# Jabali Panel > Free, open-source web hosting control panel for Debian 13. Manages domains, PHP-FPM, email (Stalwart), DNS (PowerDNS), databases (MariaDB/PostgreSQL), SSL, WordPress, Docker apps, and Python apps. Every doc listed below is served both as HTML (for humans) and as raw markdown at the same slug + `.md` extension (for AI tools). Prefer the `.md` URLs when consuming programmatically. ## Sites & applications - [Domains](https://jabali-panel.com/docs/domains.md): A Domain is a hosted vhost owned by exactly one user. Each domain row in the panel DB drives a real nginx vhost, the reconciler converges them on every… - [WordPress](https://jabali-panel.com/docs/wordpress.md): WordPress is the first-class app in Jabali's Applications Framework (M10 / M19). /jabali-panel/applications → pick the domain → WordPress → Install. - [PHP Applications](https://jabali-panel.com/docs/applications.md): 15 PHP apps installed with one wizard and a shared 6-step pipeline. For Docker apps see /docs/docker-apps; for Python apps see /docs/python-apps. - [Docker Apps](https://jabali-panel.com/docs/docker-apps.md): 45+ self-hosted apps installed in one click, each in its own Docker stack with SSL, backups, and updates handled by the panel. - [Files](https://jabali-panel.com/docs/files.md): /jabali-panel/files. AntD-native (M11, ADR-0030). The earlier daemon was decommissioned 2026-04-19. Filesystem ops run through the agent over Unix… - [Python Apps](https://jabali-panel.com/docs/python-apps.md): Native Python hosting: WSGI or ASGI apps managed as per-user systemd units behind nginx, with per-package quotas and per-user venvs. - [SFTP](https://jabali-panel.com/docs/sftp.md): Each user manages their own keys at /jabali-panel/ssh-keys: The agent writes with permissions owned by the user. A reconciler tick re-syncs the file on… - [Cron Jobs](https://jabali-panel.com/docs/cron.md): Systemd-user timers + a command allowlist. A Cron Job is: Internally each cron row becomes: Both are owned by the user. runs at user creation so timers… - [PHP](https://jabali-panel.com/docs/php.md): Multi-version PHP via Sury + per-user FPM pools with a three-tier performance model: admin package policy, user-selectable presets, optional advanced pool tuning. ## Mail & SSL - [Email](https://jabali-panel.com/docs/email.md): Jabali's mail stack is Stalwart (SMTP submission + MTA + JMAP + IMAP, single process) with Bulwark as the JMAP webmail client and rate-limit / spam policy bridge. - [DNS](https://jabali-panel.com/docs/dns.md): Jabali ships two PowerDNS processes: Split-port setup (ADR-0047): the recursor binds the loopback so local processes (the panel, certbot, Stalwart, etc.)… - [SSL](https://jabali-panel.com/docs/ssl.md): Let's Encrypt by default with HTTP-01 challenge over the domain's port-80 nginx vhost. Custom (bring-your-own) certificates supported via CLI. - [Notifications](https://jabali-panel.com/docs/notifications.md): Redis Streams dispatcher → 6 channels → in-app + admin event sources. Admin configures channels at /jabali-admin/notifications/channels: ## Operations - [Server Status](https://jabali-panel.com/docs/server-status.md): /jabali-admin/server-status. Single page, 5-second polling, errgroup-aggregated. Each card has start / stop / restart buttons. Disabled by default, flip… - [Updates](https://jabali-panel.com/docs/updates.md): /jabali-admin/updates. Updates from the panel UI fire as transient systemd units (). This means: The transient-unit survival was live-verified on… - [Operations](https://jabali-panel.com/docs/operations.md): Day-2 operator reference. For day-1 install see installation.md. (Domain stays up; user can't log in to the panel UI.) - [Troubleshooting](https://jabali-panel.com/docs/troubleshooting.md): Symptom: installer hangs at "Installing CrowdSec" or. Cause: outbound is blocked, so the recursor can't recurse. - [IP Manager](https://jabali-panel.com/docs/ip-manager.md): /jabali-admin/ips. ADR-0049. Lets the admin curate the pool of IPv4 addresses available for per-domain listen IP selection. - [Migrations](https://jabali-panel.com/docs/migrations.md): Sections: Supported sources · Workflow · Per-source notes · Limitations. - [Removed Features](https://jabali-panel.com/docs/removed-features.md): If you're coming from the previous (PHP) Jabali generation or from an earlier dev snapshot