Qadbak
Domains & TLS
Sites, subdomains, aliases, redirects, reverse proxies. Let’s Encrypt with renewal status per host.
Open-core · Ubuntu 22.04 / 24.04 · Netherlands
Hosting control panel you run on your own VPS.
Qadbak replaces cPanel-style workflows on your VPS: sites, mail, DNS, TLS, databases, local backups, a curated app store, and operator security tools — without sending customer site data to us.
Free core: one administrator runs everything. Premium (from €2.50/mo) when you need separate client logins, built-in webmail, offsite backups (S3 / B2 / GCS), and white-label.
- LicenseApache 2.0 core · paid Premium modules
- Stacknginx · Postfix · Dovecot · BIND · MariaDB
- ActivateLicense key in panel · under one minute
Platform
Day-to-day hosting operations
Core features ship in the public repository. Install once on a fresh VPS and manage everything from the browser as the panel administrator. Scoped client logins (RBAC) are a Premium module — the free tier is built for a single operator or internal team, not a full reseller panel.
Mailboxes, forwarding, SPF/DKIM/DMARC helpers, delivery logs. Per-domain isolation for clients.
DNS
BIND9 records with a registrar checklist so clients know what to paste at their provider.
Databases & PHP
MariaDB users per site, phpMyAdmin shortcut, PHP version and pool settings per unix user.
Files & shell
File manager and terminal as the domain user — not shared root access.
Backups
Downloadable archives: site files, maildirs, panel config, DNS zone, certificates, crontab. Offsite upload to S3, B2, or GCS is Premium; local backup/restore is in core.
Security
Per-domain ModSecurity WAF, ClamAV malware scans, host firewall rules, fail2ban — plus domain security tab and journal entries.
Runtimes
Node, Python, and Docker compose helpers beside PHP-FPM — one pool per customer unix user (Ghost uses Node 18+).
App store
24 installable apps with search, categories, and one-click flow — Server admin → App store or per-domain Apps tab.
Trust & privacy
TOTP two-factor login, local activity log with retention, privacy report export — no third-party analytics on the panel.
App store
24 apps you can install today
Real installers on your VPS — not placeholders. Browse by category in Server admin → App store, or pick an app on any domain’s Apps tab. MySQL is created when needed; every install is journaled.
Scope: 24 maintained apps (CMS, shops, collaboration, education, media, support) — not a Softaculous-scale catalog of hundreds of scripts. We add installers after they pass on real Ubuntu VPS installs; use SSH or your own scripts for anything else.
24
installable apps
11
categories
1-click
DB + files + journal
CMS · E-commerce · Collaboration · Education · Forums · Analytics · Surveys · Tools · Media · Finance · Support
WordPress
CMS
Latest · auto wp-config
Joomla 5
CMS
Full package · PHP 8.1+
Drupal 10
CMS
Composer project
Grav
CMS
Flat-file · no database
MediaWiki
CMS
Wiki / knowledge base
Ghost
CMS
Node 18+ · newsletter blog
PrestaShop 8
E-commerce
Web shop installer
OpenCart 3
E-commerce
Classic PHP storefront
Nextcloud
Collaboration
Files & calendar
Kanboard
Collaboration
Kanban boards
Moodle
Education
Courses & quizzes
phpBB
Forums
Community forums
Matomo
Analytics
Self-hosted stats
LimeSurvey
Surveys
Forms & feedback
phpMyAdmin
Tools
MySQL web UI
Adminer
Tools
Single-file DB manager
Roundcube
Collaboration
IMAP webmail client
DokuWiki
CMS
Flat-file wiki
Piwigo
Media
Photo gallery
MyBB
Forums
Community forum
BookStack
Collaboration
Docs & knowledge base
Firefly III
Finance
Budgeting & expenses
osTicket
Support
Helpdesk tickets
ProcessWire
CMS
Flexible field-based CMS
Catalog lives in data/app-catalog.json — add apps with a shell installer in scripts/lib/.
Security & privacy
Operator controls without shipping data to us
Customer sites and mail stay on your hardware. The panel adds practical safeguards for admins and optional license heartbeat only (see privacy policy).
TOTP two-factor login
Admins enable authenticator apps under Account → Security or Server admin → 2FA. Password login then asks for a one-time code.
Activity log
Server admin → Activity log: sign-ins, API actions, and config changes with configurable retention on disk.
Privacy center
Outbound connections table, privacy report download, audit export, and trim tools — built for GDPR-minded hosts.
Install fingerprint
Each VPS gets a stable qb-… tag on license heartbeat (not customer PII) — auto-provisioned on install and update.
WAF & malware
Toggle ModSecurity per domain, schedule ClamAV scans, review hits from the domain security tab.
Alerts & metrics
Disk, SSL expiry, and backup health on the status dashboard — email, Slack, or Telegram when thresholds breach.
