From isolated control
to autonomous operations
Two years of architecture. One year of execution. Ten thousand decisions to make a hosting panel feel inevitable , and a runway already pointed at fully autonomous server operations.
Already in production
Twenty-five capability areas, each one built from real customer demand and real edge cases. Every line below is verifiable in the source.
Architecture & Isolation
8 features5-Layer Isolation Architecture
Cgroups v2 + Linux namespaces + SSH chroot + per-user PHP-FPM + Unix permissions. Every account is sandboxed at the kernel — no shared state between tenants.
20+ Isolated Services
nginx, apache, php (8.1–8.4), postgres 17, mysql 8, redis 7, bind, proftpd, postfix, dovecot, clamav, fail2ban, pgadmin, phpmyadmin, roundcube — every service contained under /opt/panelica.
eBPF Bandwidth Limiter
Cgroup-pinned eBPF programs with ancestor lookup. Per-user, per-domain, per-protocol traffic shaping with kernel-level enforcement.
AppArmor Mandatory Access Control
Profiles for nginx, apache, php-fpm. If a worker is compromised, AppArmor contains the blast radius before the attacker can pivot.
Triple API Architecture
Internal (3001), External (3002, HMAC-signed), and CLI — 1,263 endpoints in total. Every operation is exposed three ways with no privilege drift.
Per-User Container Isolation
Optional Docker-per-user mode for hostile multi-tenant. Cgroups + namespace today; Docker tomorrow when operators want it.
Multi-Server Management
Manage several Panelica servers from one master panel: live resources, domains and mailboxes across servers, and a one-click session on any node.
Disk Guard — Kernel Quotas
Disk and inode limits enforced by the kernel per account, with a server-wide guard that stops a full disk from taking services down.
Domain & DNS
7 features9-Step Domain Provisioning
Single-page form + live animation: nginx vhost, apache vhost, PHP-FPM pool, DNS zone, mail records, SSL request, FTP user, quota, audit log — all in one flow.
Subdomain, Alias, Redirect, Parked
Four domain modes share one codebase. Per-subdomain document_root, per-redirect 301/302 target, per-parked custom landing.
BIND9 — DNSSEC, SPF, DKIM, DMARC
Authoritative master with chroot. Per-domain SPF/DKIM/DMARC auto-generated. DNSSEC zone signing optional. Bulk record management.
Pre-Flight Quota & Honesty Checks
Domain create blocks orphan users before they happen. Quota gate, hostname honesty, DNS reachability — all checked before provisioning starts.
Auto FTP Account per Domain
Every new domain gets a virtual FTP user, home-locked, with auto cleanup on domain delete. No manual setup.
Domain Alias (Mirror)
Serve the same site under additional domain names, with SSL issued automatically for every alias.
Secondary DNS
Authorise secondary nameservers and keep their zones in sync automatically.
SSL Automation
6 featuresACME — Let's Encrypt HTTP-01
Lego-powered. Automatic issue + renew + bind to nginx and apache. Per-domain SAN support. Disk-to-DB self-healing if state drifts.
Wildcard SSL via DNS-01
Cloudflare, PowerDNS, RFC2136 providers. Wildcard certs without exposing the panel publicly.
Cloudflare Origin Certificates
15-year origin certs from Cloudflare API for orange-cloud domains. Zero rate-limit pressure on Let's Encrypt.
Auto www Inclusion
Let's Encrypt SAN automatically includes www variant. Industry-standard behavior, zero clicks.
Mail SSL Cert Management
Issue and bind LE or custom certs to Postfix/Dovecot from the panel. Dovecot SSL on by default.
Auto-Issue SSL — One-Click Panel
Detect missing or expired cert + correct strategy in one card. Operator clicks "Issue now" — system picks HTTP-01, DNS-01, or Origin Cert.
Email Stack
8 featuresPostfix + Dovecot Complete Stack
SMTP submission (587), IMAPS (993), POP3S (995). Per-user mailbox with quota. IPv6-aware, deliverability tuned out of the box.
Auto DKIM per Domain
Key generation, DNS publish, selector rotation — all one click. SPF and DMARC recommendations shown inline.
Mail Client Quick Setup
Mozilla autoconfig + Outlook autodiscover + iOS profile QR. Users scan a QR or auto-detect — no manual server settings.
Mailing List Campaigns
Campaign builder, recipient lists, unsubscribe tracking, SES integration option. Compliance-ready.
