Installation

Requirements

• A fresh Ubuntu 24.04 LTS server (x86_64 or arm64) with root access. The installer refuses hosts that already run nginx, Postfix, MySQL or Apache sites unless you pass --force; do not run it on a machine you use for anything else.
• At least 2 GB RAM and 20 GB free disk. Rspamd, MariaDB, Apache and PHP-FPM together idle at roughly 1 GB.
• A fully qualified hostname (for example panel.hoster.example) whose A (and, if the server has one, AAAA) record already points to the server. This name becomes the panel URL, the mail server name clients use, and the SFTP host.
• Outbound internet access for apt, the ppa:ondrej/php PPA and Let's Encrypt.
• Ports 22, 25, 80, 443, 465, 587, 993, 995 and 8443 reachable from the internet, plus 2087 for the admin UI (ideally only from your own addresses). The installer configures ufw accordingly.

SSH lockout protection. If your sshd_config already contains AllowUsers, AllowGroups, DenyUsers or DenyGroups, the installer stops. panelOwl installs its own AllowGroups drop-in and sshd ANDs such directives; remove yours first (the installer adds root, every sudo/adm member and the invoking user to the root-access group so nobody gets locked out).

Before you start: DNS

Create these records at your DNS provider before running the installer, so the hostname certificate can be issued immediately:

Set the system hostname too: hostnamectl set-hostname panel.hoster.example.

Getting the release onto the server

Releases are published at https://panelowl.com/releases/ as a signed tarball, minipanel-<version>.tar.gz, next to latest.json (the manifest the update feed reads). On the new server, logged in as a user with sudo:

cd ~
curl -fsSLO https://panelowl.com/releases/latest.json
v=$(python3 -c 'import json; print(json.load(open("latest.json"))["version"])')
curl -fsSLO "https://panelowl.com/releases/minipanel-$v.tar.gz"
curl -fsSLO "https://panelowl.com/releases/minipanel-$v.tar.gz.sha256"
sha256sum -c "minipanel-$v.tar.gz.sha256"

(Or copy the file from wherever you have it with scp minipanel-<version>.tar.gz user@server:.)

Running the installer

On the server, unpack and run the installer as root:

cd ~
tar xzf minipanel-$v.tar.gz
cd minipanel-$v
sudo ./install/install.sh --hostname panel.hoster.example --email admin@hoster.example

The installer shows every setting it is about to use and asks for confirmation (press Enter to accept the value in brackets). Options:

It takes about five minutes and is safe to re-run. What it does, in order:

1. Preflight checks (OS, root, resources, existing services, sshd directives).
2. Adds the PHP PPA with a pinned signing key, installs Apache, PHP-FPM, MariaDB, Postfix, Dovecot, Rspamd, Redis, fail2ban, certbot, ufw and unattended-upgrades (security updates only).
3. Creates the minipanel user, the groups minipanel-sftp, minipanel-ssh, minipanel-nopass and root-access, and the directories under /var/lib/minipanel, /var/log/minipanel, /etc/minipanel.
4. Installs the binaries to /usr/local/lib/minipanel/ (with panelctl linked into /usr/local/sbin/), the systemd units and the version marker.
5. Writes /etc/minipanel/config.toml (hostname, admin email, detected public IPs, PHP versions, default limits).
6. Generates a self-signed bootstrap certificate, then writes the base configuration of every service: default Apache vhosts (unknown hosts get a 404 page, the hostname redirects to the panel), PHP-FPM placeholder pools, MariaDB with secure defaults, Postfix/Dovecot/Rspamd for virtual mailboxes with DKIM, the sshd drop-in, /etc/cron.allow, fail2ban jails, sysctl hardening, logrotate, ufw rules.
7. Starts minipaneld, runs the schema migrations and panelctl rebuild, then requests the hostname certificate from Let's Encrypt.
8. Prints a summary with the panel URL and the DNS/PTR records to verify.

Behind a NAT firewall

panelOwl works fine on a private address behind a firewall that forwards ports (pfSense/OPNsense, a home router, a cloud NAT). Two things to get right:

• Give the installer the forwarded public address with --public-ipv4 (or correct it at the prompt). The value is stored in /etc/minipanel/config.toml as public_ipv4 and can be changed any time (edit, then systemctl restart minipaneld).
• Forward 22, 25, 80, 443, 465, 587, 993, 995 and 8443 to the server. Let's Encrypt validation needs port 80 reachable from the internet.

From inside the same LAN, the public address only works if the firewall does NAT reflection (hairpin); otherwise use the server's LAN address, and add hosts-file entries on your PC to test client sites before their DNS exists.

After installation

Check the server's health and the certificate:

panelctl doctor
panelctl ssl status

Until the hostname certificate is issued, the panel, mail services and default vhost use the self-signed bootstrap certificate; browsers and mail clients will warn. The panel is also reachable by IP address (https://<ip>:8443/) for a first look, with the same warning. Client sites are selected by hostname, so a site opened by IP shows the server's "Site not found" page. The hourly minipanel-ssl.timer retries issuance once DNS is correct; panelctl ssl retry panel.hoster.example forces an attempt.

Create the first client account:

panelctl account create acme --domain example.com --email owner@example.com

This prints the panel URL, the account's generated password (shown once) and the DNS records the client must create. See panelctl reference for all options, and hand the client the Getting started page.

What the installer configures, by service