iNetPanel 1.29: Remote S3 Backups, Tuxxin Services and Hardening

iNetPanel 1.29.0 is out, released October 24, 2026. It copies your nightly backups to any S3-compatible bucket, adds Tuxxin Services, a set of optional integrations you switch on module by module, and hardens how the panel stores its own data and keys. Update when you can; the security changes apply to every install.

Remote S3 backups

A backup that lives on the same disk as the sites it protects is gone if that disk is. The Backups page now has a Remote Backup (S3) card that copies every nightly backup to an S3-compatible bucket. It works with AWS S3, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces, MinIO and Garage, so a home server can send its backups to a cloud bucket, and a VPS can send them to a MinIO or Garage box you run yourself.

How uploads run

Uploads start in the background after each nightly backup finishes. They retry if the connection drops, and an hourly check picks up any run that failed. If uploads keep failing, a warning appears in the panel header, so a broken bucket setting does not go unnoticed for weeks. You can set an upload speed limit, which helps on a home connection where the backup shares bandwidth with the sites you host.

Remote retention

Remote retention is optional. When it is on, old backups are deleted from the bucket, with two limits: only backups this server uploaded are ever deleted, and the newest backup of each account is always kept. Several servers can share one bucket without one server pruning another's files.

Where the secret key lives

The bucket's secret key is stored where only root can read it, never in the panel database.

The same features are available from the shell:

inetp s3_backup status
inetp s3_backup test
inetp s3_backup upload
inetp s3_backup retention --dry-run

Setup steps for each provider are in the backups documentation.

Tuxxin Services

Tuxxin, the company behind iNetPanel, runs several online services, and 1.29 adds optional integrations with them under Settings > Tuxxin Services. There is a master switch plus one switch per module. A module that is off never runs and sends nothing anywhere. Each module works on a free tier; a key raises its limits or adds coverage.

External Security Audit (qsa.sh)

qsa.sh scans the server's public IPv4 address from outside. iNetPanel is built to need no open ports, since sites come in through the Cloudflare Tunnel, so 0 open ports is the expected result. When a scan does find something, it is usually a router port-forward or a DMZ setting, and the panel labels each open port with what is behind it.

New in 1.29:

• Scans run in the background with live progress, so you can leave the page and come back.
• Full and Deep paid tokens are supported. A Deep token is never used for scheduled scans.
• A scan cut off at a time limit is recognized as incomplete and is never compared with complete scans.

The free tier scans the top 1,000 TCP ports, one scan per 24 hours. Change monitoring sends an alert only when your exposure really changes.

IP Intelligence (worldip.io)

Click any IP address on the Firewall and Logs pages to see its country, network and reverse DNS from worldip.io. A new Dashboard card, This Server on the Internet, shows the server's public IP, its network, and whether its reverse DNS is forward-confirmed, which matters if the server sends email. The free tier allows 1,000 lookups a day per server.

Domain & Certificate Watch (issued.live)

issued.live tracks domain registration and certificate expiry for each hosted site. Sites close to either date get a warning on the Accounts list.

Site Screenshots (webshot.site)

webshot.site takes a weekly thumbnail of each hosted site, so you can see at a glance which sites are up and what they show.

Malware & Phishing Scan (whack.sh)

whack.sh runs on-demand scans of a hosted site from outside. It needs a key from a free whack.sh account, so this module starts switched off.

Site details for you and your clients

The results show up on the Accounts page and in the client portal. Clients can see their own site's screenshot, expiry dates and scan results.

Alerts

Alerts go to a webhook: Discord, Slack, ntfy, or any HTTPS endpoint.

Which modules start on

New installs start with the modules on, except the whack.sh scan. Upgrades add the new modules switched off, so nothing new runs on an existing server until you turn it on. The External Security Audit has been available since 1.27 and keeps its current setting.

Every module, its limits and what it sends are covered in the Tuxxin Services documentation.

Security hardening

This release tightens how the panel stores its own data:

• The panel's database and state are now private to the panel, including from Apache, which serves the hosted sites. Apache restarts once after the update to apply this.
• Keys, the qsa.sh token and webhook URLs are stored where only root can read them, instead of in the panel database.

Two new commands keep it that way:

inetp harden_panel   # re-applies these permissions at any time
inetp audit          # checks them

Every install benefits from these changes, so update even if you do not plan to use S3 backups or Tuxxin Services.

Upgrading

Update from Settings > Updates in the panel, or run this as root:

inetp panel_update

Two things to know:

• If you monitored exposure with a qsa.sh token, monitoring pauses until you run one scan by hand. That scan lets the panel confirm the token is Full rather than Deep, since a Deep token is never used for scheduled scans.
• Apache restarts once during the update, as part of the hardening above.

There are three new CLI commands, inetp tsvc, inetp s3_backup and inetp harden_panel, which brings the total to 39 inetp commands.

Get 1.29

Update your existing servers from the panel, or install iNetPanel fresh on Debian 12 or 13 with the install guide. iNetPanel is free and open source. The full list of changes is in the changelog, and release notes and source are on GitHub (v1.29.0).