ITRUPANEL documentation

Installation and first sign-in

ITRUPANEL is installed with one command on a clean Linux server with root access and systemd. It supports Ubuntu 22.04 / 24.04 / 26.04, Debian 11–13, AlmaLinux and Rocky Linux 8–10, CentOS Stream 9–10 and RHEL 8–10 on amd64 and arm64.

How it works

The command downloads the installer, verifies the checksum of the full archive and starts the installation. The installer sets up Nginx, PHP-FPM, MariaDB, FTP and DNS, creates the administrator and prints the login and password in the terminal. If the panel is already installed, the same command switches to the update procedure with a backup of the program and settings.

Features

• Command: wget -O install.sh https://itrupanel.com/panel/install-itrupanel.sh && bash install.sh (as root, without sudo).
• The panel address after installation is https://SERVER_IP:3333, login admin. The certificate is self-signed at first, so the browser shows a warning.
• Choose the PHP version with the PHP_VERSION variable (for example PHP_VERSION=8.4) or skip PHP entirely: PHP_VERSION=none.
• On the first sign-in you must read and accept the terms of use; until then the rest of the panel stays locked.
• Default ports: panel — TCP 3333, websites — 80 and 443, FTP — 21 and passive 30000–30100, DNS — 53 (if used). The firewall at your hosting provider is configured separately.
• If the installation was interrupted, fix the cause and run the command again.

Important. Install on a clean server. If another panel or live websites already run on it, prepare a separate server and move the data with the Import data section.

Panel interface

The panel is a web interface in English and Russian with light and dark themes. The menu on the left has four groups: Hosting, Server, Security and Diagnostics.

How it works

Every section opens in a tab, so you can keep several sections open and switch between them. Long actions (package installs, backups, scans) run as background tasks: the task window shows progress, and the result stays in the Tasks section.

Features

• The interface language and theme are switched in the top bar; the choice is remembered.
• The bell next to the language switch shows notifications with an unread counter.
• The Updates button in the top right shows what is new in the version and starts the panel update.
• In the file manager every file has a right-click menu; on phones and tablets it opens with the ⋯ button in the row.
• Dangerous actions (deleting, rebooting, stopping services) ask for confirmation; long tasks have a Stop task button.

Dashboard

The home page of the panel: server metrics and service status at a glance.

How it works

The panel polls the system regularly and refreshes the metrics without reloading the page. Service status comes from systemd.

Features

• CPU load, memory, disk, network and disk I/O.
• Status of the main services: web server, PHP-FPM, database, mail, FTP, DNS.
• If the server needs a reboot after a kernel update, a reboot required mark appears next to the uptime.

Websites

Create and configure websites: PHP sites, static sites and proxying to an application.

How it works

For every website the panel creates a separate system user, its own PHP-FPM pool and an Nginx configuration. Files live in /var/www/USER/data/www/DOMAIN, so sites are isolated from each other. The configuration is validated before it is applied, and the previous one is restored on an error.

Features

• Modes: PHP, static only, or proxy to an application address (Node.js, Python and so on).
• The PHP version is chosen per website; if it is missing on the server, the panel installs it when you save.
• Domains can be entered in Cyrillic, aliases are separated by spaces, and there is a quick add-www option.
• HTTP → HTTPS redirect, www redirect, gzip, browser caching of static files, upload size limit, index files, and All requests to index.php for pretty URLs in Laravel and most CMS.
• SSL: pick a certificate, a self-signed one or automatic Let’s Encrypt — the panel issues the certificate as soon as the domain points to the server.
• You can create a DNS zone for the domain at once; for a subdomain of an existing zone, A records are added automatically.
• Web server behind Nginx: PHP-FPM, and Apache or OpenLiteSpeed when needed.
• Custom Nginx directives for a site and a read-only view of the resulting configuration.
• Suspend and delete a website (with or without files).
• Default website — which site answers on the server IP address and on unknown domains.