of jabali2, here's what's intentionally not in the shipped… ## Security - [Security](https://jabali-panel.com/docs/security.md): Layered. CrowdSec is the IP-trust source; UFW handles the port baseline; AppSec WAF replaces ModSecurity; Snuffleupagus + AppArmor harden the application… - [Firewall](https://jabali-panel.com/docs/firewall.md): UFW + CrowdSec, with a strict division of labor since M43 (ADR-0089). UFW is demoted: no rules. The CrowdSec bouncers consult decisions in real time and… - [Resource Limits](https://jabali-panel.com/docs/resource-limits.md): Three layers: Enforced on /home. Per-user quota set from the user's package (default + override). Hitting the soft limit warns; hitting the hard limit… ## Platform - [Jabali Panel architecture: Go API, React UI, reconciler, agent](https://jabali-panel.com/docs/platform/stack.md): How Jabali Panel is built: a Go + Gin API, React + Ant Design UI, root-privileged jabali-agent daemon, and a reconciler loop that converges host state to the panel database on every tick. - [Components](https://jabali-panel.com/docs/platform/components.md): The full third-party inventory shipped or installed by Jabali on a Debian 13 host. Every component listed here is fetched, configured, and started by… - [Privileged Agent](https://jabali-panel.com/docs/platform/agent.md): Root-privileged process; the only thing that performs privileged host operations. Callers (the panel API, the CLI, the reconciler) reach it over… - [jabali CLI reference: every command with flags](https://jabali-panel.com/docs/platform/cli.md): Complete reference for the jabali command-line tool. Every subcommand grouped by area with one-line descriptions and copy-pasteable examples. - [AI Assistant (MCP)](https://jabali-panel.com/docs/platform/mcp.md): jabali-mcp exposes the panel's REST API as tools an MCP-capable AI assistant (Claude Code, Claude Desktop, Cursor, Cline, Windsurf, Codex, OpenCode, Gemini CLI) can call. Read-only by default; writes gated by env flag + explicit confirm. - [DNSSEC](https://jabali-panel.com/docs/platform/dnssec.md): Per-domain, opt-in. ADR-0057. Each hosted zone can be signed independently. Toggle per-domain at Domains → Edit → DNSSEC (admin) or… - [Mail Autoconfig](https://jabali-panel.com/docs/platform/mail-autoconfig.md): Bulwark serves three autoconfig flavours so clients pick up correct mail settings automatically. (For Outlook, also handle the SRV-record fallback: SRV →… - [Health Monitor](https://jabali-panel.com/docs/platform/health-monitor.md): The same surface as Server Status but exposed at machine-readable endpoints for external monitoring. The watched set is computed at startup; services… - [Monitoring](https://jabali-panel.com/docs/platform/monitoring.md): Three signal sources, complementary. /jabali-admin/audit. Append-only structured rows. Every privileged mutation lands here: ## Admin — system - [Server Settings](https://jabali-panel.com/docs/admin/server-settings.md): /jabali-admin/settings. Global settings that apply to the whole installation, organized into sections. See Database Tuning for the per-key reference. - [Services](https://jabali-panel.com/docs/admin/services.md): The per-service control surface, an expanded view of the cards shown on Server Status. For each watched systemd unit: - [Theming & Branding](https://jabali-panel.com/docs/admin/theming.md): Server-wide brand colors, chrome colors per theme, and font size — set once, applied to the whole panel, exposed to the unauthenticated login page via /api/v1/branding. - [Release Channel](https://jabali-panel.com/docs/admin/release-channel.md): Server-wide setting that decides whether the panel and agent update to reviewed 'stable' builds or track main directly ('development'). - [Module Flags](https://jabali-panel.com/docs/admin/module-flags.md): Per-module enable flags so admins can disable subsystems (DNS, Mail, Security, Quota, API) they don't need. Panel hides the routes; middleware refuses the handlers. - [Server Updates](https://jabali-panel.com/docs/admin/server-updates.md): /jabali-admin/updates. M29. Run from the panel UI as a transient systemd unit (ADR-0064). If the update were to run inside the panel API itself, the… - [Terminal](https://jabali-panel.com/docs/admin/terminal.md): /jabali-admin/terminal. In-browser shell on the panel host, scoped to root. The