[WebDeck 2.0] Free hosting control panel - isolation built in - Love feed back

VM6 · July 13

I run VM6 Networks. Got fed up watching my cPanel bill climb every time I won a customer, then being told I needed CloudLinux on top just to stop tenants reading each other's files. So I built my own panel.

It's called WebDeck. The free tier is a proper panel, not a demo.

Free tier

2 hosting accounts, 4 websites, and every single feature:

Account isolation and resource limits
All 48 one click apps
Free SSL, plus a free hostname with a trusted cert out of the box
DNS, mail, backups
WordPress manager
cPanel importer
Self healing
Updates and security patches

Nothing is crippled or held back. If 2 accounts and 4 sites suits you and no reseller features, keep it free forever and I'm happy.

Pro - £12/mo per server

Unlimited accounts, unlimited websites, resellers, white labelling, WHMCS module.

Flat fee. Host 10 accounts or 10,000, it's still £12.

Free for VM6 clients, licensed by IP, nothing to enter.

What's actually different

Isolation, built in and free. Every account is confined to its own site's files. Can't see other customers, can't hog the box. No CloudLinux licence needed.

I'll be straight though: this isn't CageFS. CloudLinux goes further and has years more hardening. Big host with hostile tenants, they earn their money. But for the tenant separation that matters day to day, WebDeck does it, and it's in the box rather than a second monthly bill.

Pick your own stack. LAMP, LNMP or LOMP. Apache, nginx or OpenLiteSpeed, same panel and same features either way. And you can switch a running server between them without rebuilding it. Most panels decide that for you.

It fixes itself. If a vhost goes missing, a cert's about to expire, a service dies or a config drifts, the panel notices, repairs it, and tells you what it fixed. You don't find out from a customer at 2am.

What's in it

Your choice of stack - LAMP, LNMP or LOMP. Apache, nginx or OpenLiteSpeed, same panel, same features either way. And you can switch a running server between them without rebuilding it. Most panels lock you to whatever they were built around.

Self healing - if a vhost goes missing, a cert's about to expire, a service dies or a config drifts, the panel notices, fixes it, and tells you what it fixed. You don't find out from a customer.

Isolation - every SFTP/SSH account confined to its own site's files. Can't see other customers, can't hog the box. Resource limits per account, optional process cage. No CloudLinux needed.

Websites - unlimited domains, subdomains and parked domains. Per site PHP version. Redirects, directory privacy, custom error pages.

One click apps - 48 of them. WordPress, Joomla, Drupal, Ghost, phpBB, Flarum, Moodle, Nextcloud, Matomo, Mautic, EspoCRM, PrestaShop, Magento, WHMCS, LimeSurvey and the rest.

WordPress manager - install, update core, plugins and themes, manage users, search and replace. Without touching wp-admin.

Email that lands - Postfix and Dovecot with SPF, DKIM and DMARC set up properly, reverse DNS sorted, autodiscover and autoconfig published. Mail relay support if you'd rather send through someone else.

DNS - authoritative PowerDNS with your own nameservers, full record editing. Or point a domain at external DNS if you'd rather.

SSL - Let's Encrypt with auto renewal, and a free hostname with a trusted cert the moment you install. No browser warning on your panel from minute one.

Databases - MariaDB with phpMyAdmin, single sign on.

Backups - local and remote, restic and rclone, scheduled. With a test restore button that actually proves they work.

PHP - multiple versions side by side, 65 modules toggled per site, ionCube, per site FPM pools.

Resellers - four roles, real quotas with overselling protection, and branding that cascades so your reseller's customers see your reseller's brand, not yours.

White label - your name, your logo, your colours, throughout the whole panel. Not a paid extra.

WHMCS module - sell hosting and resellers with automatic provisioning.

Migration - point the cPanel importer at a cpmove archive and it recreates the account properly. Sites, databases, email, DNS, cron.

Logs in the panel - live Apache, MariaDB, PHP, mail, DNS and FTP. No SSH needed.

Security - 2FA, fail2ban, firewall management, API keys, audit log.

Runs on

Debian, Ubuntu, Rocky, AlmaLinux. One command, six step wizard, running in minutes.

What I want from you

2.0 is new. Tested across all four distros and stable on my boxes, but it hasn't got a year of production behind it and I'd rather you knew that than found out.

