Jabali Panel – Open Source (GPL) Hosting Control Panel

TrK · October 20

I really didn't wanted to join this discussion but got interested in it, came across jabali a few months back, although fully AI driven i didn't disliked it for this, but it's still far from completed. Just some suggestions, Maybe support for openresty and serving the panel on plain 80/443 ports is something i would not do unless forms are protected with some captcha or some anti-bot intrusive methods. Sure the features are all handy-dandy but making it fit for production is something else entirely. Good luck nonetheless.

edmarhub · October 20

@webquestnz said:
Here is my honest opinion about Jabali.

The company I work for Webquest has been trying to find suitable hosting for sometime. The problems we were facing were high renewal costs after the first year and web admin panels that were nearly as much as the hosting. We weren't able to, for various reasons, able to pass the full cost on to our customers and at the time platforms like cPanel were hiking their subscriptions.

There were a lot of cheap alternatives on the market, based on a Google search, but most of them seemed to be no longer supported. It was only after going through pages and pages of listings on Github.com that I found Jabali. Not a Google search, not through an advertising campaign, but by searching the hard way.

The first thing I check on Github.com for any project is the Issues tab. How often are current and new issues being addressed. This is the main point for me. To my surprise all issues were being systematically addressed with the Jabali project.

Now I didn't jump in straightaway. I researched it for about a month using a VPS virtualisor running on my laptop, slowly trying it with some of our WordPress sites and some of which were not fully updated. I also tried some Django/Wagtail apps which I admittedly had a few problems with. However I found the ticket system most adequate for getting help. Sometimes it was something I had done wrong and sometimes a bug in Jabali which I reported on github Issues and it would usually be fixed within 24 hours and sometimes a bit longer. The responses I got back from the Jabali team were often quite comprehensive, often several paragraphs. I am probably one of the stress testers of the system as I run about 50 websites on it. Anyway coming in now will reap the benefit of those bug fixes.

After about a month we purchased a VPS from Hostinger which is one of those fully automated hosting platforms and installed Jabali on a VPS. Then we proceeded to move all of our sites off of DreamIT. Note that we have no grievance against DreamIT. Their support was good. However they were quite conservative about what web panels they would provide and they felt Jabali was too new.

My personal view about Jabali is that I like it more than cPanel or DirectAdmin. I like the System Status page which shows the health of the server at a glance and which user accounts are hogging resources. You can set limits for many OS resources, like CPU, on a per user basis. Something I've never had on DirectAdmin or cPanel. Some things I found a bit of a learning curve, for instance the cron works a little differently to cPanel or DirectAdmin. Nothing that turned out to be a major problem but there was a little bit of a learning curve and I think much of that came around learning Jabali's security model.

I think for me, at the start, I knew there was some risk into jumping into something new, and I am fairly conservative by nature but in the end I considered the added benefits were worth it and that month of prior testing gave me some confidence that it wouldn't be an immediate disaster.

For anyone deciding to set this up on a production system I would advise taking a server for backup before running Jabali updates, especially if from the development branch. Otherwise I have no regrets.

Hope that helps someone. 🙂

I love jabali panel, but is this you @jabali ?

webquestnz · October 20

@edmarhub said:

@webquestnz said:
Here is my honest opinion about Jabali.

I love jabali panel, but is this you @jabali ?

Nope, I am a real person. You can see I have been posting with virtually the same alias under Issues on GitHub https://github.com/shukiv/jabali-panel/issues?q=is:issue for awhile now. I just like writing essays. 🙂

Levi · October 20

@epaslv said:
I've been using Jabali for a while now and its very promising. I only have good thing to say about it. Planning to move my cpanel clients one server at a time eventually.

Are you insane? Jabali is fit only for localhost.

stable_genius · October 20

@jabali said:

@jsg said:

@jabali said:

@jsg said:

@stable_genius said:

@jabali said:

@Zyra said:
ai deluxe

Do you love Linux?
https://www.zdnet.com/article/linus-torvalds-ai-tool-maintaining-linux-code/

So what, Linus is showing signs of decadence, you should not publicize it.

It's not totally unexpected you know, not truly a shock. I could see that coming.

