Changelog
What's new in Arka
Every release, newest first. Arka looks for new versions every six hours and installs them from the panel in one click, without dropping a connection.
Arka 0.1.12
Latest- PHP sites under load: requests waiting for php-fpm are served in the order they arrived, so the slowest answers come sooner, and small PHP requests use about a quarter less CPU.
- The official build is now also optimised for PHP and for pages compressed per request: full PHP pages use 7–11% less CPU.
- Idle keep-alive connections use 3 KB less memory each.
- hyper 1.12.
- Fixes the firewall's "standard" level and above refusing visitors who use HTTP/2 or HTTP/3 — most browsers. Update if you turned the firewall on with 0.1.10.
- Fewer firewall false positives: uploads, webhooks, analytics beacons, REST and WebDAV methods and GraphQL queries now get through at "standard" and "strict". Turned on from the panel, the firewall first only logs for a day; each refused request on the Firewall page can become an exception with one click; only attacks earn ban points.
- Alerts to a webhook: certificates that cannot be renewed or are expiring, upstreams going down, disks filling up, firewall spikes.
- Log files are rotated by Arka, and a disk reserve keeps room for certificates and settings.
- Backups (make, download, upload, restore), the server's own log and deleted sites are now in the panel, along with the remaining server settings.
- Hardened the control panel and what site files may reach.
- Lighter: idle connections use 60% less memory, small PHP requests about 20% less CPU, and pages built per request are compressed with zstd where the browser supports it.
- Fixes a problem in 0.1.9: PHP sites with max_conns and a queue could lose capacity, and stop answering, when visitors left while their request was starting. Update if you run 0.1.9.
- Quieter logs: clients that send an IP address as the TLS server name no longer add a warning per connection.
- Includes everything new in 0.1.9: firewall protection levels, large request bodies and uploads inspected before they reach the site, a PHP page cache with PURGE, php-fpm connection limits with a queue, HTTP/3 limits and larger UDP buffers, cached upstream DNS, crash-safe state files and self-restarting background work.
- Firewall protection levels: basic, standard, strict and maximum, chosen per site in the panel or the host file; the OWASP Core Rule Set is what the panel turns on.
- The firewall now inspects large request bodies before they reach the site: uploads whole (every field and file name), forms and JSON up to 1 MB; larger ones are refused from the standard level up.
- PHP hosting: a page cache with PURGE, php-fpm connection limits with a queue, failover between php-fpm servers, and faster FastCGI (up to 2.6 times as many requests a second).
- HTTP/3: header size limits, connection limits and address checks like TCP's, larger UDP buffers and a thread setting.
- Busy servers close the idle connections of the heaviest clients first, instead of refusing visitors.
- Upstream host names are cached, and the last answer keeps working while DNS is down.
- Crash-safe state files; the control panel, log writer and certificate renewer restart themselves; certificate expiry metrics.
- Improved performance and hardened security.
- Passkeys for the control panel; the access token can be rotated and limited to the server itself.
- A bot check that keeps scrapers and AI crawlers away from a site, while search engines get through.
- Virus scanning of uploads with ClamAV, including uploads to PHP and proxied applications.
- Daily backups (arka backup), and Roll back for package updates.
- Updates install without dropping a single connection.
- ACME renewal information (RFC 9773) and certificate profiles, such as short-lived certificates.
- Timeouts for stalled clients, and a disk budget for buffered request and response bodies.
- Improved performance and hardened security.
- Improved performance and hardened security.
- Control panel lockout: only different wrong tokens or passwords count towards it, so a panel tab left open across a restart or update no longer locks its owner out.
- The control panel follows its certificate files: a certificate Arka renews for the panel's own name reaches it without a restart.
- The Updates page says when the panel stops answering during an install, instead of waiting.
- The complete OWASP Core Rule Set 4.30 as a firewall rule set (
ruleset = "crs"), with request and response rules, paranoia levels and anomaly scoring. - Security: control-panel editors can no longer reach Arka's own files through a site; symbolic links that lead out of a web root are refused unless allowed.
- rustls 0.23.46 (four security advisories fixed).
- The package starts the update helper on install, and the panel says clearly when it is not running.
- The complete OWASP Core Rule Set 4.30 as a firewall rule set (