Host and protect in one place
ToutPanel hosts your sites (PHP, databases, DNS, mail, backups); ToutWAF becomes its protection engine. Both are driven from the same console.
ToutPanel integration and websites
ToutPanel is a separate web hosting panel. ToutWAF can install it on a fresh server, link to it, create a site there and the matching protected site in a single operation, then add host-name aliases afterwards, with the certificate and the policy updated together.
Where to find it in the console : Infrastructure menu: Cluster, Web servers tab; General menu: Sites (« Add a site » and the « Aliases » action).
What it is for
One site, one operation
Create the site in ToutPanel and the protected site in ToutWAF in one action, with what was already created undone if a step fails.
Aliases without opening the panel
Add or remove host names after creation: the panel, the protected site, the policy and the certificate follow together.
Do not cut yourself off from your servers
A dedicated token per server, a pinned certificate, and a guard that restores ToutWAF's access if a firewall cuts it.
How ToutWAF and ToutPanel talk to each other
The web server is an object of the console, with its own token.
Link the web server
Through a command to copy, or over SSH from the console. The command is generated with a dedicated token, the fingerprint of the console certificate and ToutWAF's address as the server sees it. The token travels in an environment variable, never as an argument.
The panel signals its presence
A heartbeat every 60 seconds. The server is « linked » if the last one is less than 3 minutes old, otherwise « unreachable », which raises the matching alert.
ToutWAF protects the sites
The panel limits its ports 80 and 443 to ToutWAF's address. Sites are synchronised and each protected site points to its origin server.
Create a site from the console
In Sites, the box « Also create this site in ToutPanel » opens the panel's form and creates the protected site right after.
Checks first
The quota, an already protected host name, a site of the same name on the panel: what is obvious is refused before anything is created.
On the ToutPanel side
The site, then optionally the database, the FTP account, the DNS zone, the certificate, an application install and a backup plan, depending on what the panel says it can do.
On the ToutWAF side
The protected site is created last, pointed at this server. So a refusal by the panel leaves nothing at ToutWAF.
Undo and credentials
If a step fails, the created objects are removed in reverse order; what cannot be removed is listed. Generated passwords are shown only once.
Host-name aliases
Free
An alias is another name served exactly like the site, without a redirect. A site's « Aliases » action updates both products, in this order, so that the same names are served everywhere.
- The ToutPanel site first (its parked domains): if the panel refuses or is unreachable, you get the cause and nothing has changed on either side.
- Then the protected site and the policy, activated at once.
- Then the certificate: if ToutWAF manages an ACME certificate for this site, a new order for all the names starts, and the old certificate serves until the new one is issued. DNS must already lead the new names to ToutWAF.
- The main domain and its www name cannot be removed; 100 names at most; a name already used by another site is refused; repeating an action already done is not an error.
Install ToutPanel and its web stack
Free
From Cluster, on a fresh server, over SSH.
- ToutWAF runs ToutPanel's official installer unattended, with its default settings, plus only what links the two products. The SSH host key fingerprint is confirmed first.
- A link to ToutPanel's setup assistant, valid once and for 24 hours, is kept encrypted and handed out only on your request. ToutWAF never sees the administrator name or password you choose.
- The web stack (Nginx, MariaDB and PHP 8.5 by default) is laid down afterwards by a ToutPanel command, as a detached task followed every 10 seconds; on Windows it is not installed automatically.
- While the stack of a server installed by ToutWAF is not ready, creating a site on that panel is refused with the cause.
A safe link between the two products
Free
Each server has its own token, which can do nothing else.
- The « toutpanel-name » token has only a fixed set of rights, is shown once, is revoked with the server and can be renewed. It can neither create users nor change global settings.
- Only a server's own token can send that server's heartbeat: no role or administrator token can.
- The panel token used to create sites is stored encrypted, preferably restricted to ToutWAF's address, and the panel's certificate is confirmed by you (pinned).
- With ToutPanel on the same machine, ToutWAF generates the command and you run it as root: it does not run root commands on a mere HTTP request.
The firewalld « keep-open » guard
Free
One day, a panel's automatic ban added a firewalld rule that cut off ToutWAF: all visitors arrive from the same address, the panel took it for a single attacker, and every site answered 502. The guard keeps that from happening again.
- Installed with the opening of ports 80, 443 and 9444 when firewalld is active, it runs every minute.
- It maintains a priority accept rule for ToutWAF's address, removes the rules that block exactly it, and logs every change in the system log; it touches nothing else.
Not yet tried in real conditionsOnly firewalld is guarded (not ufw, nftables or iptables), for single addresses, and the guard has never run against a real firewalld in production: its tests replace firewall-cmd.
What is not done, or not proven
We prefer to say it plainly.
- The panel-side options (--waf toutwaf, the connection, the heartbeat, the WAF engine screen) are delivered by ToutPanel 0.5.0 and later, not by ToutWAF. The basic link was proven on a real ToutPanel 0.5.0 (nine end-to-end scenarios).
- Have not run against a real ToutPanel: the installer of 0.5.1 and later, the web stack, the setup link, the « Behind ToutWAF » check, a machine that carries both products, Windows servers. Site creation is verified by tests against a simulated panel.
- ToutWAF holds no DNS zone and runs no DNS server: it can list and create the panel's zones, but applies one only if the panel announces it, which ToutPanel 0.5.1 does not.
- A site created by ToutPanel counts against the quota of the ToutWAF offer, whatever ToutPanel's own quota. A known defect, under investigation, prevents deleting an « associated » site in ToutPanel.
Use cases
Host and protect a new site
One form, a site created on both sides, a certificate ordered, and the database and FTP passwords shown once.
Add the bare name or a second domain
The « Aliases » action updates the panel, the policy and the certificate without opening the panel.
Set up a new hosting server
ToutPanel is installed over SSH, its web stack laid down afterwards, and the server appears linked in the console.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionFree Included in every offer, including both free offers (Free and Free +)Pro and above Paid offers: visible in the console, locked without a licence. From Pro, unless Agency or Enterprise is shown
Not yet tried in real conditions Works in the product's tests, but has not yet been tried with the real service, system or equipment. The console shows the same note where you set the function up.
ToutPanel integration and websites
- Creating a site from the console: ToutPanel site, database, FTP account, DNS zone, certificate and backups as chosen, then the protected site, with undo if a step failsFree
- Host-name aliases after creation: the ToutPanel site, the protected site, the policy and the certificate are updated togetherFree
- firewalld « keep-open » guard: restores ToutWAF's access to the web server's ports if a rule cut it (never tried against a real firewalld in production)Free
- « Behind ToutWAF » check of a panel site, in five verifications (not yet tried against a real ToutPanel)Free
Servers and host agents
- Remote installation of ToutPanel, the web hosting panel, on a fresh server, then of its web stack (Nginx, MariaDB, PHP 8.5 by default) Not yet tried in real conditionsFree
- ToutPanel web servers: link by command or over SSH, with a dedicated token, a pinned certificate and a heartbeat; ToutWAF becomes the panel's WAF engine once ToutPanel delivers its part Not yet tried in real conditionsFree
Going back to the default of an advanced option is always possible. What happens when a paid licence ends is described in the pricing FAQ: 48 hours of grace, 48 hours of read-only, then WAF protection is switched off until renewal.
Pricing Read the documentation
Put a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.