Wow, you worded it so politely! When I heard about torvalds utterings on ai, my first reaction was "Oops, now he seems to be in a race with greg k-h who is the more [self-censored] of the two!"

But maybe I just missed that he got a kind of ai transplant. Might actually be the next logical step for linux.

@jabali

Your panel seems to have some attractive features - but I don't care as it's ai slop, sorry.

Yeah, Linus knows nothing about programming or code. He is an AI shill now...

Tell your ai to not put words in my mouth. I did not say he knows nothing about programming.

Oh, that was me being cynical on your censored comment on Linus and Greg.
I will spare you what my AI think about your remark about Linus and Greg. (he wasn't polite like me)

Your AI does not think, be warned.

Most unpleasant remarks made about Linus and Greg are factually correct, the reason you don't see more people making unpleasant remarks on them is respect for the community and a fear of hurting it.

Linus and Greg made themselves easy targets, they are very lucky most good shooters refuse to shoot at them.

stable_genius · October 20

@jabali said:

@jsg said:

@stable_genius said:

@jabali said:

@Zyra said:
ai deluxe

Do you love Linux?
https://www.zdnet.com/article/linus-torvalds-ai-tool-maintaining-linux-code/

So what, Linus is showing signs of decadence, you should not publicize it.

It's not totally unexpected you know, not truly a shock. I could see that coming.

Wow, you worded it so politely! When I heard about torvalds utterings on ai, my first reaction was "Oops, now he seems to be in a race with greg k-h who is the more [self-censored] of the two!"

But maybe I just missed that he got a kind of ai transplant. Might actually be the next logical step for linux.

@jabali

Your panel seems to have some attractive features - but I don't care as it's ai slop, sorry.

Yeah, Linus knows nothing about programming or code. He is an AI shill now...

Can you give us some insights on why AI code is bad?

AI code is supposed to be used internally, it is not to be distributed to the public at large under illegal licensing terms.

stable_genius · October 20

Since many people here find real merit in your panel you could publish the panel specifications and license them in a GPL friendly way.

Publishing its code under an illegal license makes no sense but publishing its specifications under good licensing terms makes a lot of sense.

Since your panel relies so heavily on AI it would have to be AI oriented specifications not those old fashioned specs we got used to in the past. I can't see anyone doing that, you could be on of the first.

mp11 · October 20

Cool logo and nice name, looks good so far, keep on

jsg · October 20

@jabali said:
You should have read the thread, it was a cynical remake I made for someone said that Linus is [censored] for using AI and showing signs of decadence along with Greg.
I love AI and I think it's a great power tool in the developer arsenal. I don't think any of the critics of AI here can write half as good as any AI.

I think the slop in software dev is where people with no development background create a software with tons of bugs and never bother to maintain it. Which makes bad softwares flood.
But if you know what you are doing, and keep up with the bug fix, it can not considered as a slop.

Unsurprisingly you "think" wrong. I do have decades of real, even formal software development in real languages from ASM to Ada under the belt (as opposed to a few scripting languages *wink wink nudge nudge).

In other words, I stand on a solid basis and actually am able to think analytically, in particular re hardware, software development, and electronics.

As for ai I have reached my view based on that experience, real thinking, and as well on the views of engineers who actually work in that field.

Reality is that many researchers in that field are (based on my impression) desperately searching for what's needed for thinking and the best approach they currently bet on is to find out what's the basis neurologically and hoping that some day they might be able to somehow implement that in some kind of a chip.

TL;DR: ai can NOT think yet and might never be able to think. It barely fakes "thinking".

Add the factor finances to it and it should become clear that it never will be able to think, simply because the whole circus will stop sooner rather than later (highly likely with horrible economic consequences for whole countries and regions, And there is even more in that box of Pandora ...)

epaslv · October 20

@webquestnz said: Here is my honest opinion about Jabali.

Nice insight!

epaslv · October 20

@Levi said: Are you insane? Jabali is fit only for localhost.

I don't think so but thanks for your opinion.

fredo1664 · October 20

@epaslv said:

@Levi said: Are you insane? Jabali is fit only for localhost.

I don't think so but thanks for your opinion.

