Components

The full third-party inventory shipped or installed by Jabali on a Debian 13 host. Every component listed here is fetched, configured, and started by install.sh; nothing requires manual operator install.

Version pins shown are the values in install.sh at the time of writing. Run jabali --version plus dpkg-query -l for the live values on a deployed host.

Runtime services

jabali update moves Stalwart up to the version in this table, never down. A server that already runs a newer Stalwart, installed by hand, keeps it, and the update prints a warning. Jabali is tested with the version in the table.

Security stack

Apps / tooling

OS plumbing

systemd, systemd-container, systemd-resolved (gated under JABALI_DNS_FORWARDER), auditd, OpenSSH (Match Group jabali-sftp), tar, curl, wget, gnupg, ca-certificates, git, build-essential, libpcre2-dev, acl, jq, socat.

Frontend (panel-ui)

Go libraries (direct dependencies in go.mod)

gin-gonic/gin (HTTP), gorm.io/gorm + gorm.io/driver/mysql (ORM), golang-migrate/migrate/v4 (migrations), redis/go-redis/v9 (Redis), gorilla/websocket (WebSocket), spf13/cobra (CLI), robfig/cron/v3 (schedules), oklog/ulid/v2 (IDs), fxamacker/cbor/v2 (encoding), SherClockHolmes/webpush-go (VAPID Web Push), BurntSushi/toml, google/shlex, golang.org/x/crypto|net|sync|sys|term|time.

Test-only: DATA-DOG/go-sqlmock, alicebob/miniredis/v2, stretchr/testify.

In-house patterns shipped under install/

• jabali-sso-<43-char-nonce>.php — self-deleting magic SSO file (Installatron / Softaculous style). Used by Bulwark webmail and every application install for one-click admin sign-in. 60 s TTL; 256-bit nonce filename; flock + unlink on first hit.
• phpMyAdmin sso.php and Adminer jabali-sso-plugin.php — adapt the magic-file pattern to the two DB web UIs.
• install/snuffleupagus/rules/ — server-wide Snuffleupagus baseline rules.
• install/wp-cli.sha256 / install/phpmyadmin.sha256 — checksum-pinned upstream tarballs.

Removed

Components that previously shipped but are not present in the current build. See Removed Features for the rationale per item.

The installer’s cleanup_* functions actively purge leftover packages and config from these components on every install, so a host that previously ran an older Jabali generation does not carry a footprint forward.

Source-of-truth pointers

If you need the live, currently-installed version of any component on a deployed host:

dpkg-query -W -f='${Package} ${Version}\n' | grep -E 'mariadb|postgresql|redis|nginx|pdns|certbot|crowdsec|stalwart|kratos|auditd|aide|apparmor|nftables|ufw|restic|bubblewrap'
stalwart --version
kratos version
jabali --version

To see exactly which versions are pinned for the next install:

grep -E 'VERSION="|version="|local .+_version=' install.sh | grep -v '^[[:space:]]*#'