WebPortico 0.24.0

Major​

• A site's own nginx lines: a new card on the site's Hosting tab, like Plesk's "Additional nginx directives". The lines go at the end of each of the site's servers on the front, and the map blocks they name go into nginx.conf. Paths are written as @root@ (this site's folder), @root:<site>@, @php@ (the site's PHP), @fastcgi.conf@ and @front@, so a moved sites' folder or another PHP version keeps them working. A line that would break the front is refused with its line number, and nothing is saved.
• Import from Plesk carries the sites' extra web server lines. Every line of Plesk's vhost_nginx.conf, vhost.conf and vhost_ssl.conf gets one of four labels on the import page: carried, done by WebPortico, Plesk's own, or needs your action, with what to do. A XenForo forum on an nginx site always gets its internal_data, src and install folders closed: nginx does not read XenForo's own .htaccess files, so before this release a forum's stored attachments could be downloaded by their address. Plesk's preferred domain (with or without www) becomes a redirect of the other name.
• The visitor's own address behind Cloudflare: a request that comes from one of Cloudflare's addresses takes the visitor's address from Cloudflare's header, so the logs, PHP applications, IP bans and httpd see the visitor, not Cloudflare. WebPortico ships Cloudflare's list and checks it once a day. Nothing changes until you preview and apply the changes after the update.

Minor​

• Incoming mail server for a site: an application that reads a mailbox over IMAP, such as XenForo's bounced email handler, reaches MailServerPro on this NAS under the host name it already uses, through a door in that site's jail only. Import from Plesk sets it for a forum whose bounce mailbox moves to MailServerPro.
• Import from Plesk raises MariaDB's buffer pool and redo log itself when the databases it moves total 1 GB or more, within the NAS's free memory, and never lowers what you set.
• Import from Plesk names a forum that uses Elasticsearch through XenForo's Enhanced Search and asks you to install SearchServerPro from App Center when it is missing.
• A site whose Plesk lines pass its requests to a program on the Plesk server itself becomes a proxy site to that server's web server, so it keeps working after the router sends the traffic to the NAS.

Major​

• Proxy targets on your network: when you add a reverse proxy site, the new list App, virtual machine or container shows the apps of this NAS, the virtual machines of Virtualization Station and the containers of Container Station, each with the ports their web pages answer on, so Home Assistant or any other app in a virtual machine or a container is one pick away. WebPortico finds a machine's address in the NAS's own network table, tries the usual web ports on it and reads each page's title. A machine keeps its address only while your router gives it the same one: reserve it in the router's DHCP settings.
• Templates for any target: the template is now a choice of its own, with new templates for Home Assistant, Portainer, Proxmox VE, Nextcloud and any WebSocket app. For Home Assistant and Nextcloud the page says what to set in the app so that it trusts WebPortico, with the address WebPortico connects from.
• QTS's own reverse proxy rules (Control Panel > Network & File Services > Network Access > Reverse Proxy) are listed on the Sites page; Import opens the Add site wizard with the rule's name and target, and the site gets its own certificate. WebPortico does not change the rule in QTS: switch it off there once the site works.
• Domains: a new page. Add the API key of a Cloudflare or OVHcloud account to see its domains and their DNS records. For each domain, keep it at the provider (WebPortico then writes your sites' records there) or import its zone into TurboDNS on this NAS, with TurboDNS's preview of every change first. The provider keeps answering for the domain until you change its name servers at the registrar. Keys are stored on the NAS, are never shown again and can be removed.
• Certificates through OVHcloud: Let's Encrypt certificates can now be asked through OVHcloud's DNS (DNS-01) for a domain kept at OVHcloud on the Domains page.

Fixes​

• WebPortico now calls Cloudflare and OVHcloud over IPv4 first, so an API key limited to your IPv4 address also works on a NAS that has IPv6.