Wrong account?

jabali · October 20

@edmarhub said:

@webquestnz said:
Here is my honest opinion about Jabali.

The company I work for Webquest has been trying to find suitable hosting for sometime. The problems we were facing were high renewal costs after the first year and web admin panels that were nearly as much as the hosting. We weren't able to, for various reasons, able to pass the full cost on to our customers and at the time platforms like cPanel were hiking their subscriptions.

There were a lot of cheap alternatives on the market, based on a Google search, but most of them seemed to be no longer supported. It was only after going through pages and pages of listings on Github.com that I found Jabali. Not a Google search, not through an advertising campaign, but by searching the hard way.

The first thing I check on Github.com for any project is the Issues tab. How often are current and new issues being addressed. This is the main point for me. To my surprise all issues were being systematically addressed with the Jabali project.

Now I didn't jump in straightaway. I researched it for about a month using a VPS virtualisor running on my laptop, slowly trying it with some of our WordPress sites and some of which were not fully updated. I also tried some Django/Wagtail apps which I admittedly had a few problems with. However I found the ticket system most adequate for getting help. Sometimes it was something I had done wrong and sometimes a bug in Jabali which I reported on github Issues and it would usually be fixed within 24 hours and sometimes a bit longer. The responses I got back from the Jabali team were often quite comprehensive, often several paragraphs. I am probably one of the stress testers of the system as I run about 50 websites on it. Anyway coming in now will reap the benefit of those bug fixes.

After about a month we purchased a VPS from Hostinger which is one of those fully automated hosting platforms and installed Jabali on a VPS. Then we proceeded to move all of our sites off of DreamIT. Note that we have no grievance against DreamIT. Their support was good. However they were quite conservative about what web panels they would provide and they felt Jabali was too new.

My personal view about Jabali is that I like it more than cPanel or DirectAdmin. I like the System Status page which shows the health of the server at a glance and which user accounts are hogging resources. You can set limits for many OS resources, like CPU, on a per user basis. Something I've never had on DirectAdmin or cPanel. Some things I found a bit of a learning curve, for instance the cron works a little differently to cPanel or DirectAdmin. Nothing that turned out to be a major problem but there was a little bit of a learning curve and I think much of that came around learning Jabali's security model.

I think for me, at the start, I knew there was some risk into jumping into something new, and I am fairly conservative by nature but in the end I considered the added benefits were worth it and that month of prior testing gave me some confidence that it wouldn't be an immediate disaster.

For anyone deciding to set this up on a production system I would advise taking a server for backup before running Jabali updates, especially if from the development branch. Otherwise I have no regrets.

Hope that helps someone. 🙂

I love jabali panel, but is this you @jabali ?

Thank you for loving Jabali, but really dude? Are you serious to think that? You did not even opened Jabali's github page I assume.

https://github.com/shukiv/jabali-panel/issues?q=is:issue+state:closed+author:webquest-nz
Webquest has been a long time user of Jabali panel. Along with a few others, and new ones are coming every day now.

To be honest, this whole thread, I feel like I am in a kindergarten, not a technical forum. All of you should be ashamed of yourself on trying to gang-bang and bully me for just offering my panel ( for free ) for you to use. You don't like it? Don't like AI? Just keep scrolling. This attitude shows more about yourself and less about me, it shows how less of a technical person you really are.

I still haven't read a single real criticism about Jabali from this 3 pages long thread. All this AI whining is so stupid and is not productive.

This conversation is over for me. You have a question? Open a ticket: https://github.com/shukiv/jabali-panel/issues/

jabali · October 20

@ScreenReader said:
initially i don't really interested for yet another slop project but after seeing Debian 13, Go and AGPL-v3 i decided to stop by. interesting feature for isolation & hardening btw. questions;

is isolation solely rely on default docker runtime or it's using something more hardened like gVisor?

i saw crowdsec but the default / freebies blocklist are pretty inadequate, any plans for supporting extra blocklist like crowdsec-blocklist-import ?

it seems i can't figure out where to see the web domains statistic, like information how much hit has been landed into each domain. if there's IP DB can also visualize / breakdown the access per country estimate. is this not available yet?

do you check your updates are signed & verified that it's actually from you?

any plan for nodejs app support?, i have quite few usage for wordpress as backend then something-js for frontend

what will happen if a client with certain domain exceed their bandwidth usage in their package, if it's suspended, do they really get a suspended page?

seeing a nginx template is tempting to have feature nginx-ultimate-bad-bot-blocker or maybe there's already a similar mechanism in the panel?

