Open-core · Ubuntu 22.04 / 24.04 / 26.04 · Debian 12 · v1.1.0

Hosting control panel you run on your own VPS.

Qadbak replaces cPanel-style workflows on your VPS: sites, mail, DNS, TLS, databases, local backups, a curated app store, and operator security tools. Customer site data stays on your hardware. Manage from the browser, the iOS app (TestFlight beta), or attach existing Linux servers with HestiaCP, Coolify, or CasaOS through the agent.

Panel license: install on your VPS to manage hosting. Premium (from €2.50/mo) when you need separate client logins, built-in webmail, offsite backups (S3 / B2 / GCS), and white-label.

Try live demo Premium from €2.50/mo View source

LicensePanel use on your VPS · paid Premium modules
Stacknginx · Postfix · Dovecot · BIND · MariaDB
MobileQadbak panel (full) · Linux agent + OSS panels (read-only link)
ActivateLicense key in panel · under one minute

What’s new

iOS app (beta): full panel control on your Qadbak install; Linux agent for metrics, Docker, logs, reboot; link HestiaCP, Coolify, or CasaOS for read-only site/app lists
Ubuntu LTS upgrade: 22.04→24.04 or 24.04→26.04 from Admin → Updates (Premium)
Media: Jellyfin one-click, domain media library, HTML5 quick player
Linux installs: native stack on Debian 12 + Ubuntu 26.04; panel-only on any Linux + Node 20+
Live demo: demo.qadbak.com (read-only panel tour)
Site tools: deliverability, Git deploy, staging, analytics, support tickets
Newsletter: subscribers, campaigns, open/click tracking, GDPR export
App store: 25 one-click apps (CMS, shops, wiki, forums, Jellyfin, gallery, helpdesk)
REST API v1 + scoped API keys (WHMCS / Blesta starters)
Local backups + restore wizard (offsite upload → Premium)
ModSecurity WAF, ClamAV, fail2ban, metrics & alert webhooks

Platform

Day-to-day hosting operations

Core features ship in the public repository. Install once on a fresh VPS and manage everything from the browser as the panel administrator. Scoped client logins (RBAC) are a Premium module. The free tier is built for a single operator or internal team, not a full reseller panel.

Domains & TLS

Sites, subdomains, aliases, redirects, reverse proxies. Let’s Encrypt with renewal status per host.

Mail & newsletter

Mailboxes, SPF/DKIM/DMARC, delivery logs, plus built-in newsletters, subscribers, campaigns, tracking pixel, and GDPR export.

DNS

BIND9 records with a registrar checklist so clients know what to paste at their provider.

Databases & PHP

MariaDB users per site, phpMyAdmin shortcut, PHP version and pool settings per unix user.

Files & shell

File manager and terminal as the domain user, not shared root access.

Backups

Downloadable archives: site files, maildirs, panel config, DNS zone, certificates, crontab. Offsite upload to S3, B2, or GCS is Premium; local backup/restore is in core.

Security

Per-domain ModSecurity WAF, ClamAV malware scans, host firewall rules, fail2ban, plus domain security tab and journal entries.

Runtimes

Node, Python, and Docker compose helpers beside PHP-FPM, one pool per customer unix user (Ghost uses Node 18+).

Media library

Jellyfin one-click (Docker on media.domain), upload folder per domain, disk usage, and an in-panel HTML5 player for MP4/WebM, no extra app required for quick streams.

App store

25 installable apps with search, categories, and one-click flow, Server admin → App store or per-domain Apps tab.

Trust & privacy

TOTP two-factor login, local activity log with retention, privacy report export, no third-party analytics on the panel.

Mobile app (beta)

Native iOS client for iPhone and iPad, domains, DNS, mail, SSL, backups, Qmail, files, terminal, and panel updates against your panel URL.

Live demo

See the panel before you install

Open demo.qadbak.com for a read-only tour of the real Qadbak UI, domains, mail, newsletters, Site tools, app store, and server admin. Credentials are prefilled on the login page. Changes are blocked so the demo stays stable for everyone.

What you can explore

Dashboard, domain DNS/SSL/files, mail accounts & newsletter, Site tools, Media library, backups UI, security, and Premium-gated screens (visible to demo admin).

