XAXA Server control panel

XAXA

Changelog

0.5.21 — November 2026

  • Maintenance mode: a redesigned maintenance page: a card with a wrench icon, a "Maintenance in progress" badge, the site's name, a Try again button, light and dark themes, and no animation for visitors who turn motion off. Sites already in maintenance get it with the update. Actions → Maintenance mode has the same icon.
  • Interface: notifications appear at the top right, just below the header (full width on phones), with the newest on top.

0.5.20 — November 2026

  • Queue workers: Settings → PHP → Queue workers runs Laravel's php artisan queue:work as the site user all the time (1–4 workers, queue names, a job time limit), so queued jobs start within seconds instead of waiting for cron. Workers start again when they stop (also after a database outage), restart every hour to give memory back, and restart on the new code after every successful deploy and PHP version change. Status on the card, output under Logs → Queue.
  • Maintenance mode: Actions → Maintenance mode shows visitors a "back soon" page (HTTP 503 with Retry-After) and gives a preview link that lets one browser see the real site for a day. Let's Encrypt renewals keep working; uptime checks pause and the site's dot turns amber.
  • Deploy alerts: a failed deploy alerts the admins and whoever started it, by email and as the webhook event deploy: site, repository and branch, commit, who started it, duration, whether the previous release is still live, the last 20 log lines and what to check. The first success after a failure sends a "works again" alert.
  • Alerts: every alert ends with the server name, the time in the panel time zone and the panel address.
  • Slow PHP log: PHP sites log every request that runs longer than 5 seconds with its call stack, under Logs → Slow PHP.
  • Updates: the panel no longer checks for new versions daily. Instance → Updates → Check for updates checks on demand and shows the update in the card; Update now installs the newest release and names it. The dashboard banner, the daily alert and the on/off switch are gone.
  • Sign-in (security): panel account passwords need at least 8 characters (setup, users, account). Existing passwords keep working; site user and basic auth passwords still need 6.

0.5.19 — November 2026

  • Performance: firewall changes, site creation and saving an app's service environment no longer hold the panel database's write lock while the root agent works; the whole panel stopped answering for 4–5 s (up to a minute for an app restart with health check) during these.
  • Performance: the root agent and the file helper start PHP without the 40 extensions they do not use: about 130 ms less on every agent-backed page and action (file manager twice that).
  • Performance: the firewall page keeps the fail2ban list for 30 s (it is dropped on an unban); site traffic and uptime checks have per-site indexes.
  • Files: the release an atomic deploy is serving cannot be deleted, renamed or moved from the file manager; doing so kept the app running until its next restart and then took the site down.
  • Reverse proxy (security): a user-role account can no longer point a proxy site at this server or a private network (another site's app on 127.0.0.1, the cloud metadata address); admins still can.
  • Logs: errors the agent answered (a wrong certificate key, a missing file) are no longer written to the panel log with a stack trace; they stay in /var/log/xaxa-agent.log. Agent crashes are still reported.
  • Files: dropping files from your computer uploads them to the open folder even when the pointer is over a folder row (they used to land inside that folder and seemed to vanish); the toast names the folder.
  • Files: Extract… asks where to unpack a .zip: into a new folder named after the archive (the default) or into the current folder.
  • Files: keyboard shortcuts: ↑/↓ move the selection (Shift extends it), Enter opens, F2 renames, Delete deletes, Backspace goes up a folder.
  • Updates: Instance → Updates turns the daily version check off: no check, no "new version" notice or alert; update by hand with sudo xaxa update. Turning it on checks at once.
  • Interface: table rows are striped; the "detected application/package manager" boxes on Deploy and Settings and the long environment explanation are gone (a problem is still shown).
  • Sign-in (security): turning two-factor authentication off needs a code from the app (or a recovery code) as well as the password; deleting a user ends its sessions too; a failed two-factor code is logged with the account's email.
  • Firewall: a source is stored in one spelling (203.0.113.5/32 is 203.0.113.5, host bits are cleared), so the same rule cannot be added twice.
  • Cloudflare: deleting a site removes the A record the panel made for it (one made by hand, or pointing elsewhere, stays).
  • Terminal: a closed terminal removes its socket.
  • Website: canonical and Open Graph tags, /sitemap.xml, a Permissions-Policy header everywhere and a basic Content-Security-Policy on the website; install.sh --help prints usage when piped into bash.
  • Documentation: the site user examples follow the suggested naming, the API lists every site field, and Redis channel isolation is noted as Redis 6.2+.

0.5.18 — November 2026

  • Backups (security): a site user can no longer be named databases, the dump folder inside a backup archive; such a site could have its own files imported as MariaDB root on restore.
  • Reverse proxy: HTTPS upstreams with certificate verification on work again; nginx now checks the whole chain (leaf + intermediate) instead of failing with a 502.
  • Logs (security): site access and error logs are no longer readable by other site users (/var/log/nginx/xaxa is 0750 root:www-data).
  • Databases (security): a failed CREATE USER or password change no longer shows the database password in the error toast, the panel log or the agent log.
  • Users (security): an admin password reset also revokes the account's API tokens; the code that confirms two-factor setup cannot be reused to sign in.
  • Performance: Node site settings sections no longer inspect the application on every page (about 400 ms each); the Deploy tab shows the detected package manager again.
  • API: creating a cron job returns "enabled": true instead of null.
  • CLI: xaxa user:reset-password and user:disable-2fa report an unknown email cleanly; setup-token names a command that works; cloudflare-refresh is listed in xaxa help and the docs.
  • Documentation: the panel log file name (laravel-YYYY-MM-DD.log) matches the daily log channel.

