9.0 Roadmap

[email protected]Uncategorized

Thanks to Zentyal clients around the world, your feedback is our roadmap. Work begins in Oct 2026 for a Q1 2027 release.

Zentyal 9.0 Roadmap (Technical)

Scope locked for 9.0

  • Target: NPOs and SMBs (<6000 users), on-prem.
  • UI focused on initial setup + daily operational tasks.
  • Single list, no phases.
  • Estimation per block: Effort (S/M/L/XL) and Risk (Low/Medium/High).

Work we are going to do

Core (L, High)

  • 2FA for webadmin login.
  • Notifications for unwanted service states, broken packages, and critical events.
  • Notification integrations with Slack and Discord.
  • Configuration backup in UI: import specific modules.
  • Configuration backup in UI: option to force ignore dependencies or Zentyal version.

Network (M, High)

  • Fix Network Load Balancer bugs.
  • Fix Multi-Gateway bugs.

Firewall (S, Low)

  • Split logs into a dedicated file to avoid mixing with syslog.

DHCP (XL, High)

  • Migrate from isc-dhcp-server to Kea DHCP.
  • Implement HA.

NTP (S, Medium)

  • Stabilization and functional validation.

DNS (M, Medium-High)

  • Review DNSSEC status.
  • Review other DNS security measures.

Samba / LDAP (XL, High)

  • Specific audit rules for shared resources.
  • ACL reset per resource and global.
  • ACL copy between resources.
  • Delete domain objects/computers or DCs.
  • Move objects/computers between OUs.
  • Manage domain reverse zone.
  • Improve UI load performance with many LDAP objects (avoid timeouts).

Jabber (S-M, Medium)

  • Stabilization and functional testing.

Mail (XL, High)

  • Add autodiscover.
  • Replace plain_text-only auth with secure authentication.
  • Allow mailbox sharing.
  • Graph for sent/received/rejected/bounced emails by date range.
  • SPF, DKIM, and DMARC wizard with optional DNS integration.

Webmail (M-L, Medium-High)

  • Add 2FA.
  • Allow subdomain instead of https://domain.com/SOGo.
  • Tune key values (SOGo workers and ActiveSync).

Mailfilter (S, Low)

  • Add detections and score graphs.

CA (L, Medium-High)

  • Generate certificates with Certbot (Let’s Encrypt) for services (webadmin, webmail, mail, jabber, samba, apache).
  • Import third-party certificates and make them selectable per service.
  • Allow Samba service certificate configuration.
  • Improve certificate management UX (separate views for large inventories).

VPN (M, Medium)

  • Remove IPsec module from the 9.0 roadmap.
  • Keep OpenVPN.
  • Optional Samba integration.

IPS (L, High)

  • Rule editor.
  • Useful and updated rules for Zentyal services.
  • Rule import.
  • Rule generation wizard.

Backup (XL, High)

  • Fix timeouts with high volume.
  • Restore UI refactor (less complex, more flexible).
  • Support 3-2-1 strategy.
  • S3-compatible backup storage.
  • Evaluate rclone and restic as alternatives.

Version upgrade path (L, High)

  • Improve the upgrade process between Zentyal versions.
  • Priority case: upgrade from Zentyal 8.1 to Zentyal 9.0.
  • Define a clear rollback path if the upgrade fails.

Proxy (M-L, High)

  • HTTPS website blocking without using firewall rules.
  • Add usage graphs.

Modules out of scope / to remove

  • Virt: requires full refactor, critical bugs, limited usage.
  • FreeRadius: requires full refactor, insufficient validation.
  • IPsec: outdated config, one mode untested and another minimally tested.

Key dependencies and risks

  • Kea + HA: migration and compatibility.
  • Samba/LDAP: high regression risk in object operations.
  • Mail/Webmail: balance between security and client compatibility.
  • Backup restore: high risk with large datasets and partial restores.
  • Upgrade 8.1 -> 9.0: risk of config incompatibilities and unsupported modules.

Internal backlog note

  • We currently have an internal backlog of 13 technical tasks to close before October.
  • These are not externally reported; they come from day-to-day team usage.
  • Community/forum issues also keep coming in.
  • The backlog is dynamic: typically 2 tasks are closed and 2 new ones are added.
  • Backlog is not expected to reach zero; it is managed by operational impact.

Appendix A: Large deployments

Part of the 9.0 scope, grouped separately so it can be approved or dropped as a single block. Goal: scale the UI and backend to tens or hundreds of thousands of users (indicative target: 200k), beyond the 9.0 base target (<6000).

Aggregate estimate for the full appendix, assuming 1 dedicated developer: ~12-18 weeks (≈ 3-4 calendar months) including own QA. The bulk of the effort sits in the LDAP access layer refactor and in validation of A.4 (replication) on real clusters.

A.6 (DHCP at scale) leverages the Kea migration already planned in the main DHCP block, so its marginal cost here is small. A.4 (DC replication) is the most expensive and highest-risk item and can be isolated if scope reduction is needed.

