Hosting had PDNS env vars but no config/pdns.php and was missing domain_dkim_keys, so linked domains never got authoritative zones.
Co-authored-by: Cursor <cursoragent@cursor.com>
Async-only zone jobs left Ladill NS returning REFUSED for new domains, which surfaces as Let's Encrypt SERVFAIL during SSL issuance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat ns_auto domains as managed DNS, publish subdomain A records via PowerDNS without failing the UX when the local DNS registry is missing, and promote real linked domains over pending-setup.local placeholders.
Co-authored-by: Cursor <cursoragent@cursor.com>
Customers can create label-based subdomains under primary/addon sites with a separate max_domains×5 quota, nginx/docroot/SSL provisioning, and managed DNS A records when Ladill controls the parent zone.
Co-authored-by: Cursor <cursoragent@cursor.com>
The hosting panel referenced /images/app_logos/*.svg but the standalone app never shipped those assets.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the once-per-session sessionStorage guard (which suppressed the loading
screen after its first appearance) with entry-aware logic: show on app entry
and reloads, suppress on internal link navigations and back/forward.
Surface account counts, status breakdown, and available plans in heroes consistent with Ladill Servers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose authenticated service endpoints for assigning, listing, renewing, and managing hosting accounts from the platform, with tests and deploy docs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sync mobile-header-btn partials, mobile x-btn.create, and update dashboard header actions for consistent mobile FABs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove duplicate Billing header above Home; wallet card follows Billing
in menu order to match the desktop avatar dropdown.
Co-authored-by: Cursor <cursoragent@cursor.com>
Show wallet balance prominently in the mobile profile bottom sheet with refresh
on open; align session lifetime with the platform default.
Co-authored-by: Cursor <cursoragent@cursor.com>
Profile moves to the bottom nav sheet on small screens; optional search tab
support is synced from the Ladill platform template.
Co-authored-by: Cursor <cursoragent@cursor.com>
Profile moves to the bottom nav sheet on small screens; optional search tab
support is synced from the Ladill platform template.
Co-authored-by: Cursor <cursoragent@cursor.com>
The toolbar showed a static ~/public_html. The jailed shell now reports its cwd
via OSC 7 each prompt (jail rcfile keeps the user's prompt + emits it); xterm
captures it and the toolbar shows the full path (/home/<user>/...), updating as
the user cd's. Launcher/rcfile committed in deployment/ for reproducibility.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The jail's /etc/passwd listed every hosting username (no passwords — shadow isn't
in the jail — but it enumerated tenants). The launcher now binds a per-session
/etc/passwd|group (root + the current user only) inside each session's mount
namespace, and the shared jail passwd no longer carries hosting users.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Inside the jail, 'cd ..' from the home landed in a non-listable /home (Permission
denied). Mount a per-session tmpfs over the jail's /home containing only the
user's own directory, so 'ls /home' shows just their folder — no other tenants
leaked, confinement unchanged. (Live host launcher already updated.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Accounts whose node has an ssh_private_key take the remote branch, which still
launched an unjailed 'runuser' shell — leaving the breach open. Route it through
the same jailkit launcher (no sudo; provider connects as root). Now every
terminal session is chrooted to the customer's own home.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SECURITY: the browser terminal ran an unconfined login shell as the account's
system user, so customers could browse the whole host (/var/www, other tenants,
/etc). Run it inside a jailkit chroot instead: a vetted, sudo-scoped launcher
(/usr/local/sbin/ladill-jailsh) enters a private mount namespace, bind-mounts
ONLY that user's home into /home/jail, and chroots as the user. They can no
longer see anything outside their own home. Provisioning committed in
deployment/ (setup-terminal-jail.sh + ladill-jailsh) so it is reproducible.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The terminal Alpine component + xterm/xterm-addon-fit only ever existed in an
out-of-band build; committed source never had them, so clean CI rebuilds shipped
a bundle WITHOUT the terminal (blank panel). Add resources/js/hosting-terminal.js
(window.hostingInteractiveTerminal, recovered from the last working build), import
it from app.js, and add xterm deps to package.json/lock. Verified: a clean
'npm ci && vite build' now includes the component + xterm.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
createSession only waited 2.5s for the worker to flip starting->running, but
the worker cold-boots the framework (php artisan) + opens the shell, which under
load exceeds that. On timeout it also overwrote the (healthy) worker's metadata
to status=failed, so customers saw 'Terminal worker failed to start' even though
the shell was live. Wait up to 8s and return early once status is known; never
fabricate a failure — the worker records real boot errors itself.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Push the customer's connected domain to the central connected-domains registry
so it appears under My Domains (with Transfer in if not registered with Ladill).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
After provisioning a site cert on its node, report it to Domains' central SSL
registry (best-effort, non-blocking) so Domains tracks every platform cert.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Ladill Accounting is now live at accounting.ladill.com; add its row + icon to
the shared app launcher (byte-identical across all Ladill apps).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
InjectBootSplash middleware shows a self-branded loading splash once per session
while the app boots, then fades out.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Stop emailing users when their servers hit usage limits; keep database notifications for the in-app bell.
Co-authored-by: Cursor <cursoragent@cursor.com>
