A hosting control panel built for Debian 13
AGPL-3.0 open-source hosting control panel for Debian 13 (Trixie). Built in Go + React, manages nginx, PHP-FPM, PowerDNS, Stalwart Mail, and SSL.
Started as a Novell NetWare network administrator 35 years ago; system administrator and web developer for more than 25 years.
Update (August 2026): Jabali Panel now also supports Ubuntu 24.04 (Noble). The installer detects the OS and switches package sources automatically. The rationale below still explains why Debian 13 was — and remains — the primary target; Ubuntu 24.04 joined the tested matrix once its package versions caught up. See the current Installation guide for the up-to-date supported-platforms list.
Jabali Panel’s primary target is Debian 13 (Trixie), and Ubuntu 24.04 (Noble) is also supported. This post explains why Debian 13 is the primary target, what the installer does on a clean Debian 13 host, and which deployment shapes work versus don’t.
Why we target Debian 13
Debian 13 (Trixie) is the primary platform: it is the release Jabali Panel is fully tested on. Ubuntu 24.04 (Noble) is also supported, and the installer accepts both. The installer’s first action is an OS check. On Debian or Ubuntu it continues; on any other distribution it warns that the OS is untested and continues anyway.
The panel API (jabali-panel-api) and the privileged agent (jabali-agent) are written in Go. The browser UI is a React single-page application backed by Ant Design and TanStack Query. Neither the panel nor the agent is PHP-based — PHP-FPM exists in this stack as a hosted workload, managed by the panel for end-user sites.
Both core components are released under AGPL-3.0. The source lives on GitHub.
What the installer configures on Debian 13
A single curl command fetches, installs, and wires up every service:
curl -fsSL https://get.jabali-panel.com | sudo bashEnd to end it takes 8–15 minutes on a fresh VPS. The script is idempotent and safe to re-run. By the time it exits, you have:
Web stack — Debian-native nginx as the reverse proxy and TLS terminator. PHP-FPM 8.1 through 8.5 from the Sury repository, one pool per hosted user. sury-nginx is purged if present (Sury dropped nginx in 2026 — Jabali stays on the Debian-maintained package by design).
Databases — MariaDB 11.x for tenant data, with skip-networking enforced (Unix sockets only, no TCP/3306). PostgreSQL is opt-in for users who want it.
DNS — PowerDNS Authoritative for hosted zones with a MariaDB backend, plus pdns-recursor on loopback for panel-internal lookups. DNSSEC signing per domain (opt-in), with the DS record displayed in the UI for registrar publication.
Mail — Stalwart Mail 0.16.24, a single-binary SMTP + IMAP + JMAP server. Per-domain DKIM, SPF, DMARC, MTA-STS provisioned automatically. Bulwark webmail at mail.<hostname>; /webmail on the server redirects there (301).
Security — CrowdSec AppSec WAF inline with nginx, Snuffleupagus PHP hardening, AppArmor profiles for every service, AIDE host-integrity scans, auditd, LMD + YARA-X malware scanning, per-user nftables egress rules. UFW handles the port baseline.
Identity and apps — Ory Kratos for authentication, certbot for Let’s Encrypt issuance and renewal, WP-CLI 2.12.0 for the one-click WordPress installer, restic for backups.
Nothing on that list requires manual operator install. The installer fetches everything.
Known-good deployment paths
| Path | Status |
|---|---|
| KVM / QEMU on a clean Debian 13 cloud image | Recommended. Bare-metal-equivalent isolation, full systemd. |
| LXD privileged container on a recent host | Works. cgroup v2 and systemd-machined behave correctly under LXD privileged. |
| LXC unprivileged | Not supported. cgroup v2 host requirements + systemd-user timers fail. |
| Docker / systemd-nspawn as the panel host | Not supported. The panel itself uses systemd-machined for several operations; nspawn and Docker don’t permit it. |
The panel is single-host by design — one panel, one VPS. There is no clustering.
Server requirements
| Field | Minimum | Recommended |
|---|---|---|
| RAM | 2 GB | 4 GB+ |
| Disk | 20 GB | 40 GB+ SSD |
| vCPU | 1 | 2+ |
| Network | Public IPv4 + resolvable hostname | + IPv6 |
| Open ports | 22, 25, 53, 80, 443, 465, 587, 993, 995 | + 110 (POP3) if enabled |
Try it
Spin up a clean Debian 13 VPS (Hetzner, OVH, Vultr, your home Proxmox cluster — all fine), point a hostname at it, and run the installer. The installation guide walks through DNS prep and panel-hostname certificate issuance; the quickstart walks from clean host to a live hosted user in seven steps.
If you’d rather click around first, the demo panel runs the live UI with seeded admin and user accounts. Read-only — useful for evaluation without spinning up a server.
Frequently Asked Questions
- Which Debian version does Jabali Panel support?
- Jabali Panel supports Debian 13 (Trixie) and Ubuntu 24.04 (Noble). The installer verifies the OS at startup and rejects earlier releases.
- Does Jabali Panel work on Debian 12 (Bookworm) or Ubuntu?
- Not on Debian 12 (Bookworm). Ubuntu 24.04 (Noble) is supported. The installer detects unsupported releases and exits with a warning. The supported platforms are Debian 13 (Trixie) and Ubuntu 24.04 (Noble).
- What is Jabali Panel built with?
- The panel API (jabali-panel-api) and privileged agent (jabali-agent) are written in Go. The browser UI is a React single-page application using Ant Design and TanStack Query. Jabali Panel is not PHP-based.
- Which packages does the installer configure on Debian 13?
- The installer sets up nginx (Debian native), MariaDB 11.x, PostgreSQL, PHP-FPM 8.1–8.5 (Sury repository), PowerDNS Authoritative + pdns-recursor, Redis, Stalwart Mail, CrowdSec, certbot, Ory Kratos, restic, AppArmor, auditd, UFW, and nftables — among others. Everything is fetched and configured automatically; nothing requires manual operator install.
- Does the installer use Debian-packaged nginx or compile its own?
- Jabali uses Debian-native nginx. The installer actively purges sury-nginx if present, because Sury dropped nginx in 2026. This is a deliberate choice to stay on the Debian-maintained package.
- What are the minimum server requirements for a Debian 13 VPS?
- Minimum: 2 GB RAM, 20 GB disk, 1 vCPU, public IPv4, and ports 22/25/53/80/443/465/587/993/995 open. Recommended: 4 GB+ RAM, 40 GB+ SSD, 2 vCPU+.
- Does Jabali Panel work in an LXC container on Debian?
- LXC unprivileged containers are not supported — cgroup v2 host requirements and systemd-user timers fail in that environment. LXD privileged containers on a recent host work. KVM/QEMU on a clean Debian 13 cloud image is the recommended path.
- Is Jabali Panel free and open source?
- Yes. jabali-panel-api and jabali-agent are released under AGPL-3.0. There are no paid tiers or feature locks. The source is on GitHub.