EcliPanel

Delete code instances and introduce ballooning to KVM egg!
Docs, better session handle (frontend)

Nutshell small update that introduced docs and better session handling for frontend, also removed unused stuff that was broken like code instances and also modified KVM egg to have ballooning!
I also fixed display bug with CPU usage..

Changelog

• Invites fix, tunnels stuff, translation
• Fix perms to create api keys as admin following translation fix.
• Shared rescources banner/notice.
• Screw it, no android or ios.
• Add tunnels ports to plan, fix ci.
• Update packages.
• Add our beloved electron
• CI + Fix unlimited spec.
• Potential fix for pull request finding ‘CodeQL / DOM text reinterpreted as HTML’
• Fix server handler.
• Potential fix for code scanning alert no. 44: DOM text reinterpreted as HTML
• Enhance app packaging and server resource management

In this update I tried to pack EcliPanel to webview app for android and iOS but I crashed out.
This also includes merge of contributors PR of tunnels and improving tunnels logic + fixing several vulns and bugs!

Changelog

• Update suspencion logic!
• Selfie age verification!
• Admin perms rework 4/4 and staff portal UI based on perms. Add Agreements tab, Fix uploads.
• Admin perms 3/4.
• Admin perms rework 2/4. + Bug fix of orgs invites.
• Admin perms rework 1/2.
• EVEN MORE TRANSLATIONS!
• Translations!
• Web SFTP for KVM :D!

This update was primarily focused on permission update that took most of the work, it was rather annoying thing to do than hard. Due of how much eclipanel grows and how many for profit and non profit companies started using it I decided to let them create roles with limited admin perms so support staff wont have * everywhere!
This update also introduced built intop panel WEB SFTP for KVM VMs. This update also introduced selfie verification of age based on face-api that is somewhat working properly! (P.s.: I couldn’t attach selfie verification photos due it would leak my face :D)

• Add translations for parental controls. (435b6e2)
• Increase landing contrast as people complained! (fe6f404)
• Bump cargo dependencies + misc. More parental controls and fixes. (065c87e)

A lot of people complained about unreadable text due of contrast hence I increased it. + Added translations for parental controls.
Dependency bump is related to previous devlog*

Improve registration flow for parental controls and fix min age on setitngs update. (bf82b0b)
Encrypt every sensetive data in billing and PII without email. (21cdb06)
Parental control -> child registration thru linky.. (a582dab)
Prevent deletion of billing info, save old billing info just in case. Ticketing adjusts.. Passkeys fix. (12b69c2)
Age stuff. (91b2b5a)
Parental accounts, broadcast queue for emails! (5b2d66a)
Implement safe path handling functions and improve file path validation in handlers.. (54eb5a7)
Remove JWT Fallback, add skip to loading screen in landing and more! (0d130db)
Bump deps. (d432b4f)
Fix pnpm-lock.yaml. (31692a1)
Hide sftp for now. (1fb74f6)
sftp in web 1/2 + landing redesign (15c5059)
Legal updates. 2/2 (5731837)
Legal updates. (023f6d4)

This update introduced mainly legal changes, bug fixes, age stuff and parental controls and also created base for websftp that will be used for KVM servers!

I also introduced new landing page :D

Improve challenge page and crawlers whitelist. (5a865f4)
Add some L7 protection like stuff. Browser check. (b593585)
Continue with tunnels, add proper encoding to tickets, add browser check for frontend! (3beffaa)
Redirect non admins to /dashboard (56dd810)
Added firewall tab / port forward for KVM. Fixed compose panel. (5364097)
Fix for vulns from code ql. Bump. (7fcdd97)
Mailbox 3/3, add sending option, UI improvements etc. (52f70ce)

Hellos, nutshell in this update I finished mailbox sending and started working on backend, frontend and clients themselves of tunnels (reverse proxy system). It will work like cloudflare zero trust (or atleast similar).