Integrations
Sell hosting with your existing billing stack
Provision and suspend domains from WHMCS or Blesta using Bearer tokens. OpenAPI spec and integration guides ship in the public repository.
REST API v1
Domains, mail, DNS, SSL, backups, suspend — rate-limited keys with scopes. Admin → API keys.
WHMCS module
Create, terminate, suspend, and unsuspend accounts against your panel origin — see docs/integrations/WHMCS-INTEGRATION.md on GitHub.
Cloudflare-ready panels
panel.customer.com vhosts work with Flexible or Full SSL; repair script fixes post-update 520 errors.
Monitoring
Metrics history on the status dashboard plus alert rules (email, Slack, Telegram webhooks).
Operator tools
Built for people who run the server
Action journal
Each change records the commands and config files touched — readable audit trail, not raw syslog hunting.
Undo (selected actions)
Reverse mailbox and DNS record changes from the UI when safety checks pass (24h window).
Health overview
Disk, memory, certificate expiry, and service status in one place with suggested fix commands.
App store admin
Browse featured apps, requirements (PHP, DB, Node), and install paths — same catalog on every domain’s Apps tab.
Install journal
App installs show progress, post-install checklist, and rollback hints when an installer leaves partial files.
Website health
Public probe plus origin checks — hints for Cloudflare 502/523 and one-click repair on the server.
Pricing
Subscriptions (EUR)
50 domains · 1 VPS per license · full Premium. All plans renew via Stripe until you cancel. 14-day refund if the key was never activated.
Compare
Typical alternatives
| Qadbak | cPanel | Plesk | HestiaCP | |
|---|---|---|---|---|
| Entry price | €2.50 / month license | ~€35/mo | ~€15/mo | Free |
| Open-source core | Apache 2.0 | No | No | GPL |
| EU vendor | NL | US | EU+US | EU |
| Client + admin UI | Native | WHM + cPanel | Yes | Yes |
| Full backup export | Yes | Add-ons | Add-ons | Basic |
| Action journal + undo | Mail, DNS | No | Limited | No |
| App store (one-click) | 24 curated apps | Softaculous (400+) | Catalog | Limited |
| Admin 2FA + privacy report | TOTP + local log | Add-ons | Varies | No |
Install
Three steps
1
VPS + DNS
Ubuntu 22.04 or 24.04, 1 GB+ RAM. Point your panel hostname A-record to the server.
2
Installer
sudo bash install/qadbak-install.sh from the GitHub repo. Stack + panel + TLS.
3
Premium (optional)
Server admin → License → paste QAD-… key → Activate.
Install the core for free. Subscribe to Premium when you need it.
Plans from €2.50/month · €55 every 3 years. Cancel in Stripe anytime.
Questions: [email protected]
FAQ
Common questions
No. Clone the repo, run the installer, and use core features without payment. Premium unlocks client logins (RBAC), built-in webmail, offsite backups, white-label, and related modules.
Not as separate panel users. The free tier is meant for one administrator (you or your team) managing all domains. To give each customer their own login, scoped domain access, and optional panel.domain URL, activate Premium (multi-tenant-clients and client-rbac).
Softaculous bundles hundreds of third-party installers; Qadbak ships a growing, tested set of 24 apps (WordPress, Joomla, Drupal, Nextcloud, Moodle, Roundcube, BookStack, Piwigo, osTicket, Firefly III, shops, wikis, forums, surveys, phpMyAdmin, Adminer, …) with real shell installers and journal/rollback on your VPS. That keeps support predictable. Need more? Install manually via SSH, Docker, or your own scripts — the panel still handles the site, mail, and TLS around it.
Customer sites, mail, and databases stay on your VPS. With Premium, the panel sends a short license heartbeat to license.omiiba.dev — see our privacy policy. The panel also offers optional TOTP two-factor login, a local activity log, and admin privacy controls — all on your hardware.
Deactivate on the old panel (or remove the activation in Server admin), then activate on the new server with the same key. One active VPS per license by default.
All plans on license.omiiba.dev/buy are Stripe subscriptions (monthly, every 3/6 months, yearly, or every 3 years). There is no lifetime plan. Premium stays active while your subscription is paid; cancel in Stripe to stop renewals.
Twenty-four apps including WordPress, Joomla, Drupal, Nextcloud, Moodle, Roundcube, BookStack, Piwigo, osTicket, Firefly III, shops, wikis, forums, and more. Open Server admin → App store or Domains → [domain] → Apps. Ghost needs Node 18+; Grav, DokuWiki, and Adminer need no MySQL; most others use a database created by the panel during install.
Point panel A-record to your VPS. Use SSL mode Flexible until Let's Encrypt succeeds, then Full. After updates run sudo bash scripts/fix-panel-now.sh on the server — see docs/CLOUDFLARE.md.
Omiiba (Netherlands). We run the panel on our own infrastructure. About the name.