Skip to content
Provibr

Documentation

HestiaCP

HestiaCP is an open-source control panel for web hosting. Provibr talks to its own API with an access key and manages the accounts on it: creating them, suspending and resuming them, moving them to another package, and removing them.

Switch the API on and let the agent through

HestiaCP has an API on port 8083, the same port as the panel itself. It is on by default since version 1.10; you find the setting under Server settings, Security.

The panel also keeps a list of addresses that may use that API, and on a fresh install that list is empty, which means nobody, not everybody. Until the public address of the machine running your agent is on it, every call comes back refused, while your key is perfectly fine.

You set it in the panel in that same screen, or from a shell on the panel host:

shell
v-change-sys-config-value API_ALLOWED_IP '<agent-ip>'
Commands and terminal output are in English everywhere, in the panel and in these pages. One text, one truth: what you read here is literally what your host will print back.

An access key for Provibr

Create the key under Access keys, for the admin user, and leave the permission list empty:

shell
v-add-access-key admin "" "provibr-agent"
Commands and terminal output are in English everywhere, in the panel and in these pages. One text, one truth: what you read here is literally what your host will print back.
Empty means every command, and HestiaCP only accepts that for the admin user. The ready-made billing permission set comes close, but it leaves out the two commands that read your packages and the domains of an account, and with that set both stay empty. A key can be withdrawn on its own, which is why Provibr asks for one instead of for the password of your panel.
HestiaCP bans an address after five refused sign-ins, and a command outside the permissions of a key counts as one of them. After that the panel stops answering altogether: the connection no longer fails with a message but times out. You clear the ban on the panel with v-delete-firewall-ban, followed by the address and the word HESTIA.

What Provibr asks for

Four fields. The agent keeps them in its own vault on your host; Provibr cannot read them back.

  • The address of the panel including the port, for example https://panel.example.com:8083. Leave the port out and Provibr fills in 8083.
  • The key id: 20 characters. Not a secret: the panel lists it itself.
  • The secret: 40 characters of letters, digits and punctuation.
  • The SHA-256 fingerprint of the certificate, as long as the panel uses the self-signed one.
Plain http is refused. Port 8083 speaks TLS and nothing else, so an http address never points at the API.

The certificate

A fresh HestiaCP presents a self-signed certificate. Fill in the fingerprint and the agent trusts that one certificate instead of switching verification off. You read it from any machine that can reach the panel:

shell
openssl s_client -connect <host>:8083 </dev/null 2>/dev/null | \
  openssl x509 -noout -fingerprint -sha256
Commands and terminal output are in English everywhere, in the panel and in these pages. One text, one truth: what you read here is literally what your host will print back.

Once you give the panel a Let's Encrypt certificate on its own hostname, the chain verifies by itself and the field may stay empty. That is the better choice there: such a certificate renews about every ninety days, and a pinned one would have to be replaced here every time. The connection test tells you which of the two you have.

Packages

HestiaCP describes what an account may use in a package: disk space, bandwidth, and how many domains, databases and mailboxes. Provibr reads that list and refers to a package by name; what is in it stays yours.

A web hosting plan in Provibr points at one package on one integration. That is what your customer orders, and you set the price yourself.

What Provibr does with an account

Five actions, each of them addressed by the username, the same name Provibr keeps as the identity of that server.

  • Create an account, with a domain, a package and a contact address.
  • Suspend it and resume it. A suspended account does not count towards your capacity.
  • Move it to another package.
  • Remove it, with everything the panel removes along with it.
Creating takes two calls on HestiaCP: one for the user and one for the domain, because there is no command that does both. If the second one fails, say because the domain already belongs to somebody, the agent removes the user it had just created and reports the original error. A refused domain therefore never leaves half an account behind.

Disk space and bandwidth

Every reading of the panel carries the limit and the usage of each account, in megabytes. They appear on the server page and in the graphs, without a second call that could lag behind the first.

Provibr does not manage DNS, mailboxes or databases on HestiaCP, and there is no console. Those stay in the panel itself, where you and your customers keep using them.

Accounts that already exist

Accounts made outside Provibr can be imported on the integration page: the agent lists what is on the panel, and you pick which of them should become a server in Provibr.

An imported account counts towards your capacity from that moment on, like every other web server.

What this does not do

Provibr manages accounts, not the panel: it does not install HestiaCP, does not update it, does not change server settings, and does not touch DNS, mail or databases. Reading a panel with many accounts costs one extra call per account for the domains, because HestiaCP has no command that lists them all at once.

PreviousWebminNextCyberPanel