Releases

Recent versions of the panel and what changed in them.

1.0.2.20261106121902

  • Licenses and updates now use the towerpanel.com domain, updates are downloaded over HTTPS. The panel moves to the new address by itself.

1.0.2.20261106093949

  • The panel is now called TowerPanel, the new project address is towerpanel.com. Settings, licenses and sites stay as they were.

1.0.2.20261104182534

  • The panel and the installer do not follow update server redirects and do not download an archive over 64 MB
  • Installer: on failure it starts the panel services again and replaces the files at once; the --server address is checked
  • Replacing binaries and license files survives a power failure
  • Reserve key for the license server connection: the server can move to it without a new release

1.0.2.20261104161043

  • Panel updates are verified more strictly: daemon link, version and another minute and a half after start; an incomplete rollback now shows in the bell
  • License: after paying on the last day the panel asks the license server hourly, a failed key entry does not cancel the grace period, the section no longer hangs during a check
  • Without a license a MongoDB database cannot be created by import and a copy from another server cannot be restored; privileges are granted only on existing databases

1.0.2.20261104153606

  • The license is confirmed once a day and stays valid for a week; without a connection to the license server the plan stays for one more week, and the section shows the paid period
  • The trial is now one per machine: reinstalling the panel does not give a new one
  • The customer area link is signed with the panel key: a purchase can only be bound to your own server

1.0.2.20261104143513

  • Updates: the signature of each release file is now valid only for that file - the update channel is better protected
  • Without a license, mailboxes can no longer be created and compose projects can no longer be built and started

1.0.2.20261104115546

  • Docker: official Docker Hub images (nginx, mysql and others) are available to users as usual even when the administrator is logged in to Docker Hub

1.0.2.20261104113855

  • IP addresses: a Sites column and an SLAAC label; SSH logins: a wrong password counts once, a log read failure is shown; renaming the host keeps aliases in /etc/hosts

1.0.2.20261104113205

  • IP addresses: the main address cannot be deleted or set to a foreign one, deleting an address warns about DNS records pointing to it
  • SSH logins: a login address can be blocked right from the Logins tab; marking one login as known no longer hides others

1.0.2.20261104102941

  • IP addresses: an additional address with an unsuitable mask no longer takes over a route, aliases come back by themselves after a reboot, an alias that is not up is shown and no longer blocks other actions
  • The external NAT address must be IPv4: an IPv6 address there broke FTP
  • SSH logins: the warning about a root login from a new address is no longer lost among frequent automated logins; repeated logins are shown as one line

1.0.2.20261104091315

  • Protection against code injection into panel pages: a strict CSP policy; WebDisk files no longer open as panel pages

1.0.2.20261104084057

  • SSL: issuance does not start if the server clock is far off; a user's certificate auto-renewal is shown in their operations log
  • The Git webhook no longer deploys on stars, issues and merge requests; Bitbucket Cloud push is supported
  • App installation: large archives download even on slow links; a container with a server directory handed to a user can be edited

1.0.2.20261104082217

  • "Revoke and issue a replacement" now issues the new certificate first and revokes the old one only afterwards; a failure to apply an issued certificate is now reported as an error
  • A user can attach only their own certificate to their site; an administrator's own certificate in place of a Let's Encrypt one is no longer replaced by auto-renewal
  • Docker: compose project volumes are visible to and removable by their owner; the administrator's private images are hidden from users and not available without their own registry login
  • The Git webhook does not deploy for a locked owner or a suspended site; a site cannot be deleted during a deployment; wsDoctor reports Ghost updates

1.0.2.20261104075616

  • The panel data directory is protected from tampering: the web part can no longer rename directories root works with
  • Replacing a certificate or installing one for a CSR now applies to sites, mail and FTP at once; a CSR for a working certificate no longer breaks its key
  • Let's Encrypt auto-renewal renews all due certificates in one pass; the staging CA issues under a "-test" name and no longer overwrites the working certificate
  • Docker: stricter checks of users' compose files, memory and CPU limits capped by the server resources, sites with similar names no longer share volumes
  • The app installer does not clear the site until checks and download succeed; Git deployments run one at a time

