https://adminsforum.com/ Thu, 15 Oct 2026 06:11:12 +0000 MyBB https://adminsforum.com/Thread-guide-roll-back-a-git-deployment-in-aapanel-and-verify-recovery Wed, 14 Oct 2026 01:44:45 +0800 DEV]]> https://adminsforum.com/Thread-guide-roll-back-a-git-deployment-in-aapanel-and-verify-recovery To return an aaPanel Git-managed website to a recorded deployment, open Git Manager → Deployments, locate the target commit and choose Rollback. Back up first, complete the confirmation, then check the active commit and the actual website. A successful code rollback does not prove that an application's database or uploads were restored.

Tested environment and result
Ubuntu 22.04, aaPanel 8.0.7 Free Edition, Nginx and a dedicated static demo website using MDN's beginner HTML/CSS repository. We started at commit 6c7a360, deliberately deployed commit 16a0f38, then used the native deployment-history Rollback action to return to 6c7a360. The history recorded Success and Active for the restored commit. The sample page and its image loaded over HTTPS afterwards.

These commits change repository administration files, so the page looked the same before and after. This rehearsal verifies the commit transition and the native recovery controls; it does not demonstrate fixing a visibly broken page, recovering database migrations or restoring a dynamic application.

Before starting

• Use a separate test site first. Complete the Git deployment guide if the repository is not connected yet.
  
• Record the current commit, branch and intended recovery commit. Use the commit identifier rather than relying on a message or timestamp alone.
  
• Back up the site files and any separate database. Our demo's file-only backup completed before the rehearsal; restoration of that ZIP was not tested here.
  
• Review runtime uploads, configuration and dependencies that sit outside the repository. Keep automatic deployment off during the exercise so it cannot immediately replace your selected version.
  

1. Inspect the current deployment
Open Website, find the correct site, click Conf and select Git Manager. The Repository screen displays Deployed commit and the last deployment time. In our controlled test, the earlier sample commit 16a0f38 became the active version after we deployed it from Commit history.

  git-earlier-commit-20261013.jpg (Size: 279.35 KB / Downloads: 5)
The test site at commit 16a0f38 before returning to the original recorded deployment.

The Repository page's per-commit Deploy action deploys a selected remote commit. The Rollback action used below belongs to an existing deployment-history record. Do not confuse the two controls.

2. Choose the recorded recovery target
Select Deployments. Locate the record for the commit you want to restore. In our history, 16a0f38 was Current/Active, while the earlier successful deployment of 6c7a360 offered Log and Rollback.

  git-rollback-history-20261013.jpg (Size: 230.07 KB / Downloads: 4)
Deployment history before recovery. The target is the existing 6c7a360 record.

If you need to investigate a deployment first, open its Log. Check the result and commit carefully; a successful task is not proof that the application itself was healthy.

3. Confirm the rollback
Click Rollback on the intended record. Our panel warned that it would return the deployment to an earlier commit state and asked us to back up site files first. It also displayed an arithmetic verification field. Complete the check shown in your own panel and confirm only after checking the destination and target.

Wait for the result. Do not repeatedly submit the action while it is running. If it fails, inspect the deployment log before making another change. The exact prompt can differ across panel versions.

4. Verify the active version
The history should now show a new successful record for the restored commit, marked Active and Current. In our lab that record was 6c7a360; the intermediate 16a0f38 record was no longer active. The operation took 1.05 seconds in this tiny sample; this is not a performance guarantee.

  git-rollback-completed-20261013.jpg (Size: 240.11 KB / Downloads: 5)
The completed native rollback records 6c7a360 as Success, Active and Current.

Reopen Repository and check the deployed commit if the history display is unclear. Then visit the website over HTTPS. Check the affected page and its assets, not just the homepage. For a dynamic application, also verify relevant login, read and write workflows without damaging production data.

5. Know what this test does not recover
Git deployment recovery is not a full server backup restore. A database schema change may be incompatible with older code. User-uploaded media, environment secrets, generated files and installed dependencies can need a separate recovery plan. Avoid assuming that every file on disk exactly matches the selected commit: the per-commit deployment warning in this installation said matching repository files would be overwritten and other site files retained. We did not independently test deletion or retention behaviour during rollback.

Our static example had no database migration, custom build script or external application state. Those workflows need their own rehearsal before production use.

History retention and troubleshooting
The installed Free panel displays a limit of 5 deployment records. Keep an independent recovery record and backups; a short history is not a long-term backup strategy. Pro availability and limits are outside this hands-on Free test.

• Target missing: confirm the branch/filter and retained history. Do not assume every remote commit has a rollback record.
  
• Task fails: read the record's log and check repository access and disk space. Preserve useful errors before retrying.
  
• Correct commit but wrong page: check the document root, default document and application/CDN caches. Verify actual content before declaring recovery complete.
  
• Application fails after rollback: investigate database compatibility, configuration and dependencies rather than repeatedly selecting older commits.
  

Our final lab state
Original commit 6c7a360 restored; history Success/Active; demo website and image accessible over HTTPS; automatic deployment still Off. Existing WordPress and mail sites were outside this exercise.

Need help? Include the aaPanel version, branch, current and target commit identifiers and the relevant deployment error in Plugins & Integrations Support. Remove credentials and webhook secrets.]]> To return an aaPanel Git-managed website to a recorded deployment, open Git Manager → Deployments, locate the target commit and choose Rollback. Back up first, complete the confirmation, then check the active commit and the actual website. A successful code rollback does not prove that an application's database or uploads were restored.

Tested environment and result
Ubuntu 22.04, aaPanel 8.0.7 Free Edition, Nginx and a dedicated static demo website using MDN's beginner HTML/CSS repository. We started at commit 6c7a360, deliberately deployed commit 16a0f38, then used the native deployment-history Rollback action to return to 6c7a360. The history recorded Success and Active for the restored commit. The sample page and its image loaded over HTTPS afterwards.

These commits change repository administration files, so the page looked the same before and after. This rehearsal verifies the commit transition and the native recovery controls; it does not demonstrate fixing a visibly broken page, recovering database migrations or restoring a dynamic application.

Before starting

• Use a separate test site first. Complete the Git deployment guide if the repository is not connected yet.
  
• Record the current commit, branch and intended recovery commit. Use the commit identifier rather than relying on a message or timestamp alone.
  
• Back up the site files and any separate database. Our demo's file-only backup completed before the rehearsal; restoration of that ZIP was not tested here.
  
• Review runtime uploads, configuration and dependencies that sit outside the repository. Keep automatic deployment off during the exercise so it cannot immediately replace your selected version.
  

1. Inspect the current deployment
Open Website, find the correct site, click Conf and select Git Manager. The Repository screen displays Deployed commit and the last deployment time. In our controlled test, the earlier sample commit 16a0f38 became the active version after we deployed it from Commit history.

  git-earlier-commit-20261013.jpg (Size: 279.35 KB / Downloads: 5)
The test site at commit 16a0f38 before returning to the original recorded deployment.

The Repository page's per-commit Deploy action deploys a selected remote commit. The Rollback action used below belongs to an existing deployment-history record. Do not confuse the two controls.

2. Choose the recorded recovery target
Select Deployments. Locate the record for the commit you want to restore. In our history, 16a0f38 was Current/Active, while the earlier successful deployment of 6c7a360 offered Log and Rollback.

  git-rollback-history-20261013.jpg (Size: 230.07 KB / Downloads: 4)
Deployment history before recovery. The target is the existing 6c7a360 record.

If you need to investigate a deployment first, open its Log. Check the result and commit carefully; a successful task is not proof that the application itself was healthy.

3. Confirm the rollback
Click Rollback on the intended record. Our panel warned that it would return the deployment to an earlier commit state and asked us to back up site files first. It also displayed an arithmetic verification field. Complete the check shown in your own panel and confirm only after checking the destination and target.

Wait for the result. Do not repeatedly submit the action while it is running. If it fails, inspect the deployment log before making another change. The exact prompt can differ across panel versions.

4. Verify the active version
The history should now show a new successful record for the restored commit, marked Active and Current. In our lab that record was 6c7a360; the intermediate 16a0f38 record was no longer active. The operation took 1.05 seconds in this tiny sample; this is not a performance guarantee.

  git-rollback-completed-20261013.jpg (Size: 240.11 KB / Downloads: 5)
The completed native rollback records 6c7a360 as Success, Active and Current.

Reopen Repository and check the deployed commit if the history display is unclear. Then visit the website over HTTPS. Check the affected page and its assets, not just the homepage. For a dynamic application, also verify relevant login, read and write workflows without damaging production data.

5. Know what this test does not recover
Git deployment recovery is not a full server backup restore. A database schema change may be incompatible with older code. User-uploaded media, environment secrets, generated files and installed dependencies can need a separate recovery plan. Avoid assuming that every file on disk exactly matches the selected commit: the per-commit deployment warning in this installation said matching repository files would be overwritten and other site files retained. We did not independently test deletion or retention behaviour during rollback.

Our static example had no database migration, custom build script or external application state. Those workflows need their own rehearsal before production use.

History retention and troubleshooting
The installed Free panel displays a limit of 5 deployment records. Keep an independent recovery record and backups; a short history is not a long-term backup strategy. Pro availability and limits are outside this hands-on Free test.

• Target missing: confirm the branch/filter and retained history. Do not assume every remote commit has a rollback record.
  
• Task fails: read the record's log and check repository access and disk space. Preserve useful errors before retrying.
  
• Correct commit but wrong page: check the document root, default document and application/CDN caches. Verify actual content before declaring recovery complete.
  
• Application fails after rollback: investigate database compatibility, configuration and dependencies rather than repeatedly selecting older commits.
  

Our final lab state
Original commit 6c7a360 restored; history Success/Active; demo website and image accessible over HTTPS; automatic deployment still Off. Existing WordPress and mail sites were outside this exercise.

