Skip to main content

CommyPanel 0.5.1

This release is about backups you can rely on, a server that finds its own address, and pages that follow along while you wait. It also contains the fixes from a security review of the agent, so please read Before you upgrade. It covers everything since 0.4.2; there was no stable 0.5.0.

CommyPanel is still pre-1.0.

What's new​

Backups​

  • Restore a database dump from the panel. Press Restore next to a dump on a database server's page, choose a name, and it is loaded into a new database, so nothing that exists is overwritten. It shows "Restoring" until done (or "Restore failed" with the reason). Link the new database to the app, deploy again, and delete the old one when you are sure.
  • Copy backups to another place (S3). Under Settings > Backups, every new panel backup, database dump and volume archive can be copied to any S3-compatible storage: Hetzner Object Storage, Cloudflare R2, Backblaze B2, Wasabi, MinIO, Amazon S3. Test the connection checks the settings. The newest 14 copies of each backup are kept there (changeable); files that are not CommyPanel backups are never touched. The secret key is stored encrypted and never shown again.
  • Back up app volumes. A Back up button per volume on the app's Volumes tab makes a compressed archive in the background (the newest 3 of each are kept). Nothing is backed up by itself, because volumes can be large. Downloads and deletes need your password and are audited.

The server's address​

  • Found automatically. CommyPanel finds the server's public IP address by itself, in the background, the first time a page needs it; there is no button to press. It reads the server's own network connection first, so on most servers (Hetzner, DigitalOcean, bare metal) nothing leaves the machine. Only a server with no public address on its interface (behind a NAT, as on some clouds) is looked up through api.ipify.org, once; COMMYPANEL_ADDRESS_LOOKUP=false switches that off.
  • A "Wrong IPs detected?" button is next to the address everywhere it is shown (Domains, an app's Domains tab, the first-run page, a domain's page). It opens the two fields (IPv4 and optional IPv6) with a Detect again button. What you enter is never replaced by a detection, and every change is audited with what it replaced. If nothing can be found, you are asked.

Pages that wait follow along​

  • While a domain's DNS does not point at the server yet, or a certificate is being issued, the first-run page, an app's Domains tab, the app wizard's domain step and a domain's page refresh every 5 seconds, re-check DNS every 15 seconds (if you may manage domains), and stop the moment everything is in place. Before, they changed only after you pressed "Check DNS again". They pause while the tab is hidden and give up after half an hour (the server still re-checks every five minutes). A failed certificate is never retried by the automatic check, only by the button.
  • The installation is one centered page, start to finish. Creating the admin account and the welcome steps (Let's Encrypt, panel domain) share a layout with no sidebar or menu, the three steps across the top, and a card for each.

Server health and apps​

  • A warning when the disk is nearly full, on every page, from 85% used (an error from 95%; DISK_WARN_PERCENT and DISK_CRITICAL_PERCENT). The Server page has a new Disk card with a usage bar and the five biggest app volumes.
  • The name other apps call an app by moves with the traffic. Before, the old and the new release both answered to a provider app's link name during a deployment. The new release takes the name only once it is healthy and has traffic, and the old one gives it up right after.

Installing​

  • CI installs each release on Debian 13, Ubuntu 24.04 and Ubuntu 26.04 before it is published, and the tests also run on PHP 8.3.

Before you upgrade​

  • Back up /var/lib/commypanel as with any upgrade, and upgrade with sudo commypanel upgrade. The migration adds three columns to managed_databases.
  • The agent has a new private folder, /var/lib/commypanel-agent, outside the data directory, created by systemd. It holds the agent's scratch files, the record of the dumps it made, the TLS private keys, the ACME account key and the ACME challenge files, which used to sit under /var/lib/commypanel. Only root can change anything in it. The upgrade rewrites the agent's service file for it. Certificates are not moved: apps get theirs again from Let's Encrypt, so a server that already has certificates should expect them to be requested again after upgrading.
  • No new permissions. Restoring a dump needs databases.manage, volume backups need apps.volumes, and the S3 copy needs backups.manage.
  • The panel contacts the outside in two more cases, both only when you or the server's situation call for it: your S3 storage once you switch the copy on, and api.ipify.org only on a server with no public address of its own (and not at all with COMMYPANEL_ADDRESS_LOOKUP=false). Update checks remain the only call it makes without either.
  • An address you saved before stays as it was, marked as entered by you; use Detect again if you want it looked up anew.

Security notes​

  • The agent's own files are out of the panel's reach. A compromised panel could swap a temporary dump file for a link to a root-only file (the agent would then send its contents back), forge a record of a dump, or replace the certificate folder so that new private keys were written where it can read them. The scratch files, the dump records, the TLS keys, the ACME account key and the ACME challenge files now live in a folder only root can change.
  • Only dumps the agent made itself can be restored, checked by checksum, always into a new database; a restore runs as the database's own user for PostgreSQL.
  • Extra networks are link networks only, and a link network is never a container's own: a container can no longer join another app's or a database server's network, or put a name on it that answers in their place.
  • MySQL and MariaDB grants no longer treat _ in a database name as a wildcard, so a user cannot reach a database that only matches the pattern.
  • A command that is still running when its output ends is a failure, not an exit code of 0, so a dump cut off by the time limit is no longer kept as a good backup.
  • Database tools run only in database servers: managed containers named db-* started from an official database image. An app and a database server can only mount their own kind of folder, and a mount source cannot carry bind options.
  • Big jobs are limited: at most two dumps, restores or volume archives run at once, and none starts with less than 2 GB of free disk. The data of a database server is never deleted when Docker cannot be asked whether something still uses it.
  • The build context is read through a root that cannot be left, and each file is checked again when it is opened.
  • The S3 address must be https and not this server or a link-local address, redirects are never followed, and the secret key is encrypted.

Known limitations​

  • Backups are not read back from the S3 storage by the panel: download the file there and load it by hand (the docs show the command). The same goes for restoring onto a new server, since the Restore button only loads dumps that server's agent made itself. Single uploads are limited to 5 GB.
  • A volume archive is put back by hand (stop the app, tar -xzpf as root), and a database dump is restored into a new database only; there is no "replace" mode yet.
  • A server with several public IPv4 addresses and no clear default route gets the first one; correct it with Wrong IPs detected? if it is not the one your domains should use. A server behind a NAT with the outside lookup switched off has to be given its address by hand.
  • The S3 client was tested against AWS's published test vectors and a real S3-compatible server, not yet against every provider; please report what you find, with the provider's name.
  • Not in this release: API tokens, one-click GitHub connection, wildcard certificates.

Requirements​

Unchanged: Ubuntu 24.04 or 26.04, or Debian 13 or newer, with systemd; amd64 or arm64; root access; at least 1 GB of RAM.

# Install
curl -fsSL https://github.com/emrecanful/commypanel/releases/latest/download/install.sh | sudo bash

# Upgrade
sudo commypanel upgrade