terminal is gated by the admin session cookie. Anyone with a panel admin… ## Admin — PHP - [PHP Manager](https://jabali-panel.com/docs/admin/php-manager.md): /jabali-admin/php-pools. The list of installed PHP versions on the host, with per-version FPM tuning and an extension manager (M9.6). - [PHP Extensions](https://jabali-panel.com/docs/admin/php-extensions.md): /jabali-admin/php-extensions. Server-wide PHP extension manager (M9.6, ADR-0031). Installs and enables PHP extensions across every managed PHP version. ## Admin — mail - [Mail Deliverability](https://jabali-panel.com/docs/admin/mail-deliverability.md): /jabali-admin/mail/deliverability. Per-domain view of the DNS records and policies that govern outbound mail reputation. - [Mail Throttles](https://jabali-panel.com/docs/admin/mail-throttles.md): /jabali-admin/mail/throttles. Outbound mail rate-limit policy enforced by Bulwark and Stalwart (M47 Wave 3). A compromised mailbox or runaway PHP script… - [Email Logs](https://jabali-panel.com/docs/admin/email-logs.md): Cross-domain view of mail flow through Stalwart. Reachable from Mail Deliverability → All Logs, and from Server Status → Mail card. - [Email Queue](https://jabali-panel.com/docs/admin/email-queue.md): Stalwart's outbound queue. Reachable from Mail Deliverability → Queue. Successfully delivered or permanently bounced messages leave the queue immediately… ## Admin — backups - [Backups](https://jabali-panel.com/docs/admin/backups.md): /jabali-admin/backups. The parent surface for backup destinations, schedules, retention, and restore. M30 and M30.1. - [Backup Destinations](https://jabali-panel.com/docs/admin/backup-destinations.md): Backups → Destinations. The list of repositories the panel can write restic snapshots to. Each destination has its own restic repository password… - [Backup Schedules](https://jabali-panel.com/docs/admin/backup-schedules.md): Backups → Schedules. The cron expressions that drive periodic backup runs. Each schedule becomes a system timer managed by the agent. The timer triggers… - [Backup Restore](https://jabali-panel.com/docs/admin/backup-restore.md): Backups → Restore. Browse snapshots in any destination and restore an account or the whole system. Pick a destination; the page lists every snapshot… - [Backup Download](https://jabali-panel.com/docs/admin/backup-download.md): Backups → Download. Generate a single on-demand snapshot and offer it as a download. The download endpoint requires the same admin session that initiated… ## Admin — security - [Security Overview](https://jabali-panel.com/docs/admin/security.md): /jabali-admin/security. Parent page for the security tabs (M26). A header strip summarises: Each link drills into the relevant tab. - [CrowdSec decisions: list, add, delete (cscli + panel UI)](https://jabali-panel.com/docs/admin/crowdsec-decisions.md): How to list, add, and delete CrowdSec decisions using cscli or the Jabali Panel UI. Covers cscli decisions list, cscli decisions add, cscli decisions delete --ip, filters, scenarios, and bouncer behavior. - [CrowdSec Allowlists](https://jabali-panel.com/docs/admin/crowdsec-allowlists.md): Security → CrowdSec → Allowlists and Scenario Overrides tabs (M27 extensions, ADRs 0061–0063). A persistent list of IPs or CIDR ranges that bypass every… - [CrowdSec Test IP](https://jabali-panel.com/docs/admin/crowdsec-test-ip.md): Security → CrowdSec → Test IP. Verify what would happen to a given IP address right now without waiting for the IP to attempt a connection. - [AppSec](https://jabali-panel.com/docs/admin/appsec.md): Security → AppSec. The Web Application Firewall layer that inspects HTTP requests for malicious payloads. M27, ADR-0060. - [AppArmor](https://jabali-panel.com/docs/admin/apparmor.md): Security → AppArmor. Per-profile status surface for the AppArmor profiles the panel ships. Each profile is shipped under /etc/apparmor.d/. The installer… - [Snuffleupagus](https://jabali-panel.com/docs/admin/snuffleupagus.md): Security → Snuffleupagus. PHP runtime hardening loaded as a Zend extension into every installed PHP version. The installer ships a baseline rule set that… - [AIDE](https://jabali-panel.com/docs/admin/aide.md): Security → AIDE. Daily comparison of the host's filesystem against a baseline AIDE database. /etc/aide/aide.conf.d/jabali.conf (managed by the panel)… - [Malware