Changelog

Every notable change, release by release. Breaking changes always come first.

Roadmap Releases feed

2.3.1

Latest

A reworked package form and FTP tab, and the app process settings of a package saved for administrators too. Servers on 2.3 take it like any patch release, and there is nothing to do.

Changed3 changes
  • The package form in sectionsThe package form is grouped into sections with links beside it, says how many users have the package, offers Copy and Delete in its head, keeps Save in view with a note about unsaved changes, and asks before leaving with changes.
  • Feature switches and limits with unitsNode.js, Docker apps and app processes have their switch in the card head, and their settings stay greyed out while it is off. Memory and CPU limits are a number with a unit or Unlimited, and reselling has its own switch with the packages to assign picked from a list.
  • The FTP tab as a tableThe FTP tab of a web domain lists the additional FTP accounts in a table with search, sorting and pages; FTP account adds one in a dialog, each row has Edit and Delete, and selected accounts are deleted together.
Fixed3 changes
  • App process settings of a packageAn administrator who changes the app process settings of a package on the package form saves them; before, only a reseller's changes were saved.
  • Field names in REST API v2REST API v2 names the fields of refused app process settings of a package as the request does (app_processes.max), not with the form's names.
  • Confirmation dialogsConfirmation dialogs leave room between their question and the buttons.

2.3.0

The firewall moves from iptables to nftables and now covers IPv6, every backup run is recorded, and REST API v2 says more about tasks. A new release line: servers do not install it by themselves. Read the notes below, then update from Server → Updates.

Security1 change
  • No spoofed own addressesThe firewall no longer accepts packets from outside that claim one of the server's own addresses; the server's traffic to itself still arrives on the loopback interface. Rotating IPv6 privacy addresses no longer make the Firewall page report changed rules after a reboot.
Added7 changes
  • IPv6 in the firewallOne nftables table, inet arcpanel, filters IPv4 and IPv6 and is replaced in one step, checked first, so a rule set nftables refuses never replaces the one that runs. A port closed in the panel is now closed over IPv6 too; rules, bans and IP lists accept IPv6 addresses and networks, the IP list page offers IPv6 country lists, and Fail2Ban bans IPv6 addresses. 0.0.0.0/0 and ::/0 mean every address of both versions; ICMPv6 neighbour discovery is always allowed.
  • Firewall status and warningsv-check-firewall and GET /api/v2/system/firewall/status tell whether the loaded rules are still the panel's and list warnings, which the Firewall page shows with a reload button: a server left on iptables, an old Fail2Ban action, the distribution's nftables.service enabled, or SSH or the panel open over IPv4 only on a server with a global IPv6 address. While a server is left on iptables, ban and chain commands refuse instead of recording bans that block nothing.
  • Custom nftables rulesdata/firewall/custom.nft holds nftables commands that load together with the panel's table.
  • Backup run historyEvery run of a tar or restic backup (nightly, from the panel or the API, or started on the server) is recorded, failed runs with their exit code and reason, the last 30 per user. v-list-user-backup-runs, v-list-sys-backup-runs and REST API v2 list them.
  • A clearer REST API v2 documentIt names the permission set of each operation, the values of a task's status, the conflicts that backups, restores and Node.js apps answer, how a Let's Encrypt request reports a failure and renews, and how app environment values are kept.
  • App process tasks in the task listThe one-off task of an app process can be followed like any other task of REST API v2.
  • Node.js app conflictsCreating a Node.js app on a domain that already has one answers 409 E_EXISTS with the path of that app.
Changed7 changes
  • Firewall on nftablesThe upgrade moves the firewall from iptables and ipset to nftables and replaces arcpanel-iptables.service with arcpanel-firewall.service; when the new rules cannot be loaded, the server keeps iptables and the upgrade warns. The arcpanel package depends on nftables, and ipset is no longer installed. A custom.sh that calls iptables still runs, but its rules cannot open ports the new table drops.
  • IP lists in useDeleting an IP list that an active rule uses is refused, and the answer names the rule.
  • "Any address"The rule list shows 0.0.0.0/0 and ::/0 as "Any address, IPv4 and IPv6", and the rule form says that both mean every address of both versions.
  • Queue retries endA queued task that fails and asks to run again, such as Let's Encrypt while DNS propagates, is retried at most 3 times by default and then fails; before, it was retried every five minutes without end. Every failed queue task carries the reason from its log.
  • Task headers as sentThe REST API v2 document declares Link on every answer that starts a task and Location only where the answer names a resource, as the panel answers.
  • A stopped firewall stays stoppedA firewall stopped on the Services page stays stopped when Fail2Ban bans an address or starts a jail; the ban is recorded and applies when the firewall starts again.
  • Where to askThe installer's closing message, on screen and by e-mail, links GitHub Discussions for questions and for showing what you host, and the issue tracker for bug reports.
Fixed3 changes
  • Recidive bansThe ban list of the panel and REST API v2 accepts the RECIDIVE chain of Fail2Ban.
  • Failed remote uploadsA backup with only remote backup hosts that fails to upload now reports the error instead of success.
  • restic 0.16 restoresRestoring a user's folders from a restic backup works with restic 0.16, which Ubuntu 24.04 ships; it stopped with "Unable to download user folders".

