Changelog

Added

• Git → Connect repository (GitHub, GitLab, Bitbucket, Gitea/Forgejo): connect a repository with just its URL and an access token. The token is stored encrypted and only ever shown as "ends with ••••abcd".
  • Everything else is optional and off by default: link it to one of the account's websites (main domain, addon or subdomain — the folder is filled in automatically) or a folder, branch, ignore list, "Panel only" mode, and how to start (just connect / put my existing files on the repository / bring code from the repository). An account can connect many repositories, one per website or folder.
  • Works for any tool in that folder: plain git push / git pull in the account terminal — by you, Claude Code or any other agent — just work, with no token typed. The token is never written into the folder, git settings, URL or logs; the panel hands it to git only when needed and only to that account for that repository. Every use is logged in the repository's History.
  • Buttons: Push, Pull, Deploy, Test connection, Settings, Replace/Remove token, History. Replacing or removing the token takes effect immediately.
  • Auto-deploy on push (optional): a signed webhook per repository; a push to the chosen branch pulls and deploys automatically. Forged or unsigned deliveries are refused.
  • Safe default ignore list for new connections (.env, wp-config.php, .user.ini, .htpasswd, .well-known/, logs, node_modules/) so pushing an existing website never uploads its secrets. Editable per connection.
  • "Panel only" mode keeps the token inside the panel: terminal git cannot use it, the panel buttons still can.

Fixed

• Account terminals on freshly installed servers had no Node.js (and no Remi PHP on AlmaLinux/RHEL), so node, npm, php and Claude Code were missing inside the terminal. The panel now keeps the jail's list of language runtimes up to date automatically at startup.

Changed

• The plan feature Git is now enforced: accounts whose plan or feature list switches Git off no longer see the Git page.

Added

• Transfer Key — move accounts between NuvoPanel servers without handing over SSH or root access. On the old server: Transfer Tool → Generate Transfer Key (choose 1–30 days of access, default 7). On the new server: Add source server → paste the key and the old server's host name. No commands to run, no root password, no fingerprint to compare.
  • The key is single-use and must be used within 24 hours. It carries the old server's certificate fingerprint, so pairing cannot be intercepted, even with a self-signed certificate.
  • Behind the scenes the new server gets a dedicated, locked-down login (nuvo-xfer) on the old server: bound to the new server's IP, no shell, no terminal or tunnels, forced through a read-only gatekeeper that only allows copying (rsync send-only), database dumps and counts — and only for the accounts the new server has asked about. Every read happens inside a sealed sandbox that contains only that account's folder (read-only), with all privileges dropped except reading.
  • "Transfers FROM this server" on the old server lists every key with its destination, access end and last use, and Revoke cuts access immediately. Access also ends automatically when the chosen period runs out.
  • The previous method (root SSH key) remains available under "Advanced".

Changed

• After pairing, a renewed, publicly valid certificate on the old server is accepted, so a Let's Encrypt renewal during a transfer no longer interrupts it (the pairing itself stays pinned).

Security

• Webmail: Symfony components updated within 7.4 (http-foundation, http-kernel, mime, routing, yaml) for 9 advisories, including access-control bypasses and e-mail header injection.

Added

• Transfer Tool (Accounts → Transfer Tool, server administrator only): move hosting accounts from another NuvoPanel server to this one, between AlmaLinux 8/10 and Ubuntu 22.04 in any direction. The source keeps running and is never modified.
  • Source side: a new read-only Migration API token kind (admin only, fenced to /api/migration/v1, cannot reach any other route).
  • Destination side: add a source server, authorise this panel's SSH key there (copyable one-line command), confirm the source's SSH host-key fingerprint (pinned; a changed key is refused), pick accounts, and run a pre-check (name/domain/mail-domain/database clashes, PHP versions, disk space) that changes nothing.
  • Transfers run in the background, one at a time, with live progress (steps, bytes, rate, log) and survive a panel restart (resume at the first unfinished step). Cancel and Retry (finished steps are kept).
  • Copies the account (same login password, limits and plan), addon/sub-domains, website files (re-owned to the new user, never numeric ids), MySQL and PostgreSQL databases (same users/passwords), mail domains, mailboxes (same passwords), aliases, mail (re-owned to this server's mail user/group), DKIM keys, autoresponders, mailing lists, DNS zones (A records pointing at the old server rewritten to this one — optional), SSL certificates, cron jobs, FTP accounts (same passwords), background programs and git repositories; then verifies files, tables, messages and HTTP.
  • Final sync right before switching DNS copies only what changed since the first pass (including deletions) and re-copies databases.
• DNS Zones: Install DNS server button runs the BIND setup from the panel with a live log; the SSH command shown is now the real one (no --dry-run), with an optional "open port 53".

Fixed

• Databases created through the panel are recorded with the right engine (PostgreSQL databases were listed as MySQL).

• 1.13 — Licensing with an automatic free trial. Webmail overhaul: import from Gmail, Outlook or any IMAP server, signatures, scheduled send, rules and templates. Per-plan outbound mail limits and mail-only plans.
• 1.12 — Signed releases and online updates with automatic rollback.
• 1.10 – 1.11 — Per-account CPU, memory and process limits, server-wide fair-use defaults, and the Resource Usage page with history charts.
• 1.9 — Off-site backups to S3-compatible storage and SFTP.
• 1.8 — Provisioning API for billing systems and the WHMCS module.
• 1.7 — New administrator layout: List Accounts, All Domains and Database Server.
• 1.5 – 1.6 — Resellers, visitor statistics, Git, WordPress toolkit, autoresponders, mailing lists, directory privacy and hotlink protection.
• 1.2 – 1.4 — DNS zone editor, service monitor with e-mail alerts, API tokens and security hardening.
• 1.0 — First versioned release, October 2026.