3.7.2

3.7.0 made an edition a different server. This release is what running it on a real machine found — a set of things that installed, configured and reported themselves correctly, and did not work.

None of them were caught by a test, and the reason is the same each time: a test proves that the right command was called. It cannot prove what the operating system did afterwards. The largest of them had been true of every native install, and the only sign was a health snapshot with an old date on it.

Upgrading is hitechcloudcli update.

Fixed​

• The Community webmail could not install, on any server. The archive is held to a checksum, correctly — but the checksum was looked for in a file the project does not publish, so the download was discarded every time. It is now pinned in the manifest, verified against a value reviewed in a pull request. This was the whole point of 3.7.0, and it had never once worked.
• Its PHP pool never started. A service pool (Roundcube, phpMyAdmin, mail autoconfig) is not a site, so nothing resolved an owner for it, and the reload went to every account's PHP master — none of which load those pools. The one that does, the distribution master, was never reloaded. phpMyAdmin had been working by coincidence since somebody restarted that master for another reason. The install now reloads the master that actually owns the pool, and refuses rather than declaring success over a page that would answer 502.
• The installer could take over a name another site was serving. The webmail's vhost is written under the mail hostname, which on most servers is the server's own name — and the existing file was overwritten without being read. It now refuses, names the file, and offers --host. Found by watching it replace a working server's front page.
• The module registry said the webmail was not installed while it was serving. "Installed" was decided from systemd units and a marker file, and the declared package list was never read at all. Software installed from an archive was invisible. On a Community server that is the only module carrying the webmail feature, so the panel hid a webmail that worked. Modules now carry a detect signal, packages are consulted, and a test walks the shipped registry and fails the build when a module has no trustworthy way to answer the question. The same gap was open for n8n and the Python, Ruby and Java runtimes.
• Setting a mailbox password stored a hash that matched nothing. The tool asks for the password and then for a confirmation; sending one line fails that check quietly — the refusal goes to stderr, a hash of something else is printed on stdout, and the exit status is 0. The panel said the password was set and the mailbox could not be opened with it. Both lines are sent now, and the hash is verified against the password before it is stored.
• vendor.json never reached a server. Every third-party artifact is pinned to a version and a checksum in that file, and nothing installed it — so a server refused every third-party install for want of a checksum. The same gap modules.json had, one release later. Both the installer and the updater carry it now.
• A fresh Podman install unpacked a 404 page. It fetched the CLI from a branch that was merged and deleted long ago.
• fix_permissions used the account's user id as its group id, which was right only by the coincidence of one-user-one-group.
• A malware-detection hook fetched a script that belongs to an unrelated project, from a URL that no longer resolves. It now runs our own.
• The login pages had no working dark mode — the class the rest of the panel switches on was never set there, so every rule was dead, including two that were not valid to begin with.
• The web terminal's command log covered only one of the two stacks. Both now record what was typed, through the same implementation — which never records a line the shell did not echo, so a password typed at a prompt is not written down.

The server was not running its own scheduled work​

• Eighteen scheduled jobs had never run, on any native install. The installer wrote /etc/cron.d/hitechcloud with two header lines and no jobs in it. The comment above that code said the header was there so the System Crons page would not report the file missing; it did not report it missing, it reported no jobs, correctly. Gone with them: the five-minutely health monitor and its daily report, outbound send-limit enforcement, the status-page probes, the audit-chain ingest and its daily seal, the weekly system backup, domain and traffic statistics, PageSpeed, the WordPress vulnerability scan, reseller storage accounting, the FTP user file, the mail summary, trash purging and the OWASP rule update. Nothing said so, because a server with no scheduled jobs looks exactly like a healthy one. Upgrading puts back every job the server is missing and never touches one you have changed.
• The notifications page says when the monitor last ran. This is the thing that would have made the above visible on day one: an empty page looks identical whether nothing is wrong or nothing is being checked. Past fifteen minutes — three missed runs — it says so in red.
• The compliance binary was never installed, and an upgrade never noticed. The installer knew how to fetch it and the release published it, but nothing refreshed it, so a server whose first attempt failed had no audit chain and no status-page observations, for ever. It is installed and kept current now.

The monitor itself​

• A resolved problem went on being reported, and the next one did not. An unread notification is how three checks decide they have already told you about something, and nothing ever cleared that flag except an administrator clicking it away. So it did not stop one episode repeating — it silenced the next one. Worst on disk: that check asked whether it had already warned before it measured, so a single unread "Running out of Disk Space!" stopped it reading the disk at all. A server that filled up once and was tidied up had no disk monitoring afterwards. Every check now clears its own alert when it passes.
• The memory alert repeated every five minutes, because its guard compared against the start of the message rather than the notification's title and so matched nothing. CPU and system load had no guard at all — an hour of high load wrote twelve identical notifications and twelve crash reports.
• A problem that was still happening counted as a warning, not a failure, and that is what went into the health snapshot — so anything reading it saw a server with a full disk as merely worth a look.
• The monitor fought the installer over the firewall. A native install leaves CSF configured and deliberately off, because a firewall coming up during an install is a server disappearing during an install. The check read that as a service that had fallen over and tried to start it every five minutes, for ever. It now says the firewall is installed and switched off, and where to turn it on.

Services that could not start​

• HAProxy failed on every boot after the first. Its stats socket lives in /run/haproxy, and the install created that directory once — /run is a tmpfs. The configuration stayed valid, which is why it looked fine. A tmpfiles rule recreates it at boot, and repair writes the rule for a server that has already rebooted.
• WireGuard reported a VPN that was not there. native-wireguard install enabled wg-quick@wg0, discarded the result and printed "WireGuard is up". On a RHEL 8 kernel there is no WireGuard — 4.18 predates it and no module package is in the default repositories — so the unit failed on that boot and every boot after. It now checks the kernel before enabling anything, says what is wrong and what would fix it, and verifies the unit is actually running before claiming it is.

Webmail​

• Upstream MailFlow v3.5.7. Three IMAP fixes — INBOX flag stores over the persistent session, flag stores serialised and lock waiters unstuck, and the primary ladder cleared on a successful sync rather than a successful login — plus alias-forwarder unwrapping, so a message that arrived via a forwarding service shows the real sender, and keyboard triage and mailbox navigation. Twelve Vietnamese strings for the new text.
• The locale page no longer offers a language it would then refuse. It listed every directory in the catalogue, while installing one checked the name looked like a locale.

Changed​

• One command, one name. hitechcloud-rustcli is folded into hitechcloudcli; the old name stays as a symlink for everything that calls it by path. The binary has two personalities chosen by the name it was invoked under: typed by a person it checks for root, records history and runs hooks; called by the panel it does none of that and answers.
• One command surface. hitechcloudcli <noun> <verb> across all 177 commands, with every legacy name still working through the same code — proven by tests that run the binary both ways and compare the bytes. The era prefixes (native-, and the rest) are what the new names drop.
• native-wireguard is Rust, the last of the native stack's command logic to move off shell except native-ipmanager. hitechcloudcli native-install --scheduled-jobs-only is new, and is what an upgrade runs to put a server's schedule back.
• The admin's webmail selector stops offering container names. It lists the webmail modules the server has, and its action repairs the one you pick — the old one called a command that had answered "that is not how this stack serves webmail" for some time.