Host and protect in one place
ToutPanel hosts your sites (PHP, databases, DNS, mail, backups); ToutWAF becomes its protection engine. Both are driven from the same console.
ToutPanel integration and websites
ToutPanel is a separate web hosting panel. ToutWAF can install it on a fresh server, link to it, create a site there and the matching protected site in a single operation, then add host-name aliases afterwards, with the certificate and the policy updated together.
Where to find it in the console : Infrastructure menu: Cluster, Web servers tab; General menu: Sites (« Add a site » and the « Aliases » action).
What it is for
One site, one operation
Create the site in ToutPanel and the protected site in ToutWAF in one action, with what was already created undone if a step fails.
Aliases without opening the panel
Add or remove host names after creation: the panel, the protected site, the policy and the certificate follow together.
Do not cut yourself off from your servers
A dedicated token per server, a pinned certificate, and a guard that restores ToutWAF's access if a firewall cuts it.
How ToutWAF and ToutPanel talk to each other
The web server is an object of the console, with its own token.
Link the web server
Through a command to copy, or over SSH from the console. The command is generated with a dedicated token, the fingerprint of the console certificate and ToutWAF's address as the server sees it. The token travels in an environment variable, never as an argument.
The panel signals its presence
A heartbeat every 60 seconds. The server is « linked » if the last one is less than 3 minutes old, otherwise « unreachable », which raises the matching alert.
ToutWAF protects the sites
The panel limits its ports 80 and 443 to ToutWAF's address. Sites are synchronised and each protected site points to its origin server.
Create a site from the console
In Sites, the box « Also create this site in ToutPanel » opens the panel's form and creates the protected site right after.
Checks first
The quota, an already protected host name, a site of the same name on the panel: what is obvious is refused before anything is created.
On the ToutPanel side
The site, then optionally the database, the FTP account, the DNS zone, the certificate, an application install and a backup plan, depending on what the panel says it can do.
On the ToutWAF side
The protected site is created last, pointed at this server. So a refusal by the panel leaves nothing at ToutWAF.
Undo and credentials
If a step fails, the created objects are removed in reverse order; what cannot be removed is listed. Generated passwords are shown only once.
Host-name aliases
Бесплатно
An alias is another name served exactly like the site, without a redirect. A site's « Aliases » action updates both products, in this order, so that the same names are served everywhere.
- The ToutPanel site first (its parked domains): if the panel refuses or is unreachable, you get the cause and nothing has changed on either side.
- Then the protected site and the policy, activated at once.
- Then the certificate: if ToutWAF manages an ACME certificate for this site, a new order for all the names starts, and the old certificate serves until the new one is issued. DNS must already lead the new names to ToutWAF.
- The main domain and its www name cannot be removed; 100 names at most; a name already used by another site is refused; repeating an action already done is not an error.
Install ToutPanel and its web stack
Бесплатно
From Cluster, on a fresh server, over SSH.
- ToutWAF runs ToutPanel's official installer unattended, with its default settings, plus only what links the two products. The SSH host key fingerprint is confirmed first.
- A link to ToutPanel's setup assistant, valid once and for 24 hours, is kept encrypted and handed out only on your request. ToutWAF never sees the administrator name or password you choose.
- The web stack (Nginx, MariaDB and PHP 8.5 by default) is laid down afterwards by a ToutPanel command, as a detached task followed every 10 seconds; on Windows it is not installed automatically.
- While the stack of a server installed by ToutWAF is not ready, creating a site on that panel is refused with the cause.
A safe link between the two products
Бесплатно
Each server has its own token, which can do nothing else.
- The « toutpanel-name » token has only a fixed set of rights, is shown once, is revoked with the server and can be renewed. It can neither create users nor change global settings.
- Only a server's own token can send that server's heartbeat: no role or administrator token can.
- The panel token used to create sites is stored encrypted, preferably restricted to ToutWAF's address, and the panel's certificate is confirmed by you (pinned).