TLS Deliverability + HELO Auto-Sync
Postfix HELO hostname auto-syncs with FQDN. TLS optimized for major MTAs. Deliverability score visible in panel.
Mail Queue Management
Inspect, retry, delete individual messages. Bulk clear. Real-time stats.
IMAP Mail Import + One-Click Webmail
Import mailboxes from any IMAP server, including Gmail and Microsoft, and open any mailbox in webmail with one click.
Outgoing Mail Limits
Hourly and daily sending limits per account and per plan, plus control over direct port 25 delivery, to keep the server off blacklists.
WordPress Toolkit
6 featuresOne-Click Install + Hardening
Install with automatic security hardening: file permissions, wp-config secrets, comments policy, login lockout. Detect existing WP and import.
Enterprise Security Activity
GeoIP-flagged event log. Filter by event type and method. Live dashboard of every login, plugin change, file edit.
WordPress Benchmark v2
28 tests across 8 categories. WebSocket live progress. Strict scoring with 3× median. Cgroup-aware execution.
WordPress Redis Boost
Full-page + object cache integration. Bootstrap inserted before wp-settings.php. Drop-in templates embedded in the binary.
Comment Hardening + Bulk Delete
Disable comments globally or per-post. Bulk delete with timeout protection. Comment moderation queue.
WordPress Backup with Detach Mode
Site-aware backup that captures DB, uploads, plugins, and themes separately. Restore to staging or new domain.
Docker Manager
8 featuresPanelica Desktop + 100+ App Templates
Our own Panelica Desktop images (Debian, Ubuntu, Fedora, AlmaLinux, Rocky) plus 100+ curated Docker app templates — full Linux desktops, Chrome, developer tools and services running in containers with HTTPS reverse proxy auto-config.
20 Infrastructure Templates
Jellyfin, HedgeDoc, BookStack, Domain Watchdog, Meilisearch, OpenVPN Access Server, MySQLTuner — production-grade recipes.
In-Container File Manager
Browse, edit, upload to any container without exec. Works for stopped or paused containers via volume API.
Advanced Container Config
cap_add, sysctls, privileged mode, custom networks. Power without compromise — RBAC gates dangerous flags to ROOT only.
Parallel Container Actions
Start, stop, restart 50 containers at once. UI stays responsive — backend coordinates concurrency safely.
Docker Firewall Integration
nftables forward chain made persistent. Per-container egress rules from the panel — no docker-compose hacks.
Docker Stack Backup
Container, image, volume, and network state captured atomically. Restore to any node.
Visual Docker Flow + Billing API
An interactive map of containers, networks and volumes, plus an external API so billing systems can sell Docker apps.
Migration Pipeline
7 featuresLegacy Panel Adapters
Live progress UI, file rsync without timeout (100GB+ supported), MySQL hash preservation, mail import, SSL re-issue, automatic rollback on failure. Imports from major legacy hosting panels.
Zero Password Change
Email hashes from legacy panels preserved with SHA512-CRYPT. MySQL user hashes carried over with HEX-fallback. PostgreSQL hash fallback. Users keep their passwords.
Cloudflare Auto-Transfer
Zone, DNS records, SSL settings, page rules — discovered and migrated automatically. No re-typed API keys.
Cron + Subdomain Auto-Transfer
Cron jobs and subdomains migrated alongside the main site — including the subdomain's DNS, SSL, and PHP version.
Panelica-to-Panelica Migration
7-step pipeline: discovery → credentials → user create → domain create → file transfer → DB import → SSL re-issue. Failure-resilient with checkpoints.
Real-Time Migration Progress
WebSocket stream of every step. Pause, resume, retry from the failed checkpoint without restarting the whole transfer.
Third-Party Billing Platform Import
PNLCS imports clients, domains and services from WHMCS with an interactive field mapper, so billing moves to PNLCS without losing history.
Security Stack
7 featuresModSecurity + OWASP CRS
Per-domain rules, anomaly scoring, attack pattern dashboards. Tunable severity per tenant. Multi-language rule labels.
Fail2ban + nftables
Auto-ban brute force on SSH, FTP, panel, mail. nftables managed from UI with rule presets and country blocking.
Country Blocking at Kernel Level
GeoIP-based nftables rules + Go middleware. Block entire countries with one toggle — flag icons in the rule list.
