Bump distro images (ubuntu:22.04 -> ubuntu:24.04, fedora:40 -> fedora:41) in the system utils test workflow. Make package installation commands less quiet and more robust: clear /var/lib/apt/lists/* before apt-get update and remove -q flags from apt-get/dnf/yum installs so logs are more informative and apt updates won't fail on stale lists.
Set DEBIAN_FRONTEND=noninteractive to prevent interactive prompts during image package installs, add shell: bash for the Install step, and normalize command -v checks/redirection so package manager detection and installs behave more reliably. Also remove excessive suppression of apt-get update/install output to surface failures; the pip3 pytest install fallback remains unchanged.
Remove the inline "Verify expected package manager" step from the GitHub Actions workflow and add a pytest in backend/tests/test_utils_system_integration.py. The new test (test_matches_expected_manager_from_ci) reads EXPECTED_MANAGER from the environment, skips when not set, and asserts PackageManager.detect() matches the expected value. This consolidates the CI verification into the test suite and simplifies the workflow.
Introduce a new GitHub Actions workflow (.github/workflows/test-system-utils.yml) that runs unit tests, distro-based integration tests in container images (ubuntu, debian, fedora, rocky) to validate package manager and systemctl detection, and an audit job that greps migrated service files for raw subprocess patterns. Add backend/tests/test_utils_system_integration.py: Linux-only integration smoke tests that directly import backend/app/utils/system.py (avoiding Flask deps) to verify PackageManager detection, command availability, and basic ServiceControl behavior. Designed for CI verification of system utilities across real distros.
Refactor services to use centralized system helpers (ServiceControl, PackageManager, run_privileged, is_command_available) instead of ad-hoc subprocess/os calls. Updated deployment, firewall, ftp, nginx, php, python, security, and ssl services to call the new utilities and added error/timeout handling improvements and package manager abstraction. Added backend/app/utils/system.py implementing the helpers and backend/tests/test_utils_system.py with unit tests. This centralizes privileged command execution and service/package management, simplifying tests and platform differences.
Move the language selection links from the top center of the README and localized docs into the area below the project description to improve header spacing and layout. Updated README.md and docs/README.es.md, docs/README.pt.md, docs/README.zh-CN.md accordingly.
Replace generic @jwt_required() usage with role-based decorators and switch Socket.IO token handling to the auth payload.
- Replace jwt_required with viewer_required/admin_required across API modules (backend/app/api/cron.py, firewall.py, ftp.py, git.py, metrics.py) and update imports accordingly.
- Require JWT for previously public system/private endpoints (backend/app/api/system.py, private_urls.py).
- Change Socket.IO server connection handler to accept auth payload and read token from auth (backend/app/sockets.py) to avoid token leakage in query strings.
- Update frontend clients to send token via socket auth instead of query (frontend/src/pages/WordPressProject.jsx, frontend/src/services/socket.js).
These changes add finer-grained RBAC control for endpoints and improve socket auth security by removing tokens from URLs/logs.
Added calls to serverkit.ai to track successful installation, update, and uninstall events with the current version. This helps monitor usage and improve support.
Introduces backend endpoints and service logic for managing multiple WordPress sites and their environments (production, staging, development). Updates frontend to display a grid of WordPress sites, enable site creation via modal, and refactors the WordPress page UI for multi-site support. Adds environment creation controls, improves environment modal logic, and enhances styles for the new layout. Also adds wp-cli.phar to backend for WordPress management.
Introduces backend/app/paths.py to centralize all key directory paths, allowing overrides via environment variables for local development. Updates all backend services and APIs to use these centralized paths instead of hardcoded values. Adds dev path override examples to backend/.env.example and updates .gitignore to exclude dev-data. Also changes frontend dev server port to 5274 and updates related scripts and CORS settings for consistency.
Introduces an _auto_migrate_columns function in app initialization to automatically add missing columns to existing tables. Refactors the CLI migrate_db command to use a unified expected columns list and checks both 'applications' and 'wordpress_sites' tables for missing columns, improving consistency and reducing manual migration steps.
Expanded the uninstall process to explicitly list all components and directories that will be removed, including nginx configs and ServerKit-specific data. Added informational messages and ensured nginx is reloaded if necessary. Clarified that system packages are not removed automatically.
Introduces a multi-step onboarding wizard for initial server setup, including admin account creation, use case selection, resource tier display, and summary. Adds backend support for onboarding completion and use case storage. Implements developer mode toggle in settings, exposing an icon reference panel. Updates styles and refactors related frontend logic for setup and settings pages.
Switched all template icon URLs to use local /serverkit.ai/imgs/template-icons/ assets for consistency and reliability. Improved the Sidebar component with a new user context menu featuring theme switching, settings navigation, and logout, along with conditional display of the WordPress pipeline link. Added and updated related styles for the sidebar, user menu, and page headers, and introduced new theme variables for code/terminal backgrounds.
Introduces a comprehensive REST API for WordPress multi-environment management, including endpoints for project listing, environment CRUD, promotion, sync, comparison, locking, activity logs, container logs, resource limits, basic auth, WP-CLI, health checks, disk usage, bulk operations, and auto-sync scheduling. Adds new models for environment activity, promotion jobs, and sanitization profiles, and integrates auto-sync scheduling into the app startup. Updates model imports and registration to include the new models.
Added src, public, package*.json, vite.config.js, eslint.config.js, and index.html to .dockerignore to prevent these files from being included in Docker builds. This helps reduce image size and ensures only necessary files are copied.
Updates the Dockerfile to expect pre-built assets and modifies install.sh to install Node.js, ensure swap space, and build the frontend on the host before packaging it into the nginx container. This approach addresses memory limitations on low-RAM VPS servers during the Vite build process.
Added .dockerignore to reduce build context size. Increased Node.js memory limit during frontend build in Dockerfile. Updated Vite config to split vendor chunks for better caching and performance. Modified install.sh to use 'docker container prune' and removed '--no-cache' from compose build for efficiency.
Juan Denis