Indicative per-block estimate (weeks, 1 dev):

  • A.1 Users/groups UI: 2-3
  • A.2 Shares and LDAP cache: 1-2
  • A.3 Incremental SyncDaemon: 1-2
  • A.4 DC replication + sysvol + DRS panel: 4-6
  • A.5 DNS with Samba DC: 1-2
  • A.6 DHCP at scale (marginal cost over Kea): 1-2
  • A.7 Export streaming: 1

If only the immediate symptom (UI degradation past 4k users) is prioritized without adopting the whole appendix, a viable subset is A.1 + A.2 + A.7 (~4-6 weeks), which already covers realistic deployments up to ~50k users with no infrastructure changes.

Current symptom: the UI degrades past ~4000 Samba users. The root cause is not Samba/LDB itself; it is that Zentyal’s Samba module fetches full LDAP listings with no real pagination and no cache.

A.1 Users/groups UI (L, High)

  • Lazy-load the “Users and Computers” TreeView: load only rootNodes() and expand on demand via jstree AJAX. Drop open_all (main/core/src/EBox/Model/TreeView.pm:452, main/core/src/templates/ajax/treeView.mas:97).
  • Migrate ListContainer to DataTable with customFilterIds for real server-side pagination (main/samba/src/EBox/Samba/CGI/ListContainer.pm:97, pattern in main/core/src/EBox/Model/DataTable.pm:1494).
  • Switch search filters from (|(samAccountName=*X*)...) to anr=X to use LDB indexes (main/samba/src/EBox/Samba.pm:1224).
  • Drop unicodePwd and supplementalCredentials from default attrs in Samba::usersToTable (main/samba/src/EBox/Samba.pm:1205); request them only when editing password.
  • Refactor LDAPBase::pagedSearch with a callback/streaming variant instead of materializing all pages (main/samba/src/EBox/LDAPBase.pm:133).
  • User selector in EditGroup with AJAX server-side combobox instead of embedding all non-members as JSON (main/samba/src/EBox/Samba/CGI/EditGroup.pm:53, main/samba/src/templates/editgroup.mas:90).
  • Range-retrieval (member;range=0-999) in Group::_users to avoid N+1 lookups (main/samba/src/EBox/Samba/Group.pm:379).

A.2 Shares and LDAP cache (M, Medium)

  • AJAX server-side combobox in SambaSharePermissions::populateUser/populateGroup instead of full listing per editor open (main/samba/src/EBox/Samba/Model/SambaSharePermissions.pm:62).
  • Redis cache with TTL for realUsers() and securityGroups(), consumed by mail, shares and other modules. Pattern inspired by DHCP::_dhcpLeases (mtime-based cache).

A.3 SyncDaemon (M, Medium-High)

  • Replace the ~30 s LDB→POSIX full-scan with incremental sync filtering by uSNChanged>=lastUsn (AD DirSync pattern) (main/samba/src/EBox/Samba/SyncDaemon.pm).
  • Document disable_uid_sync=yes as a temporary mitigation (main/samba/conf/samba.conf:96).

A.4 DC replication (XL, High)

Current gap: Zentyal delegates all replication to Samba DRS and does not replicate sysvol (only copied at backup time, main/samba/src/EBox/Samba.pm:1847).

  • Sysvol sync across DCs via scheduled rsync -HAX or osync/unison. Native DFS-R does not exist upstream in Samba.
  • New DRS status composite: read repsFrom/repsTo from partitions and/or parse samba-tool drs showrepl. Base available in main/samba/src/EBox/Samba/FSMO.pm.
  • Replication lag alerts integrated with Core notifications.
  • Increase join timeouts for large initial sync (main/samba/src/EBox/Samba/Provision.pm:1341-1378).

A.5 DNS with Samba DC (M, Medium)

  • Zentyal UI does not list DLZ records managed by AD. Options: (a) list DLZ zones by reading LDB from the UI, or (b) document AD as source of truth and hide DC-managed zones from the DNS tree.
  • Bulk imports: chunk nsupdateCmds in batches with progressive flushes instead of accumulating in RAM (main/dns/src/EBox/DNS.pm:1618).

A.6 DHCP at scale (XL, High)

  • Largely covered by the Kea + HA migration (§ DHCP). Add:
  • Paginated leases widget querying Kea (MySQL/PostgreSQL backend or kea-ctrl-agent) instead of full-file parsing of dhcpd.leases (main/dhcp/src/EBox/DHCP.pm:1053,1108).

A.7 Export and bulk operations (S-M, Medium)

  • Streaming ExportUsers/ExportGroups with paged LDAP control instead of full CSV in RAM (main/samba/src/EBox/Samba/CGI/ExportUsers.pm:81, ExportGroups.pm:80).

Notes

  • A.1 + A.2 alone let the UI handle ~50k users without infrastructure changes.
  • Reaching real 200k also requires A.3 (incremental SyncDaemon) and A.4 (sysvol sync); otherwise the second DC diverges under daily operations.
  • The existing “Improve UI load with many LDAP objects” item in the Samba/LDAP block is subsumed by A.1 if the appendix is approved; otherwise it stays as a narrower improvement targeted at <6000.
  • Main risk: A.4 touches provisioning/join, an area with potential regressions in existing clusters. Feature flag and lab validation with >2 DCs recommended before release.