Install any plugin in 30 seconds.
Flirexa 1.4.61 ships a plugin install-by-URL flow. Paste a tarball URL plus its SHA-256 into the admin panel, hit install, restart the API. Done — your panel has new functionality.
What changed
Until today, getting third-party functionality into Flirexa meant editing files on the server. Now there's a real flow.
- New Plugins page in the admin panel (sidebar → System → Plugins).
- Top half lists every plugin currently on disk, with version, license-feature requirement, and an Uninstall button (core plugins are protected).
- Bottom half is the install form: paste a
.tar.gzURL plus the SHA-256 the author published. The system streams the file, verifies the hash, refuses path-traversal entries and oversized tarballs, then drops the plugin intoplugins/<name>/. - Restart
vpnmanager-apiand the plugin's routes mount themselves.
What a plugin looks like
Two files. That's it.
1. Manifest
{
"name": "discord-alerts",
"version": "1.0.0",
"display_name": "Discord Alerts",
"description": "Posts new client and payment events to a Discord webhook.",
"requires_license_feature": "community",
"author": "your-handle"
}
2. Plugin code
import os, httpx
from fastapi import APIRouter
from src.modules.plugin_loader import Plugin
router = APIRouter(prefix="/api/v1/plugins/discord-alerts")
@router.get("/status")
async def status():
return {"plugin": "discord-alerts", "active": True}
class DiscordAlertsPlugin(Plugin):
def get_router(self):
return router
def on_load(self):
webhook = os.getenv("DISCORD_WEBHOOK_URL", "")
if webhook:
httpx.post(webhook, json={"content": "Flirexa is online."})
PLUGIN = DiscordAlertsPlugin({
"name": "discord-alerts", "version": "1.0.0",
"display_name": "Discord Alerts",
"requires_license_feature": "community",
})
The community feature flag is granted on every install — including FREE — so plugins declaring it always load. Use a different feature name only if you're building something that should be paid-tier-only.
Publishing your plugin
- Pack the directory:
tar czf discord-alerts-v1.0.0.tar.gz discord-alerts/ - Compute the hash:
sha256sum discord-alerts-v1.0.0.tar.gz - Cut a GitHub release with the tarball attached. Put the SHA-256 in the release notes.
- Tag the repo
flirexa-pluginon GitHub so it's discoverable.
Operators copy the URL and the hash from your release page, paste both into their admin panel, restart the API. That's the whole loop.
Things people might write next
Trust the source. A plugin runs as full Python with the same permissions as the API. The SHA-256 verifies that the file you got is the file the author published — it does not vouch for what the code does. Read manifests before installing, vet authors you don't know, audit anything that handles money or customer data.
Where this is heading
- Now: install-by-URL works. Authors host on GitHub, operators copy URL + hash. No central registry.
- Q3: a curated catalog at flirexa.biz/plugins. Authors submit, we manually review, list on the site. Free for community plugins.
- Q3: signed plugin packages — author signs with their own GPG key, the panel verifies signature in addition to SHA-256.
- Later: paid plugins through the marketplace, with revenue share for authors. Crypto-only billing, same as core subscriptions.
Get started
- Read the authoring guide in the open-core repo.
- Copy the _example scaffold to start.
- If you publish a plugin, open a Discussion in the repo so we can include it in the upcoming catalog.
Questions? Bug reports? support@flirexa.biz.