Open Source Projects

Reliability release. Fixes the orphaned-vhost bug behind #17, where a deleted domain could leave Apache unable to start and take every site on the server down.

Fixed

Orphaned Apache vhosts (#17). Deleting an account enumerated its domains by scanning the home directory. If that directory was already gone, the vhost survived pointing at a and log directory that no longer existed. Apache kept serving on its loaded config, so nothing looked wrong — until the next restart (an , a reboot), at which point a missing log directory is fatal and Apache refused to start. Every site on the box then returned 502. Domains are now resolved from the panel database and vhost ownership as well as the filesystem.

Apache config is validated before every reload. ran — backwards, because a failed reload leaves the working config serving, but the restart that followed took the whole server down. Both and now run first and never escalate to a restart.

no longer overwrites a live site's . Re-adding an existing domain to regenerate its vhost copied the welcome placeholder over the real homepage. The placeholder is now only written into an empty web root.

printed garbage and always claimed an update was available. The version lookup matched every line mentioning , including doc comments, producing a multi-line blob that never compared equal. It also falls back to ASCII on non-UTF-8 consoles, where the status dots rendered as .

now works. It previously required and rejected a bare domain.

The SSH port survives an upgrade. The port was written into , which is ucf-managed on Debian — accepting the maintainer's version on the upgrade prompt silently reverted it and locked you out on the next reconnect. It now lives in , and the change is verified to have taken effect before being reported as successful.

Added

— regenerates missing Apache vhosts from the panel database and reports orphaned ones. Run for a read-only report; it will tell you whether a broken vhost is waiting to take your server down on the next reboot.

Upgrading

Nothing in this release runs automatically. All of the above execute only on explicit action, so the update itself is a straight file replacement.

If you have ever deleted a domain or an account, is worth running once after updating.

⚠️ CRITICAL — please read, and enable automatic backups

This release fixes a system-wide bug that can silently break account creation, domain setup, and SSL on servers that were previously working perfectly. If you run iNetPanel, update and read this.

► Enable automatic backups now
Settings → Backups → enable daily automatic backups, and take a manual backup before updating. The failures in this bug are silent — operations report success while doing nothing — so a known-good backup is your safety net.

The bug — full details
- What: php-fpm's systemd unit ships with , which mounts read-only for every process php-fpm spawns. The panel makes privileged system changes — , Apache vhosts, PHP-FPM pools, entries, Let's Encrypt certs — via root helpers launched by php-fpm, and does not escape php-fpm's mount namespace, so all of those writes fail.
- Symptoms: creating an account fails with or ; adding domains / issuing SSL can fail the same way. Until this release the scripts reported success anyway, leaving "phantom" accounts (a row with no Linux user) that then block re-creating that username.
- Why it appeared out of nowhere: is part of the stock php-fpm unit; a routine PHP package update in the past few months enabled it on servers that were fine before. No panel change was involved — a working system simply stops being able to create accounts. It looks like a storage/permission problem but isn't — it happens identically on ext4 and ZFS.

The fix
A php-fpm drop-in sets (keeps and read-only, allows ). New installs get it from the installer before php-fpm first starts; existing installs get it on update.

⚠️ Applying it on an already-affected server
Most servers need no action — the nightly auto-update (runs as root via cron, outside the sandbox) applies this fix automatically. Just make sure auto-update is enabled under Settings → Updates.

To apply it immediately, or if auto-update is off, run once from a root shell:

The web "Update Now" button cannot apply this particular fix — it runs inside php-fpm's read-only sandbox. After the fix applies, php-fpm stops sandboxing and everything (including "Update Now") works normally again. If a username is stuck as a phantom account, delete its row and re-create it.

---

Also in v1.24.4
- now fails loudly when fails (no more phantom accounts) — this is what finally surfaced the bug above.

Full changelog: https://github.com/tuxxin/iNetPanel/compare/v1.24.3...v1.24.4

iNetPanel v1.24.3

Bug-fix release hardening multi-tenant isolation and fixing per-domain PHP switching.

Fixed
- Cross-vhost content contamination. The Cloudflare→Apache origin hop is now pinned to HTTP/1.1 via a managed (), applied idempotently on update (configtest + safe reload, auto-revert on failure) and by the installer for new installs. This prevents HTTP/2 connection coalescing from ever serving one domain's content (e.g. ) under another. Visitors keep HTTP/2/3 from Cloudflare's edge — only the origin hop changes.
- Port-collision isolation. now allocates each vhost port atomically (flock) and scans real usage (ports file + live vhosts), refusing to co-locate two domains on one port. Backup restore re-derives unique, free ports server-side instead of trusting client-submitted values.
- Per-domain PHP version switch. Switching a domain's PHP version now runs through a root action using the correct pool naming, and validates the domain first.

Upgrade
- Existing installs apply the hardening and fixes automatically on update; new installs include them in the installer.

Full changelog: https://github.com/tuxxin/iNetPanel/compare/v1.24.2...v1.24.3