Back to Changelog
Panel Backend
v1.0.558
Backup system overhaul, update reliability, permission enforcement in the API, mail scanning and spam switch, Docker port ownership
New Features
11- Choose where local backups are stored (validated; change or move; nothing is written when the disk is not mounted).
- One backup at a time per server with a queue, cancel, and a free-space estimate before start; the backup stops before the disk fills.
- Choose what a backup contains (files, databases, mail, logs) and exclude images/videos or patterns.
- Keep the newest N backups (local and remote, scheduled and manual); usage warnings at 70/80/90 % on a separate backup disk.
- A ROOT backup carries the panel configuration (resellers, plans, quotas, settings, permissions) for restores onto a new server.
- Google Drive "Basic" connection through the Panelica Backup app (no client ID or secret to create); "Advanced" stays as before.
- Scheduled backup wizard with 28 presets or a custom cron.
- The Postfix host name (HELO) can be set in the panel.
- Plan mailbox quota; the webmail attachment limit follows the mail size limit.
- Docker host ports belong to their container; a stopped container keeps its port; Ports page with conflict resolution.
- Sentinel: 9 rare, serious event triggers and a "notify only" level.
Improvement
1- A full backup is written in one pass (lower disk peak, low priority, checksum while streaming).
Bug Fixes
25- Restoring onto a new server no longer loses accounts; a failed restore no longer reports success; a restored domain account is always a USER.
- Restore generates the vhost and PHP-FPM pool from the panel templates instead of writing the archive's configuration; .htaccess cleanup no longer follows symbolic links.
- Mail is stored once per backup; incremental backups carry mail and accounts correctly; a restore keeps live mail.
- WordPress backup, restore and staging rewritten: a large backup no longer locks the panel; interrupted operations are settled at startup.
- Backup endpoints follow the Permissions page; the external API scheduling endpoints follow the panel's rules.
- zstd is installed when missing; the panel's daily database dump no longer fills its log.
- A service no longer keeps running its old binary after an update; units that would start a service in the middle of its update are stopped first.
- Packages whose files panelica-server already carries are no longer offered or applied (an old small package could overwrite newer files).
- Rolling back panelica-server also rolls back a panel interface that requires the newer server, and restarts the rescue console on the restored files.
- The rescue console writes all files of the panelica-server package when it applies an update.
- A rollback removes the files the update had added; tenant PHP-FPM pools restart after an automatic rollback.
- File manager, cron, database, user and plan permissions are enforced by the API as well, not only hidden in the interface.
- Domain edit permissions do what they say; duplicate and ineffective switches were removed.
- The Permissions page lists only the features the server enforces.
- Users can change their own password and profile, end their own sessions and pass the 2FA page while restrictive permissions are set.
- Virus scanning uses the panel's own ClamAV on every supported OS and is applied per account.
- The per-account spam filter switch works; mail of an account with the filter off is not moved, deleted or tagged.
- Webmail calendar complete in 29 languages.
- The panel's own container cannot be renamed or recreated.
- One IP can be assigned to several accounts; the user edit form shows assigned IPs.
- On servers behind NAT, webmail, discovery, Node.js and Python vhosts follow the domain's listen rule.
- Web server change, SSL, Laravel binding and snapshot restore no longer reset a domain's PHP limits to the plan.
- PHP extensions switched off or on in the panel stay that way after PHP updates, and a switch reaches running sites at once.
- AlmaLinux/Rocky 10: ISO-8859-9 (Turkish) and Windows-1254 conversions in PHP iconv() work (glibc-gconv-extra matching the installed glibc).
- File manager opens archives that start with a "./" entry; upload-and-extract reports a failed extraction; files created through the write endpoint belong to the account.
Security Fixes
2- External API /v1/files/download returns to non-ROOT keys only files their owner can access.
- The webmail master password works only for IMAP; SPF/DMARC validation added.