https://blog.margrop.net/en/tag/qinglong-panel/ Recent content in QingLong Panel on Margrop Blog Hugo en-US Thu, 09 Jul 2026 10:30:00 +0800 https://blog.margrop.net/en/post/qinglong-to-baihu-safe-migration/ Thu, 09 Jul 2026 10:30:00 +0800 https://blog.margrop.net/en/post/qinglong-to-baihu-safe-migration/ <blockquote> <p><strong>Bottom line first</strong></p> <p>Migrating from QingLong Panel to BaiHu Panel is not a directory-copy exercise. I ran a real migration drill in an isolated Docker environment: a fresh QingLong instance with sample environment variables, scripts, labels, and cron jobs; then a fresh BaiHu instance; then an actual conversion and verification pass.</p> <p>The reliable migration unit is not the whole QingLong data directory. It is a set of assets: script files, environment variables, scheduled tasks, tags, enabled/disabled state, and task-variable relations. QingLong uses numeric IDs; BaiHu uses string IDs and relation tables. QingLong commands such as <code>task daily_check.py</code> also need to become executable BaiHu commands such as <code>python /app/data/scripts/qinglong-migrated/daily_check.py</code>.</p> <p>This article contains no full private IP address, private registry address, host name, token, cookie, or production secret. The screenshots come from a disposable lab, and the variables are redacted sample data.</p> </blockquote> https://blog.margrop.net/en/post/qinglong-baihu-panel-security/ Thu, 09 Jul 2026 10:00:00 +0800 https://blog.margrop.net/en/post/qinglong-baihu-panel-security/ <blockquote> <p><strong>Bottom line first</strong></p> <p>QingLong Panel used to be the default answer for many self-hosted scheduled-script setups. It can run scripts, manage environment variables, show logs, synchronize repositories, and wrap crontab-like workflows in a friendly web UI. But the critical QingLong issues publicly discussed in early 2026 changed the risk calculation: <strong>a task scheduler panel is not just another web admin page. It often holds scripts, secrets, notification tokens, and execution privileges. If authentication can be bypassed, the attacker is not merely viewing a dashboard; they may be standing in front of a machine that can run jobs.</strong></p> <p>For new lightweight deployments, I would now evaluate BaiHu Panel first. BaiHu is a Go + Vue3 automation task scheduling platform focused on low overhead and high performance. Its public README describes Docker / Docker Compose deployment, Mise-based runtime management, repository task synchronization, logs, notifications, and secret handling. It is not a perfect one-to-one replacement for every QingLong workflow, but it is a better starting point for many personal script-hosting cases.</p> <p>If you must keep using QingLong temporarily because of old jobs, migration cost, or compatibility constraints, do not expose it directly to the public Internet. Put a protection layer in front of it: VPN, zero-trust access, reverse-proxy Basic Auth, an allowlist, WAF rules, or equivalent access control. This article includes one-click scripts for Windows 11, Ubuntu 26.04, and macOS 26. They deploy BaiHu by default, require an explicit switch to deploy QingLong, and put either panel behind Caddy Basic Auth.</p> </blockquote>