Major​

• Port forwarding on the router: a new card on the Front server and ports page. WebPortico can keep the ports you list open on your router with PCP, NAT-PMP or UPnP, as Rtorrent 16 does: it asks again every 5 minutes while it runs and removes its forwards when it stops. A port the router already forwards to another device or program is left alone. With a UniFi gateway, the card lists, adds and removes the gateway's port forwards and IPv6 firewall rules through an API key; every change is previewed first and made after the gateway's own backup, and Undo these changes reverses it. Move to this NAS points another server's forwards and IPv6 rules at this NAS.
• A watchdog: every 20 seconds WebPortico checks each service of the stack and starts one that stopped on its own again (nginx, httpd, each site's PHP, Valkey, memcached, the panel and the optional services), with a pause that grows to 5 minutes. A database's log is read first: damaged data or too little disk space leave it stopped; otherwise it gets one start with its own crash recovery and a check of every table. Each event is a line in the watchdog's log and a QTS notification.
• A disk guard: on a volume with a database, a warning below 20 GiB (or 10 %), the databases read-only below 8 GiB (5 %; the sites still show their pages), a clean shutdown below 4 GiB (2.5 %), and a start again at 6 GiB (3.5 %), with the tables checked. The databases' settings that can damage their files after a power cut are checked after every start and once a day.

Minor​

• A clean stop: the front first, then PHP, the caches and the databases, which shut down cleanly and are never killed. Whatever of WebPortico's still runs afterwards is ended and named in the log.
• The Services page lists the databases and caches with the watchdog's state, Start, Restart and Stop, the disk space of each volume, the databases' safety and the newest backups.
• Let's Encrypt: a failed renewal is tried again after 1, 2, 4 and 8 hours, then every 12; the TLS page shows the last renewal, the next attempt and the days left.
• A UniFi gateway accepts UPnP's requests to open an IPv6 port and still keeps the port closed. With UniFi, open IPv6 ports with the IPv6 firewall rules in the card's UniFi section.
• Nothing changes on your router until you add a port or apply a change.

Major​

• Image, video and PDF programs for your sites: each PHP site can now run FFmpeg with H.264, the WebP tools (cwebp, dwebp, gif2webp, img2webp), jpegoptim, optipng, pngquant, gifsicle, ImageMagick, and the PDF tools qpdf and Poppler (pdftoppm, pdftotext, pdfinfo and more). They are in /usr/bin, as on a Linux server, so an add-on that runs /usr/bin/ffmpeg or looks a program up on PATH finds it; where an add-on asks for a program's path, enter the /usr/bin one.

Minor​

• FFmpeg can now encode H.264 (libx264). Because libx264 is GPL, FFmpeg in WebPortico is now a GPL build.
• The WebP tools now read PNG, JPEG and GIF files, not only PPM.
• The PHP tab's Isolation card lists the programs a site can run.
• After the update, Preview changes lists every PHP site, and Apply changes restarts their PHP once. Until then the sites run as before.

Major​

• Import from Plesk: a new page that moves a Plesk server's sites, databases, scheduled tasks, mail and DNS zones to the NAS. You type the server's address, its SSH port and root's password once: WebPortico adds a key of its own that works only from this NAS and does not keep the password. Remove access takes the key out again and leaves the server's key file exactly as it was.
• A dry run first: it reads the whole server without changing anything and shows, for each subscription, what each site becomes here (a PHP site, a static site, a reverse proxy or a redirect), its databases, tasks and mail, what stays on Plesk and why, and the DNS records that change when you switch over.

Minor​

• Import copies one subscription at a time: the sites are added and applied, their files and databases are copied (database users keep their passwords) and the mail goes to MailServerPro 0.6.0. Each imported site gets an After import backup point, and imported scheduled tasks start paused.
• Importing again copies only the files and messages that changed, and the databases again in full.
• A zone Plesk answers for goes to TurboDNS 1.4.0 separately: Preview the zone in TurboDNS shows the changes, and Send zone to TurboDNS sends it on the day you switch over. For a zone kept at Cloudflare or another provider, Show the records to enter lists what to change there, including a valid DKIM record for the carried key.
• Every PHP site's jail now forwards 127.0.0.1:3306 to MariaDB, for applications whose configuration names that address.
• The package carries OpenSSH's client and rsync for the importer.

Major​

• Every PHP site runs in a jail of its own: a site's PHP and its scheduled tasks now run inside a jail as the site's own account. The jail holds only the site's own folders. It reaches the database servers, the site's own Valkey and memcached, the search server, the site's mail server and websites on the internet (ports 80 and 443), and not QTS, the panel, other sites, the shared folders or the devices on your local network. Applications need no proxy settings, and the site's PHP-FPM log lists every blocked connection.

Minor​

• The PHP tab has a new Isolation card that says what the site's jail can reach.
• After the update, Preview changes lists every PHP site, and Apply changes restarts their PHP in their jails. Until then the sites run as before.
• The default site keeps the shared folders, as it had under QTS's Web Server; its network is jailed like every site's.

