Certbot was including www.data.example.com for managed DNS subdomains, which NXDOMAIN and failed the whole certificate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sales Centre left Active CustomerHostingOrder rows with pending-setup.local alongside real HostingAccounts, so customers saw two hostings.
Co-authored-by: Cursor <cursoragent@cursor.com>
Async-only zone jobs left Ladill NS returning REFUSED for new domains, which surfaces as Let's Encrypt SERVFAIL during SSL issuance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat ns_auto domains as managed DNS, publish subdomain A records via PowerDNS without failing the UX when the local DNS registry is missing, and promote real linked domains over pending-setup.local placeholders.
Co-authored-by: Cursor <cursoragent@cursor.com>
Customers can create label-based subdomains under primary/addon sites with a separate max_domains×5 quota, nginx/docroot/SSL provisioning, and managed DNS A records when Ladill controls the parent zone.
Co-authored-by: Cursor <cursoragent@cursor.com>
Surface account counts, status breakdown, and available plans in heroes consistent with Ladill Servers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose authenticated service endpoints for assigning, listing, renewing, and managing hosting accounts from the platform, with tests and deploy docs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Profile moves to the bottom nav sheet on small screens; optional search tab
support is synced from the Ladill platform template.
Co-authored-by: Cursor <cursoragent@cursor.com>
Accounts whose node has an ssh_private_key take the remote branch, which still
launched an unjailed 'runuser' shell — leaving the breach open. Route it through
the same jailkit launcher (no sudo; provider connects as root). Now every
terminal session is chrooted to the customer's own home.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SECURITY: the browser terminal ran an unconfined login shell as the account's
system user, so customers could browse the whole host (/var/www, other tenants,
/etc). Run it inside a jailkit chroot instead: a vetted, sudo-scoped launcher
(/usr/local/sbin/ladill-jailsh) enters a private mount namespace, bind-mounts
ONLY that user's home into /home/jail, and chroots as the user. They can no
longer see anything outside their own home. Provisioning committed in
deployment/ (setup-terminal-jail.sh + ladill-jailsh) so it is reproducible.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
createSession only waited 2.5s for the worker to flip starting->running, but
the worker cold-boots the framework (php artisan) + opens the shell, which under
load exceeds that. On timeout it also overwrote the (healthy) worker's metadata
to status=failed, so customers saw 'Terminal worker failed to start' even though
the shell was live. Wait up to 8s and return early once status is known; never
fabricate a failure — the worker records real boot errors itself.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Push the customer's connected domain to the central connected-domains registry
so it appears under My Domains (with Transfer in if not registered with Ladill).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
After provisioning a site cert on its node, report it to Domains' central SSL
registry (best-effort, non-blocking) so Domains tracks every platform cert.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
InjectBootSplash middleware shows a self-branded loading splash once per session
while the app boots, then fades out.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Stop emailing users when their servers hit usage limits; keep database notifications for the in-app bell.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wallet balance peek rendered as a menu row directly under Billing, backed by
a /wallet/balance endpoint (BillingClient) and guarded by Route::has. Also
opens Afia via a direct window event for reliability.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fetch owned domains from both domains.ladill.com and the platform registry so legacy customer domains populate the Ladill picker.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use the Domains API for owned domains across panel, account, and order forms, with an embedded iframe purchase modal instead of redirecting to domains.ladill.com.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire UserProfileMenu and shared Blade partial into topbar, mobile nav, and layouts so menu items match the account portal (Ladill Mail excluded).
Co-authored-by: Cursor <cursoragent@cursor.com>
Team and developer-token management now live on account.ladill.com. Remove the
local account.team* and account.developers* routes, the DeveloperController, and
the (empty) hosting Team/Developers pages; repoint the sidebar Team link to
ladill_account_url('/account/team'). The acting-account switcher (account.switch)
stays — it is load-bearing for multi-account access. Hosting developer-access
authz is already centralized via the identity API (shadow-verified + flipped).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Consolidate the inline HostingAccountMember lookups (Overview/Search/Hosting
Product/Afia controllers) into HostingAccessResolver, which can source hosting
developer-access from the monolith's central /identity/hosting/developer-access
(correlating cPanel usernames to local account ids). Shadow mode by default
(HOSTING_CENTRAL_DEV_ACCESS=false): local hosting_account_members stays
authoritative and divergence from central is logged; flip the flag to cut over.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add home.ladill.com helper, repair click-outside handling on topbar menus, and expand profile links on desktop and mobile.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use HostingTeamMember instead of the missing QrTeamMember class so the first login callback completes without error.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove interactive OAuth fallback on silent SSO failure and add ladill.marketing_url config so app subdomains open the dashboard when signed in locally.
Co-authored-by: Cursor <cursoragent@cursor.com>
Local-only sign-out: end this app's session but leave the auth.ladill.com
session intact, so the signed-out page's Sign in again re-auths silently via
prompt=none. Full sign-out of all Ladill apps remains on account.ladill.com.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Remove route-based page titles and the uppercase subtitle line so mobile
headers display a single title like Ladill Bird.
Co-authored-by: Cursor <cursoragent@cursor.com>
Route-based subtitle and page titles replace plain app labels in mobile topbars, and the Afia AI button is visible on mobile across topbars and mobile-page-header screens.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return an HTML search screen from /search for browser visits and point the bottom nav Search tab at it instead of the dashboard.
Co-authored-by: Cursor <cursoragent@cursor.com>
Import RC service orders in hosting:import, map platform_id on legacy models, and wire legacy order manage links to hosting.legacy.show.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire local notification inbox in the topbar, sync ladillhosting logo and hosting launcher icon, and fix signed-out page branding.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire a JSON /search endpoint and Alpine dropdown so customers can find accounts, linked domains, and orders from the hosting app header.
Co-authored-by: Cursor <cursoragent@cursor.com>
Display hosted_sites on account cards, scope Afia and Settings to hosting,
add hosting_settings for notifications, and remove mailbox UI from the
hosting layout and account pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the smart redirect on /dashboard with an overview hub (stats,
recent accounts, pending orders) matching Domains and Email, and move
the full account list to /hosting/accounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Route launcher and home hub entry to the account overview instead of the
control panel, label the sidebar app launcher, and extend hosting:import
to sync hosted_sites with platform_id matching for existing accounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
The account overview queried a local mailboxes table that the extracted hosting app does not have; guard those lookups and skip email-addon upsells when mailboxes are managed on Ladill Email.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hosting type pages and panel views referenced platform routes that do not exist in the extracted app; link to domains, account, and servers apps instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use user-owned domains only; the extracted hosting app does not have websites or website_members tables.
Co-authored-by: Cursor <cursoragent@cursor.com>
Skip websites/website_members lookups; domains are owned directly by user_id in the extracted hosting app.
Co-authored-by: Cursor <cursoragent@cursor.com>
Account pages were extending the email layout with undefined routes, and hosting type pages queried a missing rc_service_orders table.
Co-authored-by: Cursor <cursoragent@cursor.com>
Shared web hosting extracted from the platform monolith, with CI deploy
to /var/www/ladill-hosting matching Bird/Domains/Email.
Co-authored-by: Cursor <cursoragent@cursor.com>