0.5.17 — November 2026

  • Page cache (security): every request carrying cookies bypasses the PHP page cache, including applications with custom session cookie names.
  • Sign-in (security): resetting a password invalidates a pending two-factor sign-in. Enabling two-factor authentication requires the current password.
  • Domains: alias changes share the site-creation lock, so concurrent requests cannot assign the same name to two sites.
  • Files: creating a file refuses an existing name instead of emptying its contents.
  • Deploy: nested shared paths are rejected before any files are touched, preventing a shared parent link from deleting persistent child data.
  • Firewall: IPv4 and IPv6 rules stay distinct when narrowing a source; CIDR host bits are normalized to the network address.
  • Apps: settings changes preserve each instance's stopped/running state, including when moving its port range; health checks cover only restarted instances.
  • Performance: site-task polling returns only the task card instead of rendering the entire overview and layout.
  • Performance: backup lists and the runtime card return their own fragment while polling instead of rendering the whole page; the runtime/extension state is read in one cache query, not one per key.
  • Performance: CPU sampling reuses the previous /proc/stat sample (no 200 ms sleep per dashboard poll), the SSL check is cached for a minute, SQLite gets a larger page cache and in-memory temp store, and backups/deployments have indexes for the hot queries.
  • Performance: panel assets under /build/ are cached for a year (content-hashed names), and the panel FPM pool scales with RAM instead of a fixed 8 children.
  • Performance: a user-role account reads its site list once per request instead of on every site.access check.
  • Security: a site's Redis user can no longer list other sites' key names with SCAN, RANDOMKEY or DBSIZE; the ACL update is serialized so concurrent changes cannot lose an account or reopen the default user.
  • Security: the demo's DNS check no longer resolves arbitrary names (it was a public DNS oracle), and the setup token requires that no admin exists instead of no account at all.
  • Security: the root agent creates secret files private from the first byte (no window where a site user can read a TLS key or the SMTP password), rejects a repository key file that contains more than the pinned key, and reads the SSH port from sshd, the listening socket or the configuration (starting ssh if needed) instead of assuming 22.
  • Security: temporary files and the agent's captured output are bounded; a malformed array element returns a JSON error instead of a PHP fatal, and restore/import admission is atomic so a double-click cannot queue the same destructive job twice.
  • SSL: switching to a stored certificate re-validates its pair, expiry and domain coverage; the expiry date is written immediately instead of disappearing until the monitor runs.
  • Reloads: a failed nginx/PHP-FPM reload is reported as an error instead of saving a configuration that is not being served.
  • Backups: archive names get a short random suffix, so a manual run and the restore safety copy in the same second cannot replace one another; a failed atomic deploy removes its release directory.
  • Apps: an environment restart is health-checked (when every instance was running) and rolls the service environment back on failure; stopped instances are not probed.
  • Cron: a % the user already escaped is not escaped again, so date +\%F behaves like Run now.
  • Files: rename and archive names are validated like file creation; a ZIP that cannot be written is reported instead of shown as success.
  • Vhosts: ssi, *_store, dav_* and upload directives are rejected; the SSH/SFTP card shows the detected SSH port instead of assuming 22.
  • Installer: an update that fails during the release switch, nginx test or health check now restores the previous release, agent and database snapshot instead of leaving a broken symlink or a half-updated panel.
  • Documentation: heading links navigate to their section; the live-demo page accurately describes sample metrics and read-only forms; the SSH port, upload limits, certificate button labels, deploy restart behavior, cron escaping, mail thresholds, log rotation and setup-token wording match the code.

0.5.16 — November 2026

  • Reverse proxy (security): an HTTPS upstream certificate is verified against the system CA store; SNI is still sent. A per-site Verify upstream certificate switch allows an intentional opt-out for a self-signed internal upstream.

0.5.15 — November 2026

  • Deploy: a stopped Node.js or Python app stays stopped after a deploy; only running instances restart, and a partly stopped app is not health-checked through nginx.
  • Deploy: a rollback commit must belong to the last 50 commits of the selected branch; an object left in the cached clone is no longer enough.
  • Certificates: “Select all covered” selects only fully covered sites, not sites whose aliases would get a browser warning.
  • Files: a failed Cut/Paste keeps the clipboard so the move can be retried.

0.5.14 — November 2026

  • Restore: if copying files fails, the site's home directory permissions are restored before the error is reported.
  • Databases (security): temporary phpMyAdmin users are revoked when their database is deleted; untracked old users cannot retain access when a database name is reused.
  • Databases (reliability): creating, deleting or changing the password of a database now shares the site lock with backups, restores and deploys; stale requests recheck the database, site and account before changing MySQL. A queued clone rechecks that its account still has access to both sites and that its database mapping still belongs to those sites.

0.5.13 — November 2026

  • Restore: restoring a site's files no longer leaves its home directory at 0700; nginx can traverse it again, so the site does not return 404 after a restore.

0.5.12 — November 2026

Security and reliability fixes from a live audit of every panel area.

  • Terminal (security): the tools gate did not receive the terminal id in its auth subrequest, so an account with no access to a site could open a terminal another account had started on port 2083. The id is now read from the original request URI inside the gate; foreign and unknown ids return 403.
  • Databases (security): a GRANT written by an older release was a pattern (shop_db also matched shopXdb). xaxa:resync-sites (run by every update) revokes the old row and grants the escaped name again. New grants were already escaped.
  • Sites (security): the root agent refuses a site.create for a domain that already has a store and records the owner in it; site.delete removes the certificate, vhost, security rules and logs only for that owner. A raw vhost may only log to its own access/error log.
  • Alerts: a webhook delivery error no longer stores or shows the URL (it often holds a token); the card keeps only the host.
  • Backups (security): a symlink in a backup folder is not listed, downloaded or restored; downloads copy the archive instead of hard-linking, so the root-only archive keeps its 0600 mode. A failed SFTP save removes its temporary known-hosts file.
  • HSTS: a served certificate is verified against the system CA store; an imported self-signed or private-CA certificate (Cloudflare Origin) is untrusted, so the toggle is refused and the header is not written. Let's Encrypt and public certificates are trusted.
  • Certificates: the expiry date is updated when a certificate is installed or switched (it used to keep the previous certificate's date for an hour).
  • SSL check: a site on a self-signed certificate reports its HTTP status instead of "No response".
  • Sites: a site creation or settings save that waits too long for another site operation returns a toast instead of HTTP 500. Saving the PHP section re-applies the pool, so a failed version switch or a stale resync can be repaired from the panel; the switch helper no longer deletes a socket the new FPM already owns.
  • Apps: Start and Restart rewrite the saved command and unit, so a crash-looped unit (start-limit-hit) or an interrupted settings save recovers. Failed units are treated as "should run", and units are reset before a start or restart.
  • Proxy sites: an HTTPS upstream gets SNI (proxy_ssl_server_name/proxy_ssl_name), and the upstream receives its own Host (the visitor's host stays in X-Forwarded-Host).
  • Firewall: IPv4/IPv6 sources are compared in ufw's canonical form (/32, /128, case, /0), so rules are no longer deleted and re-added on every save; an IPv6 mask above 128 is rejected in the panel; duplicate rules are refused.
  • Tasks: dismissing a running task is refused, xaxa:prune closes tasks and deployments whose worker disappeared, and the generic deploy tab URL redirects to the deploy page instead of a 500.
  • Cron: an out-of-range schedule (61 * * * *) is rejected even while the job is paused.
  • Mail: saving the card without an optional username no longer returns 500; SMTP has a 10 s timeout instead of holding the request for a minute. Failed-jobs Retry/Forget no longer claim success for an unknown UUID.
  • Monitoring: a site deleted while the minute check runs no longer fails the whole monitor command (and delays every other site's check).
  • Users: email addresses are stored lowercase, compared case-insensitively and unique (a case variant created a second account on SQLite).
  • Rate limits: login, two-factor, setup, deploy webhooks, contact and the API have separate throttle buckets; failed webhook/API requests no longer lock out a valid sign-in from the same address.
  • Unzip: an archive entry through a symlink that stays inside the site home (Laravel public/storage, node_modules/.bin) extracts again; links pointing outside or broken links are still rejected.