5-Phase Security Audit Closed
IDOR, Zip Slip, RBAC, Docker volume escape, MySQL injection, HMAC debug leak, password change session revocation — every CVE class audited and patched.
SSH IP Blocking
Failed + invalid login both banned. 24h or permanent ban. Dashboard "Block All" button for incident response.
Maximum Security Hardening
High-Security Mode profile that disables risky features and strengthens defaults. Permission middleware fail-close everywhere.
SSH Command Allowlist + Web Terminal
Choose which commands each SSH user may run, and open a terminal for any user straight from the panel.
PHP Multi-Version
5 featuresMulti-Version PHP Side-by-Side
Multiple PHP versions installed in parallel. Per-domain selection. Wrapper scripts in /usr/local/bin avoid PHP_INI_SCAN_DIR drift.
Per-User PHP-FPM Pool
Every user gets a dedicated FPM pool with open_basedir + disable_functions. Runaway scripts cannot escape their tenant.
PHP Resource Limits UI
memory_limit, max_execution, post_max_size, upload_max_filesize, max_input_vars — 7 fields in a clean panel form, applied per-domain.
OPcache Tuning + PM Modes
OPcache parameters preset for typical workloads. Process manager mode (static/dynamic/ondemand) selectable per pool.
pn-builder PHP Source Recipe
Build any PHP version from source against our extension matrix. ionCube Loader for every supported PHP version. Composer wrapper preinstalled.
Database
6 featuresPostgreSQL with Major Upgrade Path
Postgres for panel metadata. Major-version migration supported with one click — no manual dump/restore.
MySQL with Performance Tuner
MySQL Tuner integrated into the UI: real percentile metrics, ALL_O_DIRECT detection, recommended config diff, one-click apply.
Redis with Authentication ("Boost")
Per-instance auth, socket-based access, panel-managed lifecycle. User-facing label: "Boost" (no terminology leak to customers).
phpMyAdmin + pgAdmin Embedded
Both consoles served behind admin SSO. No separate logins, no exposed ports.
MySQL Server Info Offcanvas
Slide-out panel with version, charset, uptime, top processes, slow queries — without leaving the main page.
Customer PostgreSQL + pgAdmin
Customers create their own PostgreSQL databases next to MySQL, open them in pgAdmin with one click, and they are included in account backups.
File Manager
4 featuresSSE Progress + Unlimited Upload
Server-Sent Events stream upload/download progress. No size cap. Compress and extract directly on the server with progress feedback.
Code Editor with Auth Token
CodeMirror integration with syntax highlighting. Edits stream through a short-lived auth token — no path traversal, no token leak.
Windows 11 Address Bar
Click-into-segment navigation, type-to-jump, recent paths. Familiar UX for sysadmins coming from legacy panels.
Permission System
View/edit/delete/upload as separate features per role. RBAC-aware — resellers cannot escalate beyond their tree.
Backup System
5 featuresIncremental Backup with Multi-DB Discovery
rsync deltas + automatic discovery of every DB in scope. Selective or full restore. Off-site target (S3, FTP, SSH).
Chain Rotation + Per-Schedule Retention
Hourly/daily/weekly chains rotate independently. Per-schedule retention — keep 24 hourly + 7 daily + 4 weekly without conflict.
Cross-Server Backup & Restore
Move a tenant from one Panelica node to another — backups, configs, hashes, SSL — without re-typed credentials.
Async Backup Creation
Large backups no longer time out the API call. Background job + WebSocket progress. UI stays responsive.
Granular Restore
Restore a single file, folder, database or mailbox from a backup, with a preview before anything is written.
i18n & Localization
4 features31 Languages — 23,493 Keys
OpenAI-assisted translation pipeline. Source EN, target 30 languages. 4-layer atomic sync: code ↔ JSON ↔ DB ↔ embedded seeds.
Cumulative panel-i18n Package
Translation updates ship as a separate cumulative package. Customers get new languages without a backend release.
ULTRA Audit + Double-Prefix Cleanup
767 namespace-collision keys cleaned. 5-layer permission i18n sync (DB ↔ migration ↔ JSON ↔ DTO ↔ frontend). Reset-resilient.
Modern Language Dropdown
Two-column grid, search-as-you-type, "not found" state. Login and Setup Wizard see all 31 from the start.
Frontend & UX
9 featuresModern Frontend Stack
~560 components, Redux Toolkit, React Router, Reactstrap. Vite build. WebSocket live state for every long operation.