Oh, finally a technical question! I don't know how I missed that.

Thanks! Great questions!

Docker isolation: it's standard Docker (runc), no gVisor. Apps installed by users get extra hardening:

container root isn't root on the host (userns-remap);
all capabilities are dropped, and containers can't gain new privileges;
pids, CPU and memory limits apply inside the user's own slice;
privileged mode and custom security options are blocked;
ports listen on localhost only, behind nginx.
Apps the admin installs are trusted and only get CPU and memory limits.

CrowdSec blocklists: today you get the CrowdSec community blocklist, plus the HTTP, WordPress, SSH and MySQL scenarios and AppSec (virtual patching + CRS). There's no built-in import of extra lists yet. Running crowdsec-blocklist-import on the server yourself should work, since the same bouncers enforce its decisions, but we haven't tested it. Noted as a feature request.
Domain statistics: Logs & Statistics > Domains > Real Time opens a GoAccess report per domain (hits, visitors, top pages, status codes). The domain list also shows 30-day bandwidth. A per-country breakdown isn't there yet.
Signed updates: today the install and updates come over HTTPS from our GitHub repo, and release tarballs are checked against a SHA-256 checksum. Signature verification (minisign) is built into the updater, but releases aren't signed yet. That's being worked on.
Node.js: there's no Node app runtime yet. Python apps exist, and the same design can be extended to Node. For headless WordPress with a JS frontend, a static build (SSG/export) works today as plain files. A Node server can run in Docker and be connected with a "reverse proxy" domain. Noted.
Bandwidth over the limit: at 80% and 100% you get an alert. Automatic suspension is optional, under Server Settings > Storage. When it kicks in, all of the user's sites show a "Site Disabled" page, and they come back on their own once usage drops below 80%. Email keeps working.
Bad bots: CrowdSec already catches bad user agents, crawlers and probing. There's also an optional bot challenge (proof-of-work) per domain. There's no UA blocklist like nginx-ultimate-bad-bot-blocker, but an admin can add per-domain nginx rules such as if ($http_user_agent ~* "badbot") { return 403; }.

stable_genius · October 20

@jabali said:

@edmarhub said:

@webquestnz said:
Here is my honest opinion about Jabali.

The company I work for Webquest has been trying to find suitable hosting for sometime. The problems we were facing were high renewal costs after the first year and web admin panels that were nearly as much as the hosting. We weren't able to, for various reasons, able to pass the full cost on to our customers and at the time platforms like cPanel were hiking their subscriptions.

There were a lot of cheap alternatives on the market, based on a Google search, but most of them seemed to be no longer supported. It was only after going through pages and pages of listings on Github.com that I found Jabali. Not a Google search, not through an advertising campaign, but by searching the hard way.

The first thing I check on Github.com for any project is the Issues tab. How often are current and new issues being addressed. This is the main point for me. To my surprise all issues were being systematically addressed with the Jabali project.

Now I didn't jump in straightaway. I researched it for about a month using a VPS virtualisor running on my laptop, slowly trying it with some of our WordPress sites and some of which were not fully updated. I also tried some Django/Wagtail apps which I admittedly had a few problems with. However I found the ticket system most adequate for getting help. Sometimes it was something I had done wrong and sometimes a bug in Jabali which I reported on github Issues and it would usually be fixed within 24 hours and sometimes a bit longer. The responses I got back from the Jabali team were often quite comprehensive, often several paragraphs. I am probably one of the stress testers of the system as I run about 50 websites on it. Anyway coming in now will reap the benefit of those bug fixes.

After about a month we purchased a VPS from Hostinger which is one of those fully automated hosting platforms and installed Jabali on a VPS. Then we proceeded to move all of our sites off of DreamIT. Note that we have no grievance against DreamIT. Their suppoNot anymore, now the little guy can have that too. These are GREAT TIMES indeed!rt was good. However they were quite conservative about what web panels they would provide and they felt Jabali was too new.