1.0.2.20261103223809

  • Panel e-mail notifications are DKIM-signed again (Postfix); with Exim the notification settings explain how to sign them via a mailbox

1.0.2.20261103213957

  • Mail: DKIM signing applies only to mail sent with a mailbox login; PHP mail() goes out unsigned - sites should send via SMTP with a mailbox (WP Mail SMTP and the like)

1.0.2.20261103201130

  • Backups: unread files are shown in the backup result as a warning
  • DNS: a DKIM key in quotes or parentheses is written to the zone correctly; an administrator address with a dot (john.doe@) is kept
  • Mail: the autoreply works for new mailbox aliases right away

1.0.2.20261103195907

  • Mail: your own DMARC record (p=reject etc.) is no longer replaced when saving a domain; changing the mail server sends the mail queue first
  • DNS: the records window no longer erases records added while it was open; a subdomain zone on this server is delegated in the parent; zone files are closed to other server users
  • DNS: deleting a signed zone warns about the DS at the registrar and keeps its keys
  • Databases: MySQL events (scheduled jobs) are included in exports and backups

1.0.2.20261103190909

  • Mail: a mailbox sends only from its own addresses and aliases, a mailbox password is accepted only over an encrypted connection (mail clients without encryption will stop logging in)
  • Mail: simultaneous mailbox edits are no longer lost, mail of a deleted domain does not go to a new owner of the same domain
  • DNS: “Create domain” no longer overwrites an existing zone; deleting a zone leaves Cloudflare records alone; server migration keeps DNSSEC signing
  • Databases: restoring PostgreSQL over the current data no longer leaves an empty database on failure; checking and repairing tables of large databases is no longer cut off
  • Backups: a database with an unusual name no longer breaks the backup and the cleanup of old backups

1.0.2.20261103170528

  • The dashboard resource chart no longer loses minutes or shows spikes after a clock change
  • “System information” is easy to read on a phone
  • Notifications collected during quiet hours are delivered after a panel restart too
  • CRON: “Run now” starts a job with the same groups as on schedule

1.0.2.20261103165703

  • Server reboot warns about running operations
  • Dashboard: LVM and RAID partitions, IPv6 and bond traffic are shown correctly
  • Notifications: a recurring problem is sent again, “healthy again” only follows a problem message, mail reaches Gmail with Exim
  • Sites: a directory password applies to all site names, a site suspended by root cannot be enabled by its owner, internationalized domains are accepted
  • CRON: jobs with @daily and other shortcuts open correctly in the form; a time zone change applies to jobs at once

1.0.2.20261103154229

  • Sites: a directory password also applies over HTTP, a user's first site is created, saving settings no longer resets the PHP pool, deleting files no longer affects another site
  • CRON: one invalid schedule no longer disables the jobs of all users
  • After the upgrade to Ubuntu 26.04 the panel shows and uses the new PHP version of sites
  • wsDoctor checks hard disk SMART in the background without waking sleeping disks

1.0.2.20261103132117

  • WebDisk: an interrupted upload no longer writes a truncated file over the previous one
  • File manager: no more than three long operations at once, extraction checks free space, a user home directory is protected from owner and permission changes
  • File integrity: replacing a file with a link and PHP in dependency folders are detected; a site that is not checked raises a wsDoctor signal

1.0.2.20261103125416

  • File manager: plain .gz (dump.sql.gz) is extracted, read-only folders are copied and deleted, moving no longer loses special files
  • Logs: control characters from visitor requests are not shown in lines; root always has room for a live log

1.0.2.20261103122502

  • File manager: root working in a user directory no longer follows links outside it; extraction no longer changes the owner of existing files; “Pack and delete” no longer deletes what did not get into the archive
  • Site logs are closed to other server users; large log archives and service journal entries no longer overload the panel
  • Antivirus and integrity checks no longer hang on planted files and deep directories; the quarantine has a file count limit

