Skip to content

README.md

Latest commit

 

History

History
214 lines (167 loc) · 11.5 KB

README.md

File metadata and controls

214 lines (167 loc) · 11.5 KB
VortexPanel v3.3



⚡ VortexPanel

Free, open-source server control panel for Linux.
A self-hosted alternative to cPanel, Plesk, and aaPanel — WAF, Fail2Ban, Load Balancer, WP Toolkit, 2FA, and HTTPS for the panel itself, all built in and free, with no paid Pro tier.
Built with Python/Flask + Alpine.js. No Node.js build step. No bloat. 2-minute install.

🆚 Why VortexPanel over cPanel / Plesk / aaPanel / HestiaCP?

Feature cPanel Plesk aaPanel Free aaPanel Pro HestiaCP VortexPanel
Price $30–$65/mo $16–$46/mo Free Paid add-on Free Free (MIT)
ModSecurity WAF Paid ext. Paid ext. ❌ ✅ paid Manual ✅ Built-in, OWASP CRS v4
Fail2Ban Paid ext. Built-in ❌ ✅ paid ✅ ✅ Built-in
Load Balancer ❌ ❌ ❌ ✅ paid ❌ ✅ Built-in
WP Toolkit ❌ Paid (Deluxe+) ❌ ❌ ❌ ✅ Built-in, free
Firewall (UFW + firewalld) ❌ via ext. UFW only UFW only UFW only ✅ Both, native
Panel 2FA (TOTP) ✅ ✅ ✅ ✅ ❌ ✅ Built-in
Panel HTTPS (self-hosted) ✅ ✅ ✅ ✅ ✅ ✅ Custom port, never 443
Password hashing Unknown Unknown Unknown Unknown Unknown Argon2id (OWASP #1)
PHP Webshell Scanner ❌ ❌ ❌ ❌ ❌ ✅ Built-in
Cloud Backup (S3) Paid Paid ext. ❌ ✅ paid Manual ✅ Built-in
Docker UI ❌ ❌ ✅ ✅ ❌ ✅ Built-in
RHEL/AlmaLinux/Rocky ✅ ✅ Partial Partial ❌ ✅ 9 distros
Web Terminal ✅ ✅ ✅ ✅ ❌ ✅ Built-in
Open source ❌ ❌ Partial ❌ ✅ ✅ MIT

✨ Features

🌐 Website Management

  • Nginx, Apache2, OpenLiteSpeed, Caddy — install and manage from the same panel
  • One-click SSL via Let's Encrypt — auto-detects Cloudflare DNS-01 vs HTTP-01
  • Reverse proxy, custom directives, PHP version per site, Composer integration
  • One-click WordPress/Laravel/Symfony deploy
  • PHP webshell scanner integrated with the File Manager

🔷 WP Toolkit

Full WordPress lifecycle management — install, manage, secure, stage, back up — no separate plugin or paid add-on:

  • Full install in one click: downloads WP, creates DB, writes wp-config.php, runs the installer, creates the vhost, configures SSL — done
  • PHP 7.4 → 8.5, Nginx / Apache / OpenLiteSpeed / Caddy, MariaDB / MySQL — pick any combination
  • Plugin & theme management, one-click admin login (no password needed), bulk updates
  • Security scanner — 9 checks with one-click auto-fix buttons
  • Staging clone — full site clone with DB, push/pull between staging and live, auto-backup before push
  • Backup/restore, maintenance mode, system cron, debug mode toggle
  • Auto-generates non-default admin username + randomised table prefix on install (security by default)

🔒 Server Security

  • Firewall — UFW (Debian/Ubuntu) and firewalld (Fedora/RHEL/AlmaLinux/Rocky/Oracle/CentOS/CloudLinux) from the same UI
  • Fail2ban — intrusion prevention, brute-force protection
  • ModSecurity WAF — OWASP CRS v4, 3-state engine (Blocking/Detection/Off), paranoia level 1–4, custom rule editor, audit log viewer, per-site override, weekly auto-update cron
  • SSH Hardening — create sudo users, add SSH keys, disable root login, disable password auth, change port — all with built-in safety checks that block you from locking yourself out
  • Security Score dashboard — SSH config, firewall (UFW or firewalld), Fail2ban, auto-updates, panel password strength, 2FA status, secret key — all in one glance

🛡 Panel Security (hardened to OWASP standards)

  • Argon2id password hashing (OWASP's #1 recommendation) with transparent migration from legacy SHA-256/bcrypt — existing users never notice
  • 2FA / TOTP — QR-code setup with any authenticator app (Google Authenticator, Authy, 1Password), required on every login once enabled
  • Brute-force lockout — 5 failed attempts → 15-minute lockout, persists across panel restarts
  • Panel HTTPS — self-signed or Let's Encrypt, served on your custom port (never the well-known 443), so enabling HTTPS never makes the panel newly discoverable by a generic port scan
  • IP allowlist, session timeout, login audit log, auto-generated 64-byte secret key, security headers (CSP, X-Frame-Options, HSTS-ready) on every response

🗄 Databases

  • MySQL, MariaDB, PostgreSQL, MongoDB — multi-engine
  • phpMyAdmin integration (auto-configured on its own port, separate PHP version)