0.5.11 — November 2026

Yarn and pnpm work for every site user again.

  • Package managers: on servers updated from the panel, yarn, pnpm and corepack could fail with Cannot find module for site users, which also broke Node deploys that use them. Updating to 0.5.11 repairs the installed tools.

0.5.10 — November 2026

Fixes for the Node.js and environment changes in 0.5.9.

  • Health check: a deploy counts as healthy when the app answers below 500, so a 404 on the health path no longer rolls a release back. An empty HTTP health check path turns the check off, for workers and bots; the path can be changed in Settings → General.
  • Environment files: a running app reads .env files like dotenv: the last duplicate key wins, lines that are not KEY=value are skipped, ${NAME} expands and quoted values may span lines. The panel editor still rejects duplicate keys and malformed lines.
  • Yarn and pnpm: a Yarn 1 project without a packageManager pin stays on Yarn 1. pnpm 10 runs dependency build scripts (esbuild, sharp, Prisma and similar) unless the project sets its own list. A packageManager pin that differs from the installed version is a warning, not a failed deploy.
  • Clone: a Node or Python clone without environment values also clears the .env files in the repository root and the application directory. PHP clones always keep their environment, because Laravel needs APP_KEY.
  • Upgrading: xaxa update refreshes the Node tool wrappers on existing servers, so the Corepack fixes apply without a reinstall.

0.5.9 — November 2026

Node.js apps are easier to set up and deploy, and a deploy that does not start no longer takes the site down.

  • Node apps: new templates, and an Application directory setting for monorepos. Deploys install with the package manager your project uses (npm, Yarn, pnpm or Bun, chosen from packageManager and the lockfile), including build dependencies. Yarn 1 projects stay on Yarn 1.
  • Environment variables: Settings → Environment edits the same .env files you see in Files, with separate values for build and runtime. ${NAME} references expand as in dotenv.
  • Safer deploys: with an HTTP health check path set, a deploy waits until every instance answers. If the new release does not, the previous one comes back.
  • Clone: Node and Python sites can be cloned without their environment values.

If you already have a Node app

  • Your deploy script is not changed. To use package-manager detection, replace your install and build lines with /usr/bin/php /usr/local/lib/xaxa/xaxa-app node-deploy.
  • The health check is off for existing apps. Turn it on in Settings → General with a path your app answers, for example /health.
  • With atomic releases, add your .env files to Shared paths (with the application directory prefix in a monorepo).

0.5.8 — November 2026

Security fixes from a review of the panel, and cron presets that work again. Update soon if other people manage sites on your server.

  • Security: a site could be created under a name the server already uses for itself. With the name default, its Redis user could turn password-less Redis back on for every site; with queue-long, deleting it stopped the worker that runs backups. These names are now refused for new sites.
  • Security: no site and no alias can take the panel's domain. Before, a site holding it answered the panel's address on plain HTTP. The panel domain also cannot be set to a name a site uses.
  • Security: the mysql client that imports dumps, restores backups and clones sites no longer reads local files a dump asks for (LOAD DATA LOCAL).
  • Security: only the temporary logins opened from the panel can sign in to phpMyAdmin.
  • Mail: sites can send with a login of their own (Instance → Mail → Site login), so the login the panel sends its alerts with is no longer in /etc/msmtprc, which site users can read.
  • Sign-in: a recovery code sent twice at the same moment now works once. Actions that ask for your password again allow 10 tries a minute.
  • Sites: deleting a site no longer removes the logs of another site whose name starts with it (example.com and example.com-x.org). A clone's new database passwords are encrypted on the queue.
  • Cron: choosing a schedule preset no longer writes [object Object]. Events has Export CSV and the page size at the top, 50 rows a page. The Firewall and Account pages no longer leave a gap under their short cards.

0.5.7 — November 2026

Cloudflare: real visitor addresses, clearer DNS checks and DNS records from the panel.

  • Visitor addresses behind Cloudflare: with the orange cloud on, site logs, traffic statistics, Block IPs, PHP's REMOTE_ADDR, apps and the panel's sign-in limits now see the visitor instead of a Cloudflare address. The address is taken from Cloudflare's header only on connections from Cloudflare. Cloudflare only sites keep working with the new rule.
  • DNS check: names are asked from the domain's own name server, so a record you just added counts at once. A missing or wrong record now says what to do, for example Add an A record test → 203.0.113.10 in Cloudflare.
  • Cloudflare token: save an API token under Instance → Cloudflare. Add site can then create the A record of a new domain (DNS only or proxied), and Domain & SSL shows the record and switches its proxy.
  • Updates: servers set up from a local copy had no minisign and could not update. The installer now always installs it, and xaxa update installs it when it is missing. A server that already shows minisign is missing needs apt-get install minisign once.

0.5.6 — November 2026

Backups: more reliable, SFTP storage and a safer database import.

  • Security: importing a .sql file (Databases → Import), restoring a backup and cloning a site no longer let commands of the mysql client inside the file run on the server. Update soon.
  • Reliable backups: a file that changes while it is being archived (logs, cache, sessions) no longer fails the backup. Each archive is read back once after it is written, and a failed run leaves no half archive behind.
  • Queued backups: a backup waiting for its turn shows as Queued and no longer blocks deploys and restores of the site. A slow site no longer piles up hourly backups, and deleting a queued backup cancels it. The scheduled full and database backups share one database dump.
  • Retention: besides the newest backups, keep the newest one of each of the last days and weeks (for example 24 hourly + 7 days + 4 weeks). A restore's safety backup no longer deletes the archive being restored.
  • Restore: needs free space about the size of the site instead of three times that.
  • Remote storage: SFTP (Hetzner Storage Box, a NAS, another server) besides S3, with the server's own SSH key or a password and a pinned host key. Settings are tried with a test upload before they are saved. Each backup also uploads the archives an earlier failed copy left out. The retention can be applied off-site too (off by default), and deleting a backup then deletes its off-site copy.
  • Downloads: nginx sends backup and file downloads, so large backups are no longer cut after 10 minutes.
  • Deleted sites: their backups stay on the server for 30 days. xaxa backup-scan adds archives copied back by hand (from remote storage or a deleted site) so they can be restored.
  • Alerts and lists: admins are alerted when a site's backups are overdue. The Backups page pages each tab and refreshes while backups run, the backup time is a time picker, and deleting a backup is recorded in Events.
  • API: choose the backup kind (type), download a backup and delete a backup.

0.5.5 — November 2026

Sessions, API tokens and the alert webhook.

