TWO Release Hub — licensing & release hub for plugins

TWO Release Hub is a self-built system that turns a paid plugin into a licensed product: a license server + release hub for WooCommerce and PrestaShop plugins (the “One Click Return” product). A personal project run like a real production deployment — a good case study spanning backend, security and CI/CD.

Problem

Selling a plugin means knowing who, where and until when may use it, shipping updates only to entitled users and protecting the code. Instead of paying for a third-party licensing service, I built my own — hostable on ordinary PHP+MySQL hosting.

How it works

• Products & releases — each product has a repo and releases (ZIP upload + sha256). Publishing happens only via GitHub Actions (push to main → build → /publish), never by hand.
• Clients & domains (mini-CRM) — a client has a type and multiple domains; a plugin catalogue with assignments, install and expiry dates.
• Tokens per domain×product — a license is a token bound to a specific domain and product, with validity and actions (regenerate / suspend / revoke / extend).
• /validate API — the plugin calls the hub and the response is signed with an Ed25519 key and verified client-side (cache + grace mode when offline). Downloads (/download) are token-gated.
• Expiry reminders — the hub groups licenses and plugins expiring on the same domain into a single notification and tracks client contact.

Security

Ed25519-signed responses, token-gated downloads, admin-only panel, separate production keys. The plugin and API went through a pentest (reports in the repo) and the findings were fixed.

Stack

PHP 8.3 + Slim 4, MySQL (PDO), Docker (locally), Mailpit for mail preview, a panel styled after the Two Colours brand. Target: self-hosting on cheap PHP+MySQL hosting, without Docker in production.

Draft copy — to be completed with specifics (metrics, pentest scope, target hosting).