📦 App Store

  • 25+ one-click installs: Nginx, Apache, OpenLiteSpeed, Caddy, PHP (multi-version), MySQL, MariaDB, PostgreSQL, MongoDB, Redis, Docker, Node.js, Python, Composer, Fail2ban, ClamAV, ModSecurity, Roundcube, Supervisor, Pure-FTPd, BIND9 DNS, and more
  • Live installation terminal — every install, uninstall, and version switch streams real-time output line-by-line (like aaPanel's task terminal)
  • Automatic conflict detection, RHEL-family package manager support
  • Safe database version policy — databases (MariaDB/MySQL/PostgreSQL/MongoDB) require uninstall-first to prevent data corruption; version switching kept for non-data modules

⚙ Settings — redesigned card-based control center

  • Network & Access — panel port (auto-updates firewall), custom domain, webroot
  • Panel SSL — one-click self-signed or Let's Encrypt, validity countdown, automatic safe cutover (no downtime race conditions)
  • Authentication & Security — 2FA, password, IP allowlist, session timeout, all at a glance
  • PHP Webshell Scanner — pick a path, scan, get severity-coded results with file/line/snippet
  • Panel Settings — auto-update, timezone, NTP sync, hostname, OS package updates
  • System Information — OS, kernel, IP, uptime, version, all in one card

⚡ Performance

  • Dashboard stats from /proc (not top -bn1) — 10× faster
  • Response caching for expensive endpoints, gzip compression on all responses
  • app.js 150KB → ~40KB, index.html 350KB → ~70KB over the wire

🔧 Everything else

  • Docker — container management, 45+ pre-configured image catalog
  • DNS — BIND9 zone management + Cloudflare DDNS
  • Mail — Postfix + Dovecot, domains, accounts, Roundcube webmail
  • CDN — Cloudflare, BunnyCDN, Akamai, CloudFront, KeyCDN
  • Monitoring — real-time CPU/RAM/Disk/Network, process list, bandwidth
  • File Manager — code editor, chmod, AES-encrypted zip support, ClamAV scan
  • Web Terminal — full PTY shell in browser over WebSocket
  • Backups — website + database, restore, S3-compatible cloud backup
  • Cron Jobs — visual scheduler, 10 task types, run-now, logs
  • AI Assistant — configurable OpenAI-compatible API (NeonCodex, OpenAI, etc.)

🚀 Quick Install

wget -O install.sh https://raw.githubusercontent.com/BrowserlessAPI/VortexPanel/main/install.sh && bash install.sh

Access the panel at: http://YOUR-SERVER-IP:8888

The installer auto-detects your OS and package manager. On RHEL 8-family systems (AlmaLinux 8 / Rocky 8, where default Python is 3.6) it automatically installs Python 3.11.

First things to do after install: change the default password, enable 2FA, and enable Panel SSL — all from Settings.

📋 Supported Operating Systems

Distro Versions
Ubuntu 20.04, 22.04, 24.04, 26.04
Debian 11, 12
AlmaLinux 8, 9, 10
Rocky Linux 8, 9, 10
RHEL 8, 9, 10
Oracle Linux 8, 9
CentOS Stream 8, 9
CloudLinux 8, 9, 10
Fedora 38+

Minimum requirements: 512 MB RAM (1 GB recommended) · 2 GB free disk

🛠 Tech Stack

Layer Technology
Backend Python 3.8+ · Flask 3.x · Gunicorn (4 workers × 4 threads)
Frontend Alpine.js 3.14 · Vanilla CSS (no build step, no npm)
Auth Session-based · Argon2id password hashing · TOTP 2FA
Panel config JSON files (no external database required)
Service systemd · auto-start on boot

🤝 Contributing

Contributions are welcome — bug reports, feature requests, and pull requests all help.

Before you start:

  1. Check open issues to avoid duplicates
  2. For new features, open an issue to discuss before coding
  3. Read CONTRIBUTING.md for code style and PR process
git clone https://github.com/BrowserlessAPI/VortexPanel.git
cd VortexPanel
pip install -r requirements.txt
python3 app.py   # runs on :8888

🗺 Roadmap

v3.3 (current) — shipped:

  • Visual design overhaul — coloured stat cards, sidebar icon pills
  • HTTP/3 QUIC — full multi-webserver support (nginx upgrade, Caddy/OLS auto, Apache blocked)
  • Live installation terminal — real-time SSE streaming for all App Store actions
  • Two-webserver conflict detection — dashboard warning banner
  • Mail forwarding domain selector + log filter/search
  • Session persistence across gunicorn restarts (flask-session filesystem)
  • nginx stream module auto-install across all 9 distros
  • MariaDB 12.x versions added; optimization tab fixed
  • Node.js v24 as default LTS; EOL v18/v20 removed; switch bug fixed

v3.4 (next):

  • Bandwidth Monitor — per-domain traffic graphs (daily/weekly/monthly)
  • Website-level Backup — files + database together in one click per domain
  • Dark mode — toggle with full dark variable set
  • Onboarding wizard — guided first-run flow
  • Mobile responsiveness — sidebar + layout for small screens
  • PHP Webshell Scanner — scan web roots for obfuscated shells
  • Disk usage analyzer (visual tree, delete from panel)
  • Alerting — CPU/RAM/SSL-expiry notifications (email/webhook)

📄 License

MIT License — free to use, modify, and distribute, including commercially.

Made with ⚡ by BrowserlessAPI · Releases · Issues · Contributing