4.0.8

Changed​

• 2083 and 2087: one place per job. Domains is the one per-website table (PHP version and web engine set on each row; Force HTTPS, HSTS and Repair as row actions). Site Manager is the one list of sites, with an All / WordPress / Joomla filter. /domains/ssl is the one SSL page (SSL Status, Signing request, Install, SSL Storage Manager). /backups is the one backups page (Backups, Restore & Download, Backup Schedule, Snapshots, Backup Wizard). The VirtualHost file and the override snippet are two tabs of one web server configuration view, and the File manager has a single Upload menu entry. The old URLs (/php/domains, /wordpress, /toolkit/joomla, /ssl*, /backups/list, /backups/schedule, /backups/snapshots, /backup-wizard) answer with a redirect that keeps the query string; JSON and POST requests are unchanged.
• Web servers, PHP-FPM, databases and caches are sized from the server's CPUs and RAM at install and on every update, instead of fixed defaults: worker and connection counts, keep-alive, open-file caches, PHP-FPM pool sizes and backlog, and the database and cache memory settings. hitechcloudcli service tune applies it on demand; AUTOTUNE=off in native.conf keeps your own values untouched. The front-end nginx now keeps idle connections open to each web engine, and compresses with a better gzip_types list.
• Panel daemons (2083, 2087, WAF, meet, batch jobs): pages and JSON are gzip-compressed (HTML is about 6 times smaller; HITECHCLOUD_RESPONSE_GZIP=off turns it off), HTTP/2 connections from browsers that have gone away are closed by keep-alive PINGs, and the per-request session read uses pooled Redis connections. The two panels get systemd CPU and IO weight 150 and the 13 batch jobs weight 20, so a backup or scan no longer slows the panel. Login and web-call limiters, failed-login counts and meet's signalling queue (64 frames per socket) are bounded. The panel engine is built with one codegen unit.

Added​

• FTP sub-accounts have quotas: a size in MB and an optional maximum number of files, set when the account is created or from a Quota button on the FTP accounts page, which shows "used / limit" per login. The size cannot exceed the plan's disk quota. The same fields are in the API (POST /api/ftp, PATCH /api/ftp/{username}/quota, GET /api/ftp).
• Mail Portal (port 2091): a separate sign-in surface, with its own cookie and session key, for mail-only service accounts. A mail-only account is refused at every 2083 entry (pages, API and Bearer tokens) and sent to the Portal; hosting accounts can use it too. Extra Portal hostnames for resellers and mailadmin.<domain> for verified customer domains are kept in /etc/hitechcloud/mailportal/hosts.conf (host first, then kind and owner) and managed with hitechcloudcli mailportal hostname|domain add|remove|list. A mail-only DNS zone template carries MX, SPF, DKIM, DMARC, MTA-STS and autoconfig records without web records.
• Webmail (2096) and panel sync: mailbox rules and auto-reply are one store shared by 2083 and the webmail, with mail rules converged on update; hitechcloudcli webmail admins list|remove is an alias of webmail admin.

Fixed​

• 2083 phone layout and contrast: the DNS Zones header wraps its subdomain note instead of scrolling the page sideways, and the mail log note and spam quarantine header meet colour contrast.
• Vietnamese translations for Mail Delivery, Max files, Spam & Filtering and the Mail Portal, Filters, Devices and mailbox-security pages.
• Without a database a request is treated as a hosting account instead of answering 500, and the Favorites page flashes its messages.

Security​

• Webmail (2096) audit fixes. A share link no longer serves an uploaded HTML or SVG file inline on the webmail origin (it could run script as a signed-in user, administrators included). A successful sign-in no longer resets the per-IP login counter, and the DAV login limit is checked before the password. Changing a mailbox password now ends that user's other sessions and clears the cached DAV login. The URL guard now rejects IPv6 spellings of loopback ([::ffff:127.0.0.1], [::]) and names that resolve to loopback (127.1, 2130706433, /etc/hosts entries). "Forgot password" answers at the same speed whether or not the address has an account. The rspamd web UI (port 11334) listens on 127.0.0.1 only.

Dependencies​

• rusqlite 0.40 (bundled SQLite) in the admin panel and the CLI; rustls stays at 0.23.46.
• In-range updates in every lock file: tokio 1.53.3, hyper 1.12, h2 0.4.20, hyper-util 0.1.21, serde_json 1.0.154 (panel engine), aws-lc-rs 1.18.2 (meet), and the webmail's npm dependencies (npm audit reports 0 vulnerabilities in the backend).