Run your own copy

Clone the repo, run the installer on Ubuntu 22.04/24.04/26.04 or Debian 12, or use panel-only on any Linux with Node 20+. Enable the demo host with sudo bash scripts/apply-demo-vhost.sh, see docs/DEMO.md on GitHub.

Open live demo Install guide

iOS app

Two ways to use the app

The Qadbak iOS app (TestFlight, iOS 17+) connects directly to your infrastructure. Nothing routes through our cloud except Premium license checks on the panel itself. Tokens live in the iOS Keychain.

Qadbak panel — full control

Point the app at your panel URL (HTTPS required). Same work as the browser: domains, DNS, mail, TLS, backups, Qmail (Premium), files, terminal, widgets, and package updates. This is the complete experience.

Linux agent — existing servers

Already run HestiaCP, Coolify, or CasaOS on Debian 12 / Ubuntu 22.04 / 24.04? Add the server over SSH from the app. The agent handles CPU, memory, systemd services, Docker, logs, apt updates, reboot, and shutdown. Link the detected panel with an API token to see users, domains, or applications — read-only for now.

Supported open-source panels (agent link)

HestiaCP — admin login or access key; user and domain counts
Coolify — API token; projects and applications
CasaOS — login or token; installed apps

Plesk and DirectAdmin are detected but not linked yet. The agent does not replace these panels — it gives you a phone-friendly ops layer beside them.

Get the beta

Built by Inveil alongside the open panel repo. Source and API notes: docs/MOBILE-IOS-APP.md and docs/ios/EXTERNAL_SERVERS.md on GitHub.

Email [email protected] for a TestFlight invite. You need port 9443 reachable from your phone for agent servers (or use a VPN).

Request TestFlight Panel linking docs

App store

25 apps you can install today

Real installers on your VPS, not placeholders. Browse by category in Server admin → App store, or pick an app on any domain’s Apps tab. MySQL is created when needed; every install is journaled.

Scope: 25 maintained apps (CMS, shops, collaboration, education, media, support). Not a Softaculous-scale catalog of hundreds of scripts. We add installers after they pass on real Ubuntu VPS installs; use SSH or your own scripts for anything else.

installable apps

WordPress

CMS

Latest · auto wp-config

Joomla 5

CMS

Full package · PHP 8.1+

Drupal 10

CMS

Composer project

Grav

CMS

Flat-file · no database

MediaWiki

CMS

Wiki / knowledge base

Ghost

CMS

Node 18+ · newsletter blog

PrestaShop 8

E-commerce

Web shop installer

OpenCart 3

E-commerce

Classic PHP storefront

Nextcloud

Collaboration

Files & calendar

Kanboard

Collaboration

Kanban boards

Moodle

Education

Courses & quizzes

phpBB

Forums

Community forums

Matomo

Analytics

Self-hosted stats

LimeSurvey

Surveys

Forms & feedback

phpMyAdmin

Tools

MySQL web UI

Adminer

Tools

Single-file DB manager

Roundcube

Collaboration

IMAP webmail client

DokuWiki

CMS

Flat-file wiki

Piwigo

Media

Photo gallery

MyBB

Forums

Community forum

BookStack

Collaboration

Docs & knowledge base

Firefly III

Finance

Budgeting & expenses

osTicket

Support

Helpdesk tickets

Jellyfin

Media

Movie/TV server · Docker

ProcessWire

CMS

Flexible field-based CMS

Catalog lives in data/app-catalog.json, add apps with a shell installer in scripts/lib/.

Security & privacy

Operator controls without shipping data to us

Customer sites and mail stay on your hardware. The panel adds practical safeguards for admins and optional license heartbeat only (see privacy policy).

TOTP two-factor login

Admins enable authenticator apps under Account → Security or Server admin → 2FA. Password login then asks for a one-time code.

Activity log

Server admin → Activity log: sign-ins, API actions, and config changes with configurable retention on disk.

Privacy center

Outbound connections table, privacy report download, audit export, and trim tools, built for GDPR-minded hosts.

Install fingerprint

Each VPS gets a stable qb-… tag on license heartbeat (not customer PII), auto-provisioned on install and update.

WAF & malware

Toggle ModSecurity per domain, schedule ClamAV scans, review hits from the domain security tab.

Alerts & metrics

Disk, SSL expiry, and backup health on the status dashboard, email, Slack, or Telegram when thresholds breach.