My personal view about Jabali is that I like it more than cPanel or DirectAdmin. I like the System Status page which shows the health of the server at a glance and which user accounts are hogging resources. You can set limits for many OS resources, like CPU, on a per user basis. Something I've never had on DirectAdmin or cPanel. Some things I found a bit of a learning curve, for instance the cron works a little differently to cPanel or DirectAdmin. Nothing that turned out to be a major problem but there was a little bit of a learning curve and I think much of that came around learning Jabali's security model.

I think for me, at the start, I knew there was some risk into jumping into something new, and I am fairly conservative by nature but in the end I considered the added benefits were worth it and that month of prior testing gave me some confidence that it wouldn't be an immediate disaster.

For anyone deciding to set this up on a production system I would advise taking a server for backup before running Jabali updates, especially if from the development branch. Otherwise I have no regrets.

Hope that helps someone. 🙂

I love jabali panel, but is this you @jabali ?

Thank you for loving Jabali, but really dude? Are you serious to think that? You did not even opened Jabali's github page I assume.

https://github.com/shukiv/jabali-panel/issues?q=is:issue+state:closed+author:webquest-nz
Webquest has been a long time user of Jabali panel. Along with a few others, and new ones are coming every day now.

To be honest, this whole thread, I feel like I am in a kindergarten, not a technical forum. All of you should be ashamed of yourself on trying to gang-bang and bully me for just offering my panel ( for free ) for you to use. You don't like it? Don't like AI? Just keep scrolling. This attitude shows more about yourself and less about me, it shows how less of a technical person you really are.

I still haven't read a single real criticism about Jabali from this 3 pages long thread. All this AI whining is so stupid and is not productive.

This conversation is over for me. You have a question? Open a ticket: https://github.com/shukiv/jabali-panel/issues/

That's the typical response a child would give, your intellectual maturity is close to zero

You are the child here

We're tired of your tantrums, Good riddance!

stable_genius · October 20

You publish a repo filled with machine generated code under a license that only applies to source code.

What you are doing has a name, it's called "license laundering" and it has a consequence: open-source contamination. Heckuva job jabali!!!

You have no idea what you're doing, your intellectual maturity is dangerously close to zero.

redhattom · October 20

good

jabali · October 20

@stable_genius said:
You publish a repo filled with machine generated code under a license that only applies to source code.

What you are doing has a name, it's called "license laundering" and it has a consequence: open-source contamination. Heckuva job jabali!!!

You have no idea what you're doing, your intellectual maturity is dangerously close to zero.

Dude, didn't you said you have better things to do? How about concentrating on them?

stable_genius · October 20

@jabali said:

@stable_genius said:
You publish a repo filled with machine generated code under a license that only applies to source code.

What you are doing has a name, it's called "license laundering" and it has a consequence: open-source contamination. Heckuva job jabali!!!

You have no idea what you're doing, your intellectual maturity is dangerously close to zero.

Dude, didn't you said you have better things to do? How about concentrating on them?

Fighting license laundering and source code contamination is among the best things one can do.

jabali · October 20

ROFL!!!

jsg · October 20

@jabali said:

@stable_genius said:
You publish a repo filled with machine generated code under a license that only applies to source code.

What you are doing has a name, it's called "license laundering" and it has a consequence: open-source contamination. Heckuva job jabali!!!

You have no idea what you're doing, your intellectual maturity is dangerously close to zero.

Dude, didn't you said you have better things to do? How about concentrating on them?

Oopsie. A while ago ...

@jabali said:
...
This conversation is over for me. You have a question? Open a ticket: https://github.com/shukiv/jabali-panel/issues/

stable_genius · October 20

@jabali said:
ROFL!!!

Roll as much as you like, have fun

Alyx · October 20

@stable_genius said:

@jabali said:
ROFL!!!

