Flaem

Flaem is a hosting platform on which a company runs game servers, VPSs, websites, domains and mail for its clients. For such a company to sell anything, the panel has to talk to everything around it: the payment operator, KSeF, the domain registrar, the DDoS protection provider, the text message gateway and the Discord where its clients hang out.

The operator switches each of these integrations on separately, with keys from its own contracts, in the admin panel. The setup wizard shows which ones are still missing, and whatever is not on the list connects through the REST API, signed webhooks, Terraform or an MCP server.

The client pays by card, bank transfer, BLIK, a PayPal account, a paysafecard code, text message or cryptocurrency. The operator enables a gateway with keys from its own contract, and the payment issues an invoice and starts or renews the service in the same transaction.

With Przelewy24, Tpay and PayU the six-digit BLIK code is entered in the panel itself, with no redirect to the gateway's page. The client confirms the payment in the banking app and stays in the shop the whole time.

Every gateway starts in test mode, so the first real payment never arrives by mistake. Keys are encrypted in the database and the panel never shows them again. Full and partial refunds go through the gateway, and a failed charge of a saved Stripe card at renewal is retried on the due date, after three days and after seven days.

The invoice is created at the moment of payment, and the FA(3) file goes to KSeF from a background queue, so a KSeF outage never blocks a sale or a renewal. The queue retries less and less often, and when KSeF stays silent for a long time every administrator gets a notification with the invoice number and the reason.

VIES checks the VAT number of an EU company, an invoice in a foreign currency gets the average rate from NBP table A together with the table number, and sales to consumers in other EU countries are counted in euro for OSS. When the month closes, the operator downloads one package for the accountant: revenue, MRR, unpaid invoices, refunds and reseller commission reports in CSV, XLSX and PDF, and a JPK file built from the same documents the panel shows. A reseller sends invoices with its own KSeF token, in the context of its own tax ID.

The client searches for and registers a domain in the operator's shop, and Flaem talks to the registrar the operator buys it through: Openprovider, AfterMarket.pl, ResellerClub and other LogicBoxes brands, CentralNic, OVHcloud, Namecheap, Porkbun, domeny.tv, or NASK directly for .pl domains. Each extension has an account order: when the first one does not answer, the registration goes through the next.

A registrar outside the list is connected by describing its API in a panel form, with a custom bridge, or, for an accredited registrar, over EPP straight to the registry. After the purchase the DNS zone goes to PowerDNS with a record editor in the client panel, or to Cloudflare, and mailboxes are created in mailcow, which writes the DKIM, SPF and DMARC records into the zone on its own.

Attack traffic is scrubbed by the protection provider's network before it reaches the operator's uplink. Flaem connects that protection, sets filters for every service and shows clients the attacks on their addresses without a ticket.

Flaem reads data from the old system through its API, its database or an account backup, and first shows a dry run report: what will be created, what will change and what cannot be moved. Until the operator approves it, nothing changes. Moved packages wait inactive at a price of zero, so nobody gets an invoice or a suspension by mistake, and imports from WHMCS, Convoy and Virtualizor can be undone.

From WHMCS come clients, balances into the wallet, renewal dates and amounts, invoices as an archive and saved Stripe cards. From Pterodactyl come users, nodes, port allocations, eggs, packages and servers with their identifiers kept, and the Wings node is taken over in place. Convoy machines stay on the same Proxmox without a restart, machines from Virtualizor, SolusVM, VirtFusion and VMware ESXi move to Proxmox VE nodes, and websites, domains, mailboxes and databases from cPanel and DirectAdmin come in from an account backup.

An operator who wants to stay on WHMCS, Blesta, HostBill or Paymenter installs the Flaem module there like any server module. Their system stays the owner of the client, the money, the period and the dunning, while Flaem creates, suspends and changes services through the bridge API.

Every change carries a key built from the service number and the kind of operation, so a job retried after a timeout never puts up a second machine. A bridged service gets no invoices or renewals in Flaem, because the operator's billing system handles that.

Invoices, outages, approaching limits and ticket replies reach the client wherever they choose: in the panel, by email from the operator's SMTP server, by text message through Twilio, SMSAPI or SerwerSMS, by push in the browser and in the iOS and Android apps, on Telegram or on Discord. An alert for the team goes to whoever is on call and, without acknowledgement, climbs the escalation ladder.

The Discord bot runs on the operator's own Discord application, so the operator's brand speaks on clients' servers. Every ticket opens a thread on the team's Discord, and a reply in the thread goes back to the ticket. The client gets commands for servers, backups and invoices, an alert channel for outages of their servers and roles assigned by the services they have.

The client signs in with a Google, GitHub, Discord or Steam account, or through any OpenID Connect provider. Forms are protected by Cloudflare Turnstile or hCaptcha, and before a server starts, the order is assessed by anti-fraud: the operator's rules, MaxMind minFraud or FraudLabs Pro.

The client searches for a plugin or a mod in the panel and installs it with one click, without uploading files over SFTP. The operator decides which catalogues are enabled: Modrinth, CurseForge, Hangar, SpigotMC and GeyserMC for Minecraft, and Steam Workshop and Thunderstore for Steam games. Dependencies are installed together with the plugin, and every downloaded file is checked against its checksum before it reaches the server.

Whatever is not on the list connects through the public API. All the tools share the same keys, limits and usage log.

Webhooks carry an HMAC-SHA256 signature over the timestamp and the body, so the receiver spots a forgery and an old event replayed. A failed delivery is retried at growing intervals, and an address that keeps failing is switched off with a stated reason.