal.

0.2.92

Fixes

• Software lists packages that are held in apt as installed. Holding a package changes its dpkg status to hold ok installed. Nginx, Apache, MariaDB, PHP, and the other packages installed from Software no longer show as Missing. apt upgrade still skips them.

0.2.91

Features

• PHP-FPM can be installed more than once. PHP 7.4 is in the list with 8.1, 8.2, 8.3, and 8.4. The Install button stays after the first version is installed. A new server still starts with 8.4. Installing another version does not change the current php command. phpMyAdmin still prefers 8.x. If apt cannot find php7.4-fpm, that Ubuntu release has no PHP 7.4 build.
• Packages installed from Software are held in apt. apt upgrade, unattended upgrades, and System tools → OS updates leave them as they are. Update those packages from Software. On startup the agent holds software the panel already installed. OpenSSH and Python are held only after you install or update them from Software, so SSH and the system Python still receive apt security updates until then.

0.2.90

Fixes

• An address added to a bond, bridge, or VLAN stays on that device type in /etc/netplan/99-siroc.yaml. Netplan no longer fails with changes device type when the interface is bond_public. The bond members, the existing IPv6 address, and the fe80::1 route stay in the original netplan file. If 99-siroc.yaml already listed that bond under ethernets, delete the file and run netplan generate before adding the address again.

0.2.89

Features

• On Ubuntu, IP addresses added in System tools are written to /etc/netplan/99-siroc.yaml and kept after reboot. The form has a gateway. It replaces the default route on that interface. If the interface uses DHCP, the DHCP gateway is no longer used once a gateway is set. Leave the gateway empty to keep the current route. Submitting an address that is already present updates the gateway. cloud-init is told not to rewrite netplan on boot.

Fixes

• Adding an address brings the interface up. Removing the last address on a VLAN removes that VLAN from netplan as well.

0.2.88

Features

• Service Status moves from Settings to System tools. Search, monitor, restart, and manage stay on that tab, above Memcached and FFmpeg.
• Nginx accepts a larger Cookie header. One header can be 128k (large_client_header_buffers 4 128k). Apache uses the same limit (LimitRequestFieldSize 131072).

Fixes

• client_header_buffer_size is set only in /etc/nginx/conf.d/00-siroc-headers.conf. On start the agent removes the same lines from nginx.conf and 99-cp-optimize.conf, so nginx -t does not fail on a duplicate directive. Optimize no longer writes those lines back.
• The panel hosts block no longer points public website names at 127.0.0.1. Only pma.cp.local and local names, such as .test and .local, stay there. A reverse proxy to a public hostname uses DNS instead of looping into this server.
• A reverse proxy sends X-Forwarded-For as the client address only, and does not forward CF-Connecting-IP, CF-Ray, CF-Visitor, CF-IPCountry, True-Client-IP, or CDN-Loop. Use Rebuild configs once after upgrading so existing proxy sites pick this up.

0.2.87

Features

• The Nginx cache disk limit can be typed, such as 500m or 2g. It cannot pass 90% of the disk that holds the cache folder. The page shows that limit.

Fixes

• After apt upgrades Nginx, modules built for the previous version are unloaded so Nginx can start. They are compiled again for the new Nginx and loaded back. This runs for an upgrade from the panel, unattended upgrades, or apt itself.
• Hosts rows added in System tools are saved by the panel and put back when /etc/hosts is rewritten on boot. cloud-init is told to leave that file alone. Rows already removed by an earlier reboot have to be added again.

0.2.86

Features

• Nginx cache has ready-made setups: Public pages, WordPress, Respect the app, and Long cache. Each one explains what is stored. Lifetime, disk limit, unused files, a saved page when the origin fails, background refresh, application cache headers, skipped paths, and cookie names can be set on their own. The response includes X-Cache-Status.

Fixes

• After a MariaDB package upgrade, the agent allows AppArmor to read /siroc/etc and use /siroc/db, including the MariaDB 11.8 mariadbd profile. Options MariaDB no longer accepts, such as innodb_buffer_pool_instances, are removed. A config that stops the server is rolled back and the previous one is restored.
• Nginx modules are rebuilt when nginx -t reports a module built for an older Nginx. Nginx is started again after that rebuild.

0.2.85

Features

• No new features in this release.