Give it a go on a spare box and tell me what you think:

Bugs. Anything, however small. I fix fast, usually in the next release.
What's missing. I'd rather build what people actually want.
What's annoying. Six clicks where there should be two, bad wording, anything that made you sigh.
The pricing. Is £12 right? Are the free limits sensible? Tell me if I've got it wrong.

Links

Download: https://www.webdeckpanel.co.uk/downloads
Features: https://www.webdeckpanel.co.uk/features
Docs: https://www.webdeckpanel.co.uk/docs

Ask anything in the thread and I'll answer!

If it's broken I want to know!

Rob
VM6 Networks Ltd (Company No. 16553775)

AnthonySmith · July 13

Pretty cool, well done.

The cPanel importer is a good move.

VM6 · July 13

@AnthonySmith said:
Pretty cool, well done.

The cPanel importer is a good move.

Cheers Anthony, appreciate that.
The importer was the bit I most wanted to get right, because a half-import that leaves you fixing things for a week is worse than not migrating at all. It'll pull straight from the old server too if your rather not faff with cpmove archives.

DrNutella · July 14

Thanks for sharing. Can you tell us what you think about the security and how you test it?

aphs · July 14

This looks very vibe coded.

The shared hostname system alredy bring up nuermous alarm bells. I looked in the certificate transparency and did not find a single test certificate, and the request and python file specifies 'shared wlidcard download from the server'

You must never do this if it is actually a single shared certificate
Anybody with the key can revoke the certificate for everyone globally, instantly
wd-server-Domain should be in Public Suffix list, or cookies/storage/etc are shared for all subdomains no matter who owns
at Best what you should be doing is brokering a dynamic DNS endpoint that you assign the A / AAAA record to, then the server msleeps nntil it Resolves and then you must do the request from let's encrypt on the server running the panel itself. At no point should you ever hold Private-key in mum's ship
Oh my god do not ever use a single wlidcard shared with numerous servers outside your control for any reason

aphs · July 14

Self updates are not signed. Even the hashing sha256 (which is not security, its just meant to ensure the whole file has downloaded) is optional andandanif it doesn't have a hash it doesn't check the hash.

Signed updates are mandatory and not negotiable.

What on earth is thiss xor encryption, air quotes

Almost everything in panel swallows all Exception with a conitnue or pass and don't actually handnel any. This suppresses so much you can't tell if your POST falied due to a cert error, timeout, dns, etc

Secrets are by default weak and if a 'user hasnt changed' default is set the app should refuse to start

Neat321 · July 14

Yet another vibe coded slop?

VM6 · July 14

@aphs said:
This looks very vibe coded.

The shared hostname system alredy bring up nuermous alarm bells. I looked in the certificate transparency and did not find a single test certificate, and the request and python file specifies 'shared wlidcard download from the server'

You must never do this if it is actually a single shared certificate

Anybody with the key can revoke the certificate for everyone globally, instantly

wd-server-Domain should be in Public Suffix list, or cookies/storage/etc are shared for all subdomains no matter who owns

at Best what you should be doing is brokering a dynamic DNS endpoint that you assign the A / AAAA record to, then the server msleeps nntil it Resolves and then you must do the request from let's encrypt on the server running the panel itself. At no point should you ever hold Private-key in mum's ship

Oh my god do not ever use a single wlidcard shared with numerous servers outside your control for any reason

Your spot on with all of it and I thank you for taking a look.

The wildcard cert. Yeah, you got me. Honestly I'd been using that shared setup privately for so long I stopped seeing it for what it was, and you're right, it's a real hole. Fixed now: each server gets its own cert via dns-01, private key generated on the box and never leaves it.

The XOR thing. is the most embarrassing. That was me throwing something quick together while I was getting phpMyAdmin SSO working, meaning to come back and do it properly, and then completely forgetting it was still in there. Those passwords have to be recoverable for SSO so I can't just hash them, but that's no excuse for leaving XOR in. It's proper authenticated encryption now, keyed per install.

Unsigned updates. No excuse on this one. SHA256 is integrity not authenticity. Ed25519 signed now, panel refuses anything unsigned.

On the cookie point, the panel uses per-origin sessionStorage and bearer tokens rather than cookies, so there's no shared cookie to leak, but you're right that the domain should be on the Public Suffix List regardless and I'm submitting it.

Swallowed exceptions. The network ones log the actual reason now instead of eating it.

Thanks again for taking the time to actually read the code its much appreciated