Need help? Include the aaPanel version, branch, current and target commit identifiers and the relevant deployment error in Plugins & Integrations Support. Remove credentials and webhook secrets.]]> https://adminsforum.com/Thread-guide-deploy-a-website-from-github-in-aapanel-step-by-step-guide Wed, 14 Oct 2026 00:27:54 +0800 DEV]]> https://adminsforum.com/Thread-guide-deploy-a-website-from-github-in-aapanel-step-by-step-guide aaPanel's Git Manager can deploy a public repository to an existing website. Open the website settings, choose Git Manager, enter the repository URL, test access, select its branch and use Save & deploy. Saving immediately deploys files, so start with a separate test website and a backup.

Tested environment
Ubuntu 22.04, aaPanel 8.0.7 Free Edition and Nginx 1.30.5. We deployed MDN's public beginner HTML/CSS example to a dedicated demo website. Repository access succeeded, commit 6c7a360 was deployed and recorded as Success/Active. The website returned HTTP 200 over HTTPS with certificate verification passing. We did not test private repositories, webhooks, custom build scripts or rollback in this walkthrough.

1. Prepare a separate website
Create a test website through Website → Add site. Use a domain or subdomain you control. If there are existing files, back them up before deployment. Our demo site's native backup completed successfully and produced an 86.97 KB file-only ZIP. Its restore was not tested here. A file backup does not include an application's database unless you explicitly include and verify that component.

Create a DNS A record for the test hostname pointing to the server's public IPv4 address. Configure HTTPS through the site's SSL settings after DNS resolves. Our lab used DNS-only Cloudflare resolution and a Let's Encrypt certificate. Use your own IP and hostname; the demonstration hostname is not a shared deployment service.

2. Choose a repository suitable for the first test
For this rehearsal we used the public, static MDN sample:

Code:Copy

https://github.com/mdn/beginner-html-site-styled.git

It contains an index.html plus styles and images. This avoids a database or build step during the initial Git test. Use a trusted repository and inspect its contents before deployment. A framework application may also need dependency installation, a build command, runtime configuration and a different document root.

3. Connect through Git Manager
Open Website, find the demo site and click Conf. Select Git Manager, then Repository URL. Paste the repository address. For a public repository choose Public authentication. No GitHub account connection, token or SSH key was required for our public example.

Click Test connection. Wait for the result. Our screen reported Connection successful · 4 branches available. Select the intended deployment branch; ours was main. Branch names vary by repository.

  git-repository-connection-20261013.jpg (Size: 230.67 KB / Downloads: 10)
Successful public-repository connection, with main selected before deployment.

4. Save and deploy
Check the destination site and branch again. Click Save & deploy once. The panel states that saving deploys immediately; it is not merely saving connection preferences. Wait for the task result.

After our successful deployment, reopening Git Manager showed the connected repository, deployed commit and last deployment time. Automatic deployment was Off; connecting a repository does not by itself configure a webhook.

  git-connected-20261013.jpg (Size: 279.45 KB / Downloads: 7)
Connected repository and active commit after deployment.

5. Read deployment history
Select Deployments. Confirm that the expected commit and branch appear, its result is Success, and the active version is marked. Use the record's Log action when diagnosing a failed deployment.

Our installed Free panel says it retains 5 deployment records, while its upgrade notice advertises 30 for Pro. This is the limit shown by this version, not a comparison test of Pro. The displayed 1.02-second duration applies only to this small sample and is not a deployment-speed benchmark.

  git-history-20261013.jpg (Size: 219.5 KB / Downloads: 8)
Deployment history records the tested commit as Success and Active.

6. Verify the actual website
Visit the hostname and check the expected page, stylesheet and images. A success notice alone is not proof that DNS, HTTPS or application configuration is correct. Our hostname initially had no DNS record. After adding it, the local browser retained an NXDOMAIN result temporarily. We first verified the origin over HTTPS using the hostname and explicit IP resolution; certificate checking stayed enabled. Once the resolver cache updated, a fresh browser request also displayed the deployed page and Firefox image over HTTPS.

  git-demo-live-20261013.jpg (Size: 144.12 KB / Downloads: 5)
The deployed sample rendered in the browser after DNS propagation.

Optional command for readers:

Code:Copy

curl --resolve YOUR_HOSTNAME:443:YOUR_SERVER_IP https://YOUR_HOSTNAME/

Replace both placeholders. Do not add -k to hide certificate failures. The response in our lab contained the sample's expected HTML and returned HTTP 200. A request for /.git/HEAD returned 404; that specific file was not publicly readable. This is a targeted check, not a comprehensive server security audit.

7. Understand updates before automating
The connected repository screen offers Deploy latest and per-commit deployment controls. Review the selected branch and changes, preserve a recovery copy and test an update on a staging site before using these on production. This guide directly verified the first deployment only. A Git rollback is not a database restore, and runtime uploads or secrets should not be treated as disposable repository files.

Keep automatic deployment disabled until you deliberately configure and test the separate webhook workflow. Do not publish tokens or webhook secrets in screenshots.

Troubleshooting

• Connection fails: confirm the repository URL, its visibility and outbound access. The public authentication option cannot authenticate to a private repository.
  
• Wrong page: check the site's document root, selected branch and default document order; existing index files can affect which page is served.
  
• 404 or broken assets: check filenames, asset paths and whether a build directory should be the document root.
  
• Application error: check the required PHP/Node version, dependencies and environment configuration. Copying repository files does not complete every application's installation.
  
• DNS error: verify the A/AAAA records and allow resolver caches to refresh. Changing Git settings will not repair DNS.
  

Reference sample: MDN beginner HTML/CSS repository. Its website files belong to the sample's authors; our screenshots document the aaPanel deployment workflow.

Need help? Share the aaPanel version, repository visibility, branch and relevant deployment error in Plugins & Integrations Support. Remove credentials and private configuration values first.

Tested follow-up: Roll Back a Git Deployment in aaPanel and Verify Recovery — our separate native rollback rehearsal is now complete.]]> aaPanel's Git Manager can deploy a public repository to an existing website. Open the website settings, choose Git Manager, enter the repository URL, test access, select its branch and use Save & deploy. Saving immediately deploys files, so start with a separate test website and a backup.

Tested environment
Ubuntu 22.04, aaPanel 8.0.7 Free Edition and Nginx 1.30.5. We deployed MDN's public beginner HTML/CSS example to a dedicated demo website. Repository access succeeded, commit 6c7a360 was deployed and recorded as Success/Active. The website returned HTTP 200 over HTTPS with certificate verification passing. We did not test private repositories, webhooks, custom build scripts or rollback in this walkthrough.

1. Prepare a separate website
Create a test website through Website → Add site. Use a domain or subdomain you control. If there are existing files, back them up before deployment. Our demo site's native backup completed successfully and produced an 86.97 KB file-only ZIP. Its restore was not tested here. A file backup does not include an application's database unless you explicitly include and verify that component.

Create a DNS A record for the test hostname pointing to the server's public IPv4 address. Configure HTTPS through the site's SSL settings after DNS resolves. Our lab used DNS-only Cloudflare resolution and a Let's Encrypt certificate. Use your own IP and hostname; the demonstration hostname is not a shared deployment service.

2. Choose a repository suitable for the first test
For this rehearsal we used the public, static MDN sample:

Code:Copy

https://github.com/mdn/beginner-html-site-styled.git

It contains an index.html plus styles and images. This avoids a database or build step during the initial Git test. Use a trusted repository and inspect its contents before deployment. A framework application may also need dependency installation, a build command, runtime configuration and a different document root.

3. Connect through Git Manager
Open Website, find the demo site and click Conf. Select Git Manager, then Repository URL. Paste the repository address. For a public repository choose Public authentication. No GitHub account connection, token or SSH key was required for our public example.

Click Test connection. Wait for the result. Our screen reported Connection successful · 4 branches available. Select the intended deployment branch; ours was main. Branch names vary by repository.

  git-repository-connection-20261013.jpg (Size: 230.67 KB / Downloads: 10)
Successful public-repository connection, with main selected before deployment.

4. Save and deploy
Check the destination site and branch again. Click Save & deploy once. The panel states that saving deploys immediately; it is not merely saving connection preferences. Wait for the task result.

After our successful deployment, reopening Git Manager showed the connected repository, deployed commit and last deployment time. Automatic deployment was Off; connecting a repository does not by itself configure a webhook.

  git-connected-20261013.jpg (Size: 279.45 KB / Downloads: 7)
Connected repository and active commit after deployment.

5. Read deployment history
Select Deployments. Confirm that the expected commit and branch appear, its result is Success, and the active version is marked. Use the record's Log action when diagnosing a failed deployment.

Our installed Free panel says it retains 5 deployment records, while its upgrade notice advertises 30 for Pro. This is the limit shown by this version, not a comparison test of Pro. The displayed 1.02-second duration applies only to this small sample and is not a deployment-speed benchmark.

  git-history-20261013.jpg (Size: 219.5 KB / Downloads: 8)
Deployment history records the tested commit as Success and Active.

6. Verify the actual website
Visit the hostname and check the expected page, stylesheet and images. A success notice alone is not proof that DNS, HTTPS or application configuration is correct. Our hostname initially had no DNS record. After adding it, the local browser retained an NXDOMAIN result temporarily. We first verified the origin over HTTPS using the hostname and explicit IP resolution; certificate checking stayed enabled. Once the resolver cache updated, a fresh browser request also displayed the deployed page and Firefox image over HTTPS.

  git-demo-live-20261013.jpg (Size: 144.12 KB / Downloads: 5)
The deployed sample rendered in the browser after DNS propagation.