Important. If a site was moved from another panel and its .user.ini sets open_basedir, the panel sets open_basedir in the pool itself, so old restrictions do not break the site.

SSL certificates

Issue, add and renew certificates for websites and mail.

How it works

Let’s Encrypt is issued through an HTTP check: the panel verifies that the name reaches this server, serves the challenge file before any redirects and installs the certificate on the site. Renewal is automatic.

Features

• Issue Let’s Encrypt for one or several site names.
• Create a self-signed certificate.
• Add an existing certificate (certificate, key and chain files).
• The expiry date of every certificate and the sites that use it.
• Only one issuance runs at a time; if another certbot is busy, the panel waits up to three minutes.
• Names that point to another server are left out of the request so the issuance does not fail.

Databases

Manage MariaDB databases and their users.

How it works

The panel creates a database and a user in one operation, links the database to a site and shows its size. For work in the browser there is phpMyAdmin with sign-in from the panel.

Features

• Create a database with a chosen charset; the password is generated or set manually and can be changed at any time.
• Import a dump: .sql, .sql.gz and .zip files — from your computer or from a file on the server; export to .sql.gz.
• IP access: for each database you can allow connections only from the listed addresses.
• Network access to the main MariaDB is enabled by the administrator separately; local access is always available.
• The size of every database and its link to a site.
• Delete a database together with its user.

Important. A network connection to the database needs an open port in the server firewall and at the provider; the panel does not change provider rules.

Mail

A mail server for your domains: mailboxes, forwarding, webmail and antispam.

How it works

When you add the first domain the panel installs Postfix, Dovecot and OpenDKIM and issues a certificate for the mail server name. Every domain gets its mail name and DNS hints; webmail (Roundcube) and antispam (Rspamd) can be switched on and off for a domain with toggles.

Features

• Domains and mailboxes: create, disable, delete, quotas in MB or GB, copy a mailbox password.
• Aliases, forwarding to external addresses and a catch-all for the whole domain.
• Check of the domain DNS records (MX, SPF, DKIM, DMARC, PTR) against authoritative name servers.
• Mail client setup: IMAP 993 (TLS), SMTP 587 (STARTTLS), login is the full mailbox address.
• Roundcube webmail per domain, Rspamd antispam with thresholds for the [SPAM] mark and rejection.
• A Let’s Encrypt certificate for the mail server name with automatic renewal.
• Reputation check of the domain and IP through MXToolbox (API key needed) or Spamhaus.

Important. Mail delivery needs correct MX, SPF, DKIM and DMARC records and open ports 25, 587 and 993; many hosting providers block port 25 by default.

DNS management

Your own DNS zones on the server (BIND).

How it works

The panel creates a zone, adds the basic records and name servers and reloads BIND. For subdomains of existing zones A records are added automatically, and mail records are suggested by the Mail section.

Features

• Create and delete zones, edit records (A, AAAA, CNAME, MX, TXT, NS and others).
• Name servers (NS) for new zones and zone parameters.
• The number of records and the serial number of every zone.
• A zone can also be created right when adding a website.

Important. For the zone to work on the internet, set the name servers that answer from this server at your domain registrar.

File manager

Work with website and server files right in the browser.

How it works

The manager works with the panel privileges but returns the right owner and SELinux labels to files after copy, move and extract. Deleted files go to the recycle bin and can be restored.

Features

• Browse folders, create files and folders, rename, copy and move.
• Upload files from your computer and download.
• A file editor in a window; permissions and owner.
• Create archives and extract them (zip, tar and others).
• A right-click menu with the same actions as in aaPanel, plus copying the path.
• Recycle bin: restore to the original place, delete permanently or empty; when deleting you can choose Delete permanently, bypassing the recycle bin. The bin can be turned off.

FTP users

FTP access to website files (Pure-FTPd).

How it works

An FTP user is bound to the site owner, so uploaded files belong to the right user, and the user sees only their own home folder.

