Notes from building KNJ Panel, in the order it actually happened.
blog /blɒɡ/ noun — 1. A web log. 2. Here: a build log. What we built, what broke, and what we learned.
A welcome email from our own server landed in a Microsoft 365 junk folder. Chasing that turned up two gaps, one small and one that mattered to everyone running the panel. What happened Every email carries a signature that proves it left from the domain it claims. The…
Read more →The newsletter box on our own website had gone quiet. A test sign-up showed “Thanks, you’re on the list”, but the address never reached the list. The cause…
Read more →The support desk gave the panel a lot of new screens, and next to them the older ones looked tired. So the whole panel got a fresh coat…
Read more →Until now, when something went wrong, a customer told us directly. That works for one family and one server. It does not work once other people run the…
Read more →Documentation drifts. Every feature change leaves a sentence somewhere that is no longer quite true, and nobody notices until a customer follows it. So after the security work…
Read more →After the penetration test we audited our own recent work: Deploy from Git’s keys, how the panel’s paths are shared with customer websites, the lock on the database…
Read more →The last open finding from the penetration test was the database administration tool. It still needed a valid login, but nothing about it needed to be visible to…
Read more →The documentation site now runs on the panel it documents, built by the panel’s own Deploy from Git, and every push to it goes live without anyone touching…
Read more →We installed the panel on a blank virtual machine, set it up the way a customer would, and then tested it from the outside with nothing but a…
Read more →Two jobs were sitting in the queue for over an hour: a website deploy and an SSL certificate. Neither was broken. They were waiting behind something else. Eight…
Read more →The customer’s File Manager problem was fixed twice before it was actually fixed. Both times the tests passed. The reason is worth writing down. Three places it worked…
Read more →After a customer’s bug report was fixed, we decided to go beyond a fix: stop patching the File Manager and build the one it should have been, with…
Read more →A customer’s own bug report arrived through the person who runs the server: uploads into some folders did nothing, the code editor opened blank, and saving any file…
Read more →The Traffic & Visitors page had been empty for weeks, while the same site was gaining subscribers every day. Nothing was reporting a problem, which was the problem.…
Read more →Sign-ups for the panel’s own update list had started arriving on their own. That is the moment a manual process stops being fine. The export-import routine The panel…
Read more →The last two audits looked at the server itself, from the point of view of one hosting customer curious about their neighbours. Readable by default Some things a…
Read more →The second audit found the most significant issue of the day, and it came from a sensible design choice. Quarantine in the wrong place When the malware scanner…
Read more →The first of four security audits in one day started with a question about something ordinary: where does the link in a password-reset email actually come from? Built…
Read more →The first real test of the new backup schedule failed before it started — not because anything broke, but because the system was certain it had already done…
Read more →A safety check that rejects something harmless is a bug, even if it’s the safe kind of bug — because the cost is a restore that fails on…
Read more →