Optional command for readers:

Code:Copy

curl --resolve YOUR_HOSTNAME:443:YOUR_SERVER_IP https://YOUR_HOSTNAME/

Replace both placeholders. Do not add -k to hide certificate failures. The response in our lab contained the sample's expected HTML and returned HTTP 200. A request for /.git/HEAD returned 404; that specific file was not publicly readable. This is a targeted check, not a comprehensive server security audit.

7. Understand updates before automating
The connected repository screen offers Deploy latest and per-commit deployment controls. Review the selected branch and changes, preserve a recovery copy and test an update on a staging site before using these on production. This guide directly verified the first deployment only. A Git rollback is not a database restore, and runtime uploads or secrets should not be treated as disposable repository files.

Keep automatic deployment disabled until you deliberately configure and test the separate webhook workflow. Do not publish tokens or webhook secrets in screenshots.

Troubleshooting

• Connection fails: confirm the repository URL, its visibility and outbound access. The public authentication option cannot authenticate to a private repository.
  
• Wrong page: check the site's document root, selected branch and default document order; existing index files can affect which page is served.
  
• 404 or broken assets: check filenames, asset paths and whether a build directory should be the document root.
  
• Application error: check the required PHP/Node version, dependencies and environment configuration. Copying repository files does not complete every application's installation.
  
• DNS error: verify the A/AAAA records and allow resolver caches to refresh. Changing Git settings will not repair DNS.
  

Reference sample: MDN beginner HTML/CSS repository. Its website files belong to the sample's authors; our screenshots document the aaPanel deployment workflow.

Need help? Share the aaPanel version, repository visibility, branch and relevant deployment error in Plugins & Integrations Support. Remove credentials and private configuration values first.

Tested follow-up: Roll Back a Git Deployment in aaPanel and Verify Recovery — our separate native rollback rehearsal is now complete.]]> https://adminsforum.com/Thread-guide-aapanel-app-store-guide-apps-plugins-and-what-to-install Tue, 13 Oct 2026 13:20:13 +0800 DEV]]> https://adminsforum.com/Thread-guide-aapanel-app-store-guide-apps-plugins-and-what-to-install You do not need every App Store app to host a website. Start with the components your application requires, then add optional tools for a specific purpose. This reference explains all 98 rows visible in our lab's catalog on 13 October 2026. Availability, versions and prices can change. The descriptions below are our practical summaries, not claims that every plugin has been installed or tested.

1. Find and understand the App Store
Open App Store → Official App. Search by name. Use ALL for the catalog and Installed to see services already present. Deployment, Tools, Plug-ins and Professional narrow the list. Setting opens an installed component's controls; Install starts setup for an available component; paid entries may show a purchase action. Do not treat a catalog listing as proof that an app is running.

  appstore-branded-20261013.jpg (Size: 239.23 KB / Downloads: 6)
Our Installed view contains ten components. The full 98-row catalog also includes optional and retired entries.

2. Choose a small starting stack
For a typical PHP website, choose a supported web server, a PHP runtime compatible with the application and a database when required. phpMyAdmin is an optional administration interface, not the database itself. Redis is optional caching infrastructure. Mail Server and Pure-FTPd are separate services: install them only when you need to operate mail or FTP. Our lab includes multiple web servers to demonstrate hosting configurations; a beginner does not need to install all three.

3. Before clicking Install
Check operating-system and panel-version compatibility, memory/disk requirements and existing dependencies. Back up configuration and data. Review new ports and credentials. A plugin marked Free can still use a cloud account with quotas or charges. A Paid label below means the catalog listed a price; it does not define the terms of a subscription or guarantee current pricing. Review licensing in your own account. After installation, check service status, application behavior and firewall rules.

4. Core hosting, database and runtime entries
Nginx 1.30.5 — Listed Free
Serves websites and can reverse-proxy application backends.

Apache 2.4.62 — Listed Free
Serves websites with Apache modules and per-site configuration.

MySQL 10.11.10-MariaDB — Listed Free
The lab catalog label refers to the installed MariaDB relational database; applications need compatible database settings.

Mail Server 7.4.1 — Listed Free
Manages mail services; delivery also requires DNS, certificates, reverse DNS and provider connectivity.

Redis 7.4.11 — Listed Free
Provides a key-value service used for caches and other applications; secure access and avoid shared-cache flushes.

Pure-Ftpd 1.0.49 — Listed Free
Provides FTP/FTPS accounts and transfers; require encryption and restrict user folders.

phpMyAdmin 5.2 — Listed Free
Provides a browser interface for MySQL/MariaDB administration; protect access.

Node.js version manager — Listed Free
Manages Node.js runtimes; check project compatibility and conflicts with older managers.

ffmpeg manager — Listed Free
Installs and manages FFmpeg for media conversion; resource use depends on the job.

MongoDB — Listed Free
Provides a document database for applications designed to use it.

Memcached — Listed Free
Provides an in-memory cache; restrict network access and expect cache contents to be disposable.

elasticsearch — Listed Free
Provides search and analytics infrastructure; plan its memory and storage requirements.

Openlitespeed 1.8.5 — Listed Free
Provides the OpenLiteSpeed web server; its PHP handling differs from Nginx/PHP-FPM.

RabbitMQ — Listed Free
Provides a message broker for applications that need queues.

PostgreSQL Manager — Listed Free
Installs and manages PostgreSQL databases.

Supervisor — Listed Free
Keeps configured application processes running; set the correct user and working directory.

Java Manager — Listed Free
Supports Java/JSP deployment management; choose compatible runtimes.

Mariadb multi-version management (Docker) — Listed Free
Runs multiple MariaDB versions in containers; separate ports, data and backups.

5. PHP version entries
The catalog lists PHP-8.5, PHP-8.4, PHP-8.3, PHP-8.2, PHP-8.1, PHP-8.0, PHP-7.4, PHP-7.3, PHP-7.2, PHP-7.1, PHP-7.0, PHP-5.6, PHP-5.5, PHP-5.4, PHP-5.3, PHP-5.2. All were listed Free. Each is a PHP runtime version, not a different website application. Select the version required by your software and still covered by appropriate security support. Old PHP 5.x and 7.x entries are legacy choices, not recommendations for a new site. Check the official support table before choosing or migrating a version. Installing a newer runtime does not automatically switch every existing website to it. Back up and test the site, required extensions and the selected web server before changing its runtime.

6. Optional apps and plugins
Site Diagnosis — Listed Paid
Helps investigate common website failures; verify its suggestions against the actual logs.

Network Threat Detection — Listed Paid
Reviews network traffic for suspicious activity; check the supported OS before installing.

Website Analytics — Listed Paid
Adds visitor analytics; review tracking, privacy and storage requirements.

Files Sync — Listed Paid
Transfers files between locations on a schedule or continuously; test conflict and deletion behavior first.

Network Scan Detection — Listed Paid
Looks for scanning activity against the server; alerts still need investigation.

aaPanel Daily Report — Listed Paid
Summarizes operational and security information for regular review.

Website statistics-v2 — Listed Paid
Provides website traffic statistics for supported web servers.

Nginx WAF — Listed Paid
Adds application-layer filtering for Nginx; tune rules to avoid blocking legitimate requests.

Tamper-proof for Enterprise — Listed Paid
Restricts unwanted website file changes; review incompatibilities with other tamper protection.

Load Balance — Listed Paid
Distributes requests across backends; requires healthy services and a tested routing plan.

aaPanel Mobile — Listed Paid
Provides mobile management access; protect the associated account.

Apache WAF — Listed Paid
Adds application-layer filtering for Apache; review compatibility and false positives.

Microsoft OneDrive — Listed Free
Stores backups in a Microsoft cloud account; account limits and charges are separate.

PHP code security — Listed Paid
Adds PHP behavior checks; test application compatibility before enabling blocking.

Task manager — Listed Paid
Provides controls for processes and other system tasks; stopping the wrong service can interrupt hosting.

Website Tamper-proof — Listed Paid
Protects selected website files against changes; allow your legitimate deployment workflow.

aaPanel user Manager — Listed Paid
Manages panel users and menu permissions on supported panel versions; grant the minimum access needed.

System hardening — Listed Paid
Offers system protection settings; review each change and its recovery route.

File monitor — Listed Paid
Records file changes and offers related checks or backups.

Disk analysis — Listed Paid
Helps locate large files and directories; review files before cleanup.

aaCloud — Listed Free
Connects servers to centralized management; review the access and data involved.

OpenClaw(Docker) — Listed Free
Runs a self-hosted AI assistant through Docker; plan disk, memory, model and integration requirements.

OpenClaw — Listed Free
Runs a self-hosted AI assistant; use a separate lab and review messaging integrations and credentials.

Tencent EdgeOne CDN — Listed Free
Connects edge/CDN services; review the provider account, plan and DNS requirements.

Anti-intrusion — Listed Paid
Adds protections around service and process activity; validate compatibility with your workloads.

Website basic Statistics — Listed Free
Provides a basic view of website visits.

CloudFlare free CDN — Listed Free
Integrates Cloudflare website/CDN configuration; DNS and account requirements still apply.

Website Log Analyzer — Listed Free
Analyzes selected Nginx access logs to help investigate traffic.

WebSite Speed — Listed Free
Offers website acceleration controls; review its current documentation and test before enabling.

WebHook — Listed Free
Runs configured actions on callbacks; protect webhook secrets and limit command privileges.

DeepSeek-R1 — Listed Free
Provides an AI model integration; review its current deployment, memory and model requirements.

S3 Storage (AWS S3) — Listed Free
Sends backups to S3-compatible storage; protect access keys and test recovery.

Google Drive — Listed Free
Sends backups to Google Drive; verify account authorization and storage capacity.

Fail2ban Manager — Listed Free
Manages bans triggered by repeated authentication failures; verify log paths and trusted-client access.

Cloud dns — Listed Free
Manages supported DNS-provider records; use narrowly scoped provider tokens.

DDNS Manager — Listed Free
Updates supported DNS records when an address changes.