  • Sessions: sign out a single browser instead of all of them. Each session shows when it signed in, ended sessions are no longer listed, and failed sign-ins of the last 30 days appear under the list. A sign-in from an address the account has not used before sends an alert.
  • API tokens: a new Deploy access starts deployments and does nothing else, which is enough for CI. A token can be limited to some sites. Tokens that can change things or never expire ask for your password. The list shows when a token was created and the address it was last used from. Owners get a notice a week before a token expires, and tokens expired for a month are removed.
  • Users: admins see how many API tokens each account has and can revoke them all. Deleting an account now deletes its tokens too.
  • Alert webhook: the URL holds a token, so it is stored encrypted and only its host is shown. Choose which alerts it gets, sign requests with an HMAC secret, and see the last delivery on the card. A failed test names the usual cause. A slow endpoint can no longer hold up site monitoring.

0.5.4 — November 2026

  • PHP extensions dialog: click a PHP version under Instance → Runtimes. Every extension is listed, the installed ones ticked; tick several and install them in one go, with one reload of PHP-FPM and one notice.
  • Faster install on Ubuntu: the PHP repository is added with its pinned signing key instead of add-apt-repository, which installed extra packages and asked the Launchpad API first. That was up to a minute of every fresh install.

0.5.3 — November 2026

PHP extensions and PHP versions from the panel.

  • PHP extensions: Admin → Instance has a new card to add or remove extensions per PHP version: pgsql, apcu, mongodb, memcached, gmp, ldap, imap, yaml, vips and more (23 in all). Each one is checked with PHP-FPM before it goes live and is removed again if PHP-FPM does not start with it. An extension that an included one needs is never removed.
  • PHP versions in Runtimes: install another PHP version with one click, the same way as xaxa php-install. Sites can switch to it under Settings → PHP when it is ready.
  • One spinner per button: buttons such as Send test email or Save showed two loading circles side by side while their request ran. They show one now.

0.5.2 — November 2026

  • One loading indicator per action: after an action that reloads the page (saving settings, installing a certificate), the top loading bar used to finish, disappear and then start again on the new page. It now runs once, from the click until the new page is shown.
  • Website: new screenshots, including the certificate library, and updated texts about certificates, backups and server tuning.

0.5.1 — November 2026

Fixes from the first days of the certificate library, and quieter notifications.

  • Notifications moved to the bottom right corner and take about half the space: they no longer cover the buttons at the top of the page. On phones they sit at the bottom edge. Switching the theme no longer shows a notification; the button already shows the change.
  • Used by now counts the sites that already served a certificate when it was added to the library. Before, they showed as "No site" and a Replace would have left them on the old certificate. The update links them by itself.
  • Faster Apply on many sites: a site that is already on HTTPS keeps its configuration as it is, so installing a certificate on many sites reloads nginx once instead of once per site.

0.5.0 — November 2026

Certificate library: import a certificate once, install it on many sites.

  • Admin → Certificates keeps wildcard, Cloudflare Origin and purchased certificates. The private key is stored only on the server (root, never shown again) and is part of the panel backup.
  • Apply to many sites at once: the side panel groups your sites as covered, partly covered (the aliases it misses are listed) and not covered. Filter, select all covered sites and install with one click; the summary says which sites leave Let's Encrypt. Sites that cannot take the certificate are named, the others go ahead.
  • Replace: add the renewed certificate in place of the old one, and every site that used the old one switches over.
  • Import dialog: a new From library tab lists the certificates that cover the site first. Pasted certificates can be kept in the library, and a certificate already on a site goes into the library with one click.
  • Live check while pasting: the names it covers, its issuer and expiry, whether the key belongs to it and which names of the site it misses.
  • Add site suggests a library certificate that covers the domain you type and installs it right after the site is created. A clone keeps its source's library certificate when that covers the new name.
  • Expiry notices 30 and 7 days before a library certificate ends and when it has expired; the menu marks the page meanwhile.
  • Safer imports: a certificate that has expired, or that does not cover the site's main domain, is refused with a clear message instead of breaking HTTPS.
  • API: GET /api/v1/certificates, POST /api/v1/certificates/{id}/apply, and certificate_id when creating a site (administrators).

0.4.8 — November 2026

Fixes found in the logs of a running panel.

  • No false "Server error" during an update: while the panel restarts, a status card that refreshes itself could hit the restart for a moment and show "Server error", although the update went on and finished. Self-refreshing cards now stay quiet on that short gap and try again a few seconds later. Errors from actions you start still show as before.
  • Scanners no longer reach the panel's PHP: requests for scripts that do not exist (/phpinfo.php, /wp-login.php and similar) get a 404 from nginx directly. Before, each one took a panel PHP worker and added an error log line.
  • Quieter system log: the firewall no longer logs every blocked packet. That was thousands of lines a day, mostly IPv6 multicast, and buried real warnings. Blocking itself is unchanged.

0.4.7 — November 2026

Speed: faster pages over real networks, lighter backups.

  • TCP BBR: where the kernel offers it, the server uses BBR. Downloads stay fast on long and lossy paths (mobile, other continents) instead of slowing down at every lost packet.
  • Large pages stay in memory: nginx used to write PHP and app responses above 36 KB (most HTML pages) to a temp file on disk and read them back. Responses up to 288 KB now stay in memory. Responses with many cookies no longer fail with "upstream sent too big header".
  • Open file cache: nginx reuses open files and their symlink checks for static files and PHP routing for a few seconds instead of checking every path again on each request.
  • Brotli: on systems whose nginx package has the module (Ubuntu 24.04, Debian 13 and others, but not Ubuntu 22.04), text responses are about 15% smaller than with gzip. Browsers that do not ask for Brotli keep getting gzip.
  • Backups with zstd: new site, database and panel backups are .tar.zst. Compression is several times faster than gzip at about the same size, so the nightly backup takes less CPU from the sites. Older .tar.gz backups keep restoring.
  • Tasks start sooner: deploys, backups and certificates start within a second of the click, instead of up to three seconds later.
  • ECDSA certificates: new Let's Encrypt certificates use ECDSA, which makes the certificate smaller and the TLS handshake cheaper. Existing certificates switch when they are issued again from the panel.

0.4.6 — November 2026

Server health fixes found on a running panel.

  • Clock: on some images time synchronisation started before the system bus, failed five times within a second and stayed off, so the clock drifted (2FA codes, certificate checks). It now retries every few seconds, and the update starts it again where it had stopped.
  • System log size: the journal is capped at 500 MB; a looping job could otherwise fill up to a tenth of the disk with worker output.
  • Host name: when the server's own name does not resolve, it is added to /etc/hosts; every agent call printed "unable to resolve host" and asked DNS.
  • SSH bans double for an address that keeps coming back, up to a day.
  • The panel's PHP workers and the queue workers are replaced regularly (every 500 requests and every hour), so memory cannot creep up over weeks.

0.4.5 — November 2026

  • Disk usage loop: the 3-hourly disk usage job queued itself again on every run, without end, and filled the long-jobs queue (on 0.4.4 the loop no longer stopped at a "database is locked" error). The disk usage and nightly panel backup jobs now queue the command itself, and the worker drops the leftover looping jobs, so the loop ends with the update.

