Case Study — Open Source · Infrastructure
ZoneMirror — Real-time DNS sync from cPanel to Cloudflare
An MIT-licensed cPanel/WHM plugin that mirrors Zone Editor changes into Cloudflare in real time — multi-tenant, with per-user encrypted API tokens, a systemd-supervised worker, and no cron jobs. Designed, built, and published solo, from the hook protocol to the signed release pipeline.
- PHP 8.2
- Cloudflare API
- SQLite
- systemd
- cPanel/WHM
- PHPUnit
- PHPStan
Overview
Most cPanel-to-Cloudflare workflows are a hand-rolled script run by cron: export the zone, transform it, POST it to Cloudflare. That works for one zone, one admin, one server — and breaks the moment multiple cPanel users need their own Cloudflare accounts, real-time propagation, or safe rollback when the API rate-limits.
ZoneMirror replaces that with an event-driven plugin: cPanel Zone Editor changes fire standardized hooks, land in per-user SQLite queues, and a root systemd daemon drains them into the Cloudflare API — one zone snapshot per cycle, with per-server rate-limit budgets and dry-run mode.
Engineering highlights
- Multi-tenant by design: each cPanel user enrolls their own zones with their own Cloudflare API token; one server can mirror N users × N zones.
- Tokens encrypted at rest with libsodium XChaCha20-Poly1305 (AES-256-GCM fallback); user-level hooks never read the root-only master key.
- A log redactor scrubs bearer headers, JSON token fields, and long identifiers from every line before it is written.
- Diff engine protects what sync must not destroy: email-auth records, Cloudflare-only records on delegated zones, and ACME/DMARC entries that must never be proxied.
- Record locks with five scopes (zone, subtree, name, type+name, exact) let users opt individual records out of synchronization.
- Hardened systemd unit (NoNewPrivileges, ProtectHome, MemoryDenyWriteExecute) supervises the worker; a failing hook is caught and logged, never crashing cPanel.
Shipping it as a real open-source product
The repository is run like a production project, not a code dump: PHPStan level 8 across the codebase, 690 test methods in CI on PHP 8.2, 8.3, and 8.4, shellcheck and formatting gates, SemVer releases with SHA-256 verification, and a one-line bootstrap installer that registers hooks, starts the daemon, and drops a zonemirror CLI with self-update.
Documentation covers architecture, security policy, configuration reference, diagnostics, and uninstall — because an infrastructure tool that touches DNS has to earn trust before it earns users.