Fixes

• Let's Encrypt waits when another Certbot is already running, then tries again. The message names the website that run is working on, or says certificates are being renewed. Ubuntu's Certbot timer is turned off so it no longer takes the same lock as the panel.

0.2.84

Features

• No new features in this release.

Fixes

• A failed npm or Composer command shows the error, such as a Vite+ build failure, instead of only the last lines of the stack trace.
• Websites no longer send Strict-Transport-Security. Nginx hides the header and Apache unsets it. Rebuild configs applies this to existing sites. A saved custom config loses any line that sets the header the next time it is written.

0.2.83

Features

• No new features in this release.

Fixes

• Laravel npm run build marks node_modules/.bin executable before the script and again after npm install, so vp: Permission denied does not stop the build. Saving a site keeps the execute bit on those files.

0.2.82

Features

• Backup destinations and schedules can be edited. A blank password or S3 secret keeps the current value.
• Nginx rewrite templates include vod. Point the alias at the media folder. A file plays at /vod/name.mp4/index.m3u8.
• File upload, database import, and restore upload show transfer speed and can be cancelled while the file is still sending.

0.2.81

Features

• Restore can upload a Siroc or DirectAdmin archive from the browser, up to 10 GB. A path already on the server still works.

0.2.80

Features

• Restore a DirectAdmin user backup, or an admin backup that contains several users. Websites and databases are imported. Mail, DNS, and certificates are not.

0.2.79

Fixes

• Rule exceptions lists disabled rules first, including rules outside the first page of the catalog.

0.2.78

Fixes

• Times in the panel follow the server timezone. Last deploy, files, backups, queues, and status checks no longer show raw UTC.

0.2.77

Features

• A website can be moved to another account. Its files move with it. Databases stay with the previous account.

Fixes

• Creating a database from a website selects that website's account.

0.2.76

Fixes

• After a panel update finishes, the page refreshes when the panel is back.

0.2.75

Features

• Git branch is a list read from the repository. The default branch is marked.
• The Laravel command also runs npm install, npm run build, and php artisan queue:restart. Artisan has a queue:restart button.

0.2.74

Features

• A new website turns on HTTPS with a local certificate. Let's Encrypt can replace it later.
• Git can pull from an HTTPS URL or git@github.com:org/repo.git. Pull uses the branch in the URL, or the repository's default branch. A private repository asks you to add the SSH public key as a deploy key.

0.2.73

Features

• PHP run from the command line has no time limit and no memory limit. Website PHP limits stay as they are.

0.2.72

Features

• A database user can be allowed to create databases. Only a user with that permission can create one, and the name does not have to start with the account name. Sync adds databases that user created.

0.2.71

Features

• Each website shows the bytes nginx has sent, including images and other files. The total keeps growing as traffic arrives.
• An update stores the panel, its database, TLS, logs, nginx cache, MariaDB data, and Siroc configs under /siroc. Account homes stay in /home, and the old paths keep working.

0.2.70

Fixes

• The rclone progress bar moves while files are copied and shows how many files are done. The count changes as more files are found, and copying starts immediately.

0.2.69

Features

• An admin can choose one default website. Requests to the server IP or an unknown name open that site, and HTTPS uses it when the site has a certificate. None closes unknown requests again.

0.2.68

Fixes

• Turning nginx cache on and saving keeps the switch on. The site list is no longer reused from the browser cache.

0.2.67

Features

• The nginx cache directory is filled in for the site, under /var/cache/nginx/siroc/ and the domain name.

0.2.66

Features

• A site can cache pages nginx fetches from Apache or a reverse proxy, choose how long they stay cached, and clear that cache.

0.2.65

Features

• The Web server tab can change a site's type to PHP, nginx, a reverse proxy, or an app runtime.

0.2.64

Features

• Nginx does not write access-log lines for images, video, CSS, or JavaScript. Existing sites are updated when the agent starts.
• A reverse proxy keeps the hostname in proxy_pass, such as https://doujinfast.com, and sends Host, X-Real-IP, X-Real-Port, X-Forwarded-For, and REMOTE-HOST.

0.2.63

Features

• Supervisor has its own page. Programs can be added, edited, started, stopped, and their logs read. A program created for a website stays editable from that site.
• Websites can rebuild every nginx and Apache config from the saved settings and reload both.
• A reverse proxy can target a hostname such as https://doujinfast.com. Nginx connects to the IP from Hosts. Rebuild configs after that IP changes.