Roll as much as you like, have fun

Not sure if doxing is allowed here 🤔

jabali · October 20

@TrK said:
I really didn't wanted to join this discussion but got interested in it, came across jabali a few months back, although fully AI driven i didn't disliked it for this, but it's still far from completed. Just some suggestions, Maybe support for openresty and serving the panel on plain 80/443 ports is something i would not do unless forms are protected with some captcha or some anti-bot intrusive methods. Sure the features are all handy-dandy but making it fit for production is something else entirely. Good luck nonetheless.

Thanks for taking a look, and fair points.

Just to clarify, the panel doesn't run on 80/443. It's on its own port (8443), with per-IP rate limits on login, CrowdSec bans for repeated attempts, and 2FA (authenticator app, security keys, passkeys). There's no captcha yet; good suggestion, it's noted.

OpenResty isn't needed for the CrowdSec bouncer, since we use Debian's nginx with the Lua module.

And agreed, production-ready is the real bar. I am working toward it with monthly stable releases. Thanks!

edideaur · October 20

W slops gang

stable_genius · October 20

@jabali said:

@TrK said:
I really didn't wanted to join this discussion but got interested in it, came across jabali a few months back, although fully AI driven i didn't disliked it for this, but it's still far from completed. Just some suggestions, Maybe support for openresty and serving the panel on plain 80/443 ports is something i would not do unless forms are protected with some captcha or some anti-bot intrusive methods. Sure the features are all handy-dandy but making it fit for production is something else entirely. Good luck nonetheless.

Thanks for taking a look, and fair points.

Just to clarify, the panel doesn't run on 80/443. It's on its own port (8443), with per-IP rate limits on login, CrowdSec bans for repeated attempts, and 2FA (authenticator app, security keys, passkeys). There's no captcha yet; good suggestion, it's noted.

OpenResty isn't needed for the CrowdSec bouncer, since we use Debian's nginx with the Lua module.

And agreed, production-ready is the real bar. I am working toward it with monthly stable releases. Thanks!

You are not releasing source code, you are releasing compiled machine code. AI takes your prompts and "compiles" them into machine code while mixing it with source code it found on the web. It's an amalgamation.

Dart is a language that can be compiled into JavaScript, that JavaScript is not source code, it is compiled machine code. Haxe compiles to several languages (C++, JS, PHP, Java, C#, Python and others) the code it generates is not source code either it is compiled machine code.

Your repos contain a mixture of compiled machine code with code that was copied from the web, it is NOT source code.

The prompts you gave to AI are the source code you authored, those should be your true releases.

jsg · October 20

@stable_genius said:

@jabali said:

@TrK said:
I really didn't wanted to join this discussion but got interested in it, came across jabali a few months back, although fully AI driven i didn't disliked it for this, but it's still far from completed. Just some suggestions, Maybe support for openresty and serving the panel on plain 80/443 ports is something i would not do unless forms are protected with some captcha or some anti-bot intrusive methods. Sure the features are all handy-dandy but making it fit for production is something else entirely. Good luck nonetheless.

Thanks for taking a look, and fair points.

Just to clarify, the panel doesn't run on 80/443. It's on its own port (8443), with per-IP rate limits on login, CrowdSec bans for repeated attempts, and 2FA (authenticator app, security keys, passkeys). There's no captcha yet; good suggestion, it's noted.

OpenResty isn't needed for the CrowdSec bouncer, since we use Debian's nginx with the Lua module.

And agreed, production-ready is the real bar. I am working toward it with monthly stable releases. Thanks!

You are not releasing source code, you are releasing compiled machine code. AI takes your prompts and "compiles" them into machine code while mixing it with source code it found on the web. It's an amalgamation.

Dart is a language that can be compiled into JavaScript, that JavaScript is not source code, it is compiled machine code. Haxe compiles to several languages (C++, JS, PHP, Java, C#, Python and others) the code it generates is not source code either it is compiled machine code.

Your repos contain a mixture of compiled machine code with code that was copied from the web, it is NOT source code.

The prompts you gave to AI are the source code you authored, those should be your true releases.

Arrgh! You might have put an idea in their heads there! Soon we might get lots of repos with but ai prompts ...

stable_genius · October 20

Your panel code looks opaque and hard to audit, how can we be sure it will not be used as part of a spyware operation? There's a tradition of spying in Israel, can you assure us that your panel is and will always be free from spyware?