Features

• Create a user: name, owner (the site system user), home folder, password.
• Change the password and delete.
• Default passive ports are 30000–30100 — open them in the firewall.
• Brute-force protection is enabled in the Login protection section.

Backups

Back up websites, databases and settings, manually or on a schedule.

How it works

Backups are split by kind: website files, one backup per database, website settings and the panel settings. The first backup is full, followed by up to six incremental ones: changed files and deletions are saved. The panel assembles the chain itself when restoring.

Features

• Schedule, number of kept backups and storage: on the server or on FTP (with a connection test).
• Full and incremental backups; parts of the chain needed by other backups cannot be deleted.
• Backup contents: browse files and databases and download a selection.
• Partial restore: only the files, folders or databases you need, without touching the rest of the site.
• Restore a whole site, single databases and settings.
• Find existing backups on FTP and attach them; such backups are excluded from scheduled retention.

Important. Create fresh backups of websites and databases before updating the panel and before big changes.

Import data

Move websites, databases and cron jobs from another ITRUPANEL server to this one.

How it works

You enter the address of the old panel and the administrator login and password. The panel first only looks at what is on the old server, then you tick what to move and the panel moves the selection. PHP versions missing on the new server are installed automatically before the move so the websites work right away.

Features

• Connection: the address of the old panel (for example https://old.example.com:3333) and the administrator login and password. Separate SSH access is not needed: lists are read through the panel API, and website files and database dumps are transferred through the panel. The old panel must be version 0.1.94 or newer with the terms of use accepted.
• The Choose step: tables of websites (owner, PHP version, size), databases and cron jobs; pick everything or only some websites, databases and jobs. Next to it you see what will be needed on this server.
• Files are copied with permissions, owners and links and unpacked as the site user; databases are moved together with their user, and the database password is kept (if it cannot be moved, a new one is created and shown once).
• Moving works between Debian, Ubuntu, AlmaLinux, Rocky Linux and other supported systems in any direction.
• The certificate of the old panel is remembered at the check and compared during the move; running it again duplicates nothing: existing websites and databases are skipped.
• Logins and passwords are kept in the panel memory only, for up to three hours, and never reach the disk or task logs; the export on the old panel is available only to the signed-in administrator and is recorded in its Operations log.

Important. Mail, DNS zones and FTP users are listed but not moved yet. SSL certificates are not moved: when the domain points to the new server, issue Let’s Encrypt in the SSL certificates section.

Server information

Server details, service management and the panel address settings.

How it works

The section shows the system characteristics and lets you manage services. The panel address and SSL can be set so that the panel opens by a domain without a port.

Features

• Server name, operating system, processor, uptime, load and server time.
• Services: status, start, stop and restart (with a warning about the sites that depend on the service).
• Panel address and SSL: open the panel by a domain on port 443 with a Let’s Encrypt certificate, and optionally close the direct port from outside.
• The Reboot server button: the panel checks that no tasks or backups are running, and the page refreshes itself after the reboot.
• A reboot required mark after a kernel or system library update.

PHP

Several PHP versions at the same time: every site has its own.

How it works

Each version runs as a separate PHP-FPM service. Standard modules are installed with the version, extra ones can be added and removed. The default version is used for new websites.

Features

• Install and remove PHP versions; availability depends on the OS and repositories.
• The status of every version: running, stopped, installation error.
• Packages and modules of a version: mysql, gd, curl, mbstring, xml, zip, intl, imagick, opcache and others.
• php.ini settings: memory and upload limits, execution time and so on; an empty field means the PHP default and is not written.
• Make default and restart PHP-FPM.

Database servers

Extra MySQL and MariaDB servers of the versions you need next to the main one.

How it works

Each extra server runs in its own Docker container on a separate port. On servers with little memory the panel turns on a lean mode.

Features

• The main MariaDB and extra MySQL/MariaDB servers of a chosen version.
• Create, start, stop and delete servers; network access is set separately.
• Databases can be created on any of the servers.

