Architecture

How Weborn is built and how it works

Tech Stack

Request Flow

Every request follows this path from browser to application:

For the Panel Itself

Directory Structure

weborn/
    main.py              # FastAPI app + lifespan + mounts
    config.py            # Paths, VERSION, settings
    db.py                # SQLite schema, queries, settings
    auth.py              # JWT encode/decode, PAM, idle lock
    csrf.py              # CSRF token middleware (ASGI)
    ratelimit.py         # Token bucket rate limiter
    icons.py             # 57+ Heroicons v2 outline icons
    ui.py                # Jinja2 env, icon() global
    weborn.py            # CLI entry point (argparse)
    executors/
        __init__.py      # LocalExecutor, DryRunExecutor, WSLExecutor
    managers/
        apps.py          # AppManager (create/delete/start/stop)
        nginx.py         # NginxManager (sites, SSL, cache)
        apache.py        # ApacheManager (ports, virtual hosts)
        db.py            # DBManager (MariaDB, PostgreSQL)
        email.py         # EmailManager (Postfix, Dovecot, Rspamd)
        security.py      # SecurityManager (UFW, Fail2Ban, ClamAV)
    routers/
        dashboard.py     # Dashboard overview
        apps.py          # App CRUD, monitor, process config
        addons.py        # Addon store (39 addons)
        domains.py       # Domain & DNS management
        email.py         # Email stack management
        security.py      # Firewall, Fail2Ban, ClamAV
        ...              # 20+ route modules
    templates/           # Jinja2 HTML templates
    static/              # CSS, JS, icons
    addons/              # 39 addon manifests (.json)

Executor Modes

Authentication Flow

Login Request
    |
    +--> Check panel DB (PBKDF2-SHA256 hash)
    |       |
    |       +--> Match? --> Create JWT --> Set cookie --> Redirect
    |       |
    |       +--> No match?
    |               |
    |               +--> PAM fallback (su -c "password" user)
    |                       |
    |                       +--> Success? --> Create shadow user --> JWT --> Redirect
    |                       |
    |                       +--> Fail --> "Username atau password salah"

Security Layers

• CSRF Middleware - HMAC tokens on all POST forms, auto-injected via JS
• JWT Auth - Stateless HS256 tokens in HTTP-only cookies, 24h expiry
• Rate Limiting - Token bucket per key (login: 5/5min, API endpoints vary)
• Session Idle Lock - Per-user configurable timeout, auto-locks inactive sessions
• Shell Injection - shlex.quote() on all user input in bash commands
• WebSocket Auth - JWT validation before accepting terminal/log connections
• Password Policy - Min 8 chars, uppercase + lowercase + digit + symbol

Database Schema