I also added L7 protection/challenges against bots but still allow crawlers like google.
I also added small admin protection now everyonewill be redirected to dashboard if they try accessing admin.
I also bumped npm packages and fixed code ql vulns..
And yep I know devlog is huge but nearly nothing to say, reason for that is that nearly all systems I did are massive and doing 3 hours devlogs is just not possible.
I also drew new banners!
In addition to that I fixed debian 13 template and added firewall for kvm templates that use similar port forwarding approach like my debian 13 template!
Side note: tunnels are not ready hence not enabled on demo!

Mailbox system 1/3,, AntiAbuse Fix 1/1, Minor Optimisations (5268ab3)
feat: enhance server ownership checks in server detail page (d848697)

Um, yep this is 8 hrs dev log, you might wonder why only two commits? EcliPanel is huge scale app - implementing what it seems to be email system (mailbox) that links with mailcow should be easy but it isnt. It requires dozen of changes.

Thru suffering I managed to make system that uses mailcow api and devcot to create mailbox accounts and recieve emails!
I’m still working on sending emails but I don’t want to make devlog be 9+ hrs!
All I want to say emails are pain so is mailcow and devcot (immap thingy)..

SO far you can recieve emails with attachments and without + view them as plain or raw for secure view or html if you trust and you can toggle images on need!
You can also view headers and security of email and raw message (email) details!

feat: add mailbox page for managing organisation and subuser invites (5aff513)
Add new localization strings for code section and search functionality (3126284)
feat: enhance anti-abuse detection with configurable thresholds and auto-suspend feature (04f4998)
fix: update index definition for serverId and timestamp in SocData entity (19bb6e7)

Basically added mailbox, improved subusers and invites + fixed 10s stal on startup + misc.

fix: update index definition for serverId and timestamp in SocData entity (19bb6e7) (Performance optimisation on startup)
fix: update server suspension logic to handle empty payloads and improve syncServer method (2216c03)
fix: dont target suspended, offline, etc servers. (e228f24)
chore: remove outdated contributors workflow and update README to reflect changes (79ed7cd)
feat: add GitHub Actions workflow to automatically update contributors section in README (f6fa0ed)
feat: add anti-abuse job to CI workflow and update README for clarity and structure (3c33e5b)
fix: correct wings folder reference in .gitignore (8cae28a)
feat: Update pnpm modules, update mobile support for application tab (admin), update anti abuse, delete wings folder (not maintained by us) (042b7fb)
deleted newlines (e76e175)
feat: enhance notification and select components, add search functionality, and update translations (c4c9bd3)
refactor: generic helpers to avoid duplication, inline calls (8ba472b)

Mainly UI for admin optimisation and fixes for anti abuse system + small performance optimisation (added index for SOC)!

Note: please dont abuse, dont ddos and dont portscan! I did it with permissions inside of my local network to trigger stuff!

feat: Enhance malware scanning capabilities and reporting (22b69b4)

I made fully working anti abuse scanner in rust that scans files for malwares/YARA rules matches (primarily used to detect cryptominers and nezha) + ddos / port scanning.

opensource systemd files. (d5c2364)
feat: implement background scanner for file abuse detection (302d30c)
Update mailService.ts (52fd6d2)
Potential fix for code scanning alert no. 28: Incomplete multi-character sanitization (1d96fb7)
feat: add Translations to entire frontend of app. (4da3d81)
feat: enhance network statistics reporting with adaptive bandwidth formatting and historical data calculations (709be37)
feat: implement metrics clearing endpoint and UI integration for admin dashboard (d70c55d)

I had no option but to do this huge devlog, translation took HELLA long cuz panel did not support it AT ALL. Sorrry!