Important. Extra servers need Docker (it is installed in the Docker section).

Docker

Containers, images and Docker Compose projects on this server.

How it works

The section is for the administrator. The panel installs Docker and Compose with one click and then manages containers, images, networks and volumes. Database server containers are protected from accidental stopping.

Features

• Create a container from an image: ports, volumes, environment variables, restart policy, network, memory and CPU limits.
• Start, stop, pause, logs, details and a terminal inside the container.
• Docker Compose projects: templates are validated before saving.
• Images, networks, volumes and cleanup of unused items.
• Daemon settings: registry mirrors, insecure registries.
• Removing a container also removes its image and volumes if no other container uses them; removing a project removes its volumes and images. Uninstalling Docker deletes all its data by default and shows how much space was freed.

CRON scheduler

Scheduled jobs for website users.

How it works

Each job is written to the crontab of the chosen system user and runs with their privileges. The schedule is validated before saving.

Features

• A five-field schedule (minute, hour, day, month, weekday) or @daily, @hourly and similar.
• A one-line command, a comment, enable and disable without deleting.
• Sending the output to an e-mail address, if one is set.
• Jobs are carried over by the Import data section.

IP addresses

The server addresses and their scope.

How it works

The section finds the addresses of the network interfaces and shows which of them are public. These addresses are needed for DNS A records and mail setup.

Features

• A list of IPv4 and IPv6 addresses with the interface and a public flag.
• Copy an address with one click.

Shell client

A server terminal with root privileges right in the browser.

How it works

The session opens over a secure connection and closes when you leave the page. Everything you type runs on the server as root.

Features

• A full terminal with history and copying.
• The session works while the page is open; run background processes through screen or tmux.

Website protection

HTTP request limits for each website at the Nginx level.

How it works

For a website you can set a request rate limit per IP, a burst allowance and a number of concurrent requests. Monitoring mode only records violations, blocking mode answers HTTP 429, and deny-listed addresses get HTTP 403.

Features

• Modes: off, monitoring, blocking.
• Allow and deny lists of addresses (IPv4, IPv6, CIDR); the allow list takes priority.
• An activity chart and an event log with filters by site, address and path.
• Let’s Encrypt checks are exempt from the rules.
• The configuration is validated before applying, the previous one is restored on an error.

Important. The module limits request rates. It does not filter SQL injection or XSS and does not replace DDoS protection at the provider level. Start with monitoring mode and tune the limits to the normal traffic of the site.

Antivirus

Scan websites for viruses, web shells and malicious injections, with cleanup from backups.

How it works

The built-in scan works right away, without installing packages: it looks for web shells, execution of encoded code, malicious injections in PHP, JS and .htaccess, PHP code in images and PHP files in upload folders. ClamAV with signature databases can be added if you wish. Commented-out code is not treated as a threat, and long encoded strings are decoded to show what is inside.

Features

• Scan manually all sites, one or the ones you tick; on a schedule — daily or weekly.
• Results: file, line, threat and severity.
• The Clean up button: the panel browses the backups and for every infected file finds the last clean version — only that file is restored; if there is no clean version, the malicious injection is cut out and planted files go to quarantine. A plan is shown before any change.
• Quarantine: previous file versions are kept and can be brought back.
• ClamAV: databases of about 120 MB are updated automatically once a day; if the official server is unavailable from the server country, the panel switches to trusted mirrors. ClamAV scanning needs at least 2 GB of memory.
• Notifications report findings.

Important. Heuristics can produce false positives. Look at a finding before deleting a suspicious file; the panel keeps the previous version in quarantine.

Login protection

Protect the panel and FTP from password guessing.

How it works

The panel tracks failed sign-in attempts from one IP. Blocks persist across restarts, and active sessions are not interrupted.