0.2.62

Features

• A site can turn its access log and error log on or off separately. Nginx and Apache follow that choice.
• System tools can edit /etc/hosts. The table pages through the rows and shows when a row was added.
• NFS shares and NFS mounts can be added, edited, and removed. Each option has a short explanation.
• Mounting another disk offers a filesystem choice and mount options, each with an explanation.

0.2.61

Features

• Websites can be selected and deleted together.
• File manager uploads show a progress bar for each file. A folder is one bar for the whole folder.

Fixes

• Nginx 1.25.1 and newer use the http2 directive instead of listen ... http2. Existing site files are rewritten the next time the agent starts.
• The nginx VOD runtime config no longer sets aio on.
• An nginx config opened or saved from site settings is formatted.
• Dropping several files in the file manager uploads every file.

0.2.60

Fixes

• The file manager lists a site directory on another disk, such as /mnt/data/plyxxx, and opens that directory. Breadcrumbs stay on that directory instead of looking for mnt under the account home.

0.2.59

Fixes

• Opening a site whose directory is on another disk opens that directory. It no longer looks for the same path under the account home.

0.2.58

Fixes

• Creating a site on another disk no longer changes the owner of every file there, so the request finishes.
• The agent service file no longer sets RuntimeDirectoryGroup. systemd before 256 ignored that line. An installed unit drops it the next time the agent starts.

0.2.57

Features

• Site settings sections are tabs.
• A site can set its own PHP limits. A blank field keeps that account's PHP setting.
• Composer shows the package list when composer.json is present, and that file's directory can be changed.
• Hotlink protection can allow extra sites. The primary name and aliases are allowed already.

0.2.56

Features

• Site settings open as their own page, with a Back button to that site. The section stays in the address, so a refresh keeps the same tab.

0.2.55

Fixes

• The domain list page size stays on the value you pick, including 50 and 100 per page.

0.2.54

Features

• Domain aliases can be removed together. Select the names and choose Remove selected. The primary name stays. Each name shows the time it was added, and a name that was already on the site keeps that time.

0.2.53

Features

• A backup schedule can be turned off. The site page has an Auto backup switch for that account, and the Backup page has the same switch on each schedule. A disabled schedule is left out of cron.
• Site settings open under the domain name, with section buttons across the top. The certificate is a short list: type, issuer, names, and expiry.

0.2.52

Features

• The rclone folder browser has a start path. Type a path and choose Go. On SFTP and FTP, a path that starts with / is on the server, and Up from the home folder opens that server root.

0.2.51

Features

• The dashboard shows one disk gauge for each mounted filesystem. A root-only machine still says Disk. A second mount of the same device is not counted again.

Fixes

• The rclone folder browser can move up from a single folder name, such as .ssh, back to the remote root.

0.2.50

Features

• The rclone Run form can browse folders. Source and Destination both open a folder list for a remote or for a path on this server.

0.2.49

Features

• An rclone remote can be edited. The name and type stay the same. A blank password or secret keeps the saved one, and a saved SFTP key can be replaced or removed.

0.2.48

Features

• An SFTP rclone remote can use an uploaded private key. OpenSSH, PEM, PKCS#8, and PuTTY PPK are accepted, including an encrypted file when its passphrase is entered.

0.2.47

Features

• The SSL tab shows the deployed certificate: type, brand, domains, expiry, the private key, and the PEM. Saving the pasted key and certificate installs it. Tabs are Current Certs, Let's Encrypt, and Certificate holder.
• Force HTTPS is a switch on the current certificate. Leaving it unset still redirects HTTP for Let's Encrypt and a pasted certificate. Turning it off stops that redirect.
• The site Config tab edits the Nginx and Apache files. Save tests them first and writes them only when the test passes. Reset restores the generated files.
• rclone is a tab on Backup. An expired panel session returns to the sign-in page.

0.2.46

Features

• A website can have 500 aliases. The domain list is split into pages.
• Duplicate domain names are skipped. A name already on this site or another site stays where it is, and the other names are added.
• A Let's Encrypt certificate still covers the primary name and the first 99 aliases.

0.2.45

Features

• rclone shows the file it is transferring. While copy, sync, or move is running, the current file name, percent, size, and speed update every second.