• Remove shutdown notice page and add global search API endpoint (09291dd)
• Merge branch ‘main’ of EcliPanel (abdbbb4)
• build(deps): bump lodash (4241680)
• Merge pull request #19 (73e74d6)
• Add easteregg, data export, user deletion, mobile admin UI, lazy loading, login/register redesign (da86764)
• Merge branch ‘main’ of EcliPanel (6863de2)
• feat: OAuth app management (3c5aa21)
• feat: state management for issue/order processing (45880fe)
• fix: TabsList overflow (9b3d59b)
• fix: admin dashboard overflow + padding (cfdf2d0)
• fix: dynamic tab loading + state mgmt (bf106f9)
• feat: server startup marking + process normalization (8e2681d)
• feat: organisation membership model (254c52d)
• fix: OrdersTab currency formatting (980ad06)
• feat: billing currency + tax rate settings (5f2fafd)
• feat: invoice history tax breakdown (161d175)
• feat: hiddenFromBilling for plans (65d4259)
• Gambling update (3343fec)
• feat: themes + badge color utility (29bbb44)
• BLACKJACK FOR GAMBLIN’! (2579c71)
• feat: public form page (79a3aaf)
• feat: metrics tab + API endpoint (d73b894)

New features! Applications and finally something fun.. GAMBLING MODE!!!!
Obviouslt tons of QoL updates and misc! I also added admin metrics, tax calculations and etc!
But now we can gambleeeeeeee!!

Sorry for small devlog that took long!
It was primarily backend update.
I have added fully functional export of user data that exports EVERYTHING tied to user and his owned servers + added proper account deletion and retention.
I also decided to make easter egg using https://developer.chrome.com/docs/web-platform/view-transitions?hl=en and I regret that, spent MULTIPLE HOURS trying to make it do shigure ui like I wanted.. now it works!
I also updated admin panel entirely and fixed its mobile support, fixed some ticket related stuff and added support for gif avatars/pfps + it shows EcliAI if AI in ticket Support Staff if unknown staff and proper name if its known staff member!

I also added global search and fixed search in admin stuff..
(Global search is beta!)

feat: update sidebar links from account to settings (64223d8)
Add audio captcha, refactor validation and register UI (f45438a) (7e1495f)
feat: add audio captcha support to registration page and create april fools shutdown notice page (12426aa)
feat: overhaul registration page with improved UI components and form handling, add captcha (b295c0f)
feat: add temporary email domain filtering 4d2bfd0 d876339
feat: enhance ticket detail page with user information and improve sidebar functionality (2e48b6c)
feat: enhance theme management and notification dropdown component (f31bd21)
Axios 1.14.1 was compromised. (5b76e85)
feat: add feature toggle middleware and utility functions (84b9dab)
fix: update reconnection logic to use exponential backoff delays (aee967b)
feat: add KVM support (and add Debian 13 VM egg) and enhance server management UI 77281b5

Nutshell:
I introduced temp mail filtering and captcha both visible and iknvisible
Several UI redesigns and QoL updates, more themes and several bug fixes..
Also updated KVM Support for Debian 13 VM and add ability for users to create KVM if its visible/enabled.

feat: add KVM support (and add Debian 13 VM egg) and enhance server management UI (77281b5)
fix: update email addresses to use ecli.app domain across multiple files + change metrics time collection and introduce 7 days total traffic usage (5ee3fbb)
feat: implement metrics collection and scheduling jobs, add hourly restart functionality (63daa5f)
refactor: remove unused roles and SOC pages from dashboard and clean up navigation (e73e687)
refactor and cleanup: Cleanup unused/useless functions from backend and frontend, delete mock data and update AI chat UI + fix input chat css for tickets. (5d03acd)
fix IP in logs (18638d1)

Nutshell, I finally decided to remove broken or unused UI components and routes that were implemented in a better way.
Secondly I finally decided to fix metrics (histroical server usage) it should eat heck ton of storage in database but I bought 4TB drive for it so I don’t care.
Refactored how cron job works -> proper cron now!
Added KVM support and server template/egg with debian 13 that can be run in KVM (thanks claude for helping me with doing that, it was hell).
And also added license explaining page due of several people requested.