2.2.6

A maintenance release with no change to the panel. The installers can be told which APT channel to use. Servers take it like any patch release, and there is nothing to do.

Added1 change
  • Choose the APT channelThe installers accept ARCPANEL_APT_CHANNEL=stable or ARCPANEL_APT_CHANNEL=beta to choose the ArcPanel APT channel instead of deriving it from the version, for example to install a development build with --with-debs and take the engine packages from the stable channel. Without the variable nothing changes.

2.2.5

A maintenance release with no change to the panel: the first release published from the new storage of the package repository.

The package repository apt.arcpanel.org (and apt.arcpanel.top until 30 April 2027) is now served from new storage. The addresses and the signing key stay the same. Servers take 2.2.5 like any patch release, and there is nothing to do.

2.2.4

The project moves to arcpanel.org, and backup hosts work as they should: nightly incremental backups, SFTP keys and rclone hosts without a folder.

Changed1 change
  • New home at arcpanel.orgNew installs use the package repository apt.arcpanel.org, the panel looks up its public address at https://arcpanel.org/ip, and the packages, messages and templates link to arcpanel.org. arcpanel.top and apt.arcpanel.top keep working until 30 April 2027; to move an installed server now, change apt.arcpanel.top to apt.arcpanel.org in /etc/apt/sources.list.d/arcpanel.list.
Fixed5 changes
  • Nightly incremental backupsIncremental (restic) backups run every night after the archive backups, also on servers that keep no archive backups; before, they ran only when started by hand.
  • SFTP keys keptAn SFTP backup host set up with a private key in the panel keeps working: the key is stored root-only next to the host's settings instead of pointing at a temporary file that was deleted.
  • rclone hosts without a folderAn rclone backup host without a folder uploads archives to the root of the remote.
  • SFTP delete and remote downloadDeleting an archive on an SFTP backup host no longer prints debug output, and downloading a remote archive no longer calls a Google Drive function that does not exist.
  • Options with no choiceA list of options where nothing is chosen yet, such as the Node.js versions in "Install a version", no longer shows every option as selected.

2.2.3

Security fixes for access keys, app processes and the malware quarantine. The upgrade turns off access keys whose files were changed by hand: review them after updating.

Security6 changes
  • Access-key quarantineEvery reader of an access key refuses a key file that names a setting twice. The upgrade moves such files to data/access-keys/.quarantine/, lists them in the upgrade log and notifies the administrator; those keys stop working, so review where they were used and create new keys.
  • Plain commentsComments of access keys, firewall rules and ports accept letters, digits, spaces, dots, dashes and underscores only, and v-add-access-key refuses control characters in every argument.
  • Restricted keys stay restrictedAn access key limited to addresses or with an expiry creates, through REST API v2, only keys limited to addresses inside its own list and expiring no later than it does; through REST API v1 it creates none.
  • App process tasks within limitsOne-off tasks of an app process run in the account's resource slice with the memory, CPU and task limits of the process, and stop with every process they started when the account is suspended or deleted.
  • Ports on restoreImporting a restored app process takes back its recorded port only while the account holds fewer ports than its package allows.
  • Bounded malware quarantineQuarantining a file found by the malware scan copies only a regular file of the size the scan recorded, at most 2 MiB and for at most 30 seconds; the quarantine keeps at most 200 files and 64 MiB per user.