One-click migration beta — Listed Free
Helps migrate panel data; verify backups, compatibility and the destination before relying on it.

one-click deployment — Listed Free
Deploys supported applications; update and secure each application after installation.

Intrusion Detection — Listed Free
Monitors for possible intrusion activity; review alerts instead of treating them as proof.

FTP Storage — Listed Free
Sends backups to an FTP destination; review encryption support before transmitting private data.

ClamAV — Listed Free
Scans files for malware signatures; scan results do not replace patching or incident review.

frp manager — Listed Free
Manages reverse-proxy tunnels; review which private services become reachable.

Platform Ops — Listed Paid
Coordinates maintenance across servers; protect stored access and review batch operations.

Disk Mount Manager — Listed Free
Manages disk mounts; back up first and distinguish mounting from formatting.

Google Cloud Storage — Listed Free
Sends backups to Google Cloud Storage; provider permissions and charges are separate.

Performance testing — Listed Free
Runs CPU, memory, disk and network benchmarks; schedule away from busy production periods.

System boot items — Listed Free
Manages startup services and environment settings; avoid disabling hosting dependencies.

NFS Manager — Listed Paid
Manages network file shares and mounts; restrict clients and export permissions.

Server performance testing — Listed Free
Provides server benchmarking; tests can compete with live workloads.

Linux Tools — Listed Free
Provides system utilities including DNS, swap and network settings; review disruptive changes.

PHP Guardian — Listed Free
Monitors PHP-FPM availability; investigate the underlying failure rather than only restarting it.

Log cleanup — Listed Free
Removes selected logs or temporary data; retain troubleshooting and audit evidence first.

Anti-Spam Gateway — Listed Free
Filters mail through a gateway; review routing and false-positive behavior.

IP setup tool — Listed Free
Changes network address configuration; its listed OS support is old, so check compatibility and console recovery.

Nginx free firewall — Listed Free
The catalog gives little detail; check maintenance and documentation before choosing it for protection.

7. Retired or replaced catalog entries
These rows were still visible but their catalog notices direct users to replacements. Do not use an old install guide without checking the current location and support status.

Dns Manager — Listed Free
Retired catalog entry; use the panel Domains area indicated by the catalog.

aaPanel AI Assistant — Listed Free
Unmaintained plugin entry; use the current AI menu indicated by the catalog.

Sync Tool — Listed Paid
Retired entry; the catalog directs users to Files Sync.

Abnormal Push — Listed Paid
Retired entry; the catalog directs users to Settings → Alarm.

SYS Firewall — Listed Free
Retired entry; use the current Security area.

PM2 Manager — Listed Free
Retired entry; use Website → Node Project as indicated by the catalog.

Docker Manager — Listed Free
Retired entry; use the current Docker menu.

Python Manager — Listed Free
Older entry marked for replacement; use Website → Python Project.

Website statistics — Listed Paid
Retired entry; use Website statistics-v2.

8. How to verify an installation
Return to Installed, open Setting, confirm the service status and inspect logs. Test the actual function: load a website, connect to the database through the intended private route, transfer a file using encryption or restore a backup into an isolated environment. A green service indicator alone does not prove the application is configured correctly. If setup fails, record the app/version, OS, precise error and relevant redacted log lines when asking for support.

Lab scope
The installed view shows Nginx, Apache, MariaDB, Mail Server, Redis, Pure-FTPd, phpMyAdmin, PHP 8.5, PHP 8.4 and OpenLiteSpeed. Our related guides demonstrate selected functions of this stack. The remaining catalog entries are explanations based on the visible catalog; they have not all been installed, audited or benchmarked.

Continue with focused guides
WordPress Redis object cache
Pure-FTPd installation and service checks
Firewall rules after installing services

References: aaPanel App Store documentation and PHP supported versions. Catalog review and original lab screenshot: © AdminsForum.]]> You do not need every App Store app to host a website. Start with the components your application requires, then add optional tools for a specific purpose. This reference explains all 98 rows visible in our lab's catalog on 13 October 2026. Availability, versions and prices can change. The descriptions below are our practical summaries, not claims that every plugin has been installed or tested.

1. Find and understand the App Store
Open App Store → Official App. Search by name. Use ALL for the catalog and Installed to see services already present. Deployment, Tools, Plug-ins and Professional narrow the list. Setting opens an installed component's controls; Install starts setup for an available component; paid entries may show a purchase action. Do not treat a catalog listing as proof that an app is running.

  appstore-branded-20261013.jpg (Size: 239.23 KB / Downloads: 6)
Our Installed view contains ten components. The full 98-row catalog also includes optional and retired entries.

2. Choose a small starting stack
For a typical PHP website, choose a supported web server, a PHP runtime compatible with the application and a database when required. phpMyAdmin is an optional administration interface, not the database itself. Redis is optional caching infrastructure. Mail Server and Pure-FTPd are separate services: install them only when you need to operate mail or FTP. Our lab includes multiple web servers to demonstrate hosting configurations; a beginner does not need to install all three.

3. Before clicking Install
Check operating-system and panel-version compatibility, memory/disk requirements and existing dependencies. Back up configuration and data. Review new ports and credentials. A plugin marked Free can still use a cloud account with quotas or charges. A Paid label below means the catalog listed a price; it does not define the terms of a subscription or guarantee current pricing. Review licensing in your own account. After installation, check service status, application behavior and firewall rules.

4. Core hosting, database and runtime entries
Nginx 1.30.5 — Listed Free
Serves websites and can reverse-proxy application backends.

Apache 2.4.62 — Listed Free
Serves websites with Apache modules and per-site configuration.

MySQL 10.11.10-MariaDB — Listed Free
The lab catalog label refers to the installed MariaDB relational database; applications need compatible database settings.

Mail Server 7.4.1 — Listed Free
Manages mail services; delivery also requires DNS, certificates, reverse DNS and provider connectivity.

Redis 7.4.11 — Listed Free
Provides a key-value service used for caches and other applications; secure access and avoid shared-cache flushes.

Pure-Ftpd 1.0.49 — Listed Free
Provides FTP/FTPS accounts and transfers; require encryption and restrict user folders.

phpMyAdmin 5.2 — Listed Free
Provides a browser interface for MySQL/MariaDB administration; protect access.

Node.js version manager — Listed Free
Manages Node.js runtimes; check project compatibility and conflicts with older managers.

ffmpeg manager — Listed Free
Installs and manages FFmpeg for media conversion; resource use depends on the job.

MongoDB — Listed Free
Provides a document database for applications designed to use it.

Memcached — Listed Free
Provides an in-memory cache; restrict network access and expect cache contents to be disposable.

elasticsearch — Listed Free
Provides search and analytics infrastructure; plan its memory and storage requirements.

Openlitespeed 1.8.5 — Listed Free
Provides the OpenLiteSpeed web server; its PHP handling differs from Nginx/PHP-FPM.

RabbitMQ — Listed Free
Provides a message broker for applications that need queues.

PostgreSQL Manager — Listed Free
Installs and manages PostgreSQL databases.

Supervisor — Listed Free
Keeps configured application processes running; set the correct user and working directory.

Java Manager — Listed Free
Supports Java/JSP deployment management; choose compatible runtimes.

Mariadb multi-version management (Docker) — Listed Free
Runs multiple MariaDB versions in containers; separate ports, data and backups.

5. PHP version entries
The catalog lists PHP-8.5, PHP-8.4, PHP-8.3, PHP-8.2, PHP-8.1, PHP-8.0, PHP-7.4, PHP-7.3, PHP-7.2, PHP-7.1, PHP-7.0, PHP-5.6, PHP-5.5, PHP-5.4, PHP-5.3, PHP-5.2. All were listed Free. Each is a PHP runtime version, not a different website application. Select the version required by your software and still covered by appropriate security support. Old PHP 5.x and 7.x entries are legacy choices, not recommendations for a new site. Check the official support table before choosing or migrating a version. Installing a newer runtime does not automatically switch every existing website to it. Back up and test the site, required extensions and the selected web server before changing its runtime.

6. Optional apps and plugins
Site Diagnosis — Listed Paid
Helps investigate common website failures; verify its suggestions against the actual logs.

Network Threat Detection — Listed Paid
Reviews network traffic for suspicious activity; check the supported OS before installing.

Website Analytics — Listed Paid
Adds visitor analytics; review tracking, privacy and storage requirements.

Files Sync — Listed Paid
Transfers files between locations on a schedule or continuously; test conflict and deletion behavior first.

Network Scan Detection — Listed Paid
Looks for scanning activity against the server; alerts still need investigation.

aaPanel Daily Report — Listed Paid
Summarizes operational and security information for regular review.

Website statistics-v2 — Listed Paid
Provides website traffic statistics for supported web servers.

Nginx WAF — Listed Paid
Adds application-layer filtering for Nginx; tune rules to avoid blocking legitimate requests.

Tamper-proof for Enterprise — Listed Paid
Restricts unwanted website file changes; review incompatibilities with other tamper protection.

Load Balance — Listed Paid
Distributes requests across backends; requires healthy services and a tested routing plan.

aaPanel Mobile — Listed Paid
Provides mobile management access; protect the associated account.

Apache WAF — Listed Paid
Adds application-layer filtering for Apache; review compatibility and false positives.

Microsoft OneDrive — Listed Free
Stores backups in a Microsoft cloud account; account limits and charges are separate.

PHP code security — Listed Paid
Adds PHP behavior checks; test application compatibility before enabling blocking.

Task manager — Listed Paid
Provides controls for processes and other system tasks; stopping the wrong service can interrupt hosting.

Website Tamper-proof — Listed Paid
Protects selected website files against changes; allow your legitimate deployment workflow.

aaPanel user Manager — Listed Paid
Manages panel users and menu permissions on supported panel versions; grant the minimum access needed.

System hardening — Listed Paid
Offers system protection settings; review each change and its recovery route.

