Where Reqad is headed

• Login page for the admin panel, with brute-force protection and automatic firewall bans
• Two-factor authentication with recovery codes, and passkeys
• Confirmation before sensitive changes, remembered devices, email codes for new devices and login alerts
• Firewall allowlist for the panel port, with automatic rollback if you lock yourself out
• Brute-force protection for webmail logins

• Hardened kernel settings and tighter file permissions between sites
• Accounts see only their own processes
• CPU, memory and process limits for SSH, cron and the browser terminal
• Shell access per account: full, jailed (own home only) or SFTP only
• MySQL connection limit per account
• Check and fix the owners and permissions of an account's files, with an undo script
• Links inside a site's folder are followed only to files the same account owns

• Per-account scope, limits and events - the base for hosting packages and the account panel
• Groundwork for more web server stacks
• "Needs attention" on the dashboard: certificates, SPF/DKIM/DMARC, PHP versions, WordPress updates, disk, services and backups
• REST API with scoped, expiring access tokens - accounts, databases, mailboxes, WordPress, services, mail queue and logs (off by default)
• Visitor stats and bandwidth of every site, counted every hour from the web server logs with no visitor addresses kept, and a Bandwidth Usage page for all accounts
• Resource usage of every account, checked every minute: CPU, memory, processes, PHP workers, database connections and the limits they reached, and what the rest of the server uses

Off by default; one switch turns on both.

• Git deployments from GitHub, GitLab, Gitea or Bitbucket, on every push by signed webhook, with build steps, atomic releases, a health check and one-click rollback
• Node.js and Python apps, run as the account's own user in their own sandboxed service and served through nginx with SSL and websockets
• Presets for PHP, Laravel, static sites, Node.js and Python, and managed Node.js and Python versions
• Install an app's packages with one click (pip into the app's own environment, or npm), and in every Git release by themselves, so a rollback brings back the old packages too
• The start command found in the code: Django, Flask, FastAPI, Next.js, Nuxt, SvelteKit, Express, package.json or a Procfile, with the matching Python or Node.js version
• Deploy with git push to the server itself

Manage your server from your own AI assistant: Claude, Cursor and other MCP clients. Off by default.

• Connects over SSH, with nothing new opened to the internet; works from Linux, macOS and Windows (PuTTY / Pageant)
• Server status, what needs attention, logs, the mail queue, services, accounts, databases, mailboxes, deployments and apps
• WordPress: versions and available updates, core / plugin / theme updates with a database backup first and caches emptied after
• Tokens for the whole server or one account, read-only or not, expiring; deletes need your confirmation, and every call is logged
• Connections over HTTPS, for assistants that cannot use SSH

• Hosting packages: limits for mailboxes, databases, addon domains, subdomains, aliases, cron jobs, SSH keys, deployments and apps, plus session limits, database connections and shell access
• Disk quotas, and a size for each mailbox with warning mails at 90% and when it is full
• Monthly bandwidth per account; over it, the package decides: warn, slow the sites down or suspend the account
• Account suspension: the sites show a suspended page and logins are refused, while mail keeps arriving
• Dedicated IP addresses per account, IPv4 and IPv6 (also behind NAT): its sites, outgoing mail with a matching reverse DNS, and DNS records
• nginx in front of Apache with php-fpm: full .htaccess support, static files served by nginx, switch either way
• Older PHP versions for legacy sites: PHP 5.6, and 5.4 on EL8