An open-source cPanel alternative for Debian 13

Why we built another panel

Most existing panels fall into one of two camps. The commercial ones (cPanel, Plesk, DirectAdmin) charge per account and lock features behind tiers. The free ones (HestiaCP, CyberPanel, aaPanel) make different trade-offs around language, security model, or maintenance cadence. We wanted something Debian-native, AGPL-licensed end to end, and built on a modern Go + React stack rather than a PHP monolith.

The stack

The panel API is jabali-panel-api, a Go service using Gin for HTTP routing and GORM for the data layer. The browser UI is a React single-page application built on Ant Design and TanStack Query. Privileged host operations - anything that needs root - run in a separate process, jabali-agent, accessed over a Unix domain socket. The panel itself does not run as root.

PHP, in this stack, is a hosted workload: each user gets their own PHP-FPM pool, and the panel manages versions 8.1 through 8.5 from the Sury repository per domain. The panel is not written in PHP.

What you get on a fresh install

Run the installer on a clean Debian 13 host and 8-15 minutes later you have:

• nginx as the reverse proxy and TLS terminator
• MariaDB 11.x for tenant databases (PostgreSQL is opt-in)
• PowerDNS Authoritative for hosted zones, pdns-recursor for panel-internal resolution
• Stalwart Mail 0.16.0 - SMTP, IMAP, JMAP in a single binary - with Roundcube webmail
• certbot issuing Let's Encrypt certificates per domain
• CrowdSec AppSec WAF inline with nginx, plus Snuffleupagus, AppArmor, AIDE, and auditd
• PowerDNS DNSSEC signing per domain (opt-in), with the DS record surfaced in the UI for registrar publication
• WP-CLI 2.12.0 powering one-click WordPress installs with a self-deleting SSO link into wp-admin

Everything is provisioned automatically. Nothing requires manual operator install.

Migrating from cPanel

The Migrations section accepts cPanel .tar.gz and cpmove archives directly. It also reads DirectAdmin, Hestia, and WHM backups. The restore is per-account, tracked in the UI, and writes domains, databases, mailboxes, DNS zones, and cron jobs into the new layout.

A few cPanel-specific notes:

• MySQL passwords are bcrypt in cPanel ≥ 11.96. Jabali stores the bcrypt hash directly in MariaDB so migrated apps keep authenticating without password reset.
• Email accounts move from cPanel's Dovecot+Exim to Stalwart. Mailbox passwords cannot be migrated as-is - the migration report prints the new passwords, or you can flip the "force first-login password reset" option.
• DKIM keys are imported as-is so outbound deliverability survives the switch.

What you don't get

A few honest caveats:

• This is single-host. There is no clustering. One panel, one VPS.
• We support Debian 13 only. The installer exits on earlier Debian releases or Ubuntu - not because we dislike Ubuntu, but because supporting a single distribution lets us actually test what we ship.
• The panel itself is English-only in the UI today. End-user features (webmail, autoconfig profiles) honour the user's browser locale.
• We sell paid support and pre-configured VPS instances. The software itself stays free; nothing is gated behind a paid tier.

Try it

curl -fsSL https://jabali-panel.com/install.sh | bash

That's the whole install command. The script is idempotent and safe to re-run. From a clean Debian 13 VPS, expect 8-15 minutes to a working panel at https://<panel-hostname>/.

If you'd rather see it first, the demo panel runs the live UI with seeded admin and user accounts. Everything is read-only - useful for clicking around without spinning up a server.

For longer-form documentation, the installation guide and quickstart walk through DNS prep, panel-hostname certificate issuance, and creating your first hosted user.