Troubleshooting common problems

Most problems are diagnosed with a few commands: the panel runs as the systemd unit bipanel and its log is read with journalctl -u bipanel, the admin password can be reset with sudo bipanel admin reset-password even while the panel is down, and the status and logs of the other services are on Server Admin → Services.

#The panel cannot be reached

On a server installation Server Admin is at https://your-hostname:2087/admin and the user panel at https://your-hostname:2083. A browser warning on the first login is expected: the panel uses a self-signed certificate until you get a Let's Encrypt certificate for the hostname (Server Admin → SSL & AutoSSL).

First check that the panel service is running. Internally the panel listens on 127.0.0.1:2080 and answers on /api/health:

$ sudo systemctl status bipanel
$ sudo journalctl -u bipanel -n 100 --no-pager
$ curl -fsS http://127.0.0.1:2080/api/health

If the service is running but the browser cannot open it, the problem is most likely on the network side:

Firewall: The installer opens TCP ports 2082–2083 and 2086–2087 in UFW (Debian/Ubuntu) or firewalld (AlmaLinux/Rocky/RHEL). These ports must also be open in your provider's cloud firewall.
Your IP address is banned: If you locked yourself out, these commands work from the server console, even while the panel is down:

Command	What it does
`sudo bipanel firewall allow-ip ADDRESS`	Opens all ports to your address (an allow rule at the top in UFW, the "trusted" zone in firewalld)
`sudo bipanel firewall off`	Turns the firewall off at once; turn it back on from the Firewall screen
`sudo bipanel ddos unban ADDRESS`	Lifts the DDoS and attack detection ban on the address
`sudo bipanel crowdsec unban ADDRESS`	Lifts CrowdSec and Fail2Ban bans
`sudo bipanel geoip off`	Removes server-wide country blocking

The full list of commands is on the API and CLI page.

#Forgotten admin password

The password is reset by a local command that writes to the panel database directly, so it works while the panel is down. Without a username the first server administrator is used; without --password-stdin a strong password is generated and printed:

$ sudo bipanel admin reset-password
$ sudo bipanel admin reset-password admin --disable-2fa

The reset closes that user's open sessions and lifts all IP bans in the panel; --disable-2fa also turns off two-factor authentication. For hosting accounts only the panel password changes; use bipanel account password for the account's system (SSH/FTP) password. If the CLI token was revoked in the panel or /etc/bipanel/cli.token was deleted, sudo bipanel admin reset-token creates a new one.

#Service status and logs

Server Admin → Services lists services such as Apache, MariaDB, PHP-FPM, mail, FTP and DNS with their status and shows the last 100–1000 lines of each one's log. Services are checked every minute; with monitoring on, a crashed service is restarted automatically. The same works from the command line:

$ sudo bipanel service list
$ sudo bipanel service restart apache

Where	Contents
`journalctl -u bipanel`	Log of the panel service
`/var/log/bipanel-install.log`	Log of the installer
`/root/bipanel-kurulum.txt`	Installation summary: addresses and the first administrator's details
`/var/log/bipanel/`	The panel's log directory: site access logs (`domlogs`), application and update logs
`/var/lib/bipanel/jobs/`	Logs of background jobs (SSL, backups, component installs…); also shown by `sudo bipanel job show JOB-ID --log`

Actions taken in the panel are listed, with who performed them, under System → Activity Log.

#SELinux denials

On AlmaLinux, Rocky Linux and RHEL, SELinux stays in enforcing mode; the panel manages account web root labels, panel ports and the required booleans itself. If a site cannot write files or a service reports access errors, open the SELinux section of Security → Firewall: it shows today's AVC denials (process, permission, target), recent labeling errors and a Relabel button. The Account web roots setting in the same section chooses between the recommended mode, where applications can update themselves, and a strict mode, where only application data directories are writable.

$ sudo bipanel selinux status
$ sudo bipanel selinux relabel
$ sudo bipanel selinux relabel ACCOUNT

There is no need to disable SELinux. Even while it is off, the panel keeps its rules in the policy store and relabels the accounts on its first start after SELinux is turned on.

#Disk quotas are not enforced

Without quotas the panel only monitors disk usage and warns when a package limit is exceeded. Quotas are enabled by the System → Components → Disk quota component:

ext4: usrquota is added to /etc/fstab (the file is backed up and never written without validation) and quotas take effect immediately.
XFS (the AlmaLinux/Rocky/RHEL default): Quotas can only be enabled at mount time, so the uquota option is added for a separate /home partition and a kernel parameter for the root file system. A reboot is required.
btrfs, zfs and others are not supported.

Why quotas are off, and the commands that fix it, are shown on Accounts → Resource Limits.

#Email is not sent or received

Track Delivery (Server Admin → Server) shows whether each message was delivered, deferred or bounced, based on the Postfix log. The mail queue is on the Mail Server screen.
Email → Email Deliverability in the user panel checks the domain's SPF, DKIM and DMARC records.
If your server cannot send directly over port 25, set up a sending provider under SMTP Relay (Server Admin → Server).
Depending on the distribution, the raw log is in /var/log/mail.log (Debian/Ubuntu), in /var/log/maillog (AlmaLinux/Rocky/RHEL) or only in journald.

See the email page for details.

#A certificate cannot be issued

AutoSSL runs every 6 hours and requests Let's Encrypt certificates for domains without a valid certificate. The most common cause of failure is a domain whose DNS does not point to the server: the domain is skipped and the SSL/TLS screen says so. Point the A record to the server's IP address; if a DNS provider that can manage the domain is configured, the panel also tries DNS validation. AutoSSL retries a failed domain after 24 hours; the error details are on the SSL/TLS screen and in the job log. To try again without waiting, name the domain or the hostname:

$ sudo bipanel ssl issue example.com
$ sudo bipanel ssl issue --hostname

See the SSL certificates page for details.

#An update failed

When an update started from the panel does not answer within 90 seconds, the previous installation and the database backup are restored automatically, and the update history shows Rolled back. To investigate:

/var/log/bipanel/update-VERSION.log: the log of the update script
/opt/bipanel.failed: the installation that failed to start
sudo bipanel update status: the latest status

Dependencies are installed on the server with npm, so the server must be able to reach the npm package registry. If the panel does not start at all you can update by hand with update.sh; see panel updates.

#Docker and Railway installations

There is no systemd in the container: logs are in the container output and under /data/logs, job logs under /data/jobs. The command-line tool is included in the image:

$ docker compose logs -f bipanel
$ docker compose exec bipanel bipanel admin reset-password

502 error: The panel has not started yet (the first start can take a few minutes) or memory is short.
Certificates: With Docker Compose, Caddy handles TLS; on Railway the platform does. Caddy only requests certificates for domains registered in the panel, so check that the domain has been added and that its DNS points to the server.
Not available in a container: the mail server, disk quotas, SELinux and the server firewall.
BIPANEL_ADMIN_PASSWORD is only used when the first administrator is created; changing it later does not reset the password.

See the Docker and Railway page for details. If a Pro feature is missing or a fourth account cannot be created (the Community edition allows up to 3 hosting accounts), see the licensing page and pricing.