Spotlight Command Center
Universal search and command runner — open with a keystroke. Jump to any page, run any action, search any tenant.
33-Color Branding System
Every UI surface tokenized. Operators rebrand the panel with their own palette in seconds. 20+ presets included.
Dark / Light Mode (90+ Files)
Theme switch persisted per user. 90+ component files audited for contrast, focus state, badge readability, skeleton loaders.
Notification + Toast System
Unified toast.success / notificationService.confirm / SweetAlert2 — with dark-mode contrast and theme-aware colors.
Chrome Tab Freeze Protection
Visibility-aware WebSocket teardown prevents the "Page Unresponsive" dialog when the tab sits in background for hours.
Enterprise Login Page
Custom color-token system, 2-column language grid, mobile keyboard fix. First impression that matches the product.
Quick Launch + Custom Sidebar
Jump to any part of the panel from the dashboard, and pin, hide or reorder the sidebar to suit the way you work.
Guided Onboarding Tour
A step-by-step tour across the panel for new operators, in all 31 languages.
Git & Deploy
5 featuresFull CI/CD Module
Personal Access Tokens, multi-environment deploy, pipeline & environment editors, OAuth, webhook secrets, diff viewer, rollback.
GitHub / GitLab / Gitea Support
Self-hosted Gitea/GitLab over http:// also supported. PAT validated against the API, never logged.
Security-Hardened Git Pipeline
Command injection prevention, timing-attack-safe comparison, symlink traversal blocking, token leak audit.
In-Panel Repo Guides
Local repo guide, environment + pipeline + key + webhook walkthroughs — embedded next to the form, not in a docs site.
Node.js, Python and Laravel Hosting
Host Node.js, Python and Laravel applications with per-plan limits: git-based deploys, queue workers, scheduler and an Artisan console.
Mobile
1 featureMobile App — iOS & Android
Native admin app: alerts, quick fixes, on-call console, biometric login, offline queue.
Performance
3 featuresHigh Performance Mode
Enterprise toggle that fan-outs OPcache + FPM PM + Postgres + Redis tuning. Measured improvement, not vibes.
Real-Time Bandwidth + 3-Gate Quota
Per-user, per-domain, per-protocol counters in Redis. 3-gate unbreakable quota system + bandwidth bonus UI.
Central API 12h In-Memory Cache
License + plan + feature data cached in-process. Central API call rate dropped 90%+ on busy nodes.
Cloudflare
3 featuresAuto-Detect + Adaptive Strategy
Panel detects orange-cloud and switches SSL / DNS / proxy strategy automatically. Zero manual toggles.
Bulk DNS Record Management
Multi-select delete, bulk import, IPv6 support, SRV/CAA/NS records, mail DNS sync, lazy-loaded zones.
Analytics + Enterprise Optimization
Cloudflare GraphQL analytics (7d/30d), pagination, cache, lazy loading. Built for accounts with 1,000+ zones.
RBAC & Multi-Tenancy
4 features4-Tier Role Hierarchy
ROOT → ADMIN → RESELLER → USER. Every list query goes through GetAllForUser() — resellers see only their tree.
ADMIN 2-Level Chain
ADMINs see their direct admins + the resellers and users beneath. Cleanly bounded — no privilege spillover.
95+ Granular Feature Permissions
Every page, every action, every endpoint — toggle-able per role. Migration-driven so seeds stay in sync with code.
User Permission Override UI
Pin or revoke specific features for one user without changing the role. Audited on every change.
Update System
6 featurespn-builder + Central Pipeline
Custom build system + Central package versions. Channels (testing/beta/stable). Atomic apply with rollback.
30-Day Rollback Window
Every package keeps its prior version on disk for 30 days. One-click revert if a release misbehaves.
Auto-Update Enterprise (4 services)
Backend, frontend, panel-i18n, and apache/nginx managed packages. Policy-driven schedules.
Integrity Check + Health Probe
Post-update domain health check. Empty-file tolerance, conf.d cleanup, orphan pool removal.
Repair Tool + Recovery Mode
A repair page that finds and fixes common problems, and a separate recovery console that keeps working even if the panel does not start.
One-Click Update All
Apply every pending update in a safe order with one click, including the guarded MySQL 8.0 to 8.4 LTS upgrade.
Antivirus & Malware
4 featuresMalware Scanner with Custom Signatures
Recursive CMS auto-discovery. Certainty layers (high/medium/low). Live progress monitor and instant abort.
