Linux Server Control Panel

Lightweight, modern, realtime Linux server control panel — a blend of aaPanel, Portainer, CasaOS, and Cockpit, but far lighter.

• 🔐 Multi-Factor Authentication (MFA / 2FA) — Access token, refresh token, TOTP (Google Authenticator/Authy) session management
• 👥 Dynamic RBAC — Super Admin, Admin, Operator, Read Only with per-resource permissions
• 📊 Realtime Dashboard — CPU, RAM, Disk, Temperature, Network via Socket.IO + Chart.js, featuring a Real-Time Process Inspector (sort by CPU/Memory)
• 📈 Monitoring — Historical metrics, disk health, network interfaces (with IP mapping), alert thresholds
• 🖥️ Web Terminal — xterm.js + node-pty, multi-tab, bash/zsh/fish
• 📁 File Manager — Browse, upload, download, edit, zip/unzip, rename, delete, search
• 🛡️ Security & SSH Key Manager — Dedicated UI to manage SSH keys (authorized_keys), SSH port, Password Authentication toggle, and live Fail2Ban intrusion logs dashboard
• 🌐 Tailscale VPN Integration — Optional client-side status dashboard, automatic installation scripts, one-click connection/disconnection controls, and web browser or auth key configuration to securely access the panel privately
• 🔌 Plugin Marketplace & SDK — Install/uninstall extensions dynamically with hot route mounting
• 🐘 PHP Manager Plugin — Complete control panel for multiple PHP versions (8.1 - 8.4) with FPM service actions and custom php.ini config values
• 🐳 Docker & Compose Engine — Start, stop, monitor telemetry, and deploy compose stacks (with automatic fallback to standalone docker-compose)
• 🔒 Let's Encrypt Auto-Renewal — Automatic SSL certificate request and renewal scheduler built into the panel health system
• ⚙️ Distro-Aware Auto-Updates — Dynamically writes daily update/upgrade cron scripts tailored to native package managers (APT, DNF, Pacman, Emerge)
• 📱 Responsive Design — Fully mobile-friendly layout with a frosted-glass Burger Sidebar Drawer offcanvas navigation menu
• 📡 Built-in Plugins — DB Web Admin (phpMyAdmin, pgAdmin, Adminer), Smart Home Manager (Home Assistant, Mosquitto, Zigbee2MQTT), Media & Cloud Services (Jellyfin, qBottorrent), Realtime Log Analyzer, OpenClaw AI, WireGuard VPN, Fail2ban Admin, PM2 Manager, S3/Rclone Backups, Redis, Nextcloud, AdGuard Home, MinIO S3 Server, Uptime Kuma, and Rclone Manager (featuring host-level dependencies auto-installers)
• 🔐 Security Hardened (v1.8.0) — Shell injection prevention via execFile(), Zip Slip protection, upload extension blocking (18 dangerous types), WAL-safe graceful shutdown, EISDIR crash guard, storage permission hardening (750), and path traversal validation on rename

• Node.js 20+
• SQLite 3 (embedded, zero-configuration required)
• Redis 7 (optional, for background jobs and message queues)
• Linux (Debian/Ubuntu/Fedora/Arch/Gentoo) for full terminal/PTY and service management features

cp .env.example .env
# Edit .env and set secure secrets.
docker compose up -d

Open: http://localhost:23456
Login: admin / Admin@123456 (change this immediately!)

# Pull the latest image from Docker Hub
docker pull mastarom/panelku:latest

# Run the container
docker run -d -p 23456:3000 --name panelku \
  -v $(pwd)/storage:/app/storage \
  mastarom/panelku:latest

# Install dependencies
npm install

# Copy and configure environment
cp .env.example .env

# Start development server
npm run dev

# Or production with PM2
pm2 start ecosystem.config.cjs

sudo bash scripts/install.sh

src/
├── app.js              # Express factory
├── server.js           # HTTP + Socket.IO entry
├── bootstrap.js        # DB, Redis, WS, jobs, plugins
├── config/             # App, DB, Redis, Socket, Logger configs
├── core/
│   ├── db/             # SQLite Singleton and Schema definitions
│   ├── events/         # EventBus (pub/sub)
│   ├── scheduler/      # Background job scheduler
│   ├── permissions/    # Dynamic RBAC engine
│   └── plugin-loader/  # Plugin SDK
├── middleware/         # Auth, RBAC, rate limit, error handler
├── models/             # Mongoose-compatible SQLite models
├── repositories/       # Data access layer
├── helpers/            # Response, crypto, system, validation
├── modules/            # Feature modules (auth, users, dashboard, etc.)
├── websocket/          # Socket.IO namespaces
├── jobs/               # Background jobs
├── public/             # Static assets (CSS, JS)
└── views/              # HTML pages

⚠️ Change the default password immediately after first login!