Scanning](https://jabali-panel.com/docs/admin/malware.md): Security → Malware. The detection and response surface for ClamAV, Linux Malware Detect (LMD), YARA, and Tetragon. M33 and M33.2. - [Directory Privacy](https://jabali-panel.com/docs/admin/directory-privacy.md): Admin-side view of the per-subdirectory Basic Auth feature (M50). User-facing copy lives at user/directory-privacy; this page covers operator concerns. - [UFW Baseline](https://jabali-panel.com/docs/admin/ufw-baseline.md): Security → UFW. The simple port-open / port-close baseline. M43 (ADR-0089) reduced UFW to this role; IP-trust decisions live in CrowdSec Decisions. - [Egress Firewall](https://jabali-panel.com/docs/admin/egress.md): Security → Egress. nftables + cgroup v2 vmap rules that restrict each user's outbound traffic. M34, ADR-0084. A compromised tenant whose PHP scripts can… ## Admin — support - [Automation API](https://jabali-panel.com/docs/admin/automation-api.md): /jabali-admin/automation. Scoped API tokens for the Automation API. Reads and writes across domains, mailboxes, databases, audit, backups and SSL. - [Support](https://jabali-panel.com/docs/admin/support.md): /jabali-admin/support. M29. Produce an encrypted diagnostic bundle for the upstream maintainers, then open a ticket. ## admin/auth - [Login](https://jabali-panel.com/docs/admin/login.md): /jabali-admin redirects to the Kratos login flow at /auth/login. Sessions are managed by Kratos (M20). The panel itself does not store passwords or… - [Two-Factor Challenge](https://jabali-panel.com/docs/admin/two-factor-challenge.md): After password auth, if TOTP is enrolled, Kratos asks for the 6-digit code. Profile → Security → Two-Factor → Enable. Scan the QR with any TOTP app… - [Password Reset Request](https://jabali-panel.com/docs/admin/password-reset-request.md): /auth/recovery. Kratos recovery flow. By default. Override under Server Settings → Mail → Recovery sender. If outbound mail is broken (Stalwart down, no… - [Password Reset](https://jabali-panel.com/docs/admin/password-reset-reset.md): The destination page reached from the email link sent by Request Password Reset. Recovery tokens expire after 60 minutes. After expiry the link returns… ## admin/database - [Database Tuning](https://jabali-panel.com/docs/admin/database-tuning.md): Server Settings → Database → Tuning. The curated MariaDB / PostgreSQL configuration tuner. M46, ADR-0098. Only whitelisted keys may be edited from the… ## admin/hosting - [Domains](https://jabali-panel.com/docs/admin/domains.md): /jabali-admin/domains. The cross-user view of every hosted domain on the panel. Columns: domain name, owner (username), package, primary / alias, PHP… - [DNS Zones](https://jabali-panel.com/docs/admin/dns-zones.md): /jabali-admin/dns. The cross-user view of every PowerDNS zone served by the panel. Columns: zone name, owner, record count, last modified, DNSSEC status… - [SSL Manager](https://jabali-panel.com/docs/admin/ssl-manager.md): /jabali-admin/ssl. The cross-user view of every Let's Encrypt certificate the panel is responsible for. Columns: domain, owner, status ( / / ), issued… - [Panel Certificate](https://jabali-panel.com/docs/admin/panel-certificate.md): The Let's Encrypt certificate used by the panel itself for the configured panel hostname. Managed through Server Settings → General → Panel SSL and, for… - [Panel Hostname](https://jabali-panel.com/docs/admin/panel-hostname.md): The FQDN the panel serves itself on. Set under Server Settings → General → Panel Hostname. The hostname drives several derived states: - [IP Addresses](https://jabali-panel.com/docs/admin/ip-addresses.md): /jabali-admin/ips. The pool of IPv4 (and optionally IPv6) addresses available for per-domain listen-IP selection. M24, ADR-0049. - [Applications](https://jabali-panel.com/docs/admin/applications.md): /jabali-admin/applications. Server-wide controls for the 15-app one-click registry (M10 / M19, see Applications). ## admin/migration - [Migration](https://jabali-panel.com/docs/admin/migration.md): /jabali-admin/migrations. Parent page for the cPanel / DirectAdmin / Hestia / WHM ingest pipelines. Each source has its own subpage: - [cPanel Migration](https://jabali-panel.com/docs/admin/cpanel-migration.md): The cPanel ingest path. Status: production-supported. The standard produced by cPanel's or. Either format