DirectAdmin plugin for Flowtriq DDoS detection and auto-mitigation. Automatically provisions DDoS monitoring for hosting users when their accounts are created, tied to DirectAdmin's user lifecycle (create, suspend, unsuspend, delete).
- Automated provisioning -- creates a Flowtriq workspace and monitoring node when a user is created
- Package-based enablement -- choose which DirectAdmin packages include DDoS protection
- Billing lifecycle -- suspend, unsuspend, and delete tied to DirectAdmin user events
- Admin dashboard -- overview of all provisioned users, node statuses, and traffic stats
- User status page -- protection status, recent incidents, and agent install instructions
- JSON-based storage -- no database required, per-user data stored as JSON files
- DirectAdmin 1.60+
- PHP 7.4+ (CLI and CGI)
- cURL PHP extension
- A Flowtriq account with a deploy token (found in Settings > API)
-
Clone or download this repository to your server:
git clone https://github.com/flowtriq/flowtriq-directadmin.git cd flowtriq-directadmin -
Run the installer as root:
sudo bash install.sh
-
Log in to DirectAdmin as admin.
-
Go to Admin > Flowtriq DDoS Protection > Settings.
-
Enter your API URL (default:
https://flowtriq.com) and Deploy Token. -
Optionally set which packages should have DDoS protection enabled. Leave blank to enable for all users.
-
Save and test the connection.
All configuration is stored in /usr/local/directadmin/plugins/flowtriq/data/config.json with restricted permissions (0600).
| Setting | Description |
|---|---|
| API URL | Your Flowtriq instance URL (default: https://flowtriq.com) |
| Deploy Token | Your white-label deploy token from Flowtriq > Settings > API |
| Enabled Packages | Comma-separated list of DA packages. Blank = all packages |
| Auto Provision | Automatically provision new users on account creation |
| DirectAdmin Event | What Happens |
|---|---|
| User Created | Sub-workspace + monitoring node created in Flowtriq |
| User Suspended | Node deleted (stops monitoring), workspace kept for history |
| User Unsuspended | New node provisioned in existing workspace |
| User Deleted | Node deleted + workspace deactivated, local data removed |
You can limit DDoS protection to specific DirectAdmin packages. Only users on enabled packages will be auto-provisioned. Users on other packages will not see the DDoS Protection menu entry (no workspace is created for them).
To enable for specific packages, enter their names in the Settings page (comma-separated). Leave the field blank to enable for all users regardless of package.
Administrators see:
- Total provisioned users count
- Online, offline, and under-attack node counts
- Table of all users with IP, status, last seen, and traffic data
- Auto-refreshing status (every 30 seconds)
Users see:
- Protection status banner (Protected, Under Attack, Elevated Traffic, Offline)
- IP address and current traffic levels
- Link to their full Flowtriq dashboard
- Recent DDoS incidents with attack type, severity, and peak PPS
- Agent install instructions with their node ID and API key
flowtriq/
plugin.conf # Plugin metadata
hooks/
admin_txt.html # Admin menu entry
user_txt.html # User menu entry
user_create_post.sh # Auto-provision on user creation
user_destroy_pre.sh # Cleanup on user deletion
user_suspend_post.sh # Suspend node
user_activate_post.sh # Unsuspend node
admin/
index.html # Admin dashboard
settings.html # API configuration page
status.raw # AJAX endpoint for live status
user/
index.html # User protection status page
status.raw # AJAX endpoint for user status
lib/
FlowtriqApi.php # cURL API client
functions.php # Config, storage, helpers
provision.php # Provisioning logic (called from hooks)
data/ # Runtime data (created by installer)
config.json # Plugin configuration
users/ # Per-user JSON data files
flowtriq.log # Plugin log file
The plugin communicates with the Flowtriq REST API v1:
| Endpoint | Purpose |
|---|---|
GET /api/v1/workspace |
Test API connection |
POST /api/v1/workspaces |
Create sub-workspace for user |
DELETE /api/v1/workspaces/{uuid} |
Deactivate sub-workspace |
POST /api/v1/nodes |
Provision monitoring node |
GET /api/v1/nodes/{uuid} |
Fetch node status |
DELETE /api/v1/nodes/{uuid} |
Remove monitoring node |
GET /api/v1/incidents |
Fetch recent incidents |
- Verify the plugin is installed in
/usr/local/directadmin/plugins/flowtriq/ - Check that
plugin.confexists and hasactive=yes - Restart DirectAdmin:
systemctl restart directadmin
- Confirm hook files are executable:
ls -la /usr/local/directadmin/plugins/flowtriq/hooks/ - Check that PHP CLI is available at
/usr/bin/php - Review the log file:
cat /usr/local/directadmin/plugins/flowtriq/data/flowtriq.log
- Verify the API URL is correct and reachable from the server
- Check that the deploy token is valid (copy it fresh from Flowtriq > Settings > API)
- Test connectivity manually:
curl -s -H "Authorization: Bearer YOUR_TOKEN" https://flowtriq.com/api/v1/workspace
- Confirm auto-provisioning is enabled in Settings
- Check if the user's package is in the enabled packages list
- Review the log:
tail -50 /usr/local/directadmin/plugins/flowtriq/data/flowtriq.log
- Ensure the
data/directory is owned bydiradmin:diradminwith mode 0700 - Re-run the installer to fix permissions:
sudo bash install.sh
Run the uninstaller as root:
sudo bash uninstall.shThis backs up your data to /tmp/ and removes the plugin directory. Existing Flowtriq workspaces and nodes are not affected on the Flowtriq side. Manage them from your dashboard.
Start your free 14-day trial at flowtriq.com/signup.
MIT. Copyright (c) 2026 Flowtriq.
Built by Flowtriq -- Real-time DDoS detection and mitigation.