0.4.4 — November 2026

Reliability and security fixes.

  • "database is locked": a background job (disk usage, backups) could fail at once when the panel was busy, for example during an update. Writers now wait for each other, and site settings no longer hold the database while the server applies them.
  • Settings in background jobs: backup retention, off-site copies and mail settings are read again for every job. Before, a worker kept the values it saw at its start until the next update, so a raised Keep could still prune old archives.
  • Interrupted jobs: a backup, restore, deploy, import or clone whose worker died (out of memory, reboot) is marked failed instead of starting again two hours later over newer changes. A safety backup cut off this way no longer leaves the site "busy" for good.
  • Clone locks the source site, so a deploy or restore of the source cannot run during the copy.
  • Site settings: if a later step fails (for example the vhost test), the steps already applied on the server are put back, so an app is not left on a port nginx does not use.
  • Deploy webhook: the GitHub ping and other non-push events no longer start a deploy, and the branch filter also works with GitHub's form content type.
  • Two-factor: while 2FA is on, a new key cannot be set up from the account page; disable it first, which asks for the password.
  • Cron: a % in a command (date +%F) works on schedule as it does with Run now, and month and weekday names (MON-FRI) are accepted.
  • Restore unpacks next to the home directory instead of /tmp (a small RAM disk on Debian 13) and stops early when the disk is too full.
  • Moving the panel to a new server works as documented: xaxa resync-sites --recreate creates the site accounts and databases again, and the panel backup also holds the page cache zones and the Redis users.
  • Updates: an update that stops before the switch removes its half-installed release (and puts the database back if it was migrated), so xaxa rollback cannot pick it.
  • Custom vhosts may use try_files … /index.php$is_args$args.
  • A PHP version that is not installed is refused before a pool is written, and only versions with an installed PHP-FPM are offered.
  • File manager: ~ opens the home directory, Windows (CRLF) line endings survive the editor, and file times, the site's creation date, token expiry and certificate dates use the panel timezone.
  • Changing the timezone shows the real backup time; uptime and traffic checks resume within 30 minutes after a crashed run instead of a day; Let's Encrypt has time to finish writing the vhost.

0.4.3 — November 2026

  • Instance is one page again. Server and Panel stack in the left column, Software, Services and Runtimes in the right one, so a long card no longer leaves a gap next to it.
  • Update from the panel: when the update finishes, the page reloads on the new version with a short notice instead of keeping the log card. A failed update keeps its log until Dismiss.
  • Timezone is a list to pick from, each zone with its current UTC offset (the free-text field with suggestions did not take a picked value everywhere).
  • Tighter forms: the panel domain and timezone Save buttons line up, mail and site settings lose their stray empty lines.

0.4.2 — November 2026

Interface polish; no new features.

  • Instance is split into Overview, Runtimes and Settings & alerts (address, timezone, Redis, mail, webhook).
  • One button language: every form saves with a primary Save at its bottom right; secondary actions are outlined. Every on/off setting is a switch.
  • Restore has its own icon (undo arrow) instead of the refresh icon used for restarts and updates.
  • The site Overview starts with a status row: up/down, certificate, last backup and disk.
  • Times read the same everywhere: relative ("5 minutes ago") with the exact time on hover, YYYY-MM-DD dates, a 24-hour backup time. Deployments show when they ran and how long they took.
  • Empty lists explain what goes there and offer the first step; the cron form describes the schedule while you type it.
  • Sites: the whole row opens the site, the certificate shows on phones, the app port reads "Port 3000"; reverse proxies are no longer marked in red.
  • Backups (admin) can be filtered by site; Backup frequency is greyed out while automatic backups are off.
  • Buttons show a spinner while their request runs; small text is a little larger; site tabs fade at the edge when more are hidden on a phone; the Load card has a per-core bar; Health comes first on the dashboard.
  • Signing out other sessions asks for the password in a dialog.
  • Background tabs no longer poll deploys, backups, site tasks and updates.
  • Live demo: sample files match each site, backups appear at the backup time.

0.4.1 — November 2026

  • Update from the panel: when a new version is out, Instance has an Update now button. It runs the same signed xaxa update in the background and shows its log; the panel restarts by itself and goes back to the previous version if the new one does not start. Servers on 0.4.0 or older update to 0.4.1 over SSH once.
  • The live demo's vhosts are rendered again from the current template.

0.4.0 — November 2026

  • Zero-downtime deploys: Deploy can build every deployment in its own release folder and switch the site to it only when the script succeeded, with shared paths (.env, storage, uploads) kept across releases. The last 3 releases are kept.
  • Update notice: the panel checks for new versions daily and shows them on the dashboard and Instance, with one alert per version.
  • Disk usage per site on the site overview (every 3 hours), with an optional disk alert limit.
  • Backup frequency per site: every hour, every 6 hours, daily or weekly; the backup time is set under Backups.
  • REST API: deployments, backups, restore, cron jobs, Let's Encrypt and traffic endpoints.
  • Alert webhook: alerts are also posted as JSON to Slack, Discord, Mattermost, Telegram or any HTTPS endpoint, with or without SMTP.
  • Blocked addresses: the Firewall page lists fail2ban bans and can lift one.
  • SQL import: import a .sql / .sql.gz from the site folder into a database, in the background, with an account limited to that database.
  • Traffic and server errors: the site overview shows requests, 5xx rate and response times from the access log, and admins get an alert when a site starts returning server errors. The dashboard charts 30 and 90 days from hourly averages.
  • Events are linked to their site, so the site filter is exact; cron schedules with ranges, lists and months are described in plain English; Cloudflare-only sites get Cloudflare's current IP ranges every week; the Debian PHP repository key is checked by its fingerprint; Ubuntu 26.04 installs as soon as the PHP repository supports it.
  • Releases are built, signed and published by GitHub Actions once the tests pass on every supported OS.

0.3.4 — November 2026

  • Fixed: the activity list on the dashboard and Events lost its row layout in 0.3.2.
  • Restore is undoable: the current state is backed up before a restore (if that fails, nothing is restored), each database is emptied before the import so tables created after the backup no longer stay behind, and a running Node.js or Python app restarts on the restored code.
  • Quieter alerts: a site counts as down after two failed checks in a row; a single slow response no longer sends a down/up email pair.
  • Security: the two-factor step expires 10 minutes after the password is accepted; two webhooks arriving at the same moment queue one deploy, not two.
  • Cloning a site dumps its databases at low CPU/disk priority, like backups.
  • Deleting a site right after its user was logged in (SSH, web terminal) could leave the Linux user behind: the user's sessions and systemd manager are now stopped before it is removed.
  • The installer enables ufw.service, so the firewall is loaded again after a reboot on images that ship the unit disabled.
  • Releases: publish-release.sh refuses a commit whose GitHub Actions runs did not pass, and every push runs a fresh install plus the smoke test on Ubuntu 22.04/24.04 and Debian 12/13.