- With ToutPanel on the same machine, ToutWAF generates the command and you run it as root: it does not run root commands on a mere HTTP request.
The firewalld « keep-open » guard
Бесплатно
One day, a panel's automatic ban added a firewalld rule that cut off ToutWAF: all visitors arrive from the same address, the panel took it for a single attacker, and every site answered 502. The guard keeps that from happening again.
- Installed with the opening of ports 80, 443 and 9444 when firewalld is active, it runs every minute.
- It maintains a priority accept rule for ToutWAF's address, removes the rules that block exactly it, and logs every change in the system log; it touches nothing else.
Ещё не проверено в реальных условияхOnly firewalld is guarded (not ufw, nftables or iptables), for single addresses, and the guard has never run against a real firewalld in production: its tests replace firewall-cmd.
What is not done, or not proven
We prefer to say it plainly.
- The panel-side options (--waf toutwaf, the connection, the heartbeat, the WAF engine screen) are delivered by ToutPanel 0.5.0 and later, not by ToutWAF. The basic link was proven on a real ToutPanel 0.5.0 (nine end-to-end scenarios).
- Have not run against a real ToutPanel: the installer of 0.5.1 and later, the web stack, the setup link, the « Behind ToutWAF » check, a machine that carries both products, Windows servers. Site creation is verified by tests against a simulated panel.
- ToutWAF holds no DNS zone and runs no DNS server: it can list and create the panel's zones, but applies one only if the panel announces it, which ToutPanel 0.5.1 does not.
- A site created by ToutPanel counts against the quota of the ToutWAF offer, whatever ToutPanel's own quota. A known defect, under investigation, prevents deleting an « associated » site in ToutPanel.
Use cases
Host and protect a new site
One form, a site created on both sides, a certificate ordered, and the database and FTP passwords shown once.
Add the bare name or a second domain
The « Aliases » action updates the panel, the policy and the certificate without opening the panel.
Set up a new hosting server
ToutPanel is installed over SSH, its web stack laid down afterwards, and the server appears linked in the console.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
РедакцияБесплатно Входит во все предложения, включая оба бесплатных (Free и Free +)Pro и выше Платные предложения: видна в консоли, без лицензии заблокирована. Начиная с Pro, если не указано Agency или Enterprise
Ещё не проверено в реальных условиях Работает в тестах продукта, но ещё не проверялась с реальным сервисом, системой или оборудованием. Консоль показывает ту же пометку там, где вы настраиваете функцию.
ToutPanel integration and websites
- Creating a site from the console: ToutPanel site, database, FTP account, DNS zone, certificate and backups as chosen, then the protected site, with undo if a step failsБесплатно
- Host-name aliases after creation: the ToutPanel site, the protected site, the policy and the certificate are updated togetherБесплатно
- firewalld « keep-open » guard: restores ToutWAF's access to the web server's ports if a rule cut it (never tried against a real firewalld in production)Бесплатно
- « Behind ToutWAF » check of a panel site, in five verifications (not yet tried against a real ToutPanel)Бесплатно
Серверы и агенты хоста
- Удалённая установка ToutPanel — панели веб-хостинга — на чистый сервер, затем его веб-стека (по умолчанию Nginx, MariaDB, PHP 8.5) Ещё не проверено в реальных условияхБесплатно
- Веб-серверы ToutPanel: связь командой или по SSH, выделенный токен, закреплённый сертификат и heartbeat; ToutWAF становится WAF-движком панели, когда ToutPanel поставит свою часть Ещё не проверено в реальных условияхБесплатно
Вернуться к значению по умолчанию для расширенной опции можно всегда. Что происходит по окончании платной лицензии, описано в вопросах и ответах о тарифах: 48 часов льготного периода, 48 часов только для чтения, затем защита WAF отключается до продления.
Поставьте щит перед вашими приложениями уже сегодня
Установите его на собственный сервер или напишите нам, чтобы обсудить лицензии.