Fixes

• PHP leaves proc_open available so Composer, Symfony, and Laravel Process can run. An account still using the previous default list picks this up the next time its PHP settings or a site is saved. Shell commands stay disabled.

0.2.44

Features

• rclone has its own page. Add S3, B2, SFTP, FTP, WebDAV, or local remotes, then copy, sync, move, list, check, or delete. Install rclone from Software.
• Websites can be Direct nginx. Nginx serves the document root itself. PHP and Apache are not used, and a PHP file returns 404.

0.2.43

Features

• Each added IP address can set a VLAN ID. The VLAN interface is created and brought up, and the address is placed on it. Removing the last address on that VLAN removes the interface.

0.2.42

Features

• Sign-in can remember the username and password, and the browser password manager can fill the fields.
• A new website starts on HTTP. The SSL tab shows the certificate subject, issuer, dates, names, and serial. You can install your own certificate and key, or still use Let's Encrypt or local HTTPS.
• Redis can stay in memory. Turning off Save to disk stops RDB snapshots and the AOF, so a restart drops the data.

0.2.41

Features

• The New website dialog uses two columns. Account, domain, document root, and aliases are on the left. Type, PHP or app settings, and the Nginx rewrite are on the right.

0.2.40

Features

• Account disk usage is measured in the background every hour, including website folders outside the home. Pages show the last result instead of waiting on du.

0.2.39

Fixes

• Extra FTP logins, and accounts with SSH turned off, can sign in. vsftpd was rejecting the nologin shell and the client reported a wrong password. The stored password is unchanged, and SSH stays closed.

0.2.38

Features

• Each extra FTP login can show its stored password and reset it. Reset changes only that login, and can fill a random password. The account password stays the same.

0.2.37

Features

• Issuing or renewing Let's Encrypt shows the Certbot log in the SSL tab, including when it fails.
• Issued certificates renew twice a day, at 03:17 and 15:17, from /etc/cron.d/siroc-ssl. Nginx and Apache reload after a certificate is replaced.

0.2.36

Features

• System tools → Updates can turn automatic updates off. The hourly install stops, and Check and Apply still work. It stays off after the agent restarts.
• Pages show a skeleton while their first data load is in progress.

0.2.35

Features

• Account disk usage includes each website document root. A path already inside the account home is not counted twice. A path on another disk is added.
• An extra FTP user can take a random password, and the path can be chosen from that account's websites.

0.2.34

Features

• Each account can add extra FTP users from the account menu. The login is account_name. An empty path uses /home/account. A relative path stays inside that home. A path that starts with / can be on another disk, and that user is jailed to it.

0.2.33

Features

• The document root still defaults to /home/user/. A path that starts with / uses another disk.
• Backup jobs show the date and time they were created.

Fixes

• Artisan, Composer, npm, and WordPress command output stays readable on the dark theme.

0.2.32

Features

• A website document root can be an absolute path on another mounted disk, such as /mnt/data/site/public_html. A relative path still stays inside the account home.
• Reverse proxy cache can use its own directory. Leave the path empty to keep the shared cache at /var/cache/nginx/siroc.
• The panel checks the public channel every hour and installs a newer version automatically.
• A website can have 99 domain aliases. The primary name plus those aliases stay within one Let's Encrypt certificate.

0.2.31

Features

• Fail2ban and UFW install with the base stack. The firewall turns on once and allows SSH, FTP, HTTP, HTTPS, the panel port, and the FTP passive range. Turning it off later stays off.
• Security → Firewall has an address whitelist and blacklist. A whitelisted address is allowed. A blacklisted address is denied ahead of the port rules. The same address cannot be on both lists.

Fixes

• GoAccess opens in the full window.

0.2.30

Features

• OS updates lists apt packages that can be upgraded. Update refreshes the list. Upgrade installs them and keeps existing config files. The list is checked every day at 04:15 and is not installed until you choose Upgrade. The daily check starts the next time the agent starts.

Fixes

• Website cards and the file manager use the dark surface, so the domain name and labels stay readable.
• Navigation numbers stay Siroc orange on every page.

0.2.29

Features

• The panel uses a darker layout. Navigation is numbered, the mark sits beside the name, and each page title has a short description. Sign-in and first-run setup show the mark and Siroc on one line.
• The default theme is dark with the Siroc orange. A theme already saved on the server stays until it is changed under Settings.