File monitor — Listed Paid
Records file changes and offers related checks or backups.

Disk analysis — Listed Paid
Helps locate large files and directories; review files before cleanup.

aaCloud — Listed Free
Connects servers to centralized management; review the access and data involved.

OpenClaw(Docker) — Listed Free
Runs a self-hosted AI assistant through Docker; plan disk, memory, model and integration requirements.

OpenClaw — Listed Free
Runs a self-hosted AI assistant; use a separate lab and review messaging integrations and credentials.

Tencent EdgeOne CDN — Listed Free
Connects edge/CDN services; review the provider account, plan and DNS requirements.

Anti-intrusion — Listed Paid
Adds protections around service and process activity; validate compatibility with your workloads.

Website basic Statistics — Listed Free
Provides a basic view of website visits.

CloudFlare free CDN — Listed Free
Integrates Cloudflare website/CDN configuration; DNS and account requirements still apply.

Website Log Analyzer — Listed Free
Analyzes selected Nginx access logs to help investigate traffic.

WebSite Speed — Listed Free
Offers website acceleration controls; review its current documentation and test before enabling.

WebHook — Listed Free
Runs configured actions on callbacks; protect webhook secrets and limit command privileges.

DeepSeek-R1 — Listed Free
Provides an AI model integration; review its current deployment, memory and model requirements.

S3 Storage (AWS S3) — Listed Free
Sends backups to S3-compatible storage; protect access keys and test recovery.

Google Drive — Listed Free
Sends backups to Google Drive; verify account authorization and storage capacity.

Fail2ban Manager — Listed Free
Manages bans triggered by repeated authentication failures; verify log paths and trusted-client access.

Cloud dns — Listed Free
Manages supported DNS-provider records; use narrowly scoped provider tokens.

DDNS Manager — Listed Free
Updates supported DNS records when an address changes.

One-click migration beta — Listed Free
Helps migrate panel data; verify backups, compatibility and the destination before relying on it.

one-click deployment — Listed Free
Deploys supported applications; update and secure each application after installation.

Intrusion Detection — Listed Free
Monitors for possible intrusion activity; review alerts instead of treating them as proof.

FTP Storage — Listed Free
Sends backups to an FTP destination; review encryption support before transmitting private data.

ClamAV — Listed Free
Scans files for malware signatures; scan results do not replace patching or incident review.

frp manager — Listed Free
Manages reverse-proxy tunnels; review which private services become reachable.

Platform Ops — Listed Paid
Coordinates maintenance across servers; protect stored access and review batch operations.

Disk Mount Manager — Listed Free
Manages disk mounts; back up first and distinguish mounting from formatting.

Google Cloud Storage — Listed Free
Sends backups to Google Cloud Storage; provider permissions and charges are separate.

Performance testing — Listed Free
Runs CPU, memory, disk and network benchmarks; schedule away from busy production periods.

System boot items — Listed Free
Manages startup services and environment settings; avoid disabling hosting dependencies.

NFS Manager — Listed Paid
Manages network file shares and mounts; restrict clients and export permissions.

Server performance testing — Listed Free
Provides server benchmarking; tests can compete with live workloads.

Linux Tools — Listed Free
Provides system utilities including DNS, swap and network settings; review disruptive changes.

PHP Guardian — Listed Free
Monitors PHP-FPM availability; investigate the underlying failure rather than only restarting it.

Log cleanup — Listed Free
Removes selected logs or temporary data; retain troubleshooting and audit evidence first.

Anti-Spam Gateway — Listed Free
Filters mail through a gateway; review routing and false-positive behavior.

IP setup tool — Listed Free
Changes network address configuration; its listed OS support is old, so check compatibility and console recovery.

Nginx free firewall — Listed Free
The catalog gives little detail; check maintenance and documentation before choosing it for protection.

7. Retired or replaced catalog entries
These rows were still visible but their catalog notices direct users to replacements. Do not use an old install guide without checking the current location and support status.

Dns Manager — Listed Free
Retired catalog entry; use the panel Domains area indicated by the catalog.

aaPanel AI Assistant — Listed Free
Unmaintained plugin entry; use the current AI menu indicated by the catalog.

Sync Tool — Listed Paid
Retired entry; the catalog directs users to Files Sync.

Abnormal Push — Listed Paid
Retired entry; the catalog directs users to Settings → Alarm.

SYS Firewall — Listed Free
Retired entry; use the current Security area.

PM2 Manager — Listed Free
Retired entry; use Website → Node Project as indicated by the catalog.

Docker Manager — Listed Free
Retired entry; use the current Docker menu.

Python Manager — Listed Free
Older entry marked for replacement; use Website → Python Project.

Website statistics — Listed Paid
Retired entry; use Website statistics-v2.

8. How to verify an installation
Return to Installed, open Setting, confirm the service status and inspect logs. Test the actual function: load a website, connect to the database through the intended private route, transfer a file using encryption or restore a backup into an isolated environment. A green service indicator alone does not prove the application is configured correctly. If setup fails, record the app/version, OS, precise error and relevant redacted log lines when asking for support.

Lab scope
The installed view shows Nginx, Apache, MariaDB, Mail Server, Redis, Pure-FTPd, phpMyAdmin, PHP 8.5, PHP 8.4 and OpenLiteSpeed. Our related guides demonstrate selected functions of this stack. The remaining catalog entries are explanations based on the visible catalog; they have not all been installed, audited or benchmarked.

Continue with focused guides
WordPress Redis object cache
Pure-FTPd installation and service checks
Firewall rules after installing services

References: aaPanel App Store documentation and PHP supported versions. Catalog review and original lab screenshot: © AdminsForum.]]> https://adminsforum.com/Thread-guide-configure-cloudflare-tunnel-in-aapanel Sun, 11 Oct 2026 21:02:29 +0800 DEV]]> https://adminsforum.com/Thread-guide-configure-cloudflare-tunnel-in-aapanel This is the next guide after installing the Cloudflare Tunnel plugin in aaPanel.

We will connect one test website to a public hostname using fdciabdul's community plugin. The example hostname is tunnel-test.example.com: replace it everywhere with a subdomain of your own Cloudflare-managed domain.

Verification scope: Plugin controls and behavior are based on source commit ff0c7359f050fbca2b9efab11b61aa462d65b2d0 (metadata 1.3.0), checked against Cloudflare's documentation. Live plugin installation, account authorization and end-to-end screenshots remain pending. This is a written setup walkthrough, not a claim that our lab tunnel is already running.

1. Prepare the test website first
Open aaPanel → Website and create or select a harmless test website bound to your chosen hostname. Put an identifiable test page in its document root, for example “AdminsForum tunnel test.” Use the web server and listening port that actually serve this website.

For a local HTTP origin on port 80, open Terminal and check:

Code:Copy

curl -I -H 'Host: tunnel-test.example.com' http://127.0.0.1:80

Replace the hostname. The response must belong to the intended site. A connection refusal means the local server/port needs fixing first. A default website means its hostname binding needs checking. An unexpected redirect needs investigating before adding the tunnel.

Why this comes first: Cloudflare forwards requests to the origin you configure. It cannot repair an incorrect local website or missing web server.

2. Check the Cloudflare zone
Your domain must be active in Cloudflare with its authoritative nameservers set correctly. Decide on a dedicated unused test subdomain. Inspect its DNS records before proceeding and record any existing values you need to preserve.

Do not reuse a hostname serving an existing website or mail service. The reviewed plugin has DNS conflict and cleanup limitations described in our plugin review and fixes.

3. Configure the account profile and credentials
Open Cloudflare Tunnel in aaPanel, then its credentials/profile section. Give the profile a recognizable name, such as AdminsLab.

There are two separate credentials in this locally managed workflow:

• Browser-login certificate: supports the cloudflared CLI operations used to create/manage tunnels.
  
• DNS API token: lets the plugin discover the zone and automate its CNAME record.
  

Saving a DNS token is not proof that tunnel CLI login is ready. Likewise, browser authorization does not prove the token can edit DNS.

For the DNS token, use zone-scoped permissions suitable for the plugin's zone lookup and DNS edits, limited to the intended test zone. Its code lists zones and modifies records; verify both operations instead of relying only on a token-valid response. Avoid giving unrelated domains to the token.

Use the plugin's Login/Get login URL control for the intended profile, follow the Cloudflare browser authorization, then return and check the result. Protect tokens, login links and certificate files; redact them in screenshots.

If Login reports “Profile not found”: an empty profile is filtered out by the reviewed upstream lookup. Stop and follow the version-specific fix article linked above. Do not keep creating duplicate profiles.

4. Create a locally managed tunnel
In the tunnel section, select the authorized profile and enter a unique name such as adminsforum-lab. Use Create & use, or Create followed by Use if your installed build separates those actions.

Record the returned tunnel UUID and confirm the selected profile. Tunnel creation generates credentials; it does not by itself establish a running connector.

Start with a fresh locally managed test tunnel. A tunnel managed through the Cloudflare dashboard can obtain its ingress remotely and ignore the local configuration this plugin writes. Mixing both management approaches makes troubleshooting confusing.

5. Add the hostname mapping
In the hostnames/ingress section:

1. Enter your dedicated hostname, such as tunnel-test.example.com.
   
2. Set the local service to http://127.0.0.1:80 only if that is the origin verified in step 1. Use the actual port for your website.
   
3. Select the Cloudflare zone that owns the hostname and the appropriate profile where offered.
   
4. Enable automatic CNAME creation only after checking that the hostname has no conflicting records.
   
5. Save the mapping and read the complete result.
   

A local HTTP service behind the connector is different from the public HTTPS address visitors use. If you choose an HTTPS origin, validate its certificate and hostname/SNI rather than disabling certificate verification as a default fix.

In Cloudflare DNS, verify a proxied CNAME for the chosen hostname pointing to the selected UUID's cfargotunnel.com target. Do not create a second competing A/AAAA record for that same tunnel hostname.

