Hosting service integrations
The reviewed source interfaces target Nginx, optional Apache compatibility, advertised PHP-FPM, separate customer MariaDB, optional separately advertised customer PostgreSQL, local authoritative DNS, Postfix/Dovecot mail, encrypted restic backups, supported WordPress, Node.js/Python applications and Git deployment. Each needs its actual installed capability and qualified operator/service configuration. A source integration is not certification of a live public service.
Certificate authorities
The certificate UI recognizes advertised local ACME test service, Let's Encrypt staging and Let's Encrypt production. HTTP-01 and same-account local-zone DNS-01 are capability-gated, and production requires current exact-target staging evidence. An arbitrary DNS provider API credential or external ACME URL cannot be invented through the public form. Imported certificates use the separate PEM/private-key flow.
Backup transports
Destinations are root-enrolled and listed to the authorized UI. The requested Google Drive / S3 / SFTP menu leaf is explicitly unavailable as a combined self-service destination setup. Do not infer support for a particular provider, OAuth workflow or remote credential format from restic's upstream capabilities. Use only the protected destination types documented by the exact approved kit and test independent encrypted recovery.
Billing and licensing
Orbit Area provides purchases, invoices, main licences and premium addon rights outside Panel. The local billing connection is read-only hosting inventory with the exact owner-token scope. Inventory tokens cannot mutate accounts; newer source adds separately scoped owner-only suspension/reactivation. Automated create, package change, termination and payment collection remain outside that connection. No payment gateway adapters, card processing, registrar registration/renewal/transfer modules, customer invoice suite or reseller billing are included in this release.
Extension and vendor boundaries
The native Plugin Library has fixed component inspection, an unconfigured signed-extension catalogue and no individual component installer. Premium addon source controls need a genuine signed package, trusted publisher, protected installed mapping/credential and current main rights; none of those follows from a marketplace login. phpMyAdmin, Ruby applications, optional licensed installers/alternative web servers and arbitrary hooks must not be advertised as installed merely from a menu label.
Unsupported scope
Clustering, linked hosting-node control, resellers, DNS synchronization, public root terminal, complete server profiles and whole-machine automatic restore are outside or unimplemented in this checkpoint. Every requested menu leaf is documented with its exact unavailable reason where applicable. Use the menu reference and release-specific capability state before choosing an integration plan; never substitute a fake success or disable a safety gate.