New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
https://github.com/hestiacp/hestiacp
FOSS.
care to answer these questions @HPanel ?
The backup/restore bit is the one that stuck with me. I once had a panel reporting clean backups for months, then the one time I actually needed one the restore fell over on a permission mismatch — and that was the day I stopped trusting a green tick. Now I only count a backup if I've restored it somewhere else and actually logged in afterwards. Curious how you handle that part, is restore testing something you run on a schedule, or only after something goes wrong?
Hostinger offers hPanel.
is this the same?
No, this is just a AI SLOP, cPanel wanabe.
@JasonM No, it's not related. Hostinger's hPanel is the panel they use for their own hosting customers, while HPanel is a self-hosted control panel you install on your own server, made by Hostlic Webhosting Ltd. More details are at https://hpanel.net/
Why not just contribute to this free, open source panel instead?
https://github.com/hestiacp/hestiacp
@itzsenu @edmarhub Fair questions, here are the answers point by point.
Account isolation: Every account runs as its own Linux user with its own PHP-FPM pool, and PHP can only reach that account's own files. Shell-command functions are disabled, and chroot can also be turned on per account. A compromised plugin only reaches that one account.
cgroups / resource limits: We use cgroup v2 through systemd, with one slice per account for CPU, RAM, I/O and process limits. Changes apply live and stay after a reboot. When an account hits a limit, only that account slows down.
Source of truth: The panel database holds everything, and server configs are generated from it. Every config is tested before it's loaded, so a bad change never goes live. Manual edits are replaced on the next update, and custom rules have their own place in the panel.
Production scale: We run 60 accounts on one live production server and have tested more than 500 accounts on a single server.
Backups: Backups go to a Hetzner Storage Box, Amazon S3, S3-compatible storage, Google Cloud or local disk, with automatic retention. Every backup is checksummed and verified before restore. Admins are alerted if a backup fails.
Disaster recovery: A full-server backup plus emergency restore rebuilds everything on a fresh server automatically: accounts, files, databases, DNS, mail, SSL, PHP settings, limits and cron. A full end-to-end restore test with published timings is part of the public test in #20.
cPanel migration: Domains, files, databases and users, mailboxes with their passwords, DNS and PHP versions migrate automatically, and SSL is issued fresh. Standard WordPress and app rewrites work natively on nginx, and custom rules go into Site Rules. Anything unsupported is listed in the migration report, and the migration keeps going.
Concurrent operations: Heavy jobs run one at a time and are claimed atomically, so a job can never run twice. Interrupted jobs are marked failed and are safe to retry. Database backups are consistent even while the site is live.
Panel compromise: The panel runs on its own ports, separate from customer sites, and can be firewalled to admin IPs. It has bcrypt passwords, 2FA, role-based access, rate limiting and audit logs. Customer websites have no access to the panel API.
Attack surface: HPanel is built with Node.js, Express, React and PostgreSQL. Updates are signed and checksum-verified, passwords are hashed with bcrypt, and stored credentials are encrypted. Security reports go to [email protected].
Multi-tenancy: Each account has its own CPU, RAM, process and I/O limits, plus disk and inode quotas and MySQL per-user limits. Each account has its own temp folder, and Fail2Ban and ModSecurity protect the whole server.
PHP-FPM: Each account gets its own pool, user, socket and limits. PHP 7.4 to 8.4 can be chosen per domain, extensions are set per account, and dangerous functions are disabled.
Database isolation: Every database and database user belongs to one account and can only access that account's databases. Per-user MySQL limits stop one database from hurting others, and backups are taken consistently.
DNS: BIND9 zones are generated from the panel database and tested before every reload. If a change fails, the last good zone stays live. DNS cluster nodes stay in sync, and only the owner or an admin can edit a zone.
Mail: Mail runs on Postfix and Dovecot, with DKIM, SPF and DMARC set up automatically. SpamAssassin, ClamAV and Fail2Ban protect it, and mailboxes are included in backups. A compromised mailbox can be reset or suspended from the panel in one click.
SSL: Let's Encrypt certificates are issued and renewed automatically. If a renewal fails, the current certificate stays active and the panel shows the status. nginx is always tested before it reloads.
Updates / rollback: Updates are signed and verified, health-checked after install, and rolled back automatically if something fails. Customer sites keep running during a panel update, and auto-update can be turned off.
Monitoring: Every 5 minutes HPanel checks nginx, PHP-FPM, PostgreSQL, MySQL, mail and DNS services, plus disk usage. Admins get email or webhook alerts when something goes down and again when it recovers. Backup failures and malware detections are alerted too.
Benchmarks: On an idle server the panel itself uses around 80 to 120 MB of RAM. We'll publish the full numbers (account creation, backup, restore and migration speed, config generation and concurrency) together with the public test in #20.
Reproducibility: Agreed, that's a good test. We'll run it on a fresh Debian server, from install all the way to restore, and post the results here as soon as it's done.
Why not choose to contribute to this free, open-source project?
https://github.com/aaPanel/aaPanel
Why not choose to contribute to this free, open-source project?
https://github.com/openssh/openssh-portable
@souhaojicom That permission problem doesn't happen on the HPanel: a restore puts website files and mail back with their correct owners, and we verify it by restoring an account and sending a test mail to it. Automatic scheduled test-restores are coming in an upcoming release too.
@aaPanel_team Why would we contribute to your project when you are selling your own panel too? Your panel is totally useless, and many of your users have already moved to HPanel. This thread is for feedback on HPanel, so please don't use it to advertise your product. Kindly stop spamming here.
LOL
Bull$hit: many of your users have already moved to HPanel
Believe me use 1panel instead of whatever these ai made arse are claiming to be
@woinokiz People who can't build anything themselves are always the loudest at barking at others. HPanel is built by real developers, and if you have real feedback we're happy to hear it.
How many security audits have been done? Who have done them?
Real devs my ass
Claude
This. I would be far more trusting if any reputable red team pentested your software.