Installing on a server

#Before you start

• Supported systems: Ubuntu 22.04 / 24.04 / 26.04, Debian 12 / 13, AlmaLinux / Rocky Linux / RHEL 9 / 10 on x86_64 or ARM64 (aarch64). Memory, disk and network details are on the system requirements page.
• The server must be freshly installed. The installer stops if it finds another hosting control panel, Nginx, Apache or MySQL/MariaDB; --force lets you continue anyway, but existing configuration may be changed.
• The server name must be a fully qualified domain name (FQDN) such as server.example.com. Point an A record for it at the server's IP address; the server's SSL certificate is issued for that name.
• Run the commands as root (or with sudo).

This page covers the native server install. A Docker or Railway install has no mail server, DNS server or FTP; for that route see Docker and Railway.

#One-command install

$ curl -fsSL https://bipanel.io/install.sh | sudo bash -s -- --hostname server.example.com --email [email protected]

The bootstrap script:

1. Reads the operating system from /etc/os-release and checks the CPU architecture, stopping before it installs anything on an unsupported system.
2. Installs any missing tools (curl, tar, sha256sum, python3) with apt on Ubuntu and Debian, or dnf on AlmaLinux, Rocky Linux and RHEL.
3. Looks up the latest release on the selected channel at bipanel.io, downloads the archive and verifies its SHA-256 hash, stopping on a mismatch.
4. Unpacks the archive and runs the bundled deploy/native/install.sh with the options you pass after --.

The whole script is wrapped in a function, so nothing runs if the download is cut short. From a terminal, the installer lists the components it will install and the installation report notice, then asks you to confirm; -y or --yes skips the prompt. Without a terminal (under cloud-init, for example) it does not ask.

The default update channel is stable. To install from another channel, pass BIPANEL_CHANNEL to the bootstrap (lts, stable, release, current or edge); the installed panel keeps taking updates from that channel:

$ curl -fsSL https://bipanel.io/install.sh | sudo BIPANEL_CHANNEL=lts bash -s -- --hostname server.example.com --email [email protected]

The channels are explained on the panel updates page.

#Installing from a downloaded archive

If you would rather not pipe a script straight from the internet, get the release archive from the Download page. The page also shows the SHA-256 hash of the latest release; compare it before unpacking:

$ sha256sum bipanel-*.tar.gz
$ tar -xzf bipanel-*.tar.gz
$ cd bipanel
$ sudo bash deploy/native/install.sh --hostname server.example.com --email [email protected]

On Enterprise Linux (AlmaLinux, Rocky Linux, RHEL) the script must be run from inside the unpacked archive; a copy of install.sh on its own cannot find the distribution layer and stops.

#install.sh options

sudo bash deploy/native/install.sh --help lists every option. With the one-command install, put the options after bash -s --.

Default PHP versions that the distribution's repositories do not offer are skipped with a warning. If none of the versions you pass with --php is available, the install stops.

#What gets installed and configured

#System preparation

The server name is set and added to /etc/hosts. Installed packages are then updated within the same distribution release: no release upgrade, no packages removed, modified configuration files kept. If a new kernel came in, the summary asks you to reboot. --no-upgrade skips this step.

#Web, PHP and database

#Email, DNS and FTP

By default the installer sets up a mail server with Postfix, Dovecot and OpenDKIM, Roundcube webmail, the BIND9 DNS server and Pure-FTPd. Each can be skipped with the --without-… options above.

#Firewall

UFW is configured on Ubuntu and Debian, firewalld on Enterprise Linux. Incoming traffic is blocked by default and these ports are opened:

#Enterprise Linux specifics

The EPEL and CRB repositories are enabled. SELinux stays in enforcing mode: the installer defines the booleans, panel ports and account directory file contexts the panel needs. If SELinux is disabled, the rules are still stored and take effect once it is enabled. chronyd is installed for time sync. If /home is on XFS and mounted without a quota option, the installer tells you what to do; quotas can be turned on with the disk quota component under Server Admin → System → Components.

#Default add-on components

Components such as automatic security updates, the jailed shell, the bipanel command-line tool, WP-CLI, GoAccess, log rotation, kernel link protections, and cron and SSH session limits are installed as well. A component that fails does not stop the install; retry it from Server Admin → System → Components. Others, such as PostgreSQL, Rspamd, ClamAV and Redis, are not installed by default and can be added from the same screen.

Finally the panel is installed under /opt/bipanel and started as the bipanel systemd service.

#Admin credentials and first login

When the install finishes, a summary is printed and saved to /root/bipanel-kurulum.txt, which only root can read:

The password and the other settings are also kept in /etc/bipanel/bipanel.env (mode 600). On first login your browser warns about the self-signed certificate. Then:

1. Issue a Let's Encrypt certificate for the server name under Server Admin → SSL & AutoSSL.
2. If you will run your own name servers, create glue records at your domain registrar and enter the name servers under Server Admin → Basic Setup.
3. Change the admin password and turn on two-factor authentication.

Without a license key the panel runs as the Community edition with up to 3 hosting accounts. You activate a Pro license under Server Admin → System → License; see licensing for details and pricing for the editions. Carry on with first steps.

#Installation report

Every installation sends a short report to bipanel.io about every 2 hours for vulnerability matching: bipanel version and edition, update channel, operating system, architecture and kernel version, server name, counts of accounts, domains and resellers, installed package and component versions, and, once a license is entered, the first 8 characters of the license key and the server fingerprint. Customer data, email contents, passwords, file contents and databases are never sent. The report is on in both Community and Pro and cannot be turned off; everything it sends is shown under Server Admin → System → Installation Report.

#Duration, log and re-running

The install usually takes 10–20 minutes, depending on the server and its network. All output goes to /var/log/bipanel-install.log (root only). If the panel does not respond within 60 seconds, the installer warns you; check the service log with:

$ journalctl -u bipanel -n 100

The installer is safe to run again:

• If /etc/bipanel/bipanel.env exists, it runs in update/repair mode and keeps the existing passwords and channel.
• If an earlier install stopped halfway (the log file exists but the environment file does not), just run the same command again; the clean-server check does not trip over packages the earlier attempt installed, so --force is not needed.

If something goes wrong, see troubleshooting.