1.0.2.20261103115021

  • Cloudflare Tunnel: the tunnel reaches Nginx through a closed socket, so the visitor address can no longer be forged from the server itself

1.0.2.20261103102155

  • Fail2ban: text from webmail and site code can no longer slip someone else's address into the rules; the webmail log is now in the systemd journal
  • Site logs: PHP errors go to a separate “PHP - errors” log instead of the Nginx log

1.0.2.20261103085917

  • Panel administrators can no longer change the root and other administrators' accounts; root “signed in as the owner” does not change the owner's password, 2FA, keys and sign-in addresses
  • Guessing 2FA codes is also limited per account: 10 wrong codes in 15 minutes
  • A site's “Log rotation” edit is checked before saving; restarting MariaDB and Apache from “Services” no longer times out

1.0.2.20261103083826

  • Processes: a user sees only their own processes; “Services” no longer start shutdown or reboot units and do not restart wsp-root in the middle of a task
  • Security: an API key cannot change the panel protection and is revoked when the password or 2FA is reset; a 2FA “trusted browser” works only on its own network
  • Changing the server name also updates /etc/hosts, and this server's backups are no longer treated as foreign afterwards
  • Site settings: a config edit that changes addresses is applied, a failure no longer leaves Nginx or PHP stopped, address rebuilds are kept in the config history

1.0.2.20261103080758

  • Fail2ban: the “Panel login” rule can no longer be fooled by a forged name in the connection - it cannot be used to ban someone else's address; rejected Fail2ban settings no longer stay on disk
  • Users: databases and mail domains of a deleted user become free - a new user with the same name does not get them
  • Apache: user sites need the MPM-ITK variant (with Prefork all Apache sites see each other's files); wsDoctor reports existing ones
  • A read-only API key and HEAD requests no longer change anything

1.0.2.20261103004308

  • Server move: databases, zones, MySQL accounts and site directories that already exist on this server are not overwritten
  • App installer: an unsuitable database account password is refused before the install starts; a database created before a failure is visible to the site owner

1.0.2.20261103002554

  • Notifications: a panel login from a new device is sent immediately, even during quiet hours
  • Terminal: closes by itself if the browser disappeared without closing the connection
  • Cloudflare: if the SSL mode could not be changed in all zones, the zones already switched are reverted

1.0.2.20261102233024

  • Server move: site and mail files are put in place more safely, files with an unknown owner go to the site owner

1.0.2.20261102232117

  • Security: site cloning and app installation run with the site owner's rights
  • Panel login: a session works only from the network where you logged in; simultaneous login attempts from one address are queued
  • Notifications: long messages are trimmed to the Telegram and Discord limits; the night digest is not lost if there is no connection in the morning

1.0.2.20261102220052

  • Software configuration: an interrupted package install is also completed before removal, upgrade, PHP extensions and source changes
  • Notifications: after software removal and upgrade - what exactly changed; “Snooze” by root no longer hides site owners' signals

1.0.2.20261102214857

  • Software configuration: a third-party repository key is accepted only if it is the vendor's real key
  • Package sources: changing a mirror is no longer rolled back because of a broken third-party source
  • Cloudflare: new “User domains” setting - without it, domains that users added on their own are not touched in the Cloudflare account
  • Software install: “Will be removed” shows everything that will be removed

1.0.2.20261102210241

  • License: it works only on its own server, setting the clock back no longer extends it
  • Updates: the new version number and “What's new” are signed, the installer does not roll the panel back to an older version

1.0.2.20261102200916

  • Ghost update runs with the site owner's rights, the database copy is kept in a private directory
  • Software configuration: a version switch cannot be interrupted midway, two operations do not start at once, “Update” no longer breaks on a slow server

1.0.2.20261102194345

  • Backups: copies of deleted databases and sites are removed by the retention period, the last copy of each is kept

1.0.2.20261102193029

  • Visitor statistics (AWStats) are calculated as a separate user, not as root