Integrations

Billing APIs, mobile ops, and panel links

WHMCS and Blesta modules use Bearer tokens against your Qadbak panel. The iOS app adds a separate path: a Linux agent on servers you already operate, with optional read-only links to HestiaCP, Coolify, and CasaOS.

REST API v1

Domains, mail, DNS, SSL, backups, suspend, rate-limited keys with scopes. Admin → API keys.

WHMCS module

Create, terminate, suspend, and unsuspend accounts against your panel origin, see docs/integrations/WHMCS-INTEGRATION.md on GitHub.

iOS + Linux agent

Install qadbak-agent over SSH from the app. Metrics, services, Docker, logs, updates, reboot. Link HestiaCP, Coolify, or CasaOS with a local API token — credentials stay on the server.

Monitoring

Metrics history on the status dashboard plus alert rules (email, Slack, Telegram webhooks).

Operator tools

Built for people who run the server

Action journal

Each change records the commands and config files touched, readable audit trail, not raw syslog hunting.

Undo (selected actions)

Reverse mailbox and DNS record changes from the UI when safety checks pass (24h window).

Health overview

Disk, memory, certificate expiry, and service status in one place with suggested fix commands.

App store admin

Browse featured apps, requirements (PHP, DB, Node), and install paths, same catalog on every domain’s Apps tab.

Install journal

App installs show progress, post-install checklist, and rollback hints when an installer leaves partial files.

Website health

Public probe plus origin checks, hints for Cloudflare 502/523 and one-click repair on the server.

Ubuntu LTS upgrades

Premium: move 22.04→24.04 or 24.04→26.04 from Admin → Updates, preflight, background job log, stack repair, reboot.

Multi-tenant hosting business

Premium is a Stripe subscription (monthly through 3-year). You get a QAD-… key by email, activate once in the panel, and renewals extend access automatically until you cancel. Without Premium you still run hosting as one admin; you do not get per-customer panel accounts, built-in webmail, or offsite backup credentials.

Module	Core (free)	Premium
Admin + single operator	Included	–
Client logins & RBAC	–	Premium
Per-client vhosts & PHP-FPM pools	–	Premium
Webmail UI	–	Premium
White-label (logo, colours, panel URL)	–	Premium
License slot management / VPS moves	–	Premium
In-panel admin updates + Ubuntu LTS upgrade	–	Premium
Offsite backup credentials (S3 / B2 / GCS)	–	Premium
REST API v1 + billing modules (included with panel)	Included	–
App store (25 one-click apps)	Included	–
TOTP 2FA, activity log, privacy center	Included	–

Pricing

Subscriptions (EUR)

50 domains · 1 VPS per license · full Premium. All plans renew via Stripe until you cancel. 14-day refund if the key was never activated.

1 month

€2^.50

per month · cancel anytime

All Premium modules

3 months

€7^.45

every 3 months

All Premium modules

6 months

€10^.50

every 6 months

All Premium modules

1 year

€20

per year

All Premium modules

Best value

3 years

€55

every 3 years

All Premium modules

Compare

Typical alternatives

	Qadbak	cPanel	Plesk	HestiaCP
Entry price	€2.50 / month license	~€35/mo	~€15/mo	Free
Self-host panel	Licensed panel use	No	No	GPL
EU vendor	NL	US	EU+US	EU
Client + admin UI	Native	WHM + cPanel	Yes	Yes
Full backup export	Yes	Add-ons	Add-ons	Basic
Action journal + undo	Mail, DNS	No	Limited	No
App store (one-click)	25 curated apps + Jellyfin	Softaculous (400+)	Catalog	Limited
Native iOS app	Beta (TestFlight)	No	Limited	No
Admin 2FA + privacy report	TOTP + local log	Add-ons	Varies	No

Install

Three steps

VPS + DNS

Debian-based Linux VPS (Debian 12 or Ubuntu 22.04/24.04/26.04 LTS), 1 GB+ RAM. Point your panel hostname A-record to the server. Panel-only UI: any Linux with Node 20+.

Installer

sudo bash install/qadbak-install.sh (full stack) or install/qadbak-install-panel.sh (UI only). Pin a release: git checkout v1.1.0.

Premium (optional)

Server admin → License → paste QAD-… key → Activate.

Install the core for free. Subscribe to Premium when you need it.

