An open-source cPanel alternative for Debian 13

Jabali Panel is a GPL hosting control panel for Debian 13 servers. Manage domains, PHP-FPM, email, DNS, WordPress, and SSL — no licence fee, no per-domain pricing.

By Jabali Panel team Updated 3 min read

If you run a Debian server and you are tired of paying per-account fees for a hosting control panel, this post is for you. Jabali Panel is a GPL-licensed control panel built for one operating system — Debian 13 (Trixie) — and one job: managing hosted websites, email, and DNS for end-user accounts.

Why we built another panel

Most existing panels fall into one of two camps. The commercial ones (cPanel, Plesk, DirectAdmin) charge per account and lock features behind tiers. The free ones (HestiaCP, CyberPanel, aaPanel) make different trade-offs around language, security model, or maintenance cadence. We wanted something Debian-native, AGPL-licensed end to end, and built on a modern Go + React stack rather than a PHP monolith.

The stack

The panel API is jabali-panel-api, a Go service using Gin for HTTP routing and GORM for the data layer. The browser UI is a React single-page application built on Ant Design and TanStack Query. Privileged host operations — anything that needs root — run in a separate process, jabali-agent, accessed over a Unix domain socket. The panel itself does not run as root.

PHP, in this stack, is a hosted workload: each user gets their own PHP-FPM pool, and the panel manages versions 8.1 through 8.5 from the Sury repository per domain. The panel is not written in PHP.

What you get on a fresh install

Run the installer on a clean Debian 13 host and 8–15 minutes later you have:

  • nginx as the reverse proxy and TLS terminator
  • MariaDB 11.x for tenant databases (PostgreSQL is opt-in)
  • PowerDNS Authoritative for hosted zones, pdns-recursor for panel-internal resolution
  • Stalwart Mail 0.16.0 — SMTP, IMAP, JMAP in a single binary — with Roundcube webmail
  • certbot issuing Let’s Encrypt certificates per domain
  • CrowdSec AppSec WAF inline with nginx, plus Snuffleupagus, AppArmor, AIDE, and auditd
  • PowerDNS DNSSEC signing per domain (opt-in), with the DS record surfaced in the UI for registrar publication
  • WP-CLI 2.12.0 powering one-click WordPress installs with a self-deleting SSO link into wp-admin

Everything is provisioned automatically. Nothing requires manual operator install.

Migrating from cPanel

The Migrations section accepts cPanel .tar.gz and cpmove archives directly. It also reads DirectAdmin, Hestia, and WHM backups. The restore is per-account, tracked in the UI, and writes domains, databases, mailboxes, DNS zones, and cron jobs into the new layout.

A few cPanel-specific notes:

  • MySQL passwords are bcrypt in cPanel ≥ 11.96. Jabali stores the bcrypt hash directly in MariaDB so migrated apps keep authenticating without password reset.
  • Email accounts move from cPanel’s Dovecot+Exim to Stalwart. Mailbox passwords cannot be migrated as-is — the migration report prints the new passwords, or you can flip the “force first-login password reset” option.
  • DKIM keys are imported as-is so outbound deliverability survives the switch.

What you don’t get

A few honest caveats:

  • This is single-host. There is no clustering. One panel, one VPS.
  • We support Debian 13 only. The installer exits on earlier Debian releases or Ubuntu — not because we dislike Ubuntu, but because supporting a single distribution lets us actually test what we ship.
  • The panel itself is English-only in the UI today. End-user features (webmail, autoconfig profiles) honour the user’s browser locale.
  • We sell paid support and pre-configured VPS instances. The software itself stays free; nothing is gated behind a paid tier.

Try it

curl -fsSL https://jabali-panel.com/install.sh | bash

That’s the whole install command. The script is idempotent and safe to re-run. From a clean Debian 13 VPS, expect 8–15 minutes to a working panel at https://<panel-hostname>/.

If you’d rather see it first, the demo panel runs the live UI with seeded admin and user accounts. Everything is read-only — useful for clicking around without spinning up a server.

For longer-form documentation, the installation guide and quickstart walk through DNS prep, panel-hostname certificate issuance, and creating your first hosted user.

Frequently Asked Questions

Is Jabali Panel a drop-in replacement for cPanel?
Jabali Panel covers the same hosting-management categories as cPanel — web/PHP, email, DNS, databases, SSL, one-click app installs. It is not binary-compatible with cPanel and requires a fresh Debian 13 (Trixie) server, but its Migrations section can ingest cPanel archives (.tar.gz / cpmove format) to restore accounts.
Can I migrate an existing cPanel account to Jabali Panel?
Yes. The Migrations section at /jabali-admin/migrations accepts cPanel .tar.gz and cpmove archives, plus archives from DirectAdmin, Hestia, and WHM. The restore tracks per-account progress in the UI.
What is Jabali Panel built with?
The panel API (jabali-panel-api) is written in Go using Gin and GORM. The browser UI is a React single-page application built on Ant Design and TanStack Query. A root-privileged Go daemon (jabali-agent) performs host operations over a Unix socket. Jabali Panel is not PHP-based.
Which operating system does Jabali Panel run on?
Jabali Panel supports Debian 13 (Trixie) only. The installer detects and rejects earlier Debian releases and Ubuntu.
Is Jabali Panel free?
Yes. Both jabali-panel-api and jabali-agent are released under AGPL-3.0. There are no paid tiers, no per-domain fees, and no feature locks.
Which PHP versions can hosted sites use?
The panel installs PHP-FPM versions 8.1 through 8.5 from the Sury repository. Each hosted user gets a dedicated PHP-FPM pool socket, and each domain can select its own PHP version. PHP-FPM is a hosted workload managed by the panel, not part of the panel's own runtime.
What email server does Jabali Panel use?
Stalwart Mail 0.16.0 — a single-binary SMTP + IMAP + JMAP server. Jabali provisions mailboxes, DKIM, SPF, DMARC, MTA-STS, and Roundcube webmail per domain.
Does Jabali Panel support WordPress one-click installs?
Yes. The Applications section provides one-click WordPress installation via WP-CLI 2.12.0. The wizard provisions the database, downloads WordPress, runs wp core install, and creates a single-use SSO link into wp-admin with a 60-second TTL. 14 additional apps (Moodle, Drupal, Joomla, NextCloud, and more) are also available.