0.3.3 — November 2026

  • Fresh installs could stop at "Installing the XAXA panel" with "Could not get lock /var/lib/dpkg/lock-frontend" while unattended-upgrades was running in the background. Every apt call of the installer now waits up to 30 minutes for the package lock instead of failing.

0.3.2 — November 2026

  • Performance: site and panel PHP-FPM pools keep a warm worker ready (pm = dynamic) and no longer set open_basedir, re-enabling PHP's 4 MB realpath_cache (sites remain isolated by their Linux user and 750 home directory). Panel settings and the server timezone are read once per request, runtime task checks use a single Cache::many query, documentation pages cache rendered Markdown, and nginx compresses responses at gzip_comp_level 5.
  • Task indicator: the top bar tracks running site installs, clones, backups, deployments and runtime installs across pages and shows a toast with a direct link when each finishes.
  • Alerts and filters: the sidebar marks down sites, failed backups and failed background jobs; the dashboard and Instance warn if the scheduler stops; Sites adds status filters and sorting; Events adds category, user and site filters, CSV export and a Root agent log view; Cron shows plain-English schedules and next-run times.
  • Forms: validation errors also appear beneath the matching field.

0.3.1 — November 2026

  • Fresh installs on Ubuntu 22.04 stopped at "Unable to locate package minisign": that release has no minisign package. The installer now uses the static minisign 0.12 binary there (pinned SHA-256); other systems keep the distribution package.
  • Smoke test: the terminal and vhost checks no longer fail on their own command line or a missing field.

0.3.0 — November 2026

Security release. Update with xaxa update, then open port 2083 in your provider's cloud firewall if you use one.

  • Vhost: the raw vhost editor is admin-only, and the root agent rejects .. and request values in try_files, index, rewrite and error_page paths. Before, an account with the user role could make nginx serve files of other sites.
  • Updates: xaxa update and xaxa php-install run the installer from inside the signed release, checked with the key saved on the server. The installer on the website is no longer run as root by updates.
  • phpMyAdmin and terminal move to port 2083, a separate browser origin from the panel. The terminal (ttyd) runs as the site user instead of root and checks the WebSocket origin. phpMyAdmin needs a login opened from the panel and is no longer in the www-data group.
  • Access ends everywhere: deleting an account, removing its site, signing out or changing the password closes its open terminals and drops its temporary phpMyAdmin logins.
  • Login: no trusted proxy any more (a site on the server could fake its IP and skip the rate limit and fail2ban); 10 wrong passwords per account in 15 minutes lock that account for a while; "remember me" lasts 30 days.
  • Redis: each site can get its own Redis user (Databases → Redis) limited to its own keys. New servers require it; updated servers can switch password-less access off under Instance → Redis.
  • Off-site backups are encrypted before upload (rclone crypt). The password is shown once when remote storage is saved; storage set up earlier shows a warning until it is saved again.
  • Secrets of one-click installs and clones (database and WordPress admin passwords) no longer appear in process lists.
  • Node.js downloads are checked against the checksum list signed by the Node.js releasers.
  • Panel security headers: Content Security Policy, and HSTS when the panel runs on a domain.
  • The SSL check only requests public addresses of a site's domain.
  • The one-time setup link is masked in the panel access log.

0.2.16 — November 2026

  • xaxa update no longer ends with "unexpected EOF while looking for matching" after the update finished: the CLI file is replaced as a new file instead of being rewritten while the running command still reads it. The update itself was not affected. The message can show one last time on the update to this release, because that update is started by the old CLI.
  • Code comments, scripts and developer documentation are now in English.

0.2.15 — November 2026

  • Basic auth: changing the user name now asks for a password. Before, the panel showed the new name while the server kept the old one, so the new name could not sign in.
  • Two-factor sign-in allows 5 wrong codes per account in 15 minutes, whatever IP they come from; after that even a correct code waits. The fail2ban jail also blocks port 443 when the panel has a domain.
  • Updates: a release that fails its migration or health check is removed and the database snapshot is restored, so xaxa rollback can no longer pick the broken release. Rollback also restores the root agent of the older release and deletes the used snapshot.
  • Installer: the Sury key package, Composer (2.11.1) and WP-CLI (2.12.0) are checked against fixed SHA-256 sums, and temporary files get random names.
  • Uploads: the root agent passes large files without copying them over and over (a 128 MB upload took seconds of CPU). Uptime figures use an index instead of reading every site's checks.
  • Confirmations: "Discard changes?" in the file editor shows above the editor. Stopping an app and dismissing one-time credentials ask first; the stop button shows a pause icon.
  • Files: a lost connection during upload shows an error. Logs: live mode scrolls to the newest line and pauses while the tab is hidden. Dashboard cards keep keyboard focus when they refresh.
  • New CLI command xaxa user:delete <email> removes a panel user and its API tokens.

0.2.14 — October 2026

  • Site access logs end with rt= (whole request) and urt= (PHP-FPM or app time) in seconds, so a slow page can be traced to the application or to the network (see Logs). Applied to default vhosts on xaxa update.
  • PHP-FPM workers stay 10 minutes when idle instead of 2: a quiet site no longer starts a cold worker on most visits.
  • Docs: why the page cache rarely applies to Laravel pages.

0.2.13 — October 2026

  • Database tuning on MariaDB 11.8 (Debian 13): the running server only grows the InnoDB buffer pool up to its start-up size and gave no error, so the larger size silently waited for the next restart. A new install now restarts the database once; xaxa update prints the new size and the restart command instead of interrupting the sites' database.

0.2.12 — October 2026

  • Server tuning, sized to the server's memory on every install and xaxa update (see Technology stack → Server tuning): a swap file below 4 GB of RAM when none exists, PHP-FPM workers per site from memory (2–10) kept for 2 minutes when idle, a larger shared OPcache with validate_permission, an InnoDB buffer pool of 25% of RAM, a Redis memory limit that only evicts expiring keys, and low CPU/disk priority for nightly backups.
  • nginx: TLS 1.2/1.3 only, a shared TLS session cache, kept-alive connections to Node.js and Python apps, and buffered access logs (up to 5 seconds' delay in the Logs tab). Package configuration files are not edited, so security updates keep installing.
  • Collapsed sidebar: the logo and the account avatar are centred like the menu icons.