Update deps cuz vulns poped up (105bfcf) (2e90bf5)
feat: update dependencies and enhance guide component functionality (b3b5d17)
feat: add user onboarding guide with step-by-step instructions (fb5e7af)
Refactor API data handling and improve error pages (eacdf58)

Very cool onboarding btw check out here: click to open videon on cdn

Nutshell: This was huge UI QoL update with adding 404 pages and error pages + refactoring some API to fix minor issues and more!

feat: enhance ticket detail page with user avatars and adjust message layout (e364bac)
feat: add global average response time and sample count to tickets dashboard (6a349df)
refactor: remove unused multi-arch Docker image creation workflows from build and release configurations (75ac0eb)
fix: update binary artifact paths to include project name for better organization (e4e274e)
refactor: replace constant GIT_COMMIT, GIT_BRANCH, and TARGET with functions for better flexibility; remove unused logs module from API routes (3ec6e32)
fix: handle optional environment variables for GIT_COMMIT, GIT_BRANCH, and TARGET (af8e7fc)
feat: add rootless mode support and auto-sync functionality for eggs and servers (d8f43f1)
Add Wings status page component + Update wings (mirror) (883e3b9)
feat: enhance ticket handling and admin panel functionality (420be59)

This was mainly QoL update with bug fixes and AI Agent support integration! Overall I spent most of the time on AI Agents refactor and enhanting UI and geo policies (geo blocck) updates.

feat(tickets): add ticket archiving and admin bulk archive controls (f83f4e7)

• Ticket model: add archived boolean.
• User ticket API (/tickets): support archived, includeArchived, status=archived.
• Admin ticket list (/admin/tickets): support status + archived query, persist via TicketConfig/Ai policy and keep existing priority wait grouping.
• Admin API: new POST /admin/tickets/archive for bulk archive/unarchive with ids + archived flag.
• Admin UI:
  • Ticket filter bar includes archived.
  • row checkbox for multi-select.
  • bulk “Archive” / “Unarchive” actions.
  • refresh after bulk changes.
• Admin user profile loads ServerConfig-linked servers in addition to Wings servers.
• Add user support ban management in profile status card.
• Replace custom markdown hacks with react-markdown + remark-gfm in AI/admin views.
• Include dependency updates in lockfile.
• Add AI Agents for support
• Allow free users to use high and urgent ticket type, checked by AI if statisfies urgency

feat: implement product updates announcement feature for admins + optimisation (ac58ad7)
enhance notification system with user preferences and email notifications + fix download file (1b0699c)
feat: add Code Instances management to admin dashboard (aac74f9)
API retries, ssh keys/pass keys renaming, billing display fix, server creation on EDU fix (f16455f)
Edu plan apply + treat as paid, min step 512 -> 1, 128 -> 1, 10 -> 5 on server selector (eb13e71)
Fix build after DNS update (b9e3610)
DNS and etc (8e2fff6)
Recursive chmod (cdb700b) (1c7b006)
Optimisation, Chmod, UI (78ddf46)
Optimisation and useMemo fix (aa8a419)
Fix UI stuff (bab3057)
Fix backup renaming (27d9cec)
Fix OAuth redirect + Email Verification reditect, Implement Backups FULLY (d08126a)

Add encryption for addresses, phone, etc. #82c17a2
Add example for OAuth client #82c17a2
Landing #ba54b65 #988e32c #f848abf
Hack Club OAuth for EDU Plans and some ID Stuff #f848abf #8816d6a
Scheduled student reverify jobs #ddc53db
Admin UI redaction, ednpoints and more! #ddc53db
SSH/SFTP fix, new search bar for users, display update, audit logs update, bug fixes and more! #8816d6a
Start of DNS rework 1/2 #d0a2c8f
SFTP/SSH Fix 1/2 #d0a2c8f
App optimisation, logs fix, server creation fix, server limits fix #97e737d
Optimisations and console fix + reconnector in console #c8ef767