Password Policy Engine, Split-View File Manager with CodeMirror & Media Previews, CSP Security Hardening, and 0-Vulnerability Dependency Audit.

🚀 New Features & Enhancements

• Password Policy Engine & Expiry Reminder: Configurable password complexity rules, automated password expiration reminder background job, forced password change on login (mustChangePassword), policy history audit trail, and JSON import/export.
• Split-View File Manager: Dual-pane file manager with side-by-side file tree and editor, smooth draggable divider, and full-width responsive flex container.
• Self-Hosted CodeMirror Integration: CodeMirror text editor with syntax highlighting, active line highlighting, match brackets, auto-close brackets, line numbers, and instant light/dark theme switcher.
• Media & Document Previewer: Inline file previewer for images (with zoom in/out, fit-to-width, fit-to-page controls & mouse wheel zoom), audio player, video player, and PDF reader iframe inside the split view.
• Tree-to-Editor Drag & Drop: Drag files or folders from the file explorer tree directly into the editor to insert relative/absolute paths at cursor position.
• CSP Nonce Security Hardening: Automated Content Security Policy nonce injection for all inline scripts & style blocks across EJS views.
• Optimized Rate Limiting: Smart API & Download Token rate limiters with loopback/auth exemptions to prevent false-positive 429 Too Many Requests during active session management.
• 0-Vulnerability NPM Audit: Resolved 100% of high-severity npm vulnerabilities via package overrides (brace-expansion 5.0.8).

12 new modules added — GPU management, power management, mail server, CDN/cache, IoT device manager, enhanced database explorer, runtime managers, and more.

🚀 New Modules

• GPU Manager — Full NVIDIA GPU monitoring via nvidia-smi, CUDA/CUDNN detection, per-GPU utilization (GPU/Memory/Power), temperature, fan, clocks, process management with kill capability, power limit control
• Power Manager — CPU frequency scaling & governor control, power profiles (Performance/Balanced/Power-Saver), suspend/hibernate/hybrid-sleep, thermal zone monitoring with threshold alerts, fan RPM monitoring
• Mail Server Manager — Postfix/Dovecot/SpamAssassin: install/uninstall, domain management, email accounts (SHA512-CRYPT), mail queue view/flush/delete, SpamAssassin config, SSL viewer, journalctl logs
• CDN & Cache Manager — Cloudflare API (zone list, cache purge, analytics), Varnish (status, VCL editor, cache purge), Redis cache stats/flush, Full Page Cache
• IoT & Edge Device Manager — Mosquitto MQTT broker (config/users/ACL/publish QoS), Home Assistant & Node-RED Docker deploy, nmap device discovery, MQTT metrics
• Enhanced Database Explorer — 5-tab explorer: Browse (paginated, sortable), Structure (columns/keys/FK), Query (SQL console with Ctrl+Enter), Export (JSON/CSV/SQL), Import (CSV/SQL), History (last 100 queries)
• Runtime Managers — Node.js version management (nvm/nodenv), Python virtual environments (pyenv/Gunicorn/Uvicorn), MongoDB full management, Redis dashboard with keyspace monitor, Apache virtual host manager
• Caddy Server Manager — Full Caddyfile editor, automatic HTTPS, reverse proxy config, import management
• AI Auto-Repair — GPT-powered log analysis, intelligent fix suggestions with one-click apply, predictive alerting, trend analysis
• Auto-Updater & Rollback — One-click git update with pre-update health check, automatic rollback on failure
• Multi-User RBAC + SSO/LDAP — LDAP integration, SAML/OpenID Connect SSO, fine-grained permissions, group-based mapping
• Service Mesh & Auto-Healing — systemd health checks, auto-restart, alerting on repeated failures
• Backup & Disaster Recovery — Rclone + S3 automated backups with retention policies
• Analytics Dashboard — Historical metrics with time-range selectors, log aggregation, trend charts
• Comprehensive Swagger API Docs — OpenAPI 3.0 documentation for all modules with interactive Try-It-Out

🔴 Critical: Shell injection fix (execFile), Zip Slip protection, upload filter (18 types), graceful shutdown WAL-safe, EISDIR crash guard, install dir fix (/opt/panelku), storage 750, install.sh multi-distro rewrite.

OpenClaw AI Copilot, Nginx Reverse Proxy Docker Mapper, PHP Pool Manager, Database Visual Explorer, WhatsApp Alerting, Service Watchdog, Audit Log Dashboard, Security Advisor, Multi-Cloud S3 Backup, Terminal AI, Git Webhooks, Tailscale VPN.

Multi-Node Cluster Manager, SQLite Auto-Backups, Terminal Audit Logs, GitHub Actions CI/CD.

PHP Manager, 2FA/MFA, SSH Key Manager, Let's Encrypt Auto-Renewal, Fail2Ban logs, distro-aware auto-updates.

MIT