3.0.0

The first product release.

Everything before this was the rebuild: the stack moved off containers onto host services, the panel was rewritten, and the last few weeks were spent finding out what the result actually did on a real server rather than what it was supposed to do. This is the version that stands behind the answer.

Security review​

The release was held for a review of the whole surface. What it found:

• Two administration surfaces were open to the internet. OpenLiteSpeed's own WebAdmin console ships listening on every interface and nothing here had ever touched it, so choosing that engine put a second administration panel on the public internet with credentials this panel does not manage. And the distribution's machine-wide varnishd was running on port 6081 despite an installer comment explaining at length why it is left stopped — nothing in the code stopped it. The console is on loopback now and the stray service is masked. Both were confirmed reachable from off the machine before the fix and refusing connections after it.

• The search engine was open to the internet. The installer appended network.host: 127.0.0.1 and a comment saying "a search engine open to the internet is a database open to the internet, and this one indexes customers' site content". Elasticsearch's own package configuration writes http.host: 0.0.0.0 earlier in the same file, and http.host is the setting that binds the REST API — so the node listened on every interface and the comment was simply wrong. It was answering from off the machine on port 9201. Both settings are pinned now.

• The webmail backend listened on every interface. listen(PORT) with no host binds all of them, so the backend was reachable on port 8892 straight past the front end that terminates TLS and sets the security headers. The CLI that installs it has carried the comment "on loopback only" since the day it was written; nothing made it true. It does now.

• hitechcloudcli license verify restarted both panels. A command that reports whether a licence is valid dropped every open session and cut every request in flight, every time it ran. It reports and changes nothing now.

• The firewall's own preflight locked it out of its master key. hitechcloudwaf -check generated the key when there was none, and the check runs as root while the service does not — so the service could never read the file its own check created. One server had restarted 12,968 times. A check no longer writes anything.

• Checked and found sound: no credential has ever entered any repository in this project, including its history; every route is behind a session, an API token, an HMAC or is deliberately public; the deploy webhook verifies HMAC-SHA256 in constant time; the OIDC endpoints validate signing method, issuer and bearer token; no private key is world-readable; the search engines listen on loopback only.

• Vulnerability scan: both binaries report no reachable vulnerable code. Three advisories exist in dependencies and none has a published fix — one in a library feature this product does not use, one in a package nothing here imports, and one in a build-time image tool that never sees untrusted input.

The two editions​

3.0.0 is the release where Community and Enterprise are real. Until now the panel answered "Enterprise" to every licence question, and a fresh install wrote the pre-split default key into its own config — so every Community download came up with resellers, hosting plans, the admin panel and no limits. A new install writes no key at all, which is what Community is.

Community hosts your own sites on one server: three hosting accounts and fifty domains, as hitechcloud.org has always published, with every hosting feature the product has. The hosting panel on port 2083 is the whole of it, and it is where the server's PHP versions are managed too, because there is no admin panel to do it from.

Enterprise is the multi-tenant half: resellers, hosting plans, customer accounts, the permissions between them, and the admin panel on port 2087 that administers all of it. Port 2087 answers one page on a Community server and nothing else — not the dashboard, not the login form, not the API. The administration panel is that half, so gating it page by page would only leave whichever page nobody remembered to gate.

Entering a key does everything. hitechcloudcli license <key> lifts the limits, opens 2087, switches on the Enterprise modules, and installs the components those modules need — FTP, the mail stack, PostgreSQL, Node and ClamAV — in the background, because the panel is usable within a second and a package install takes minutes. Nothing is reinstalled and nothing is reconfigured: it adds the components and leaves the running server alone.

The edition is read from the key on the machine, never from the licensing server. A vendor outage or a firewall in front of a customer cannot turn an Enterprise server back into a Community one in the middle of an afternoon.

Added​

• Install and remove whole PHP versions. On Enterprise that is the admin panel; on Community it is the hosting panel, because that edition has no admin panel and the person running the server is there. On Enterprise a hosting account cannot — a PHP version is shared by every account on the machine, and removing one takes it from the neighbours. A version a website runs on, and the default for new sites, cannot be removed at all; the page says which, instead of offering a button that would be refused.

• A default install now brings up eight PHP versions, not thirteen — 5.6, 7.4 and 8.1 through 8.6. Every installed version runs a process manager and its idle workers from boot whether or not a website uses it. The rest are a minute away from the panel when somebody needs one.

• Install and remove whole PHP versions from the admin panel. A default install runs every supported version's process manager whether or not a website uses one; on a fresh server that is a dozen idle FPM masters. The page shows what each version is carrying and lets you take the unused ones off. A version a website runs on, and the default for new sites, cannot be removed — the page says which, instead of offering a button that would be refused.

Fixed​

Carried in from the 2.1.27–2.1.30 releases, and worth repeating because they are what the first product release rests on:

• Deleting one domain deleted every mailbox the account had, on every domain.
• A mailbox could send as any domain on the server.
• The spam filter's blocklists were answering nothing, silently.
• A site that worked on nginx was broken and slow on OpenLiteSpeed.
• Document Root opened the wrong directory everywhere it appeared.
• A zone whose nameservers are CNAMEs was reported as healthy.
• An address could not be allocated to a reseller, and never could.

Notes​

Upgrading is an ordinary update. There is no migration, no schema change and no new service. hitechcloudcli update brings a 2.1.x server to 3.0.0.

The version number. It is 3.0.0 because the product is finished, not because anything in it breaks compatibility with 2.1.30.