Plans from €2.50/month · €55 every 3 years. Cancel in Stripe anytime.

Questions: [email protected]

View plans GitHub

FAQ

Common questions

Is there an iOS app?

Yes. TestFlight build for iOS 17+. Path 1: your own Qadbak panel over HTTPS — domains, mail, terminal, the lot. Path 2: Linux agent on an existing VPS (SSH setup from the app) with optional links to HestiaCP, Coolify, or CasaOS for read-only panel data. Request access: [email protected]. Docs: MOBILE-IOS-APP.md, PANEL-LINKING.md.

Can the iOS app manage my HestiaCP or Coolify server?

Partly. Install the Qadbak Linux agent on the same machine (Debian 12 or Ubuntu 22.04/24.04). You get system metrics, services, Docker, logs, and reboot from the app. Then link HestiaCP, Coolify, or CasaOS with an API token stored on the server — today that shows users, domains, or apps without changing panel settings. Full domain/mail control still means running the Qadbak panel or using the panel’s own UI.

Is there a live demo?

Yes. demo.qadbak.com runs the real panel in read-only mode. Use the prefilled demo login to browse domains, mail, newsletters, Site tools, and server admin. To make changes, install Qadbak on your own VPS.

Do I need a license to try Qadbak?

No. Clone the repo, run the installer, and use core features without payment. Premium unlocks client logins (RBAC), built-in webmail, offsite backups, white-label, and related modules.

Can customers log in on the free core?

Not as separate panel users. The free tier is meant for one administrator (you or your team) managing all domains. To give each customer their own login, scoped domain access, and optional panel.domain URL, activate Premium (multi-tenant-clients and client-rbac).

Why only 25 apps, not like Softaculous?

Softaculous bundles hundreds of third-party installers; Qadbak ships a growing, tested set of 25 apps (WordPress, Joomla, Drupal, Nextcloud, Moodle, Roundcube, BookStack, Piwigo, Jellyfin, osTicket, Firefly III, shops, wikis, forums, surveys, phpMyAdmin, Adminer, …) with real shell installers and journal/rollback on your VPS. That keeps support predictable. Need more? Install manually via SSH, Docker, or your own scripts, the panel still handles the site, mail, and TLS around it.

What data leaves my server?

Customer sites, mail, and databases stay on your VPS. With Premium, the panel sends a short license heartbeat to license.inveil.dev, see our privacy policy. The panel also offers optional TOTP two-factor login, a local activity log, and admin privacy controls, all on your hardware.

Moving to a new VPS?

Deactivate on the old panel (or remove the activation in Server admin), then activate on the new server with the same key. One active VPS per license by default.

Is Premium a subscription or a one-time payment?

All plans on license.inveil.dev/buy are Stripe subscriptions (monthly, every 3/6 months, yearly, or every 3 years). There is no lifetime plan. Premium stays active while your subscription is paid; cancel in Stripe to stop renewals.

Which apps can I install with one click?

Twenty-five apps including WordPress, Joomla, Drupal, Nextcloud, Moodle, Roundcube, BookStack, Piwigo, Jellyfin, osTicket, Firefly III, shops, wikis, forums, and more. Open Server admin → App store or Domains → [domain] → Apps. Ghost needs Node 18+; Grav, DokuWiki, and Adminer need no MySQL; Jellyfin uses Docker; most others use a database created by the panel during install.

Cloudflare and panel.domain?

Point panel A-record to your VPS. Use SSL mode Flexible until Let's Encrypt succeeds, then Full. After updates run sudo bash scripts/fix-panel-now.sh on the server, see docs/CLOUDFLARE.md.

Which Linux versions are supported?

Native full stack: Ubuntu 22.04, 24.04, or 26.04 LTS and Debian 12. Panel-only: any Linux with Node.js 20+ (mock demo or hybrid remote API). See LINUX-SUPPORT.md on GitHub.

Can I upgrade Ubuntu from the panel?

Yes. With Premium, native Ubuntu VPS hosts can run an in-place LTS upgrade (22.04→24.04, then 24.04→26.04) from Admin → Updates. Snapshot your VPS first; expect 30–90+ minutes downtime and an automatic reboot. Install pending package updates before starting.

Who maintains Qadbak?

Inveil (Netherlands) builds Qadbak and the iOS app. We run the public panel on our own VPS. About the name.