6. Verify configuration and the connector service
The plugin writes its local configuration to /etc/cloudflared/config.yml. Review the tunnel ID, credentials path, intended hostname/service and final fallback rule. Avoid posting the credentials file itself.

Validate the generated ingress:

Code:Copy

cloudflared tunnel --config /etc/cloudflared/config.yml ingress validate

Use the Advanced service controls to install/start the service when needed, then check its actual state:

Code:Copy

systemctl is-active cloudflared journalctl -u cloudflared -n 50 --no-pager

Expected checkpoint: ingress validation succeeds, the intended service is active and its logs show successful connector registration. A saved row or an “apply succeeded” message alone is insufficient: the reviewed upstream code can miss restart failures.

7. Open the public website
Open https://tunnel-test.example.com using your own hostname. Verify the identifiable page from step 1, not merely a response from any website.

Check these independently:

• The correct local origin responds.
  
• The intended tunnel/profile is selected.
  
• DNS points to that tunnel.
  
• Ingress maps the hostname to the correct origin.
  
• The connector is actually running.
  
• The public page is the intended website.
  

Publishing a website through a tunnel does not automatically create a Cloudflare Access login policy. This walkthrough maps a public test website; administration/private applications need a separate access-control design.

8. Troubleshoot the failing checkpoint

• No zone listed: check account ownership and the token's zone scope/permissions, then refresh the zone list.
  
• Wrong website: check the aaPanel site binding and Host header. Use httpHostHeader only when deliberately required by the origin.
  
• Origin connection error: repeat the local request and check the service port.
  
• Certificate error for HTTPS origin: check certificate trust and SNI.
  
• Connector not connected: inspect service logs and outbound connectivity.
  
• Save/apply failed: inspect both DNS and configuration. Upstream rollback does not reliably restore every changed component.
  

Restore recorded DNS/configuration values deliberately if abandoning the test. Do not delete unrelated records to clear an error.

Guide sequence: Installation → this configuration walkthrough → version-specific fixes.

References: Plugin source and author instructions · Cloudflare locally managed tunnel guide · Cloudflare credential permissions.]]> This is the next guide after installing the Cloudflare Tunnel plugin in aaPanel.

We will connect one test website to a public hostname using fdciabdul's community plugin. The example hostname is tunnel-test.example.com: replace it everywhere with a subdomain of your own Cloudflare-managed domain.

Verification scope: Plugin controls and behavior are based on source commit ff0c7359f050fbca2b9efab11b61aa462d65b2d0 (metadata 1.3.0), checked against Cloudflare's documentation. Live plugin installation, account authorization and end-to-end screenshots remain pending. This is a written setup walkthrough, not a claim that our lab tunnel is already running.

1. Prepare the test website first
Open aaPanel → Website and create or select a harmless test website bound to your chosen hostname. Put an identifiable test page in its document root, for example “AdminsForum tunnel test.” Use the web server and listening port that actually serve this website.

For a local HTTP origin on port 80, open Terminal and check:

Code:Copy

curl -I -H 'Host: tunnel-test.example.com' http://127.0.0.1:80

Replace the hostname. The response must belong to the intended site. A connection refusal means the local server/port needs fixing first. A default website means its hostname binding needs checking. An unexpected redirect needs investigating before adding the tunnel.

Why this comes first: Cloudflare forwards requests to the origin you configure. It cannot repair an incorrect local website or missing web server.

2. Check the Cloudflare zone
Your domain must be active in Cloudflare with its authoritative nameservers set correctly. Decide on a dedicated unused test subdomain. Inspect its DNS records before proceeding and record any existing values you need to preserve.

Do not reuse a hostname serving an existing website or mail service. The reviewed plugin has DNS conflict and cleanup limitations described in our plugin review and fixes.

3. Configure the account profile and credentials
Open Cloudflare Tunnel in aaPanel, then its credentials/profile section. Give the profile a recognizable name, such as AdminsLab.

There are two separate credentials in this locally managed workflow:

• Browser-login certificate: supports the cloudflared CLI operations used to create/manage tunnels.
  
• DNS API token: lets the plugin discover the zone and automate its CNAME record.
  

Saving a DNS token is not proof that tunnel CLI login is ready. Likewise, browser authorization does not prove the token can edit DNS.

For the DNS token, use zone-scoped permissions suitable for the plugin's zone lookup and DNS edits, limited to the intended test zone. Its code lists zones and modifies records; verify both operations instead of relying only on a token-valid response. Avoid giving unrelated domains to the token.

Use the plugin's Login/Get login URL control for the intended profile, follow the Cloudflare browser authorization, then return and check the result. Protect tokens, login links and certificate files; redact them in screenshots.

If Login reports “Profile not found”: an empty profile is filtered out by the reviewed upstream lookup. Stop and follow the version-specific fix article linked above. Do not keep creating duplicate profiles.

4. Create a locally managed tunnel
In the tunnel section, select the authorized profile and enter a unique name such as adminsforum-lab. Use Create & use, or Create followed by Use if your installed build separates those actions.

Record the returned tunnel UUID and confirm the selected profile. Tunnel creation generates credentials; it does not by itself establish a running connector.

Start with a fresh locally managed test tunnel. A tunnel managed through the Cloudflare dashboard can obtain its ingress remotely and ignore the local configuration this plugin writes. Mixing both management approaches makes troubleshooting confusing.

5. Add the hostname mapping
In the hostnames/ingress section:

1. Enter your dedicated hostname, such as tunnel-test.example.com.
   
2. Set the local service to http://127.0.0.1:80 only if that is the origin verified in step 1. Use the actual port for your website.
   
3. Select the Cloudflare zone that owns the hostname and the appropriate profile where offered.
   
4. Enable automatic CNAME creation only after checking that the hostname has no conflicting records.
   
5. Save the mapping and read the complete result.
   

A local HTTP service behind the connector is different from the public HTTPS address visitors use. If you choose an HTTPS origin, validate its certificate and hostname/SNI rather than disabling certificate verification as a default fix.

In Cloudflare DNS, verify a proxied CNAME for the chosen hostname pointing to the selected UUID's cfargotunnel.com target. Do not create a second competing A/AAAA record for that same tunnel hostname.

6. Verify configuration and the connector service
The plugin writes its local configuration to /etc/cloudflared/config.yml. Review the tunnel ID, credentials path, intended hostname/service and final fallback rule. Avoid posting the credentials file itself.

Validate the generated ingress:

Code:Copy

cloudflared tunnel --config /etc/cloudflared/config.yml ingress validate

Use the Advanced service controls to install/start the service when needed, then check its actual state:

Code:Copy

systemctl is-active cloudflared journalctl -u cloudflared -n 50 --no-pager

Expected checkpoint: ingress validation succeeds, the intended service is active and its logs show successful connector registration. A saved row or an “apply succeeded” message alone is insufficient: the reviewed upstream code can miss restart failures.

7. Open the public website
Open https://tunnel-test.example.com using your own hostname. Verify the identifiable page from step 1, not merely a response from any website.

Check these independently:

• The correct local origin responds.
  
• The intended tunnel/profile is selected.
  
• DNS points to that tunnel.
  
• Ingress maps the hostname to the correct origin.
  
• The connector is actually running.
  
• The public page is the intended website.
  

Publishing a website through a tunnel does not automatically create a Cloudflare Access login policy. This walkthrough maps a public test website; administration/private applications need a separate access-control design.

8. Troubleshoot the failing checkpoint

• No zone listed: check account ownership and the token's zone scope/permissions, then refresh the zone list.
  
• Wrong website: check the aaPanel site binding and Host header. Use httpHostHeader only when deliberately required by the origin.
  
• Origin connection error: repeat the local request and check the service port.
  
• Certificate error for HTTPS origin: check certificate trust and SNI.
  
• Connector not connected: inspect service logs and outbound connectivity.
  
• Save/apply failed: inspect both DNS and configuration. Upstream rollback does not reliably restore every changed component.
  

Restore recorded DNS/configuration values deliberately if abandoning the test. Do not delete unrelated records to clear an error.

Guide sequence: Installation → this configuration walkthrough → version-specific fixes.

References: Plugin source and author instructions · Cloudflare locally managed tunnel guide · Cloudflare credential permissions.]]> https://adminsforum.com/Thread-guide-install-cloudflare-tunnel-plugin-in-aapanel Sun, 11 Oct 2026 20:54:06 +0800 DEV]]> https://adminsforum.com/Thread-guide-install-cloudflare-tunnel-plugin-in-aapanel Start here: install the community Cloudflare Tunnel plugin before configuring a tunnel or applying bug fixes.

This plugin adds a Cloudflare Tunnel wizard to aaPanel. It is maintained by fdciabdul and is a third-party extension. The plugin interface and the cloudflared connector are separate components: importing the ZIP installs the interface; the first wizard step installs the connector.

Verification scope: These steps follow the author's installation instructions and our source review of commit ff0c7359f050fbca2b9efab11b61aa462d65b2d0 (source metadata 1.3.0). We have not yet completed a live import and end-to-end Cloudflare test. Screenshots will be added after that test; this article does not claim a lab-tested installation.

1. What you need

• An aaPanel installation and access to its App Store as an administrator.
  
• A disposable Linux lab server for your first attempt.
  
• Outbound internet access for downloading cloudflared.
  
• For the later configuration guide: a Cloudflare account, a domain using Cloudflare DNS and a working local test website.
  

You do not need to create a tunnel or change website DNS just to import the plugin. A domain becomes necessary when you connect a public hostname to your website.

2. Check existing tunnels and make a backup
If cloudflared already runs on this server, record its service and configuration before proceeding. The plugin manages /etc/cloudflared/config.yml and the cloudflared service; do not use an existing production connector as a learning environment.

