A tour of AlphaPanel — 25 screens, explained

01 / 25

Dashboard

The first screen after sign-in answers "is anything wrong, and what changed?" without a single click. Counts for websites, virtual machines, disk and bandwidth sit above a live health ring for CPU, memory and disk, so a server under strain is obvious from the doorway.

Quick actions for the five things you actually do: new site, new database, new mailbox, file manager, web console
Server environment panel naming the exact PHP, nginx, MariaDB and OS versions in use — no guessing which stack you are on
A /var/www tree so you can see where the disk went without opening a shell

02 / 25

Websites

Every site on the box as a card: its domain, PHP version, HTTPS state, size on disk and when it last changed. Creating one asks where it goes — a new subdomain or a folder inside an existing site — and picks the stack for you.

Static, PHP, WordPress, Laravel, Node, Python and Docker port-proxy stacks, wired into nginx for you
Real per-site storage quotas: a loop-mounted volume, so the site sees its own size and cannot spill into the rest of the disk
Per-site upload caps and download speed limits, with a proper notice page instead of a broken request

03 / 25

File Manager

A real file manager, not a directory listing. Browse, upload by drag and drop, edit in place, compress and extract, with every path jailed to /var/www so a stray click cannot walk into /etc.

Recycle bin with a 30-day auto-purge — a delete is recoverable rather than final
Disk-usage analyser that expands folder by folder to show exactly what filled the disk
Secure share links for files and folders with expiry, password, download caps and view-or-edit permissions

04 / 25

Databases

Create databases and users, watch their size, and open a full SQL client in the browser. The engine catalogue covers MariaDB, MySQL, PostgreSQL, SQLite and more, with install and enable handled for you.

Import and export SQL straight from the panel, using admin credentials held off the webroot
Per-database size, table count, engine and collation at a glance
Backups, performance and user management as tabs on the same screen

05 / 25

Emails Studio

The whole mail stack in one place — accounts, verification and warm-up strategies. On a fresh server it says so plainly and installs Postfix and Dovecot for you rather than pretending mail already works.

Mailboxes, aliases and quotas with DKIM, SPF and DMARC generated for your registrar
Deliverability checks that test your domain against real blocklists
Warm-up strategies that ramp daily send volume so a new IP is not burned on day one

06 / 25

Cron Jobs

Scheduled work, yours and the system's, in one list. The panel shows every job on the box — including the ones it installed itself — with its schedule, command, user and where it came from.

A schedule builder, so nobody has to remember the five-field syntax
Run history, so you can see whether a job actually fired and what it printed
System jobs are labelled by source, which makes an unexplained cron entry immediately traceable

07 / 25

Content

Generates the legal pages every site needs — privacy policy, terms, cookie notice — from what you actually collect, rather than a template you paste and hope about.

Tick the data you collect and the sections are written to match
Governing law, retention periods and third-party processors are all inputs, not placeholders
Publishes straight to a site on the box, with a live preview first

08 / 25

Reports & Analytics

Traffic, bandwidth, errors, geography, devices and browsers — all rebuilt from your own nginx logs. Nothing is sampled, nothing is sent anywhere, and no script is injected into your pages.

Requests over time, bandwidth and requests-by-hour, so peaks are visible
Errors per day with the rate, separating a bad deploy from a bad day
Export to CSV, Excel or PDF for anyone who wants it in a spreadsheet

09 / 25

Notifications

One composer for email, SMS, web push and in-app messages. It shows what each channel is ready to send before you write, then renders the message through the real send path so the preview is the thing that ships.

Campaigns, subscriber lists with import and verification, and per-campaign open and click statistics
Web push with its own service worker and per-browser preview — self-hosted, no Firebase
SMS segment maths as you type, so a message does not silently become three

10 / 25

CI/CD Pipelines

Deploy any site on the box from git. Build, test and deploy run as steps with logs kept per run, and a bad release rolls back to the previous one.

Push-to-deploy webhooks and scheduled deploys, per site
Full output captured per run, so a failure is diagnosable after the fact
Separate environments, so staging and production are not the same button

11 / 25

Web console

A real terminal in the browser for when a screen does not cover it. Sessions are scoped to the web user and every command is written to the audit log.

Runs in the panel, so no SSH key handling on a phone or a borrowed laptop
Copy output in one click for pasting into a ticket
Common commands available as shortcuts

12 / 25

Secrets & Vault

An encrypted key-value store using libsodium, scoped per application and environment, so credentials stop living in config files and chat history.

