Changelog

## Summary - DNS editor: edit and delete records in place (AJAX, no page reload) - CSRF middleware replays POST bodies so DNS record forms keep their fields - Panel health watchdog: systemd timer restarts mrmpanel when `/health` stops responding ## Notes - Recommend 2 GB+ RAM for the full stack (web + mail + DNS + DB); low-memory hosts may feel slow or time out after idle

## Summary - User site backups (create / download / restore / delete) - ClamAV antivirus with Enable/Disable and a customizable scan schedule (default daily 03:00 quick, Sunday 03:30 full) - Email spam filter admin - WordPress starter theme (mrmpanel Clean) activated on new installs - Next.js starter and deploy wait so the site is not marked done on a 502

## Summary - Next.js deploy picks **Next.js version** 14 / 15 / 16 (patched pins) plus Node runtime - Starter installs matching \`next\` + React for that choice

Hide empty App version on deploy for stacks that have none (e.g. Next.js).

## Summary - **Files** action on each site opens a manager rooted at that site’s `domains/<hostname>/` folder - Upload, create folders, edit text, delete — without leaving the site tree

## Summary - Scheduled backups (systemd timer), retention, optional rsync/S3, verify, dashboard status - Path-safe file manager under `/home/<user>` - Adminer at `/dbadmin/` with one-click open - SMTP smarthost for outbound mail - Harder disk quotas when usrquota is available; soft `du` otherwise - Optional admin TOTP 2FA - Stack smoke script + scoped single-host support statement ## Notes Rollback pin: `v0.1.45`. Verify restores before trusting backups. Mail still needs a good IP or smarthost.

## Summary - **node-express**: run `npm install` before `node server.js` - **node-next**: install, build, then start with pinned `next@15.5.7` + React 19

## Summary - WordPress installs use https:// when DNS points here - Trust Traefik X-Forwarded-Proto so assets are not mixed-content blocked

## Summary - Generate WordPress security salts locally during deploy so EOL PHP CLI is not blocked by api.wordpress.org TLS

## Summary - WordPress core download uses a modern WP-CLI image so PHP 5.6/7.x deploys are not blocked by outdated CA certificates

## Summary - Fix site deploy failing with empty **Invalid domain name:** when CSRF middleware consumed the multipart body

## Summary - WordPress PHP choices: 5.6, 7.0/7.2/7.4, 8.0–8.5 (PHP 6 never shipped) - Compatible WordPress cores from 4.9 through 7.1, filtered by selected PHP