For a read-only check in aaPanel's Terminal:

Code:Copy

command -v cloudflared systemctl status cloudflared --no-pager

A missing binary or service on a fresh server is expected. If a service is present, inspect who manages it before importing another controller. Back up an existing /www/server/panel/plugin/cloudflare_tunnel directory, its data subdirectory, /etc/cloudflared and any associated service configuration before upgrading. Store credential backups outside public website folders.

3. Download the author's plugin archive
Open the author's repository and use its Releases link to choose the intended plugin release. Download the plugin ZIP asset rather than GitHub's generic “Source code” archive.

The README names a 1.2.0 archive, while the source we reviewed identifies itself as 1.3.0. Check the actual release asset and info.json; do not assume an old filename is the newest version. If no suitable plugin archive is available, stop at this step rather than importing the entire repository ZIP.

Open the downloaded archive locally before uploading it. The author's packaging instructions put info.json, install.sh, index.html, icon.png and the Python modules at the archive root. A repository wrapper folder is different from this import format. The archive must not contain another user's API tokens, certificates or runtime data.

4. Import the ZIP into aaPanel

1. Sign into aaPanel on the lab server.
   
2. Open App Store in the sidebar.
   
3. Locate the Import or upload control; the author describes it at the top right. Its placement can vary between panel versions.
   
4. Choose the plugin ZIP downloaded in step 3.
   
5. Submit the import and wait for the installation result.
   
6. Find Cloudflare Tunnel in the installed applications and open it.
   

Do not search for an official Cloudflare Tunnel product and assume it is the same extension. This guide refers specifically to fdciabdul's plugin.

Expected checkpoint: The Cloudflare Tunnel interface opens with sections for the binary, credentials/profiles, tunnel and hostnames. Record the installed version and compare it with your downloaded archive.

5. Install the cloudflared connector

1. Open the first wizard section for the cloudflared binary.
   
2. Use Install / Update.
   
3. Read the complete result and allow the download/install operation to finish.
   
4. Use Recheck if available.
   
5. Confirm the binary version, either in the interface or with the command below.
   

Code:Copy

cloudflared --version

The reviewed implementation returns “already installed” when the binary exists. The button label therefore does not prove that an existing binary was upgraded. Record the reported version instead of repeatedly pressing Install / Update.

If the download fails, check outbound HTTPS access, the server's architecture and the installation error. Keep certificate verification enabled. Import success alone does not prove the connector was installed.

6. Stop at the installation checkpoint
At this point the plugin should open and cloudflared should report its version. A public website is not expected to work yet: account authorization, tunnel creation, hostname mapping and service verification are later configuration steps.

The plugin exposes separate credential mechanisms. A browser-login certificate supports tunnel CLI operations; an API token is used for Cloudflare DNS automation. Do not assume that saving a DNS token completes browser authorization.

If you add an empty profile in the reviewed 1.3.0 source and Login returns “Profile not found,” read Fix Cloudflare Tunnel Profile Not Found in aaPanel. Match the installed source version before applying a code change. That article also describes other limitations; it is not a certified plugin release.

Common installation problems

• ZIP import fails: confirm that this is the plugin asset with the required files at its root, not the generic repository archive. Save the exact error.
  
• Plugin opens with missing methods: check for mismatched old and new files. Back up runtime data before replacing anything. The author's source installation notes call for a panel restart after first install or Python changes; a restart briefly interrupts panel sessions.
  
• Binary missing after import: complete the separate connector installation in step 5.
  
• Service is not active: installation alone does not create a configured working tunnel. Continue with account/tunnel configuration before treating this as a fault.
  

Guide order: Install plugin → configure account and test website → verify tunnel/service/DNS → troubleshoot any errors.

Source: Cloudflare Tunnel aaPanel plugin repository and installation instructions. Credit belongs to the original author. No reviewed source bundle is being publicly distributed with this article.]]> Start here: install the community Cloudflare Tunnel plugin before configuring a tunnel or applying bug fixes.

This plugin adds a Cloudflare Tunnel wizard to aaPanel. It is maintained by fdciabdul and is a third-party extension. The plugin interface and the cloudflared connector are separate components: importing the ZIP installs the interface; the first wizard step installs the connector.

Verification scope: These steps follow the author's installation instructions and our source review of commit ff0c7359f050fbca2b9efab11b61aa462d65b2d0 (source metadata 1.3.0). We have not yet completed a live import and end-to-end Cloudflare test. Screenshots will be added after that test; this article does not claim a lab-tested installation.

1. What you need

• An aaPanel installation and access to its App Store as an administrator.
  
• A disposable Linux lab server for your first attempt.
  
• Outbound internet access for downloading cloudflared.
  
• For the later configuration guide: a Cloudflare account, a domain using Cloudflare DNS and a working local test website.
  

You do not need to create a tunnel or change website DNS just to import the plugin. A domain becomes necessary when you connect a public hostname to your website.

2. Check existing tunnels and make a backup
If cloudflared already runs on this server, record its service and configuration before proceeding. The plugin manages /etc/cloudflared/config.yml and the cloudflared service; do not use an existing production connector as a learning environment.

For a read-only check in aaPanel's Terminal:

Code:Copy

command -v cloudflared systemctl status cloudflared --no-pager

A missing binary or service on a fresh server is expected. If a service is present, inspect who manages it before importing another controller. Back up an existing /www/server/panel/plugin/cloudflare_tunnel directory, its data subdirectory, /etc/cloudflared and any associated service configuration before upgrading. Store credential backups outside public website folders.

3. Download the author's plugin archive
Open the author's repository and use its Releases link to choose the intended plugin release. Download the plugin ZIP asset rather than GitHub's generic “Source code” archive.

The README names a 1.2.0 archive, while the source we reviewed identifies itself as 1.3.0. Check the actual release asset and info.json; do not assume an old filename is the newest version. If no suitable plugin archive is available, stop at this step rather than importing the entire repository ZIP.

Open the downloaded archive locally before uploading it. The author's packaging instructions put info.json, install.sh, index.html, icon.png and the Python modules at the archive root. A repository wrapper folder is different from this import format. The archive must not contain another user's API tokens, certificates or runtime data.

4. Import the ZIP into aaPanel

1. Sign into aaPanel on the lab server.
   
2. Open App Store in the sidebar.
   
3. Locate the Import or upload control; the author describes it at the top right. Its placement can vary between panel versions.
   
4. Choose the plugin ZIP downloaded in step 3.
   
5. Submit the import and wait for the installation result.
   
6. Find Cloudflare Tunnel in the installed applications and open it.
   

Do not search for an official Cloudflare Tunnel product and assume it is the same extension. This guide refers specifically to fdciabdul's plugin.

Expected checkpoint: The Cloudflare Tunnel interface opens with sections for the binary, credentials/profiles, tunnel and hostnames. Record the installed version and compare it with your downloaded archive.

5. Install the cloudflared connector

1. Open the first wizard section for the cloudflared binary.
   
2. Use Install / Update.
   
3. Read the complete result and allow the download/install operation to finish.
   
4. Use Recheck if available.
   
5. Confirm the binary version, either in the interface or with the command below.
   

Code:Copy

cloudflared --version

The reviewed implementation returns “already installed” when the binary exists. The button label therefore does not prove that an existing binary was upgraded. Record the reported version instead of repeatedly pressing Install / Update.

If the download fails, check outbound HTTPS access, the server's architecture and the installation error. Keep certificate verification enabled. Import success alone does not prove the connector was installed.

6. Stop at the installation checkpoint
At this point the plugin should open and cloudflared should report its version. A public website is not expected to work yet: account authorization, tunnel creation, hostname mapping and service verification are later configuration steps.

The plugin exposes separate credential mechanisms. A browser-login certificate supports tunnel CLI operations; an API token is used for Cloudflare DNS automation. Do not assume that saving a DNS token completes browser authorization.

If you add an empty profile in the reviewed 1.3.0 source and Login returns “Profile not found,” read Fix Cloudflare Tunnel Profile Not Found in aaPanel. Match the installed source version before applying a code change. That article also describes other limitations; it is not a certified plugin release.

Common installation problems

• ZIP import fails: confirm that this is the plugin asset with the required files at its root, not the generic repository archive. Save the exact error.
  
• Plugin opens with missing methods: check for mismatched old and new files. Back up runtime data before replacing anything. The author's source installation notes call for a panel restart after first install or Python changes; a restart briefly interrupts panel sessions.
  
• Binary missing after import: complete the separate connector installation in step 5.
  
• Service is not active: installation alone does not create a configured working tunnel. Continue with account/tunnel configuration before treating this as a fault.
  

Guide order: Install plugin → configure account and test website → verify tunnel/service/DNS → troubleshoot any errors.

Source: Cloudflare Tunnel aaPanel plugin repository and installation instructions. Credit belongs to the original author. No reviewed source bundle is being publicly distributed with this article.]]> https://adminsforum.com/Thread-guide-fix-cloudflare-tunnel-profile-not-found-in-aapanel Sun, 11 Oct 2026 20:48:38 +0800 DEV]]> https://adminsforum.com/Thread-guide-fix-cloudflare-tunnel-profile-not-found-in-aapanel New to this plugin? Start with Install Cloudflare Tunnel Plugin in aaPanel Free Edition, then use this article if you encounter the profile error.

A newly created Cloudflare Tunnel profile can return “Profile not found” before its first browser login. This article explains the confirmed cause and the local code fix, plus the other issues found during review.

Reviewed build: Community plugin by fdciabdul, source commit ff0c7359f050fbca2b9efab11b61aa462d65b2d0; info.json version 1.3.0. This is a source-level review with isolated tests. Live plugin installation and Cloudflare end-to-end verification are pending. The fixes below do not make the whole plugin a certified or production-tested release.