works. - [DirectAdmin Migration](https://jabali-panel.com/docs/admin/directadmin-migration.md): The DirectAdmin ingest path. Status: production-supported. DirectAdmin's standard backup tarball (). Produce on the source host via: - [Migrate from HestiaCP to Jabali Panel: files, DBs, DNS, mail](https://jabali-panel.com/docs/admin/hestiacp-migration.md): How to migrate a HestiaCP account to Jabali Panel on Debian 13 — files, MariaDB databases, PowerDNS zones, and mailboxes. What transfers automatically, what needs manual re-implementation, and the cutover checklist. - [WHM Migration](https://jabali-panel.com/docs/admin/whm-migration.md): The WHM ingest path. Status: production-supported; effectively a batch of cPanel restores. A WHM-level dump produced by: ## admin/notifications - [Channels](https://jabali-panel.com/docs/admin/notifications/channels.md): /jabali-admin/notifications/channels. Configure the delivery endpoints that notification events fan out to (M14). - [Events](https://jabali-panel.com/docs/admin/notifications/events.md): /jabali-admin/notifications/events. The catalog of event sources the panel can emit. Configure routing on Routing. - [Routing](https://jabali-panel.com/docs/admin/notifications/routing.md): /jabali-admin/notifications/routing. Per-event-source mapping to per-channel destinations, with severity thresholds and recipient filters. - [Test](https://jabali-panel.com/docs/admin/notifications/test.md): /jabali-admin/notifications/test. Fire a synthetic event through the dispatcher to verify channel and routing configuration without waiting for a real… ## admin/overview - [Admin Panel](https://jabali-panel.com/docs/admin.md): Sections: Sidebar groups · What is intentionally *not* here. - [Dashboard](https://jabali-panel.com/docs/admin/dashboard.md): /jabali-admin/dashboard. First page after admin login. Top-right toolbar: New User · New Domain · Run Backup Now · Open Server Status · Open Audit. - [Audit Log](https://jabali-panel.com/docs/admin/audit-log.md): /jabali-admin/audit. Append-only structured record of every privileged mutation on the panel (ADR-0106). Every action that changes state writes one row… - [Home](https://jabali-panel.com/docs/admin/home.md): /jabali-admin/ redirects to /jabali-admin/dashboard. See Dashboard for the landing page content. The legacy /jabali-admin/home route is retained as an… - [Server Status](https://jabali-panel.com/docs/admin/server-status.md): /jabali-admin/server-status. M31. Live status of every watched service plus host vitals. Errgroup-aggregated polling every 5 seconds. Each card returns… ## admin/userspackages - [Users](https://jabali-panel.com/docs/admin/users.md): /jabali-admin/users. The list and lifecycle controls for every panel user (administrators and hosting customers). - [Create User](https://jabali-panel.com/docs/admin/users/create.md): Reached from Users → Create User. Single-form wizard that provisions every piece of per-user state. Most steps complete within five seconds; PHP pool and… - [Edit User](https://jabali-panel.com/docs/admin/users/edit.md): Reached from the Edit action on a row in Users. Modifies every mutable attribute of a panel user. A single transactional against, plus a Kratos call if… - [Hosting Packages](https://jabali-panel.com/docs/admin/hosting-packages.md): /jabali-admin/packages. A Package is a bundle of quotas and limits assigned to a user. Each row shows the package name, the number of users assigned… - [Create Hosting Package](https://jabali-panel.com/docs/admin/hosting-packages/create.md): Reached from Hosting Packages → Create. Defines a new bundle of quotas and limits that may then be assigned to users. - [Edit Hosting Package](https://jabali-panel.com/docs/admin/hosting-packages/edit.md): Reached from the Edit action on a row in Hosting Packages. Modifies any field on an existing package. A field change persists immediately to the row. The… ## core/start - [Documentation](https://jabali-panel.com/docs/.md): Jabali is an open-source Linux web-hosting control panel. Go agent + React UI, MariaDB-as-truth, reconciler-converged host state. Built as a clean… - [Installation](https://jabali-panel.com/docs/installation.md): Install Jabali Panel on a fresh Debian 13 or Ubuntu 24.04 root shell. The installer is idempotent and safe to re-run. - [Quickstart](https://jabali-panel.com/docs/quickstart.md): For