Major​

• Outgoing mail for PHP sites: a PHP site's PHP tab has a new Outgoing mail card: SMTP server, port, connection security, user name, password and sender address. PHP's mail() and the site's scheduled tasks then send through that server, signed in with the site's mailbox and always with the sender you set. For MailServerPro on the same NAS, enter 127.0.0.1, port 587 and STARTTLS.
• Copies of the backups: the Backups page has a new Copies card. Add a shared folder on another volume, or a server over SFTP, FTPS, WebDAV, S3 or FTP. After each backup run, every site's backups and exports are copied there and checked. Copies sent to a server are always encrypted with a password the page shows once, so save it.
• Export: any backup, an incremental one too, can be exported from a site's Backups tab as one complete file. Download it and unpack it by hand on any Linux; RESTORE.txt inside gives the commands.

Minor​

• Restore databases puts back only the databases of a backup. The site's files and settings stay as they are.
• A PHP site's localhost in its database settings now reaches the site's own MySQL server, so an application moved from another host connects without changes. After the update, Preview changes and Apply changes add this to each PHP site.
• A site's own PECL extension keeps the source it was built from, and every backup carries it. Restore settings as draft builds a missing extension again from that source.
• The app now includes msmtp 1.8.34 and rclone 1.75.1.

Major​

• Backups of every site: choose a backup folder on the new Backups page. Each live site is then backed up every day at the time you set (03:00 by default): its files, its databases (MariaDB, Percona Server and PostgreSQL) and its settings. The weekday you choose makes a full backup, the other days save only the changes, and whole weeks are kept (4 by default). Back up now adds a backup at any time.
• Restore: a site's Backups tab lists the kept days. Restore puts the site's files and databases back as they were, after you type the site's name. WebPortico unpacks and checks the backup while the site keeps running, then backs the site up as it is, so you can go back. When the site cannot be backed up as it is, nothing changes and the tab offers Restore without backup.
• Adminer for a site's databases: Open in Adminer, on the site's Database tab and on the Databases page, opens Adminer 6.3.0 for that database in a new tab, signed in with an account that reaches only that site's databases. It answers on its own port, 9556: let that port through wherever the panel's port 9541 is.

Minor​

• Each backup holds RESTORE.txt with the commands to unpack it by hand with GNU tar and zstd. A site's PostgreSQL databases are closed to other sites' database users.

Major​

• Clearer wording across the panel: labels use the names hosting panels use. The Sites list and the Add site wizard say Site type (it was "Kind"), the site tab with the site type, web server and PHP version is Hosting, a database's server is Database server, and a site's PHP-FPM process is its PHP service. Dry run is now Preview changes and Apply this plan is Apply changes. The navigation says Front server and ports and SSL/TLS. The Logs tab lists Access log, Error log and the other logs by name, and the PHP-FPM and MariaDB limits read Maximum and Minimum.

Minor​

• Messages say what happened and what to do next, and the Polish texts read as written Polish. No setting, site or file changes with this update.

Major​

• Add site starts with your domain: the wizard asks "Do you have a domain for this site?". With a domain, it reads where the domain is registered and who answers for its DNS (Cloudflare, OVHcloud, TurboDNS or another provider) and shows the steps for that provider, with links to its pages. With a Cloudflare token or an OVHcloud key, which the wizard checks before it keeps it, WebPortico writes the site's records itself and shows them as a plan first. For another provider it lists the records to set and checks them live. Without a domain, it shows how to buy one at OVHcloud.
• PHP step: a PHP site gets its PHP version with the dates of its bug and security fixes, default limits (256 MB of memory, 64 MB uploads, 72 MB requests, 120 s per script), each with one line on why, and the choice to turn OPcache on now or when the site is finished.
• Caches: a PHP site's Cache tab shows what its Valkey, memcached, APCu and OPcache hold and flushes each one. nginx's page cache has Purge and Turn off. The PHP tab turns OPcache on or off for that site alone.
• Starter page: a new static or PHP site gets WebPortico's starter page as index.html in its folder, in English or Polish. Replace it with the site's own files.

Minor​

• The wizard and the setup checklist say a fact, a value or an action in every sentence, and the live DNS check no longer lists what it did not check.
• No scheduled task starts while WebPortico stops, the NAS shuts down or restarts, or QTS stops its services. One task runner runs at a time, and after a crash its next start stops what the interrupted task left running.
• The Cache tab no longer ends with a paragraph about a module WebPortico never shipped.