1. Fix “Profile not found” on first login
The UI allows adding a profile without an API token. However, DnsManager.find_profile() looks in _all_profiles(), which intentionally hides profiles that have neither token nor cert_path. That filter is useful for choosing working DNS credentials, but wrong for resolving the profile that is about to receive its first browser-login certificate.

In dns_manager.py, change find_profile() to check the saved profiles first:

Code:Copy

def find_profile(self, profile_id):     for p in self._read_profiles():         if isinstance(p, dict) and p.get("id") == profile_id:             return dict(p, virtual=False)     for p in self._all_profiles():         if p["id"] == profile_id:             return p     return None

Keep the empty-profile filter in _all_profiles(). Do not broadly treat an empty profile as valid API credentials. Our regression test creates an empty saved profile, supplies no usable profiles and verifies that find_profile still returns the intended profile for login. It passes with this change.

2. Fix unsafe UI string encoding
Profile names are inserted into single-quoted JavaScript onclick arguments using an HTML-only encoder. An ordinary apostrophe can break an action; crafted text can introduce script in the authenticated panel UI. Encode for the JavaScript string context first, then the surrounding HTML attribute. The reviewed patch uses a separate jsesc helper for those action arguments, and escapes names/errors in HTML-rendered dialogs. HTML escaping alone is insufficient here.

Do not test script injection on a live shared panel. Our six isolated JavaScript tests round-trip apostrophes, backslashes, quotes, newlines and markup without executing injected instructions. The entire UI script also parses successfully. We have not demonstrated unauthenticated panel compromise.

3. Protect installer staging and credentials
The original binary installer downloads into one predictable file under /tmp. A privileged process should use a unique private temporary directory, invoke curl/install with argument arrays, restrict download redirects to HTTPS and check command results. The review patch implements that approach. Independent checksum verification and release pinning remain future work.

Validate tunnel IDs as UUIDs before saving them or constructing credential paths. Apply mode 0600 to existing and newly relocated tunnel JSON credentials, and report relocation failures. Keep credentials out of public web directories, screenshots and support replies.

4. Fix configuration encoding and restart reporting
In ingress_manager.py, use proper quoted YAML scalar encoding rather than only replacing quotation marks. JSON-quoted strings are valid YAML scalars and handle backslashes/control characters:

Code:Copy

def _yaml_escape(s):     return json.dumps(str(s), ensure_ascii=True)

The source also ignores the exit status of systemctl restart. Check it and return a failure when the restart fails:

Code:Copy

restarted = subprocess.run(     ["systemctl", "restart", SERVICE_NAME],     capture_output=True, text=True, timeout=30, ) if restarted.returncode != 0:     return public.returnMsg(         False,         "Config written, but service restart failed: "         + (restarted.stderr or restarted.stdout),     )

This change reports a real failure; it does not undo every previous DNS/config change. Do not describe it as complete transactional rollback.

5. Avoid DNS data loss
Before an automatic CNAME upsert, inspect every record returned for the hostname. Our patch refuses conflicting non-CNAME or multiple-record responses instead of replacing the first record. A user-selected zone must also match the hostname; stale/unavailable zone selections are rejected rather than silently redirected to another zone.

For removal, refuse records that are not tunnel-target CNAMEs and check each Cloudflare deletion response. Do not delete A, AAAA, MX or TXT records simply because they share a hostname. Our tests verify these refusal paths and confirm API errors are returned.

Remaining limitation: the patch recognizes tunnel CNAMEs by target suffix, not an ownership manifest for the particular tunnel. Full DNS/config/service rollback and concurrent-write locking are also still needed.

6. Validate before applying to a server
Back up the installed plugin directory, runtime data and /etc/cloudflared first. Match the exact source version; do not paste partial changes into an unrelated older release. Check Python syntax and run the isolated tests. Our local review passed 13 backend tests and six UI string-encoding checks, plus script parsing and diff whitespace checks.

Then use a disposable lab server to verify import, empty-profile login, account selection, credentials, origin response, generated ingress, DNS changes and actual service state. An API token accepted by the verification endpoint does not prove the zone permissions needed by this plugin. Browser login for tunnel CLI operations and the DNS API token serve different purposes.

7. What is not yet fixed or verified

• Complete rollback across DNS, JSON state, config and service.
  
• Concurrent profile login and re-login certificate isolation.
  
• Shared locking and atomic persistence across all managers.
  
• Independent checksum verification and a real binary update operation.
  
• aaPanel dispatcher authentication/CSRF behavior and live end-to-end operation.
  

No public exploit demonstration is needed to explain these fixes. The patched download is not publicly released yet; the written changes above are available for maintainer review.

Credits and references: Original plugin repository · Author's aaPanel thread · Cloudflare tunnel permissions]]> New to this plugin? Start with Install Cloudflare Tunnel Plugin in aaPanel Free Edition, then use this article if you encounter the profile error.

A newly created Cloudflare Tunnel profile can return “Profile not found” before its first browser login. This article explains the confirmed cause and the local code fix, plus the other issues found during review.

Reviewed build: Community plugin by fdciabdul, source commit ff0c7359f050fbca2b9efab11b61aa462d65b2d0; info.json version 1.3.0. This is a source-level review with isolated tests. Live plugin installation and Cloudflare end-to-end verification are pending. The fixes below do not make the whole plugin a certified or production-tested release.

1. Fix “Profile not found” on first login
The UI allows adding a profile without an API token. However, DnsManager.find_profile() looks in _all_profiles(), which intentionally hides profiles that have neither token nor cert_path. That filter is useful for choosing working DNS credentials, but wrong for resolving the profile that is about to receive its first browser-login certificate.

In dns_manager.py, change find_profile() to check the saved profiles first:

Code:Copy

def find_profile(self, profile_id):     for p in self._read_profiles():         if isinstance(p, dict) and p.get("id") == profile_id:             return dict(p, virtual=False)     for p in self._all_profiles():         if p["id"] == profile_id:             return p     return None

Keep the empty-profile filter in _all_profiles(). Do not broadly treat an empty profile as valid API credentials. Our regression test creates an empty saved profile, supplies no usable profiles and verifies that find_profile still returns the intended profile for login. It passes with this change.

2. Fix unsafe UI string encoding
Profile names are inserted into single-quoted JavaScript onclick arguments using an HTML-only encoder. An ordinary apostrophe can break an action; crafted text can introduce script in the authenticated panel UI. Encode for the JavaScript string context first, then the surrounding HTML attribute. The reviewed patch uses a separate jsesc helper for those action arguments, and escapes names/errors in HTML-rendered dialogs. HTML escaping alone is insufficient here.

Do not test script injection on a live shared panel. Our six isolated JavaScript tests round-trip apostrophes, backslashes, quotes, newlines and markup without executing injected instructions. The entire UI script also parses successfully. We have not demonstrated unauthenticated panel compromise.

3. Protect installer staging and credentials
The original binary installer downloads into one predictable file under /tmp. A privileged process should use a unique private temporary directory, invoke curl/install with argument arrays, restrict download redirects to HTTPS and check command results. The review patch implements that approach. Independent checksum verification and release pinning remain future work.

Validate tunnel IDs as UUIDs before saving them or constructing credential paths. Apply mode 0600 to existing and newly relocated tunnel JSON credentials, and report relocation failures. Keep credentials out of public web directories, screenshots and support replies.

4. Fix configuration encoding and restart reporting
In ingress_manager.py, use proper quoted YAML scalar encoding rather than only replacing quotation marks. JSON-quoted strings are valid YAML scalars and handle backslashes/control characters:

Code:Copy

def _yaml_escape(s):     return json.dumps(str(s), ensure_ascii=True)

The source also ignores the exit status of systemctl restart. Check it and return a failure when the restart fails:

Code:Copy

restarted = subprocess.run(     ["systemctl", "restart", SERVICE_NAME],     capture_output=True, text=True, timeout=30, ) if restarted.returncode != 0:     return public.returnMsg(         False,         "Config written, but service restart failed: "         + (restarted.stderr or restarted.stdout),     )

This change reports a real failure; it does not undo every previous DNS/config change. Do not describe it as complete transactional rollback.

5. Avoid DNS data loss
Before an automatic CNAME upsert, inspect every record returned for the hostname. Our patch refuses conflicting non-CNAME or multiple-record responses instead of replacing the first record. A user-selected zone must also match the hostname; stale/unavailable zone selections are rejected rather than silently redirected to another zone.

For removal, refuse records that are not tunnel-target CNAMEs and check each Cloudflare deletion response. Do not delete A, AAAA, MX or TXT records simply because they share a hostname. Our tests verify these refusal paths and confirm API errors are returned.

Remaining limitation: the patch recognizes tunnel CNAMEs by target suffix, not an ownership manifest for the particular tunnel. Full DNS/config/service rollback and concurrent-write locking are also still needed.

6. Validate before applying to a server
Back up the installed plugin directory, runtime data and /etc/cloudflared first. Match the exact source version; do not paste partial changes into an unrelated older release. Check Python syntax and run the isolated tests. Our local review passed 13 backend tests and six UI string-encoding checks, plus script parsing and diff whitespace checks.

Then use a disposable lab server to verify import, empty-profile login, account selection, credentials, origin response, generated ingress, DNS changes and actual service state. An API token accepted by the verification endpoint does not prove the zone permissions needed by this plugin. Browser login for tunnel CLI operations and the DNS API token serve different purposes.

7. What is not yet fixed or verified

• Complete rollback across DNS, JSON state, config and service.
  
• Concurrent profile login and re-login certificate isolation.
  
• Shared locking and atomic persistence across all managers.
  
• Independent checksum verification and a real binary update operation.
  
• aaPanel dispatcher authentication/CSRF behavior and live end-to-end operation.
  

No public exploit demonstration is needed to explain these fixes. The patched download is not publicly released yet; the written changes above are available for maintainer review.

Credits and references: Original plugin repository · Author's aaPanel thread · Cloudflare tunnel permissions]]>