brand-new hosts. Assumes Debian 13 (Trixie), root, public IPv4, and DNS pointed at the box. The installer brings up MariaDB, PowerDNS (auth +… - [Support](https://jabali-panel.com/docs/support.md): /jabali-admin/support. M29. Produces an encrypted diagnostic bundle suitable for emailing to the upstream maintainers without leaking secrets or end-user… ## topics/data - [Databases](https://jabali-panel.com/docs/databases.md): MariaDB and PostgreSQL, per-user databases and DB-users, with SSO into phpMyAdmin / pgAdmin. (Both are connected to the panel itself via Unix socket; the… - [Backups](https://jabali-panel.com/docs/backups.md): Two backup kinds: Both are restic-backed (deduplicated, encrypted at rest, multi-destination). /jabali-admin/backups → Destinations: ## user/apps - [Applications](https://jabali-panel.com/docs/user/applications.md): /jabali-panel/applications. One-click installs for WordPress and 14 other popular apps (M10 / M19). WordPress, Moodle, Drupal, Joomla, NextCloud… - [Install and manage WordPress on Jabali Panel (WP-CLI + SSO)](https://jabali-panel.com/docs/user/wordpress.md): One-click WordPress installation using WP-CLI 2.12.0 on Jabali Panel: database provisioning, wp-admin single-use SSO, per-install auto-update, clone, and integration with the CrowdSec WAF. ## user/auth - [Login](https://jabali-panel.com/docs/user/login.md): /jabali-panel redirects to the Kratos login flow at /auth/login. The login page has a Forgot password? link → Request Password Reset. - [Two-Factor Challenge](https://jabali-panel.com/docs/user/two-factor-challenge.md): After entering your password successfully, if your account has TOTP two-factor authentication enrolled, you are prompted for a six-digit code. - [Password Reset Request](https://jabali-panel.com/docs/user/password-reset-request.md): The /auth/recovery page reached from the login page's Forgot password? link. The recovery email is sent from by default, using the panel's own Stalwart… - [Password Reset](https://jabali-panel.com/docs/user/password-reset-reset.md): The destination page reached from the recovery email link. The recovery token is valid for 60 minutes from the moment the email was sent. Expired tokens… ## user/data - [Databases](https://jabali-panel.com/docs/user/databases.md): /jabali-panel/databases. Your MariaDB and PostgreSQL databases. Database names are prefixed with your username for isolation: a database you create with… - [Database Users](https://jabali-panel.com/docs/user/db-users.md): /jabali-panel/database-users. The DB-user accounts your applications use to connect to databases. You may have many DB users (typical pattern: one DB… - [PostgreSQL](https://jabali-panel.com/docs/user/postgresql.md): PostgreSQL databases are managed under the same Databases and Database Users pages as MariaDB; pick PostgreSQL as the engine when creating. ## user/domains - [Domains](https://jabali-panel.com/docs/user/domains.md): /jabali-panel/domains. The domains hosted on the panel under your account. Columns: domain name, PHP version, SSL state, DNSSEC state, listen IP, last… - [DNS Records](https://jabali-panel.com/docs/user/dns-records.md): The records inside a single DNS zone you own. Is generated and managed by the panel; you do not edit it directly. - [DNSSEC](https://jabali-panel.com/docs/user/dnssec.md): Per-domain DNSSEC signing. Toggle under Domain Edit → DNSSEC. DNSSEC ("Domain Name System Security Extensions") signs every record in your zone with… - [SSL](https://jabali-panel.com/docs/user/ssl.md): /jabali-panel/ssl. The TLS certificate state for the domains in your account. For each domain: status (issued / pending / failed / off), issued at… - [Directory Privacy](https://jabali-panel.com/docs/user/directory-privacy.md): Domains → Edit → Security tab → Directory Privacy. Per-subdirectory HTTP Basic Auth (M50, the cPanel "Directory Privacy" equivalent). ## user/email - [Manage mailboxes, forwarders, autoresponders in Jabali Panel](https://jabali-panel.com/docs/user/email.md): How to create mailboxes, set up per-address forwarders, configure vacation autoresponders, and route catch-all mail through the Jabali Panel Mail UI. Roundcube webmail included with one-click SSO. - [Mailboxes](https://jabali-panel.com/docs/user/mailboxes.md): /jabali-panel/mail/mailboxes. The list and lifecycle of mail