Solved File upload limit regression — preserve per-domain limits across Panelica regeneration

[EvilTater]

Hello,

We operate a production-critical file-sharing website on Panelica.

Large file uploads failed because the upload limits were inconsistent across the Panelica-managed stack:

- Nginx client_max_body_size: 128 MB
- PHP-FPM upload_max_filesize: 128 MB
- PHP-FPM post_max_size: 160 MB
- ModSecurity SecRequestBodyLimit: 13,107,200 bytes (~12.5 MB)

The ModSecurity limit caused multipart uploads larger than approximately 12.5 MB to be rejected before PHP processed them. Apache logged:

ModSecurity: Request body (Content-Length) is larger than the configured limit (13107200).
ModSecurity: Multipart parsing error: Multipart: Final boundary missing.

We corrected the domain to support these limits:

Nginx client_max_body_size: 1100M
PHP upload_max_filesize: 1024M
PHP post_max_size: 1100M
ModSecurity SecRequestBodyLimit: 1153433600 bytes

Please investigate and provide a durable Panelica-supported way to preserve these per-domain settings across Panelica upgrades, domain rebuilds, and control-panel saves. Specifically:

1. Expose and preserve a per-domain ModSecurity request-body limit.
2. Ensure domain PHP-FPM, Nginx, and ModSecurity upload limits can be set together or validated for consistency.
3. Avoid regenerating a working domain with lower default limits.
4. Provide a post-update hook or configuration-management mechanism for domain-specific limits.
5. Confirm whether any recent Panelica update or regeneration could have reset these values.

This website is business-critical, so we need assurance that a Panelica update cannot silently restore lower limits.

Thank you.

 

[admin]

Hello,

Thank you for the detailed report. We reproduced exactly what you describe on our own test servers.

What is going on

1. ModSecurity's server-wide request body limit is 12.5 MB (SecRequestBodyLimit 13107200). When ModSecurity is "On" (blocking) for a domain, larger uploads are refused before they reach PHP: the browser gets an HTTP 500 and Apache logs the two lines you posted. In "DetectionOnly" mode the same thing is only logged.
2. When a domain's ModSecurity settings were saved (mode change, rule on/off, IP block), the panel rewrote the site's nginx file with a fixed 128M. An nginx limit you had raised by hand could fall back with any of these actions.
3. Changing the PHP limits in the panel did not reach nginx.

The fix (coming with the next panel update)

• A site's upload limit is tied to a single setting: Post Max Size on the domain's PHP tab. nginx's client_max_body_size and the site's ModSecurity limit follow it automatically. The ModSecurity limit never goes below the server-wide value you have set.
• ModSecurity actions no longer lower the nginx limit. When you save the PHP limits, nginx and ModSecurity are updated at once.
• At the first start after the update, the panel raises sites whose limit is below their PHP value. It never lowers any site's limit.
• The update does not change your modsecurity.conf.

What we suggest now (it also holds before the update arrives)

1. Enter the values in the panel: open https://your-server:8443/domains and click your domain; the address becomes https://your-server:8443/domains/edit/<domain-id>. Go to the PHP tab (.../domains/edit/<domain-id>#php), and in the PHP Resource Limits card set Post Max Size: 1100 and Upload Max Filesize: 1024, then click Apply Changes. From then on the panel uses these values every time it regenerates the site; an nginx file edited by hand is overwritten the next time it is regenerated.
2. For ModSecurity until the update arrives: on the same domain open the Security tab (...#security), put SecRequestBodyLimit 1153433600 into the Custom ModSecurity Rules box and click Save Custom Rules. Panel actions do not remove this rule. After the update it is no longer needed; you can remove it by emptying the box and saving (saving an empty box also comes with the update).
3. "Maximum request body size" on https://your-server:8443/webserver/settings#nginx does not apply to sites; it is only for requests that match no site. Please do not use it for this.

Your questions in short

1. Per-domain ModSecurity limit: automatic with the update (Post Max Size); until then, the custom rule.
2. Setting the limits together: yes, it is now a single field.
3. Regenerating with lower values: fixed.
4. A post-update hook: not needed. The values live in the panel's database and are applied every time the site is regenerated.
5. Did an update or a regeneration reset the values: the update package does not change modsecurity.conf. But saving ModSecurity settings, turning a rule on or off, or blocking an IP set nginx back to 128M, and generated files edited by hand (the site's nginx file, modsecurity_domain.conf) are rewritten every time the site is regenerated.

We will post here with the version number when the update is published.