Fixes

• No bug fixes in this release.

0.2.28

Features

• No new features in this release.

Fixes

• Git deploy marks node_modules/.bin executable before the build command and again after npm install, so vite: Permission denied does not stop the site build. The panel UI build calls Vite through node.

0.2.27

Features

• Git deploy shows the commit that is checked out: short hash, message, author, and time. The Git tab reads it from the deploy directory, including after a webhook pull.
• Fail2ban has a whitelist on Security. An address or network such as 203.0.113.0/24 is never banned. Localhost stays ignored, and adding an address unbans it.
• Website logs can be emptied. Clear empties the open file. Clear all empties Nginx, Apache, WAF, and Laravel logs for that site and deletes rotated copies. The live files stay in place so the web server keeps writing.

Fixes

• PHP-FPM starts in the account home instead of /, so getcwd() stays inside open_basedir. Existing pools are updated the next time the agent starts.

0.2.26

Features

• The File Manager lists 50 files per page. Type a path and press Enter to open it. An admin can jump to a system path such as /etc/ssh.
• Click an image to preview it, and rename one selected file or folder in the same directory.
• Backup schedules install /etc/cron.d/siroc-backup. A task covers one account or all accounts, runs hourly, daily, weekly, or monthly, and keeps the latest local archives (default 3). The log is /var/log/siroc/backup-cron.log.

Fixes

• Apache can read .htaccess again when a directory is a symlink, such as Laravel public/storage. Web directories are 0755 and files are 0644. The agent repairs existing trees the next time it starts.

0.2.25

Features

• Nginx serves static files from the document root, the same way Plesk does. PHP still goes to Apache, and a missing file is sent there too. The extension list is editable per site under Web Server, and it is on by default. Open the site and save once so the existing Nginx file is rewritten.

Fixes

• No bug fixes in this release.

0.2.24

Features

• No new features in this release.

Fixes

• Reinstalling Nginx no longer fails while the package tries to start. Module lines and the VOD snippet are set aside until the new modules are built, and lua-resty-core 0.1.28 is installed so the Lua module can start.

0.2.23

Features

• No new features in this release.

Fixes

• Updating Nginx no longer fails while looking for dfxp_format.c. The VOD module keeps that file under vod/subtitle/, and the build finds it there. Verified by compiling Nginx 1.31.6 with GCC 15 and libxml 2.15.

0.2.22

Features

• MariaDB and MySQL install from official apt packages. MariaDB comes from deb.mariadb.org (10.11, 11.4, 11.8). MySQL comes from repo.mysql.com (8.0, 8.4 LTS, or 9.7 LTS when that Ubuntu release publishes it). Installing again replaces a previous source build under /opt/siroc/db and keeps /var/lib/mysql.

Fixes

• No bug fixes in this release.

0.2.21

Features

• Database import, phpMyAdmin, and the File Manager accept files up to 10GB. A plain SQL dump of that size can be imported, and large imports are not cut off by the short agent timeout.
• Database import keeps a live log at /var/lib/siroc/import-logs/. The import dialog and the Log button show bytes received, MySQL output, and whether the import finished.

Fixes

• No bug fixes in this release.

0.2.20

Features

• No new features in this release.

Fixes

• Updating Nginx no longer fails while compiling the VOD module against libxml2 2.14. The deprecated recovery field is not used, and other deprecated declarations are warnings instead of errors.

0.2.19

Features

• The software page shows a live install terminal. Each package keeps its log at /var/lib/siroc/install-logs/, and the Log button opens it again after the install finishes.
• The Nginx VOD module is built with file AIO, the thread pool, -O3, and a 256-track limit. Popcnt and AVX2 are used when the CPU has them. Nginx sets aio on and vod_open_file_thread_pool.

Fixes

• Updating Nginx 1.31 no longer fails while compiling the VOD module on GCC 15. ngx_http_vod_exit_process now takes the cycle argument Nginx expects.

0.2.18

Features

• Nginx enables a thread pool and builds the Kaltura VOD module and Lua module for the installed Nginx.
• URL rewrite accepts location blocks in the server. A location / you write replaces the default proxy location. Directives without a location stay inside that default location.
• Reverse proxy sites open an aaPanel-style dialog for the path, target, host, rewrites, websocket, timeouts, extra config, content replacement, cache, compression, and IP lists.
• The database list shows each database size. File uploads and database import show progress while bytes are sent.