ScreenReader · October 21

@jabali said:

@ScreenReader said:
initially i don't really interested for yet another slop project but after seeing Debian 13, Go and AGPL-v3 i decided to stop by. interesting feature for isolation & hardening btw. questions;

is isolation solely rely on default docker runtime or it's using something more hardened like gVisor?

i saw crowdsec but the default / freebies blocklist are pretty inadequate, any plans for supporting extra blocklist like crowdsec-blocklist-import ?

it seems i can't figure out where to see the web domains statistic, like information how much hit has been landed into each domain. if there's IP DB can also visualize / breakdown the access per country estimate. is this not available yet?

do you check your updates are signed & verified that it's actually from you?

any plan for nodejs app support?, i have quite few usage for wordpress as backend then something-js for frontend

what will happen if a client with certain domain exceed their bandwidth usage in their package, if it's suspended, do they really get a suspended page?

seeing a nginx template is tempting to have feature nginx-ultimate-bad-bot-blocker or maybe there's already a similar mechanism in the panel?

Oh, finally a technical question! I don't know how I missed that.

Thanks! Great questions!

Docker isolation: it's standard Docker (runc), no gVisor. Apps installed by users get extra hardening:

container root isn't root on the host (userns-remap);

all capabilities are dropped, and containers can't gain new privileges;

pids, CPU and memory limits apply inside the user's own slice;

privileged mode and custom security options are blocked;

ports listen on localhost only, behind nginx.
Apps the admin installs are trusted and only get CPU and memory limits.

CrowdSec blocklists: today you get the CrowdSec community blocklist, plus the HTTP, WordPress, SSH and MySQL scenarios and AppSec (virtual patching + CRS). There's no built-in import of extra lists yet. Running crowdsec-blocklist-import on the server yourself should work, since the same bouncers enforce its decisions, but we haven't tested it. Noted as a feature request.

Domain statistics: Logs & Statistics > Domains > Real Time opens a GoAccess report per domain (hits, visitors, top pages, status codes). The domain list also shows 30-day bandwidth. A per-country breakdown isn't there yet.

Signed updates: today the install and updates come over HTTPS from our GitHub repo, and release tarballs are checked against a SHA-256 checksum. Signature verification (minisign) is built into the updater, but releases aren't signed yet. That's being worked on.

Node.js: there's no Node app runtime yet. Python apps exist, and the same design can be extended to Node. For headless WordPress with a JS frontend, a static build (SSG/export) works today as plain files. A Node server can run in Docker and be connected with a "reverse proxy" domain. Noted.

Bandwidth over the limit: at 80% and 100% you get an alert. Automatic suspension is optional, under Server Settings > Storage. When it kicks in, all of the user's sites show a "Site Disabled" page, and they come back on their own once usage drops below 80%. Email keeps working.

Bad bots: CrowdSec already catches bad user agents, crawlers and probing. There's also an optional bot challenge (proof-of-work) per domain. There's no UA blocklist like nginx-ultimate-bad-bot-blocker, but an admin can add per-domain nginx rules such as if ($http_user_agent ~* "badbot") { return 403; }.

thanks, those are some cool details. as for crowdsec proof-of-work i'm going to try it myself. i ran several websites where they're actually profitable from people paying me for services but the ads income from blog section is nuked to oblivion from bogus visitor (just one hit then cycles IP, so ratelimit doesn't really works). i'm not really fond of putting sites behind cloudflare so that's something worth a try.

one more question perhaps: do you have something in the ci pipeline to detect supply-chain attack? (something similar like semgrep ci, iirc the dependency scanning also available for free)

oh also a little advice from someone spends embarassing amount of time in mongolian basket weaving image board: don't feed the troll.

jabali · October 21

@ScreenReader said:

@jabali said:

@ScreenReader said:
initially i don't really interested for yet another slop project but after seeing Debian 13, Go and AGPL-v3 i decided to stop by. interesting feature for isolation & hardening btw. questions;

is isolation solely rely on default docker runtime or it's using something more hardened like gVisor?

i saw crowdsec but the default / freebies blocklist are pretty inadequate, any plans for supporting extra blocklist like crowdsec-blocklist-import ?

it seems i can't figure out where to see the web domains statistic, like information how much hit has been landed into each domain. if there's IP DB can also visualize / breakdown the access per country estimate. is this not available yet?

do you check your updates are signed & verified that it's actually from you?

any plan for nodejs app support?, i have quite few usage for wordpress as backend then something-js for frontend

what will happen if a client with certain domain exceed their bandwidth usage in their package, if it's suspended, do they really get a suspended page?

seeing a nginx template is tempting to have feature nginx-ultimate-bad-bot-blocker or maybe there's already a similar mechanism in the panel?