Features

• Panel: 5 failures in 10 minutes block the address for 15 minutes; enabled automatically.
• FTP: the Install and enable button sets up Fail2ban and blocks the address on the chosen port after 5 failures in 10 minutes.
• A list of blocked addresses and manual unblocking.

Firewall

Incoming connection rules of the server.

How it works

Rules are checked in order: the first match decides the action. SSH and the panel port are protected from accidental blocking, and changes apply immediately.

Features

• Allow or deny connections from a given network; modes Only selected addresses and Block selected addresses.
• Rules for ports and server services.
• Management ports, local and already established connections are always allowed.
• Outgoing connections and forwarded traffic (for example Docker) are not filtered here.
• If other firewalls (ufw, firewalld) are found on the server, the panel shows them: their rules are kept and can block even a connection allowed here.

Operations log

All changes made through the panel.

How it works

Every operation is recorded with the time, user, address, action, object and result. The log helps to see who changed what and when.

Features

• Time, user, address, action and object of every operation.
• The result of the operation and the error text if it failed.

Visit log

Panel sign-ins and failed attempts.

How it works

The section shows the date, address, browser and result of every sign-in attempt. It helps to notice password guessing and foreign sign-ins.

Features

• Successful sign-ins and failed attempts.
• The visitor address and the time.
• Blocks for failed attempts are configured in the Login protection section.

Website logs

Access and error logs of the web server for each website.

How it works

The panel reads the Nginx and PHP logs, lets you search them and download. Log rotation is set up automatically, including SELinux systems.

Features

• Access and error logs of the chosen site.
• Search in the logs.
• Refresh the list of log files.

Traffic usage

Outgoing traffic of websites.

How it works

Data is collected from the Nginx logs and refreshed every 10 minutes. You can see which sites use the most traffic.

Features

• Outgoing traffic of every site.
• Comparison of the sites with each other.

Resource usage

History of CPU, memory and disk load.

How it works

The panel records server metrics periodically, and the section shows them as charts so you can find load peaks.

Features

• Charts of CPU and memory use from the recorded metrics.
• Load peaks are visible over time.

Disk usage

What exactly takes space on the partition.

How it works

The section shows all the main space consumers, not only websites: the system, Docker, the swap file, package cache, temporary files, ClamAV databases, quarantine, the recycle bin and the unaccounted remainder.

Features

• Cleanup buttons: package cache, system journal, recycle bin.
• A warning when the disk is fuller than a set percentage (configured in Notifications).

Tasks

Background tasks of the panel.

How it works

Package installs, backups, antivirus scans and data moves run in the background. The section shows the status, stage and log of every task.

Features

• Status: running, done, error; a live log.
• The Stop task button for scans, ClamAV database updates, reading backups, data moves and Docker image downloads. A package install cannot be stopped: interrupting it can leave it unfinished.
• While background tasks run, the panel update is unavailable.

Notifications

Panel and server events.

How it works

The panel collects important events — detected threats, update failures, a full disk — and shows them with the bell. They can also be duplicated to the administrator e-mail.

Features

• A list of events with a read mark.
• The administrator e-mail for messages.
• The disk usage threshold that triggers a warning.

Panel updates

Update to a new version right from the panel.

How it works

The panel checks the signed latest.json on itrupanel.com, verifies the checksum and signature of the archive and updates itself. Every release is a full archive, so previous versions are not needed for updating. Environment fixes for installed servers are applied by migrations during the update.

Features

• The Updates button shows the version, release date and the list of changes.
• A copy of the program and settings is created before the update.
• The update is unavailable while background tasks run; they can be stopped.
• From the terminal: the same install command in update mode, or bash update.sh from an extracted archive.

Important. Make fresh backups of websites and databases before updating.

Feedback

A message to the ITRUPANEL developer.

How it works

The form sends the message over a secure connection to itrupanel.com. Questions and discussions also go on in the community forum.

Features

• A description of a problem or a suggestion.
• A reply can arrive at the e-mail you give.
• Forum: itrupanel.com/forum/.