2.2.2

Automatic updates that stay on the installed release line, and an APT repository that keeps every version.

Changed4 changes
  • Automatic updates stay on the lineWith automatic updates on, a server installs only the patch releases of its line (2.2.x on 2.2), never a new minor or major release such as 2.3.0, which can change how the server works. When a newer line is published, the administrator gets a notification, and an e-mail with update e-mails on, and updates from Server → Updates after reading the release notes.
  • Updates at nightAutomatic updates run at a random time between 01:00 and 06:59 of the server instead of 04:41 everywhere. Their output goes to /usr/local/arcpanel/log/autoupdate.log, and a failure sends one line through the cron e-mail.
  • Clearer failed updatesA failed update of an ArcPanel package shows the output of apt-get in the task log and never waits for a question about a changed configuration file. arcpanel-web-terminal is updated with the other packages.
  • Every version keptapt.arcpanel.org keeps each published version, starting with 2.2.1, so a patch of an older line no longer replaces a newer release and an earlier version can be installed again with apt-get install arcpanel=<version>.
Fixed1 change
  • Version order on the Updates pagePackage versions are compared as versions, not as text, so 2.10 no longer looks older than 2.9.

2.2.1

Webmail and the database tools on their own ports with webmail sign-on, and arm64 packages again.

Added3 changes
  • Webmail and database tools on their own portsThe webmail client answers on port 8086 and phpMyAdmin and phpPgAdmin on port 8087 of every address of the server, with the panel certificate, so the buttons work without DNS for each mail domain and when the panel is opened by IP address. Change or turn them off under Server → Settings, through REST API v2 or with v-change-sys-webmail-port and v-change-sys-db-admin-port.
  • Webmail sign-on"Open Webmail (signed in)" on a mail account opens Roundcube without the mailbox password, for whoever may change that password. The session lasts up to 8 hours, ends when the password or the mailbox changes, and every sign-on is in the user's action log.
  • arm64 packagesStable releases publish the ArcPanel packages for arm64 again, next to amd64. Installing on arm64 is not supported yet: the installers still stop on aarch64.
Changed3 changes
  • Webmail links without SSL"Open Webmail" uses http:// while a mail domain has no SSL and the link points at webmail.<domain>, as the 1.x pages did.
  • No CSRF cookieThe panel no longer sends the XSRF-TOKEN cookie; its scripts read the token from the page.
  • Add process without web domainsThe Add process page of an account without web domains links to the Add Web Domain page.
Fixed2 changes
  • Settings changed over SSH apply at onceA change made outside the panel, for example with v-add-sys-api-ip, applies to the panel and REST API v2 at the next request instead of after up to 60 seconds.
  • Description of v2-appsThe Access keys page and GET /api/v2/access-key-sets name app processes in the description of the set.

2.2.0

REST API v2 additions for clients that operate many servers: a server identifier, key restrictions, monitoring keys, lists across users, a request journal and service logs. Every change is additive.

Added6 changes
  • Server identifierEvery server gets a random identifier at install or upgrade, kept while the machine stays the same and renewed when it is cloned. GET /api/v2/me answers it as server_id, with the expiry and allowed addresses of the calling key.
  • Monitoring keysThe permission set v2-observe is v2-read without file contents, the secret store and restic file listings, for a client that watches a server without reading files or secrets.
  • Key restrictionsAn access key can be limited to up to 20 addresses or networks and given an expiry when it is created, on the Access keys page, through the API or with v-add-access-key. Both APIs enforce them.
  • Cross-user listsWeb domains, databases, cron jobs, Node.js apps and backups of every user for administrators, or of a reseller's tree for resellers, paged, with updated_since for incremental indexing.
  • Request journalEvery REST API v2 write of a key is journaled for 7 days without its body, so a client whose answer was lost can ask what became of its request. A write keeps running when its client disconnects.
  • Service logsAdministrators read the last lines, up to 500, of a service's systemd journal through the API or with v-list-sys-service-log.
Changed1 change
  • Node.js app fieldsThe live fields of a Node.js app in REST API v2, such as status, pid and memory_mb, are documented as nullable: the cross-user list answers them as null. The per-user endpoints answer them as before.

2.1.3

Security hardening of downloads and permissions, and app processes for Laravel Octane and other long-running app servers. Rotate access keys made before 2.1.3.