Oh, finally a technical question! I don't know how I missed that.

Thanks! Great questions!

Docker isolation: it's standard Docker (runc), no gVisor. Apps installed by users get extra hardening:

container root isn't root on the host (userns-remap);

all capabilities are dropped, and containers can't gain new privileges;

pids, CPU and memory limits apply inside the user's own slice;

privileged mode and custom security options are blocked;

ports listen on localhost only, behind nginx.
Apps the admin installs are trusted and only get CPU and memory limits.

CrowdSec blocklists: today you get the CrowdSec community blocklist, plus the HTTP, WordPress, SSH and MySQL scenarios and AppSec (virtual patching + CRS). There's no built-in import of extra lists yet. Running crowdsec-blocklist-import on the server yourself should work, since the same bouncers enforce its decisions, but we haven't tested it. Noted as a feature request.

Domain statistics: Logs & Statistics > Domains > Real Time opens a GoAccess report per domain (hits, visitors, top pages, status codes). The domain list also shows 30-day bandwidth. A per-country breakdown isn't there yet.

Signed updates: today the install and updates come over HTTPS from our GitHub repo, and release tarballs are checked against a SHA-256 checksum. Signature verification (minisign) is built into the updater, but releases aren't signed yet. That's being worked on.

Node.js: there's no Node app runtime yet. Python apps exist, and the same design can be extended to Node. For headless WordPress with a JS frontend, a static build (SSG/export) works today as plain files. A Node server can run in Docker and be connected with a "reverse proxy" domain. Noted.

Bandwidth over the limit: at 80% and 100% you get an alert. Automatic suspension is optional, under Server Settings > Storage. When it kicks in, all of the user's sites show a "Site Disabled" page, and they come back on their own once usage drops below 80%. Email keeps working.

Bad bots: CrowdSec already catches bad user agents, crawlers and probing. There's also an optional bot challenge (proof-of-work) per domain. There's no UA blocklist like nginx-ultimate-bad-bot-blocker, but an admin can add per-domain nginx rules such as if ($http_user_agent ~* "badbot") { return 403; }.

thanks, those are some cool details. as for crowdsec proof-of-work i'm going to try it myself. i ran several websites where they're actually profitable from people paying me for services but the ads income from blog section is nuked to oblivion from bogus visitor (just one hit then cycles IP, so ratelimit doesn't really works). i'm not really fond of putting sites behind cloudflare so that's something worth a try.

one more question perhaps: do you have something in the ci pipeline to detect supply-chain attack? (something similar like semgrep ci, iirc the dependency scanning also available for free)

oh also a little advice from someone spends embarassing amount of time in mongolian basket weaving image board: don't feed the troll.

Proof-of-work sounds like a good fit for that kind of traffic, since IP cycling doesn't get around it. Let us know how it works for you.

On CI: partly. I run govulncheck on every push and PR, and npm audit nightly (which mostly fails lol). GitHub Actions are pinned to exact commits, installs use the lockfiles, and third-party downloads in the installer are checked against pinned SHA-256 checksums. Those scans only report for now and don't fail the build, and I don't have Semgrep/CodeQL-style code scanning or secret scanning yet. Good suggestion! noted! Thanks!

I couldn't care less about these guys and I have stopped answering them long ago. It seems like they have no job and nothing better to do. I am a busy man, and I do not waste my time answering to losers. But thanks for the tip.

Howdy, Stranger!

Categories

In this Discussion

Jabali Panel – Open Source (GPL) Hosting Control Panel

Comments

You are the child here

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Jabali Panel – Open Source (GPL) Hosting Control Panel

Comments

You are the child here