Virtual hosts
Creating a site generates the vhost, the document root, the system user, the PHP-FPM pool and the log files in one operation. Templates cover the common cases - static site, PHP application, reverse proxy to a local port - and the generated file stays readable, because at some point you will want to edit it by hand.
Aliases, redirects, custom directives and per-site rate limits are configurable from the panel without leaving the generated file unmanageable.
Config test and rollback
Before any change is applied, the panel writes the new configuration to a temporary location and runs the web server’s own validation. Only a passing test results in a reload. A failing test restores the previous file and reports the exact error.
This is the single most useful safety property in the panel, and it applies to DNS zones and mail configuration too.
SSL
Certificates are issued through acme.sh with HTTP-01 or DNS-01 validation, and renewal runs on a schedule with alerting when a renewal fails. Wildcard certificates via DNS-01 work when the zone is managed by the panel’s own BIND9 integration.
Certificates, keys and the renewal state live on your server. Nothing is escrowed anywhere.
- Let’s Encrypt and ZeroSSL through acme.sh
- HTTP-01 and DNS-01 validation
- Wildcard certificates with managed DNS
- Automatic renewal with failure alerts
- Manual certificate upload for existing certs
Isolation
Each site runs under its own system user with its own PHP-FPM pool, its own open_basedir and its own log files. A compromised WordPress install on one site does not get read access to the next site’s configuration.
The panel service itself runs under systemd with a hardened unit - restricted filesystem access, no new privileges, limited capabilities.