Breaking3 changes
  • REST API v1 off on new installsTurn it on with "REST API v1" on the Security tab or v-change-sys-api enable v1; servers that upgrade keep their setting. REST API v2 is the supported API.
  • Reseller packages keep to the planThe shells a reseller may give come from the new setting "Shells resellers may give in their packages" (nologin by default), templates are the reseller's own, and limits with units such as 512M, 1G or 50% are compared correctly. Packages already beyond the plan keep working; the upgrade log lists them, and an edit is refused until they fit.
  • Narrower sudo for the panelarcpanelweb runs only the commands on the panel's allow-list, written to /etc/sudoers.d/arcpanelweb at install and upgrade. v-get-user-secret, v-change-sys-release, v-add-sys-arcpanel and v-update-sys-sudoers are root-only.
Added2 changes
  • App processesLong-running app servers run as the hosting user, each in its own systemd unit: they restart after a crash or a reboot, stop while the user is suspended, and survive rebuilds, backups and restores. Presets for Laravel Octane, queue workers, Horizon and the scheduler, Gunicorn, Uvicorn, Celery, Go binaries, Puma and Sidekiq, or a custom command, with logs, environment values and tasks such as composer install in the panel. Packages grant them and limit their number, memory and CPUs.
  • REST API v215 operations for app processes, in the new v2-apps permission set.
Changed1 change
  • Web terminal on fresh installsThe ticket key is written at install, so the web terminal starts after an install with --webterminal yes.
Security4 changes
  • Rotate your access keysKeys made before 2.1.3 came from a weak generator: create new keys, delete the old ones and review the keys of the root administrator. Run v-add-sys-pma-sso again to renew the phpMyAdmin single sign-on key.
  • Verified downloadsEverything fetched by the build, the installer and upgrades uses HTTPS and a pinned SHA-256, and APT keys are checked against pinned fingerprints. Engine packages are rebuilt from verified sources, rclone comes from a pinned release, and upgrades report unexpected APT keys.
  • Administrator boundariesWith read-only access for other administrators on, they can no longer change the root administrator. A suspended reseller or administrator only reads, also while acting as a customer. Only an administrator links a firewall rule to a port.
  • Stronger keys and API v1 checksAccess keys come from /dev/urandom. REST API v1 compares keys strictly, answers every authentication failure the same way and limits failed attempts per address. The phpMyAdmin single sign-on verifies the panel's certificate.
Fixed1 change
  • Setup on package upgradesAn upgrade now refreshes the command allow-list and the sudo rules, rebuilds the framework caches and sets up app processes, as a fresh install does.

2.1.2

The first published 2.1 release: it ships everything in 2.1.1 and 2.1.0 below, for amd64 only.

Fixed3 changes
  • Folder modes of new usersv-add-user sets the modes of the user's web/ and conf/ folders whatever the caller's umask; a root shell with umask 077 left them closed to the user and the web server.
  • php.ini backupsPruning the php.ini backups of a PHP version no longer parses the output of ls.
  • Ubuntu 22.04 buildThe package build installs its tools without debconf questions; the time zone question of tzdata stopped the builds of 2.1.0 and 2.1.1.

2.1.1

Not published

Drops arm64 for now. Its build did not finish, so this change ships in 2.1.2.

Breaking1 change
  • No arm64 for nowPackages are built for amd64 only, and the installer stops on an arm64 server before it changes anything. Debian 12 / 13 and Ubuntu 22.04 / 24.04 / 26.04 on amd64 stay supported.

2.1.0

Not published

Two features for PHP sites: the PHP Manager for versions, extensions, php.ini and PHP-FPM profiles, and a malware scan for PHP files. Its build did not finish, so these changes ship in 2.1.2.