accounts in your domains. Mailbox storage lives inside Stalwart's data directory… - [Forwarders](https://jabali-panel.com/docs/user/forwarders.md): /jabali-panel/mail/forwarders. Forward mail addressed to one address to one or more destinations. A forwarder does not have storage. Mail addressed to a… - [Autoresponders](https://jabali-panel.com/docs/user/autoresponders.md): /jabali-panel/mail/autoresponders. Vacation-style automatic replies per mailbox. Save with Active = on. Stalwart begins responding at the start date and… - [Catch-all](https://jabali-panel.com/docs/user/catch-all.md): /jabali-panel/mail/catch-all. What happens to mail addressed to a local part that does not exist as a mailbox or forwarder. - [Disclaimer](https://jabali-panel.com/docs/user/disclaimer.md): /jabali-panel/mail/disclaimer. A server-side disclaimer appended to outbound mail per domain. Per-domain: Stalwart appends the disclaimer at the bottom… - [Shared Folders](https://jabali-panel.com/docs/user/shared-folders.md): /jabali-panel/mail/shared-folders. IMAP shared folders for collaborative mailboxes. Click Create shared folder, supply: - [Email Logs](https://jabali-panel.com/docs/user/email-logs.md): /jabali-panel/mail/logs. Live tail of inbound and outbound mail for your domains. Click a row to view: You can see the metadata for every message in your… ## user/files - [Files](https://jabali-panel.com/docs/user/files.md): /jabali-panel/files. The in-panel file manager (M11, ADR-0030). File operations route through the panel API, which calls the agent over Unix socket. The… - [SSH Keys](https://jabali-panel.com/docs/user/ssh-keys.md): /jabali-panel/ssh-keys. Manage the SSH public keys used for SFTP access to your account (M12). SFTP is the file-transfer protocol the panel exposes (port… - [PHP Settings](https://jabali-panel.com/docs/user/php-settings.md): /jabali-panel/php-settings. Per-user PHP configuration. Applied to every domain you own that runs PHP through your per-user FPM pool. - [Cron Jobs](https://jabali-panel.com/docs/user/cron-jobs.md): /jabali-panel/cron. Scheduled commands that run under your account (M8). Click Add cron job, supply: On save, the agent creates two systemd-user units in… ## user/migration - [DirectAdmin Migration](https://jabali-panel.com/docs/user/directadmin-migration.md): If you are moving from DirectAdmin to Jabali, the operator handles the per-user backup ingest. Operator-side details: DirectAdmin Migration. ## user/ops - [Backups](https://jabali-panel.com/docs/user/backups.md): /jabali-panel/backups. Your account-level backup view. If the administrator has enabled tenant-visible backups for your package, this page shows: - [Backup Download](https://jabali-panel.com/docs/user/backup-download.md): Profile → Backups → Download my account. Produce a fresh snapshot on demand and download it. Subject to the administrator allowing tenant-initiated… - [Logs](https://jabali-panel.com/docs/user/logs.md): /jabali-panel/logs. nginx access and error logs for your domains, plus the PHP-FPM error log for your account. - [Activity](https://jabali-panel.com/docs/user/activity.md): /jabali-panel/activity. The audit trail scoped to your account. Every privileged action that affected your account. Each row contains: ## user/start - [User Panel](https://jabali-panel.com/docs/user.md): This is the table of contents for the tenant-facing documentation. A few things only the administrator can do for you: - [Dashboard](https://jabali-panel.com/docs/user/dashboard.md): /jabali-panel/dashboard. The first page after a tenant logs in. Top of the page: New Domain · New Mailbox · New Database · Open Files · Open Webmail. - [Profile](https://jabali-panel.com/docs/user/profile.md): /jabali-panel/profile. The tenant's account settings. Email changes propagate to Kratos; the next login uses the new email. - [Home](https://jabali-panel.com/docs/user/home.md): /jabali-panel/ redirects to /jabali-panel/dashboard. See Dashboard for the landing page content. The legacy /jabali-panel/home route is retained as an… ## Optional - [Repository](https://github.com/shukiv/jabali-panel): source, issues, discussions. - [Blog](https://jabali-panel.com/blog/): announcements + long-form guides. - [jabali-mcp](https://github.com/shukiv/jabali-mcp): official MCP server exposing the panel's REST API as 75+ tools for AI assistants.