0.2.11 — October 2026

  • Theme: switching between light and dark spreads the new theme from the button with a wavy edge (View Transitions). Browsers without support, reduced motion and hidden tabs switch instantly as before.
  • Updates no longer kill running jobs: queue workers finish the current backup, clone, install or deploy and restart with the new release. A job that still dies (reboot, crash) marks its backup, deployment or site task as failed instead of leaving the site busy forever.
  • Rollback: the database snapshot is restored with the queue, scheduler and PHP-FPM stopped and the old WAL files removed, so a stale WAL can no longer corrupt the restored database.
  • Root agent: database actions refuse MySQL's own databases and accounts (mysql, sys, information_schema, performance_schema, phpmyadmin, root…), and the panel rejects these names too.
  • File manager: saving and uploading write to a temporary file and replace the original only when complete, keeping its permissions; a full disk no longer leaves an empty or half-written file.
  • The nightly panel backup runs on the long-job queue, so uptime checks and metrics keep running at 02:45.
  • Clone keeps the Node.js/Python version and the number of instances, waits until the source site has no running task, and shows an error on the new site if its databases cannot be created.
  • API and webhooks follow the panel rules: the API refuses a backup or deploy while another task runs (409) and both are recorded in Events. A push while a deployment is still queued does not queue another one.
  • Settings: changing an app port checks that no other process listens on it, as Add site already did.
  • A backup cannot be deleted while a restore or another task is running for its site.
  • Nightly cleanup (04:15): deployments older than 90 days (the last 50 per site are kept), failed backup rows older than 30 days and events older than 180 days.
  • Alerts: an e-mail that could not be sent is retried on the next check instead of being silenced for the throttle period.
  • Two-factor login: an accepted code cannot be used a second time.
  • Faster pages: the task progress poll on Overview no longer queries the agent, the 7-day dashboard chart is averaged in the database, and download copies are removed after 15 minutes even if nothing else is downloaded.

0.2.10 — October 2026

  • File manager: double-clicking a file opens the editor in a window over the list instead of a new page, so you stay in the folder. Ctrl/⌘ + S saves; closing with unsaved changes asks first, and the list refreshes after a save.
  • Events: each event has a readable description and a coloured dot; search by name, subject or IP and filter by category, user and site. Page links keep the filters.
  • Site page: an Actions menu at the top (Back up now, Terminal, Clone site, Restart app, Issue SSL) works on every tab and replaces the Overview Quick actions card, whose links duplicated the tabs. The Overview Details card links to certificates, backups, databases and SSH/SFTP instead.
  • Domain & SSL: the certificate this server serves is always listed first, and the column is now Serving (Yes · to Cloudflare behind a proxy). The Cloudflare check shows a message while it runs and when it fails, instead of an empty space.

0.2.9 — October 2026

  • Passwords: every password field accepts 6 characters instead of 12 (setup, users, account, site user, basic auth, database users). No composition rules were added — the character set is unchanged.
  • Add site: Install WordPress/Laravel now starts unchecked, so a new site is empty unless the box is ticked.
  • Users, Firewall and Sites: the list cards share the dashboard card header, and the cards clip their rounded corners so table headers and row hover no longer overflow.
  • Delete a site: the button is now shown only to the account that created the site and it asks for your password before anything is removed; the site.deleted event keeps the account and IP. Sites without an owner (older installs or a deleted creator) can be deleted by an administrator, and the API follows the same rule (the token is the identity, so no password is asked).
  • Domain & SSL behind Cloudflare: the check now reads both certificates over TLS and reports what is actually served — the edge certificate visitors get (issuer, names, expiry, whether it covers the domain) and the certificate this server answers with on port 443, compared with the installed one by fingerprint. It also shows HSTS and how many resources the page loads over http:// (mixed content), the other reason browsers mark a proxied site "not secure". The check runs as soon as the page opens.
  • Installer: xaxa update prints the release it is installing (Installing XAXA 0.2.9 (installed: 0.2.7)) and refuses to install a release older than the installed panel instead of silently reinstalling the old one; --allow-downgrade overrides it. Releases are published with scripts/publish-release.sh, which uploads the package to both download paths, purges the CDN cache, deploys the marketing site and verifies the live package and demo.

0.2.8 — October 2026

  • Panel on a non-default port: Debian 13's nginx-common sets fastcgi_param HTTP_HOST $host;, which drops the port. Laravel builds its root URL from the request, so every asset and route link on a https://IP:8443 install pointed at port 443 — where the default server closes the connection — and the panel loaded without CSS or JavaScript. The panel fastcgi blocks now pass HTTP_HOST with the port when it is not 80/443.

0.2.7 — October 2026

  • Installer: on Debian 13 nginx failed to start with "server_tokens" directive is duplicate because the installer wrote server_tokens off; into conf.d/xaxa.conf while Debian's nginx.conf already sets it. The installer now adds the line only when nginx.conf does not set it.

0.2.6 — October 2026

  • Add site works per type: PHP has an Application list that fills in the document root (Laravel, Symfony, Drupal, CakePHP, Magento, Craft CMS and more), Node.js and Python sites choose their app port (checked against other sites and running services), versions are labelled (Node.js 24 LTS), and the site user password can be set or generated.
  • Site users are suggested short (test.example.com.tr → test-example) and never collide with an existing one.
  • Sites list: click anywhere on a row to open the site, a Manage button, and the SSH/SFTP user is labelled.
  • Dashboard: the load chart has a y-axis with a fixed 0–100% scale for CPU and memory, and shows the last hour, 24 hours or 7 days. A new Health card summarises services, backups, expiring certificates, sites that are down, package updates and failed jobs.
  • Instance: swap, load averages, processes, pending updates and a Software card with nginx, database, Redis, PHP, Node.js and Python versions.
  • SSL: sites behind Cloudflare show the two connections (visitor ⇄ Cloudflare, Cloudflare ⇄ server) and which certificate each one uses.
  • PHP 8.1 is no longer supported: new installs offer 8.2–8.5, and xaxa update removes PHP 8.1 when no site uses it.

0.2.5 — October 2026

  • Theme: the panel opens in the light theme unless you chose dark; your choice is remembered. Checkboxes and autofilled fields no longer turn dark in the light theme when the operating system uses a dark theme.
  • File manager: sort by any column (name, size, owner, modified, mode), ascending or descending; the order is kept between folders.
  • SSL: sites behind Cloudflare are recognised ("Proxied through Cloudflare" instead of a DNS warning), and Test Cloudflare checks the Cloudflare → server connection and explains 525/526/Flexible-mode problems.
  • Fixed: opening the folder tree without a path returned an error.
  • New sites get a self-signed certificate with a subjectAltName (it only had a CN, which current clients ignore).
  • Tests now try every panel route as a guest, as a user without access and in the read-only demo, open every page as an admin, and reject invalid input for every form without running a server command.