Reveal, copy and rotate individually — with the rotation recorded in the audit log
Connectors for ten social sign-in providers and the SMS gateways, all reading from the vault
Values are stored off the webroot and never written into the page unless you ask

13 / 25

Login Portal

Designs the public sign-in page your own users see, on its own host — separate from the admin panel, which is never exposed. Pick a layout, set the brand, and watch the preview update.

Three layouts, your accent colour, logo and copy, with light and dark handled
Sign-in, sign-up, recovery and desktop or mobile previews side by side
Social sign-in, account list and security policy on the same screen

14 / 25

Webhooks & Integrations

Outbound webhooks fired from the audit stream, so the events the panel records can reach Slack, Discord or anything that accepts a signed HTTP POST.

Per-endpoint event selection rather than one firehose
Delivery log with response codes, so a silent integration is visible
HMAC-signed payloads for generic endpoints

15 / 25

Global API

A documented REST API on its own host — never the admin host — with scoped bearer tokens, an endpoint explorer and copy-as-curl for every route.

45 endpoints across the panel, each labelled with the credential it accepts
Try-it console that mints, calls and revokes a throwaway token
Request monitoring with per-hour volume, so an integration going wrong is visible

16 / 25

Payment Studio

A visual checkout builder with a live preview. Design the page, choose the gateway, set the fields, and every transaction on the box goes through one ledger.

Branding, corner radius, accent and checkout fields edited with the result rendered beside you
Gateways, plans, invoices, transactions, fraud rules and API keys as tabs on one screen
Order records that a licence, a renewal or a one-off sale all flow through

17 / 25

Add-ons

Add-ons are not bundled into the panel — they arrive through the Marketplace, so what is installed is only ever what you chose and paid for.

Browse, Installed and Marketplace as tabs on one screen
Enable and disable really stops what an add-on runs, with the measured CPU and memory impact shown
Versions live side by side, so an upgrade is undone by removing one folder

18 / 25

Marketplace

What you own, what you can add, and one-click install. Packages are checked against a published SHA-256 and a vendor signature before anything is unpacked.

Owned, installed and purchasable states are distinct — no guessing what a button will do
Ratings and reviews written by other licensed customers
Updates show the exact version jump, and a security release is offered whatever channel you follow

19 / 25

Server Administration

The runtimes underneath, managed rather than described. PHP versions install, enable and switch from here, with a compatibility checker before you move a site.

Multiple PHP versions side by side, each with its own extension set and php.ini editor
Catalogues for databases, cache, web servers, services and the firewall — each with real install and enable
Strengths and weaknesses written out for every alternative, so a swap is an informed choice

20 / 25

Snapshots

Targeted backups: one folder, one site, one database, one VM — or the whole stack. Restores go back to the same place, and retention prunes the rest.

Schedules per target, so a busy database is not tied to a monthly full backup
Off-site push, because a backup on the same disk is not a backup
Restore is a first-class action, not a tarball you unpack by hand

21 / 25

Virtualization

LXD containers and QEMU virtual machines with browser consoles. Launch, size, start and stop from the panel, and open a terminal or a screen without a client.

Per-instance CPU, memory and disk limits that are actually enforced
Browse a stopped VM's disk read-only, to pull a file out of a machine that will not boot
Consoles publishable on their own subdomain behind a token

22 / 25

System Monitoring

Live infrastructure health: CPU, memory, storage and API health as rings, resource usage over time, and the state of every service that matters.

Services listed individually with start, stop and restart
Resource history, so "it was slow an hour ago" is answerable
A single honest line at the bottom: all monitored services operational, or which one is not

23 / 25

Security

Authentication, access control and monitoring on one screen, with a score that reflects what is actually switched on rather than what is available.

Two-factor auth, auto-logout, brute-force lockout, webroot hardening and off-webroot credentials as explicit toggles
Active sessions with device and address, and sign-out for any one of them
Failed login attempts with IP, count and status — and unban in a click

24 / 25

Audit Logs

An append-only record of what was done, by whom, from where. Every write action in the panel lands here, including the ones the panel takes on its own behalf.

Filter by actor, action or target, over any window
Merged with authentication failures, so a break-in attempt sits in the same timeline as the change it preceded
Export to CSV for anyone who has to keep records

25 / 25

System Settings

Platform-wide configuration in one place — branding, domain and hostname, defaults for new sites, backup storage, logging, performance and privacy.

Attach a domain and the panel renames itself, issues certificates and moves everything over
Localisation, timezone and theme, including the accent colour used across the panel
Every section is a real setting the panel reads, not a preferences page that does nothing

Every screen, explained.

What you see first