BinaryLane's platform is a .NET solution with multiple customer-facing interfaces, a compute backend, and supporting infrastructure services. Understanding what's external (customer-triggerable) vs internal (admin/ops-only) is critical for finding customer-side bugs.

• vps/vps (project 1) — Main .NET solution containing all customer-facing software
• vps/compute (project 22) — Programs deployed to compute host nodes (HostDaemon, live migration, guest lifecycle)
• vps/qemu-network (project 20) — iptables/netns firewall code on compute hosts
• vps/ops/ops (project 65) — Internal ops tooling
• vps/bootstrap (project 34) — Host provisioning
• vps/dynamic_rs (project 61) — Dynamic reservation logic
• vps/mpay (project 9) — Payment processing
• vps/backup (project 33) — Backup host programs
• vps/backupproxy (project 4) — Backup download proxy
• vps/looking-glass (project 5) — Network looking glass
• vps/router (project 31) — Router configs/scripts
• vps/butler (project 50) — Butler bot
• vps/cli-based-tests (project 55) — E2E tests against WebAPI
• vps/python-binarylane (project 41) — Python API client library
• vps/binarylane-cli-dotnet (project 73) — .NET CLI

The .NET solution in product/website/ contains:

product/website/
├── AdminSite/           — Admin panel (staff only, NOT customer-facing)
├── ClassicPanel/        — Classic ASP.NET WebForms panel (legacy customer UI)
├── PanelSite/           — Modern SPA panel (.NET Core + React/TypeScript)
├── WebApi/              — REST API (customer + CLI facing)
├── Domain/              — Core domain entities (shared across all panels)
├── Persistence/         — NHibernate data access
├── HostDaemon/          — Daemon running on compute hosts
├── StatsDaemon/         — Statistics daemon
├── MpayClient/          — Payment client
├── SynergyClient/       — Synergy wholesale integration
├── Configuration.*      — Config/log4net/NHibernate modules
├── Controllers.Shared   — Shared controller code
├── MonoRail/            — MonoRail MVC framework (ClassicPanel uses this)
├── Mammoth.Wooly/       — Asset bundling
├── MigratorDotNet/      — DB migrations
├── lib/                  — Shared libraries
├── devenv/               — Development environment
└── scripts/              — Build/deploy scripts

• REST API — Primary programmatic customer interface
• Controllers: Servers, Accounts, Domains, Invoices, Backups, Snapshots, VPCs, LoadBalancers, NetworkAlerts, FailoverIps, Keys, Images, Software, ReverseNames, DataUsages, Customers, Actions
• Called by: PanelSite frontend, binarylane-cli, Python client, customer scripts
• Key service: AdvancedFirewallApiService.SetFirewallRules() — accepts firewall rules for a guest
• Authentication: API key or session-based

• Modern SPA — .NET Core backend + React/TypeScript frontend (ClientApp/)
• Purpose: The new mPanel SPA version of the control panel
• Customer access: Web browser at panel.binarylane.com.au (or equivalent)
• Visual regression tests: vps/panel-visual-regression-tests (project 30)

• Legacy WebForms — MonoRail MVC on ASP.NET
• Controllers: Panel/FirewallController, Panel/Network, Panel/SelectGuest, Panel/SuspendedGuest, DomainNamePlans, Plans, Rescues, Search, Landing, Debug
• Customer access: Older panel URL (being phased out per issue #1802)
• Notable endpoints:
  • POST /Panel/Firewall/ValidateFirewallForm — validates firewall rules
  • POST /Panel/Firewall/Import — imports firewall rules from raw JSON
  • POST /Panel/Firewall/Save — saves firewall rules for a guest
  • GET /Panel/Firewall/Show — displays current firewall rules

• Admin panel — Staff only, NOT customer-facing
• Purpose: Internal admin operations
• Access restricted to permitted admin addresses (PermittedAdminAddress entity)

These are the core objects customers interact with:

• Guest — A VPS/server instance. Has FirewallRules, Interfaces, Storage, etc.
• GuestFirewallRule — Individual firewall rule with SourceAddresses, DestinationAddresses, DestinationPorts, Protocol, Target
• Customer — Customer account
• Plan / WebPlan — Hosting plans
• Lease / WebLease — Billing leases
• Invoice / InvoiceLineItem — Billing
• DomainName — Domain registration
• Backup / Snapshot — Data protection
• Network / Interface — Networking
• Host — Physical compute node

When a customer modifies firewall rules or powers a guest on/off, the following chain executes:

1. Customer action → WebApi/PanelSite/ClassicPanel
2. Domain validation → Validators (per-item, NOT per-collection)
3. Command execution → NHibernate persists changes
4. GuestManagementService.UpdateGuestNetwork() → Sends config to HostDaemon
5. HostDaemon → Runs on compute host, applies iptables rules
6. OperatingSystem.XenConfiguration() → Builds FIREWALLRULES xenConfig string
7. Guest.GetIptablesEntries() → Iterates all firewall rules
8. GuestFirewallRule.GetIptablesEntries() → 4-level Cartesian loop (source x destination x protocol x port)
9. qemu-network/mammothvps.sh → Applies iptables with claim_lock

• GuestFirewallRule.cs — No cap on SourceAddresses/DestinationAddresses count, no cap on rules per guest
• ValidateAddressListAttribute.cs — Validates individual addresses but NOT collection count
• GuestFirewallRule.GetIptablesEntries() — 4-level nested loop (source x dest x protocol x port)
• Guest.GetIptablesEntries() — Aggregates across ALL rules on a guest (no size limit)
• OperatingSystem.XenConfiguration() line 350 — FIREWALLRULES xenConfig built from unbounded list
• HostDaemon — claim_lock iptables held during apply, serialising across ALL guests on host

• ApproveAccount / ProcessDomainNameCommand — Race condition (#1635, #1863)
• Mpay token-delete — Timeouts blocking card updates (#1811)
• PayPal opening deposit — Can leave billing on old card (#1891)

• Live migration with DB failover (#1889, #1890)
• Paid guest stuck suspended (#1884)
• Building guest receiving leases (#1886)

• AdminSite — Staff only
• HostDaemon — Runs on compute hosts, not directly customer-accessible
• StatsDaemon — Internal statistics
• vps/ops/ansible, vps/ops/icinga, vps/ops/tron — Internal ops tooling
• vps/vmbuilder — Image building tool
• vps/bootstrap — Dev environment setup
• vps/butler — Internal bot
• vps/forks/* — Third-party forked libraries

• Customer-Side Bug Finding Methodology