0.2.4 — October 2026

  • Two-factor: a setup started before 0.2.3 kept showing the old 20-character key, which Google Authenticator rejects; the account page now replaces it with a valid 32-character key. New key starts over, and the key is shown in groups of four. 8 one-time recovery codes are created when 2FA is turned on and work on the sign-in screen instead of the 6-digit code.
  • File manager: a click selects, a double-click opens (a tap on touch screens); a folder tree on the left like a desktop file manager; drag rows onto folders to move them and drop files from your computer to upload; owner column; symbolic links are copied as links.
  • Page cache: PHP sites can keep pages in nginx for 1 minute, 10 minutes or 1 hour, skipped for logged-in users and forms, purged with one click and after every successful deploy.
  • HTTPS options: HSTS per site, and HTTP/3 (QUIC) where the server's nginx supports it.
  • Imported certificates warn 30 days before they expire, since they do not renew by themselves.
  • nginx 1.25.1 and newer (Debian 13) get the http2 on; directive instead of the deprecated listen … http2.
  • Security: htmx no longer puts DELETE parameters in the URL, so the password typed to turn off 2FA cannot end up in the web server's access log.
  • Backup downloads use a hard link instead of a copy, so a large backup does not need twice the disk space.

0.2.3 — October 2026

  • SSL: a Certificates list shows every certificate of a site (Let's Encrypt, imported, self-signed) with domains, expiry date and whether it is installed. Imported certificates are kept, so you can switch between them and Let's Encrypt with one click. Import opens in a dialog.
  • Backups: every night sites with databases also get a separate database backup, kept on its own schedule (default: the last 7). Full and database backups are shown in separate tabs; every backup can be downloaded.
  • File manager: Ctrl/⌘ + click and Shift + click select several rows; the right-click menu applies to the whole selection; copy, cut and paste between folders; keyboard shortcuts (Ctrl/⌘ A, C, X, V, Delete).
  • Two-factor: new secrets are 32 characters (160 bit), which Google Authenticator scans directly. Existing 2FA setups keep working.
  • Site vhosts: static files fall back to the application when missing (Laravel routes ending in .png or .js), fonts and media are cached and served with CORS, favicon.ico/robots.txt are not logged, and proxied apps get X-Forwarded-Host.

0.2.2 — October 2026

  • phpMyAdmin opens in one click from a database, signed in and on that database's structure.
  • The file manager has a right-click menu: open or edit, download, rename, permissions, copy path, zip, extract and delete.
  • Two-factor setup explains how to scan the code inside Google Authenticator; the iPhone camera hands otpauth codes to the Passwords app.
  • The SSL tab explains that a proxied Cloudflare record shows Cloudflare's certificate in the browser, not the installed Origin certificate.
  • The panel domain opens on port 443 (https://panel.example.com); port 8443 stays for the IP address.
  • Adminer is replaced by phpMyAdmin (Ubuntu/Debian package, served at /phpmyadmin/), signed in with a 60-minute temporary user.
  • Site users can no longer list / and /home (chmod 0711); their own home directories stay private.
  • The PHP version chosen for a site also applies to its command line (php, cron and terminal).
  • Changing the server timezone applies at once: cron, PHP-FPM pools and queue workers pick it up; no restart is needed.

0.2.1 — October 2026

Fixes found by running every panel feature on a real Ubuntu 24.04 server:

  • Creating sites and Let's Encrypt certificates no longer fail with "cannot lock /etc/group" / "Read-only file system": the panel's PHP-FPM sandbox now leaves /etc writable for the root agent (ReadWritePaths=/etc did not override ProtectSystem=full).
  • Creating a PHP 8.4 site no longer returns 502 and leaves a site on the server without a panel record: PHP-FPM reloads now let running requests finish (process_control_timeout).
  • Switching a site's PHP version no longer takes the target PHP-FPM down for all sites.
  • Restoring a backup works (the site user could not read the extracted files); dependency folders are kept.
  • Adminer opens the database again (Adminer 6 rejected the panel's sign-in form).
  • Deleting a site removes its Linux group too, so the same site user can be created again; a failed delete keeps exactly what is still on the server.
  • Site monitoring runs again (certificate dates broke the cache every minute).
  • Restarting nginx or the panel's PHP-FPM from the panel no longer cuts the request.
  • xaxa panel-backup and other CLI commands work when run from root's home directory.
  • Fewer "database is locked" errors while long tasks run.

0.2.0 — October 2026

  • Security: a hand-edited vhost stays inside its own site — document roots in the site's home, PHP only through the site's own pool, server_name limited to the site's domains, ports 80/443 only; nginx no longer follows a symlink to another user's files.
  • Security: site cloning copies files as the site users instead of root; file names can no longer inject script into the file manager; an open web terminal is closed when the user loses access to the site; changing your password signs out your other sessions.
  • Backups, restores and deployments of the same site really run one at a time; a failed off-site copy keeps the local backup and shows a warning.
  • The default deploy script stops at the first failing step (for example a failed migration).
  • The file editor saves content byte for byte (leading/trailing whitespace and the final newline are kept); file dialogs, unzip, Ctrl/⌘ S and live logs work again.
  • Dashboard and Instance show memory and disk in GB, CPU model and clock speed, load for 5/15 minutes, hostname and IP; hover a card or the chart for details.
  • Instance → Settings: panel domain with a Let's Encrypt certificate, and the server timezone.
  • New installs come with PHP 8.1–8.5 and Node.js 20, 22 and 24.
  • Ubuntu 26.04 is not offered until the PHP package repository supports it; the installer stops with a clear message instead of failing halfway.

0.1.0 — October 2026

First public release.

  • Fixed file permissions in installation and release packaging: the release server's restrictive permissions no longer stop the panel user from reading the artisan file.

  • The terminal session regex in the installer's nginx template is now quoted; {32} is no longer interpreted as a configuration delimiter.

  • Runtime installation no longer exits silently when the optional corepack is missing; it continues on to generate the admin setup link.

  • An interrupted installation resumes with the same command; if there is no first admin yet, the full setup link is shown automatically at the end of installation and update. If an account already exists, the setup token is not changed.

  • Added a narrow /etc write exception to the panel's PHP-FPM service; fixed the root agent hitting a lock error caused by the read-only file system when creating a site user.

  • One-command installer for Ubuntu 22.04/24.04/26.04 and Debian 12/13 (x86_64 and ARM64).

  • Sites: PHP 8.1–8.5, Node.js, Python, static and reverse proxy, each with an isolated Linux user.

  • Vhost editor with nginx -t validation and automatic rollback.

  • Let's Encrypt and custom certificates, automatic HTTPS redirect.

  • Site security: IP blocking, bot blocking, basic auth, Cloudflare-only mode.

  • MariaDB/MySQL databases, cron jobs, SSH/SFTP passwords and keys, logs.

  • Nightly backups with retention, restore and S3-compatible remote storage.

  • Users with admin/user roles, TOTP two-factor authentication and an audit log.

  • Dashboard metrics, service status and restarts.

  • xaxa command-line tool.

  • Domain aliases with redirect, DNS check before Let's Encrypt, international domain names.

  • Signed releases, automatic rollback on failed updates, nightly panel backup.

  • SMTP relay for sites and email alerts (site down, certificate expiry, failed backups, full disk).

  • Weekly Node.js/Python patch updates, cron pause and "Run now", root agent log viewer.

Found a mistake or need help? support@xaxa.com.tr