A hosting control panel built for Debian 13
GPL open-source hosting control panel for Debian 13 (Trixie). Built in Go + React, manages nginx, PHP-FPM, PowerDNS, Stalwart Mail, and SSL for hosted sites.
Jabali Panel targets one operating system: Debian 13 (Trixie). Not “Debian-based”. Not “Debian and Ubuntu”. One distribution, one release. This post explains why that constraint exists, what the installer does on a clean Debian 13 host, and which deployment shapes work versus don’t.
Why Debian 13 only
The installer’s first action is an OS gate. On anything other than Debian 13 (Trixie) it exits with a warning. That’s deliberate — supporting a single, well-defined platform means every component (nginx, MariaDB, PowerDNS, PHP-FPM, AppArmor, nftables) is tested against the same base. Multi-distribution support sounds good in marketing copy, but in practice it multiplies the test matrix and turns every release into a regression hunt.
The panel API (jabali-panel-api) and the privileged agent (jabali-agent) are written in Go. The browser UI is a React single-page application backed by Ant Design and TanStack Query. Neither the panel nor the agent is PHP-based — PHP-FPM exists in this stack as a hosted workload, managed by the panel for end-user sites.
Both core components are released under AGPL-3.0. The source lives on GitHub.
What the installer configures on Debian 13
A single curl command fetches, installs, and wires up every service:
curl -fsSL https://jabali-panel.com/install.sh | bashEnd to end it takes 8–15 minutes on a fresh VPS. The script is idempotent and safe to re-run. By the time it exits, you have:
Web stack — Debian-native nginx as the reverse proxy and TLS terminator. PHP-FPM 8.1 through 8.5 from the Sury repository, one pool per hosted user. sury-nginx is purged if present (Sury dropped nginx in 2026 — Jabali stays on the Debian-maintained package by design).
Databases — MariaDB 11.x for tenant data, with skip-networking enforced (Unix sockets only, no TCP/3306). PostgreSQL is opt-in for users who want it.
DNS — PowerDNS Authoritative for hosted zones with a MariaDB backend, plus pdns-recursor on loopback for panel-internal lookups. DNSSEC signing per domain (opt-in), with the DS record displayed in the UI for registrar publication.
Mail — Stalwart Mail 0.16.0, a single-binary SMTP + IMAP + JMAP server. Per-domain DKIM, SPF, DMARC, MTA-STS provisioned automatically. Roundcube webmail at /mail/.
Security — CrowdSec AppSec WAF inline with nginx, Snuffleupagus PHP hardening, AppArmor profiles for every service, AIDE host-integrity scans, auditd, LMD + YARA-X malware scanning, per-user nftables egress rules. UFW handles the port baseline.
Identity and apps — Ory Kratos for authentication, certbot for Let’s Encrypt issuance and renewal, WP-CLI 2.12.0 for the one-click WordPress installer, restic for backups.
Nothing on that list requires manual operator install. The installer fetches everything.
Known-good deployment paths
| Path | Status |
|---|---|
| KVM / QEMU on a clean Debian 13 cloud image | Recommended. Bare-metal-equivalent isolation, full systemd. |
| LXD privileged container on a recent host | Works. cgroup v2 and systemd-machined behave correctly under LXD privileged. |
| LXC unprivileged | Not supported. cgroup v2 host requirements + systemd-user timers fail. |
| Docker / systemd-nspawn as the panel host | Not supported. The panel itself uses systemd-machined for several operations; nspawn and Docker don’t permit it. |
The panel is single-host by design — one panel, one VPS. There is no clustering.
Server requirements
| Field | Minimum | Recommended |
|---|---|---|
| RAM | 2 GB | 4 GB+ |
| Disk | 20 GB | 40 GB+ SSD |
| vCPU | 1 | 2+ |
| Network | Public IPv4 + resolvable hostname | + IPv6 |
| Open ports | 22, 25, 53, 80, 443, 465, 587, 993, 995 | + 110 (POP3) if enabled |
Try it
Spin up a clean Debian 13 VPS (Hetzner, OVH, Vultr, your home Proxmox cluster — all fine), point a hostname at it, and run the installer. The installation guide walks through DNS prep and panel-hostname certificate issuance; the quickstart walks from clean host to a live hosted user in seven steps.
If you’d rather click around first, the demo panel runs the live UI with seeded admin and user accounts. Read-only — useful for evaluation without spinning up a server.
Frequently Asked Questions
- Which Debian version does Jabali Panel support?
- Jabali Panel supports Debian 13 (Trixie) only. The installer verifies the OS at startup and rejects earlier Debian releases and Ubuntu.
- Does Jabali Panel work on Debian 12 (Bookworm) or Ubuntu?
- No. The installer detects non-Trixie systems and exits with a warning. Debian 13 (Trixie) is the only tested and supported platform.
- What is Jabali Panel built with?
- The panel API (jabali-panel-api) and privileged agent (jabali-agent) are written in Go. The browser UI is a React single-page application using Ant Design and TanStack Query. Jabali Panel is not PHP-based.
- Which packages does the installer configure on Debian 13?
- The installer sets up nginx (Debian native), MariaDB 11.x, PostgreSQL, PHP-FPM 8.1–8.5 (Sury repository), PowerDNS Authoritative + pdns-recursor, Redis, Stalwart Mail, CrowdSec, certbot, Ory Kratos, restic, AppArmor, auditd, UFW, and nftables — among others. Everything is fetched and configured automatically; nothing requires manual operator install.
- Does the installer use Debian-packaged nginx or compile its own?
- Jabali uses Debian-native nginx. The installer actively purges sury-nginx if present, because Sury dropped nginx in 2026. This is a deliberate choice to stay on the Debian-maintained package.
- What are the minimum server requirements for a Debian 13 VPS?
- Minimum: 2 GB RAM, 20 GB disk, 1 vCPU, public IPv4, and ports 22/25/53/80/443/465/587/993/995 open. Recommended: 4 GB+ RAM, 40 GB+ SSD, 2 vCPU+.
- Does Jabali Panel work in an LXC container on Debian?
- LXC unprivileged containers are not supported — cgroup v2 host requirements and systemd-user timers fail in that environment. LXD privileged containers on a recent host work. KVM/QEMU on a clean Debian 13 cloud image is the recommended path.
- Is Jabali Panel free and open source?
- Yes. jabali-panel-api and jabali-agent are released under AGPL-3.0. There are no paid tiers or feature locks. The source is on GitHub.