Introduction

Maran is a web hosting control panel for Linux servers. Install it on a server and manage websites, PHP versions, SSL certificates, databases, files, backups and the firewall from a browser, with a separate cabinet for every hosting customer and an API a billing system can drive to create accounts automatically.

Three processes, and only one of them is root

A Maran server runs exactly three processes, and the split between them is the product's main design decision:

• maran-api — the panel itself. It holds every piece of business logic and is the only thing that touches the database. It runs as an unprivileged system user.
• maran-agent — the only root process. It is stateless, has no database and no configuration of its own, and it alone touches the web server, php-fpm, the database server, SSH and file transfer, the scheduler, the firewall and certificates.
• PostgreSQL — reachable only from maran-api, over a unix socket, with no TCP listener at all.

The panel asks the agent for named operations over a unix socket, with typed and validated arguments. There is no operation that runs a caller-supplied program, and no shell string anywhere in the exchange: the set of things the root process can be made to do is finite, written down and reviewable.

What a hosting account is

A real Linux user, with its own home directory and filesystem permissions. Its PHP runs in its own pool under its own uid, and file operations run under that uid too — never as root. Every table that belongs to a tenant is scoped by account at the database level, and a request for another account's resource answers 404 rather than 403, so an error never confirms that a row exists.

No brokers, no sidecars

Background work runs on durable queues stored in PostgreSQL. Installing Maran does not add a message broker, a sidecar or a second daemon to the server.