View full log: https://pastebin.com/2VkiKHiw

Don’t allow disabling TLS for wings service #f204e8a
Run frontend on 0.0.0.0 (./start.sh) #ae2d2f2
Show wings responce on transfers #9e09624 #a32bc56
Fix CORS #fa7ed6b #4e73fc5 #4e73fc5 #a32bc56

Api Keys Fix, Vulnerability Fix (Api Keys could be assigned to any user by manipulating request) + Api keys fix and UI #4d80269 #8c60f96 #4e73fc5 #4e73fc5
Bump dependencies #20a6aa8
Improve mobile UI 2/2, fix organisations (2/2) #39623f0

Add mobile UI and fix Organisations #39623f0 #ee9d4fc
Fix code injection, add mobile support, fix rust wings uuid issue, add sync to wings, add auto sync, add auto duplicate check + mirror rust wings into the repo #ecfa87e
Add notice that github student verification is coming soon #2bc9b2d

Added my servers and other servers #a8dcc9f
Hid demo popup in billing for existing enterprises #a8dcc9f

Add demo mode #4b0c3cd
Fix organisation deletion and user deletion #2854a0f #4b0c3cd

Fix verification link (issue #1) #cc70b02
Reload page after adding first passkey to avoid account lock #1c9b827
Fix frontend compilation issue caused by #cc70b02 and #1c9b827 #4498d4c
Fixed deletions not deleting account #7343efa

Made it more clear to people that country field and several others are required. #8373be6 #372040a

Fixed around 33 vulnerabilities 12 related to code 21 related to dependencies. (Thanks to
github-advanced-security[bot] with helping to fix some issues)
Added default role gen command #dacb0eb
Added + fixed auto assigned portals with plans Last #71d205a
Fixed some linter issues (TS) Last #e647a53
Fixed registration causing internal server error #55b5217
Added ID verification block for EU users (to avoid complaining with EU laws) #de2698f
Encrypt IDs uploaded on ID Verification #77ffcb3
Added proper country selector instead of text field #de2698f
Added better Ticket System (priorities, departments, etc) #ed7f78c #fbc09ff #2cfe7c4
Fixed permission display of role in admin #2b4060a

Legal stuff - added ID verification block (toggleable in .env).
US Companies aren’t really allowed to do ID verifications for EU or require extra steps hence added it for myself.

• Added better selector of countries and new registration form (added missing fields)

Added code assitant (auto tab)
Added code editor settings and footer/legal documents
Published onto github. (obviously nearly leaked my ID cuz forgot to add uploads onto gitignore)
Changed license to opensource one.

Finally migrate to elysia and bun!
Now everything is working properly and faster,
Added new status for console named “Connecting” and also working right now on metrics server

Working on api documentation and full rewrite
Fastify -> Elysiajs
Have big todo but for now focusing on api docs and rewrite + ws to wss proxy fix

Working on migration to bun and @elysiajs.
Sadly wss proxy (ws to wss) broke after that! I’m trying to fix it!

Big updates!
Firstly I fully finished wings service and panel linking.
Secondly, I fully finished passkeys and OTP (2FA or email)
Thirdly, I finished submission of ID and etc
Still working on some minor QOL updates but panel seems to be nearly done!
I already published ALPHA release on ecli.app for several people.
Also some other stuff like organisations etc was finished..
Also sent application to GitHub to get access to Github Edu enpoints for educational plans..

Have not a lot to write, wired up wings with panel.
Working on Quality of Life improvements and misc fixes!
Also moving on console to another one soon!

Added eggs support PTDL_1/2 of pterodactyl imports + Node connectivtiy to the panel, working on OAuth!
Note: Front is like always mostly AI but backend was torture to make for that one! I wanted to integrate wings-rs (ptero like wings) with it!