Introducing ShadowPanel

What is ShadowPanel?

ShadowPanel is a self-hosted web hosting control panel — a modern, self-hosted alternative to cPanel and Plesk built for developers and hosting providers who want full control over their stack.

It runs on a standard Ubuntu 22.04 or 24.04 VPS and installs everything you need in under 10 minutes: Nginx, PHP-FPM, PostgreSQL, MariaDB, Redis, ClamAV, Certbot, BIND9, Postfix, and Dovecot — wired together and managed through a clean React-based dashboard on port 2087.

Why we built it

Existing panels either cost a fortune, lock you into their ecosystem, or ship with legacy UX that hasn't changed in a decade. We wanted something that:

• Installs in minutes, not hours
• Stays out of your way — no bloat, no upsells inside the UI
• Runs securely by default — privilege-separated daemon, Argon2id passwords, JWT with short TTLs, mandatory 2FA for admins
• Supports modern workflows — Git Deploy, Docker, staging environments, automated cloud backups

Core features

Every ShadowPanel installation — even the free tier — includes:

• Multi-site management with per-site PHP-FPM pools and open_basedir isolation
• One-click SSL via Let's Encrypt with automatic 30-day renewal
• File manager with privilege-separated daemon access
• DNS management (BIND9 zones and records)
• MySQL/MariaDB databases per site with dedicated users
• Email accounts via Postfix + Dovecot virtual mailboxes
• Cron jobs, maintenance mode, domain aliases, and redirects

Pro and Agency tiers unlock Git Deploy, Docker, automated cloud backups, 1-click app installer, SEO toolkit, staging environments, and reseller sub-accounts.

Architecture that takes security seriously

The panel runs with strict privilege separation: the API process runs as an unprivileged shadowpanel user and communicates with a root-level daemon over a Unix socket. The daemon exposes a whitelist of typed, Zod-validated commands — no shell string concatenation, no exec() calls.

Every API endpoint is gated by Zod schema validation, rate limiting, and HMAC-verified Redis caching. Admin actions require a second-factor check at login.

Getting started

Install ShadowPanel on a fresh Ubuntu 22.04 or 24.04 VPS in minutes.

Option A — Personal install link (requires a free account):

wget "https://shadowpanel.de/install/<your-token>" -O shadowpanel.zip \
  && unzip -o shadowpanel.zip \
  && tar -xzf shadowpanel-v*.tar.gz \
  && sudo bash shadowpanel-v*/deploy/install.sh

Option B — One-liner:

curl -fsSL https://shadowpanel.de/install.sh | bash

The installer sets everything up and prints your admin credentials at the end. Open https://<your-domain>:2087 to log in.

We ship updates regularly. Follow the changelog to stay up to date, and reach out at support@shadowpanel.de if you run into anything.