ClamAV with Selective Freshclam
ClamAV disabled at boot by default (resource-friendly). Schedule freshclam updates per-tenant or panel-wide.
In-App Malware Notifications
Findings surface in the notification center with severity, path, and one-click quarantine.
Panelica Shield
Signature-based malware scanner built on Linux Malware Detect, with a live scan page and per-account results.
AI & Ops
7 featuresOpsAI — Embedded Operations Co-Pilot
Your server's on-call engineer, embedded in the panel. Three expert profiles (domain, security, performance), demo mode for safe exploration, per-server credential isolation, zero external runtime — runs entirely from the binary. The foundation for fully autonomous operations.
OpsAI Terminal — Crash-Safe Live Console
sync.Once Done-channel protection prevents double-close panic. Survives flaky LLM disconnects.
OpsAI Knowledge Base — 1,263 Endpoints
Every internal and external endpoint documented as structured training data. The knowledge layer that lets OpsAI reason about every panel action — and the foundation for fully autonomous mode.
Browser Companion Extension
Chrome side panel for sysadmins — quick login, multi-server switch, alert badges, command center anywhere. Available on the Chrome Web Store.
AI Auto-Heal — Sentinel
Sentinel watches logs and metrics around the clock. When a service degrades it explains what happened, suggests the fix and, once you approve, lets the AI agent apply it. Alerts also reach you on Telegram.
Conversational Operations
Tell OpsAI what you need in plain language, in the panel or on Telegram, and it carries out the panel actions for you. Works with Claude Code, Codex CLI, Gemini CLI and Cursor Agent.
OpsAI — Choose Your AI Provider
OpsAI runs with Claude Code, Codex CLI, Gemini CLI or Cursor Agent, and accepts screenshots pasted straight into the chat.
License & Trial
5 featuresCentral Billing & License
Customers, plans, licenses, packages, changelogs, invoices, coupons, tickets, screenshots — single admin pane.
Trial Tracking + Dismissable Banner
Heartbeat carries trial fields. Dashboard banner shows days remaining, hides on dismiss, locks itself in the last 3 days.
Quota Enforcement Everywhere
max_users, max_subdomains, max_migrations, restore feature — license quota enforced on every code path including External API + Migration race.
Heartbeat with System Metrics
CPU cores, disk total, swap, memory pressure — every 60 seconds to Central. Detects drift and offline nodes immediately.
Central Admin i18n Sync
Hardcoded strings being lifted into translation tables across the Central admin. Phase 1 baseline complete; automated diff in progress.
Dashboard & Monitoring
5 featuresPermission-Aware Dashboard
Cards, widgets, and quick actions appear only if the user has access. RBAC drives the layout — not just the data.
Power Control + Hard Reset
Reboot, shutdown, and hard-reset endpoints with audit trail and 403 fix. Available to ROOT only.
Network Traffic + Activity Timeline
Live network charts with overlap-free labels. Smart activity timeline showing isolation events, deploys, and quotas.
Top Processes REST Endpoint
Per-tenant process list available over the panel API for external monitors. CPU, RAM, age, command.
Storage Manager
See every disk and partition, mount and unmount drives safely, and share folders over SMB or NFS from the panel.
CLI & DevOps
3 featurespanelica CLI (Cobra)
Every panel operation reachable from the shell — server, user, domain, db, plan, ssl, dns, php. CI/CD friendly.
Migration CLI Tool
Discovery, configure, and run migrations from any node. PostgreSQL DSN + production schema alignment.
CLI Login --url + DB Token
No-auth CLI bootstrap from a freshly installed node. Direct DB token — secure, scriptable, idempotent.
OS Compatibility
2 featuresModern Linux Distribution Support
Ubuntu and Debian LTS releases supported. Glibc compatibility floor enforced in the build pipeline. IPv6-aware Postfix profile.
Reproducible Build Pipeline
Multi-distribution build container. 5-OS smoke test before publish. Module diff against prior stable. Verified content-addressed tarball.
In progress · planned next
The path from "isolated control" to "fully autonomous" runs through self-healing, predictive scaling, and conversational ops. Here is the runway.
From whiteboard to autonomous
Architecture started in 2024, long before a single git commit landed. By 2026, the panel was running real customers and shipping a release every week.
Want to influence what ships next?
The roadmap is a conversation. The forum is where requests turn into priorities, and the changelog is where you'll see them land.