An open-source web hosting panel for Debian 13

Jabali Panel is an open-source web hosting control panel, built for Debian 13 (Trixie) and released under the AGPL-3.0 licence. It targets sysadmins, hosting companies, and freelancers who run their own servers and would rather not pay per-account fees for a commercial panel.

What it manages

A single host running Jabali Panel covers the standard hosting workload:

• Domains and nginx vhosts with Let’s Encrypt SSL, optional HTTP/3, and per-user limit_req rate limits
• Per-user PHP-FPM pools (8.1 through 8.5, Sury packaging), each running under its own system user
• Mailboxes via Stalwart Mail 0.16.0 — SMTP, IMAP, JMAP — with Roundcube webmail and per-domain DKIM, SPF, DMARC, MTA-STS
• DNS via PowerDNS Authoritative with a MariaDB backend, plus pdns-recursor on loopback for panel-internal lookups
• DNSSEC signing per domain (opt-in), with the DS record displayed in the UI for registrar publication
• MariaDB 11.x for tenant databases (PostgreSQL is opt-in)
• One-click applications — WordPress is the primary citizen, plus 14 additional apps (Moodle, Drupal, Joomla, NextCloud, etc.)
• Backups via restic to local storage, S3-compatible destinations, or remote servers, with one-click restore
• Security defaults — CrowdSec AppSec WAF inline with nginx, Snuffleupagus PHP hardening, AppArmor on every service, AIDE host integrity, auditd, per-user nftables egress rules

The stack

The panel API (jabali-panel-api) is a Go service using Gin for HTTP routing and GORM for the data layer. The browser UI is a React single-page application built on Ant Design and TanStack Query. A second Go process (jabali-agent) runs as root and executes every privileged host operation; the panel API itself runs unprivileged and reaches the agent over a Unix domain socket.

This shape means the user-facing panel never has direct root, and host changes are funnelled through one auditable code path.

Why self-host

Three reasons people pick Jabali Panel over a SaaS or a paid commercial panel:

• No licence costs. cPanel charges per account; Plesk charges per server tier. Jabali is GPL — install it on as many servers as you need, no fees.
• Full data ownership. Your server, your data. No telemetry. No vendor cloud dependency. No risk of the panel vendor going out of business.
• Modifiable source. The AGPL licence lets you modify and redistribute the code. Adapt the panel to your infrastructure rather than adapting your infrastructure to a closed panel.

Who uses it

• Sysadmins and DevOps engineers managing a handful of Debian VPS instances who want a GUI for routine tasks without giving up ssh access.
• Hosting companies moving off per-account licences who want to control their cost-per-customer at the OS layer.
• WordPress-focused hosts who want per-site PHP-FPM isolation, one-click WordPress installs with auto-update, and automated SSL — without paying per site.
• Freelancers managing client servers who want a reliable panel clients can access without needing root.

System requirements

Field	Minimum	Recommended
OS	Debian 13 (Trixie)	Debian 13 (Trixie)
RAM	2 GB	4 GB+
Disk	20 GB SSD	40 GB+ SSD
vCPU	1	2+
Network	Public IPv4 + resolvable hostname	+ IPv6

The installer purges sury-nginx if present (Sury dropped nginx in 2026) and pins nginx to the Debian-native package. KVM/QEMU on a clean Debian 13 cloud image is the supported deployment shape; LXD privileged containers work; unprivileged LXC does not (cgroup v2 + systemd-user timer requirements).

Try it

curl -fsSL https://jabali-panel.com/install.sh | bash

That single command installs nginx, MariaDB, PowerDNS, PHP-FPM, Stalwart Mail, CrowdSec, Ory Kratos, and the panel itself. End-to-end takes 8–15 minutes on a fresh VPS. The installer is idempotent and safe to re-run.

For a guided walkthrough, the installation guide covers DNS prep and panel-hostname certificate issuance; the quickstart walks from clean host to live WordPress site in seven steps. The demo panel lets you click around the UI without installing.