Fixes

• Saving a timezone writes /etc/timezone and /etc/localtime, and the clock shows the local offset.

0.2.17

Features

• Each database can be exported as SQL, gzip, or zip, and imported from a .sql, .gz, or .zip dump.

Fixes

• phpMyAdmin sign-on failed because the database account existed only for localhost, while phpMyAdmin connects to 127.0.0.1. Opening phpMyAdmin creates that account. A failed sign-on shows the database error.

0.2.16

Features

• Fail2ban lists banned addresses in a table. Open a row for ASN and location, and delete a row to unban it. Jails cover the panel, SSH, FTP, MySQL or MariaDB, Redis, Nginx, and Apache when those services are installed.
• Web server optimize can set HttpOnly cookies on or off. On adds the flag for cookies from Nginx and Apache.
• Websites accept international domain names. The panel stores punycode and shows the real name.

Fixes

• Apache Server Status no longer returns HTTP 404 when a site rewrite handles requests to 127.0.0.1. Status is served from its own local virtual host.

0.2.15

Features

• Website settings open in one dialog with Domain Manager, directory, access limits, rewrite, default document, SSL, PHP, Git, redirects, reverse proxy, hotlink protection, maintenance mode, and response logs.
• ModSecurity sits on its own Websites tab, and each site can turn off individual WAF rules without affecting other sites.
• Database passwords are stored and can be shown again. Reset password changes the MySQL user and saves the new password.

Fixes

• No bug fixes in this release.

0.2.14

Features

• File manager copies or moves every checked file and folder, then pastes them into one destination.
• Right-click a row for Open, Copy, Move, Paste, and Delete. Right-click empty space for New file, New folder, Upload, and Paste.
• Sidebar items, status pages, Logs and Databases tabs, and website names are real URLs, so they can open in a new tab.

Fixes

• Copy and Move used only the first checked item, so a multi-select still said “Move assets”.

0.2.13

Features

• Panel, server, SSH, cron, and website logs show as a table, newest first, with a page size picker.
• Scan history sorts newest first and uses the same pager.

Fixes

• Log viewers dumped the raw tail with the oldest lines first and no table pager.

0.2.12

Features

• Dashboard Traffic and Disk I/O charts update from live interface and disk counters.
• Logs menu covers Panel, Website, Server, SSH, Cron / syslog, and Scan.

Fixes

• No bug fixes in this release.

0.2.11

Features

• Databases shows Redis status, Redis settings, and a raw redis.conf editor.
• Database monitor reports SQL slow queries and the Redis slow log.
• The project license is Apache License 2.0.

Fixes

• Apply update no longer fails with “package checksum mismatch” when a CDN still has the previous rolling tarball. Releases use a versioned URL.

0.2.10

Features

• Login shows a captcha after two failed attempts within 30 minutes.
• Fail2ban can jail the panel login log, and Security is split into tabs.
• Software is a table; install and update open in a modal.
• ModSecurity can virus-scan uploads with ClamAV.
• The panel checks for updates every day at 04:00 server time.

Fixes

• A failed login no longer clears the failure counter before the 30-minute window ends.

0.2.9

Features

• Settings for server timezone, theme style and color, logo, favicon, and service status.

Fixes

• No bug fixes in this release.

0.2.8

Features

• Backup stores one archive per hosting user and can restore sites, databases, and mail together.

Fixes

• Restore creates the Linux user when that account is missing, instead of failing on a home directory that does not exist.

0.2.7

Features

• Plesk-style file manager with upload, editor, archive, and permissions.
• New databases get a random name, user suffix, and password.
• phpMyAdmin opens from Databases through the panel.

Fixes

• phpMyAdmin returned HTTP 502 when its PHP-FPM pool was down or pointed at a dead socket.

0.2.6

Features

• Each website opens a dashboard for files, databases, Git, SSL, logs, and app tools.

Fixes

• No bug fixes in this release.

0.2.5

Features

• Per-site Git deploy, with Git offered in the default software set.

Fixes

• No bug fixes in this release.

0.2.4

Features

• A site alias can be a wildcard such as *.example.com.

Fixes

• Files uploaded into a hosting home as root are given back to that Linux user.