Breaking3 changes
  • Old PHP versionsPHP 5.6 to 7.3 can no longer be installed; installed versions keep running and can be removed. The installer's --multiphp yes installs PHP 7.4 to 8.5.
  • Stricter PHP commandsv-add-web-php refuses versions the PHP repository does not provide. v-delete-web-php refuses a version in use or the default, and purges its extensions and php.ini backups.
  • One php.ini per versionThe shared php.ini editor is gone: v-change-sys-service-config php is refused. Edit php.ini per version and SAPI on the PHP page.
Added3 changes
  • PHP ManagerA version catalog with end-of-life dates, extensions per version, php.ini for FPM and CLI with validation and rollback, and PHP-FPM profiles chosen by the package and per web domain.
  • Malware scanAn optional plugin that scans PHP files for webshells as the hosting user, on demand and every night. Findings are reported first; quarantine, restore and ignore are manual.
  • REST API v223 operations for the PHP Manager and 11 for the malware scan, in the new v2-security permission set.
Changed3 changes
  • PHP version listVersions show their status, dates and extensions, and may have two-digit parts such as 8.10.
  • Templates by packageUsers and resellers see only the backend templates of the PHP versions their package allows.
  • Pools on upgradeUpgrades refresh unchanged pool templates; the pools of existing web domains stay the same.

The redirects of /app/ and the 1.x page paths still answer in 2.1. A later release removes them and says so here.

2.0.0

The new panel serves every page at the root URL, and the HestiaCP web interface of 1.x is gone. ArcPanel is now a hard fork with ArcPanel names throughout.

Breaking10 changes
  • Panel at the root URLPages moved from /app/… to /…. Old /app/ and 1.x paths redirect, so bookmarks keep working; a later release removes the redirects.
  • ArcPanel names everywherePaths, configuration, commands (v-*-arcpanel-*), packages, users, services and the ArcPanel-Exit-Code API header use ArcPanel names, without aliases.
  • Fresh installs onlyNo upgrade from ArcPanel 1.x or HestiaCP. Install 2.0 on a new server and move users with backups.
  • web/ removedWhat commands still use moved to lib/: Quick Install, 2FA helpers, the mail wrapper, the API script, translations and error pages.
  • White label and RRD dataWhite-label files and RRD data now live under data/; they are still served at the same URLs.
  • FileGator removedThe panel's own file manager replaces it; v-add-sys-filemanager only turns it on and off.
  • New themesThe old CSS themes are gone. THEME is now nocturne, light or auto.
  • Switches removedARCPANEL_APP_PAGES and ARCPANEL_APP_LOGIN no longer exist; there is no legacy interface to switch back to.
  • Backups and third-party toolsArchives use ./arcpanel/; HestiaCP and VestaCP archives still restore. WHMCS and Blesta modules must use the new names.
  • One version numberVERSION in arcpanel.conf is the only version; upgrade steps live in install/upgrade/versions/.
Added11 changes
  • New panelEvery page runs in the new panel, with light and dark themes and sidebar hubs that group related pages in tabs: databases, cron, DNS, mail, backups, firewall, logs, statistics, the web terminal, services and server settings.
  • ResellersA role between administrator and user: a reseller owns a tree of customers inside the limits of its own package.
  • Port registryThe administrator assigns ports to users; apps bind only the ports they were given, and public ports open the matching firewall rule.
  • Node.jsNode.js versions and global packages per user, and Node.js apps run by a per-user pm2 behind a web domain.
  • Docker appsApps from a curated catalog, every container run as the hosting user.
  • File Manager v2Every file operation runs as the user.
  • System packagesPython 3, Go, Ruby, FFmpeg, ImageMagick and build tools from the distribution archive, with runtime badges in the template picker.
  • Web templatesTemplate metadata, variables per web domain and sixteen new templates, among them Python, Go, Ruby, Laravel Octane and hardened WordPress.
  • Secret storeEncrypted secrets per user, referenced in the environments of Node.js and Docker apps instead of plain values.
  • REST API v2A new API under /api/v2/ with permission sets per key, and OpenAPI documents for API v1 and v2.
  • Log downloadDownload the last 5000 lines of a web domain log from the log page.
Changed1 change
  • Bundled dependenciesphpPgAdmin 7.14.6 and the quoteshellarg helper ship with ArcPanel; installs no longer download them from the HestiaCP organisation.
Security1 change
  • Security reviewRoot no longer follows paths that users control; login and two-factor attempts are rate limited; reset links come from the panel's configuration; a password change ends older sessions; sensitive account changes ask for the password again; the web terminal needs a short-lived signed ticket.

Base

HestiaCP 1.10.5

ArcPanel started from HestiaCP 1.10.5 and became a hard fork of it in 2.0. For changes before the fork, see the HestiaCP changelog. ArcPanel is an independent project, not affiliated with the HestiaCP project.