AdminServer Documentation
A complete, plain guide to every part of the panel — for the administrator who runs the server, and for the account owner who runs one site on it.
What AdminServer is
AdminServer is a hosting control panel for AlmaLinux, Rocky and RHEL (9 & 10). It turns one server into a place where several websites live side by side, each isolated from the others, and gives you a browser page to manage all of it — no SSH required for everyday work.
Two kinds of user
- Administrator — runs the whole server: creates accounts, installs PHP and Node.js versions, hardens security, manages DNS and mail, takes backups, and watches the system.
- Account owner — manages their own account only: their websites, files, databases, mailboxes and backups. They never see other accounts or the server's internals.
How the screen is laid out
- Top bar — language toggle, light/dark mode, notifications, server-health badge, and the server's host name.
- Side menu (left) — the sections you are allowed to open, grouped by purpose. For an open account it also lists its sites, and under each site its pages and sub-domains.
- Breadcrumb (top of the page) — shows where you are and lets you step back up.
Signing in & the top bar
After install, the panel prints a one-time password and a URL like https://SERVER_IP:8443. Open it, sign in, and change the initial password when asked — the panel refuses to do anything else until you do.
If you ever forget it, run on the server: sudo adminserver reset-password.
The top bar, left to right
- Language — switch the whole panel between English and Arabic at any time.
- Light / dark mode — the moon/sun button; your choice is remembered.
- Notifications — the bell, with a red count of unread items.
- Server health — a percentage badge (admin only); click it for the Security Center.
- Host name — the server this panel runs on.
Home — server dashboard Admin
The administrator's home page is the server at a glance: an overall health percentage, CPU / memory / disk use, how many accounts and sites are hosted, and a short list of anything that needs attention. An account owner's home is their own account instead, with their sites and disk usage.
Security Center Admin
The heart of the panel. It runs more than 28 checks on how the server is hardened — the firewall, SELinux, SSH, kernel settings, service isolation, and more. Each check is one row:
- A green / red dot tells you if it passes.
- An explanation in plain words: what it is and why it matters.
- A Fix button that applies the correct setting in one click.
- A safe rollback — if a fix ever causes trouble, you can undo it.
SSH Keys Admin
Manage the public keys that may log into the server over SSH as root. Add your key here so password SSH can be turned off (the Security Center recommends it), leaving key-only access.
Accounts Admin
An account is one customer or project. Each account is a real Linux user with its own home, its own process slice, its own disk quota — fully walled off from the others.
List Accounts
Every account with its site count and disk use. Open one to see its websites, reset its password, or delete it.
Create Account
Pick a name (lowercase letters and digits). The panel creates the Linux user, its home, its slice and quota, and gives you a one-time password to hand over.
Resources & limits
Each account has a Resources page showing live CPU, memory and disk use. The administrator can cap an account here (CPU share, memory, number of processes, disk quota) so one account can never starve the rest. Owners see their usage but not the limits card.
PHP Versions Admin
Install several PHP versions side by side (e.g. 8.1, 8.2, 8.3). They are installed once, centrally and read-only; each site then picks the one it runs on. This page shows each version, how many sites use it, which are past end-of-life, and lets you install or remove one and manage its extensions.
Node.js Versions Admin
Exactly like PHP, but for Node.js. Install the majors you want to offer (e.g. 20, 22, 24); the panel downloads the official release, checks its checksum, and stores it read-only. A site or sub-domain that runs as a Node app then chooses one of these.
DNS Admin
If you want the server to answer DNS for its domains, set the server's name servers here (ns1…, ns2…). Once set, each site gets a DNS tab where its zone and records are managed on this server directly.
Mail Admin
Turn on mail hosting for the server (Postfix + Dovecot, with anti-spoofing). This sets the mail host name once; afterwards each site can enable mail and create mailboxes from its own Mail tab.
Monitoring Admin
Every active session: who is signed in, from which address and country. You can sign a suspicious session out. All of it is kept locally — no external service ever sees it.
Activity Log Admin
A record of every sign-in and every command the panel ran — with the user, address and time. Use it to see exactly what happened and when.
Network Admin
The server's network traffic over time, so you can see spikes and which hosts are busiest.
Settings Admin
Panel-wide preferences: for example, lock each session to the address it was created at (so a stolen cookie is useless elsewhere), and other safety options. Account owners have their own smaller settings (password, notifications).
Billing & Plans Admin
The business side, when you use it: the plans you offer, who owes what (orders & invoices), and requests to join. An owner sees only their own plan and invoices under Billing.
Sites & their tabs
A site is one domain (e.g. example.com). Add one from inside an account; its files live in the account's home. Open a site and it unfolds in the side menu into a set of tabs. The tabs shown depend on the site's type: a PHP site shows the PHP tab, a Node site shows the Node tab.
Overview
The site at a glance: SSL certificate status, whether DNS points to this server, the site type, and the number of databases. Here you also:
- Choose the site type — PHP or Node.js. Picking PHP stops any Node app; picking Node hands every request to your Node process.
- Choose the web server for a PHP site — nginx alone, or Apache behind it (for
.htaccess). - See and fix any issues (missing certificate, DNS not pointing here) in one click.
- Remove the site (its files stay in the account's home).
File Manager
A full file manager for the site's folder: browse, upload by drag-and-drop, create, rename, move, delete, and extract archives. A built-in code editor (Monaco) opens text files for editing. Everything runs as the account's own user, so permissions stay correct.
Sub-domains
Host names under the site (e.g. blog.example.com), each served from a folder inside the site and each with its own certificate. Create one with just a name; it gets a folder automatically. Each row shows its type and has an Overview button that opens the sub-domain as its own small site (see below), and a Remove button.
PHP Configuration
For a PHP site. Three parts:
- Version — pick which installed PHP version this site runs on; the change is immediate.
- Extensions — turn on the extensions this site needs, from those the administrator installed.
- Options — adjust the safe
php.inisettings (upload size, memory, time limits…).
Node.js
For a Node site. Enable the app, choose its Node version, the start command (e.g. npm start), the app folder, and any environment variables. The app runs as a long-lived service in the account's slice; nginx forwards every request to it over a private socket (WebSockets included). The page shows whether it is running, its recent logs, and buttons to start / stop / restart it and to run npm install.
Databases
Create a MariaDB database for the site, each with its own user. The panel shows the connection details and a one-time password, resets a password, opens phpMyAdmin for one database, or deletes a database. Delete a database before removing its site so its data is never lost by accident.
DNS
If the server runs DNS, this tab manages the site's zone and records (A, AAAA, CNAME, MX, TXT, …). If DNS is managed elsewhere, the panel still shows exactly which records to add there.
Enable mail for the domain, create and delete mailboxes, change their passwords, and read the exact DNS records (SPF, DKIM, MX…) the mail needs — with one click to publish them if the zone is on this server. Connection details for any mail client are shown, and webmail if it is set up.
Traffic
The site's visitors and requests over time (hour, day, week…), with a breakdown by host. Each account has a wider traffic view too.
Terminal
A web terminal that runs as the account's own user, inside an isolated session — handy for composer, git, or quick commands without full SSH access. It can never reach another account or the system.
A sub-domain as its own site
Each sub-domain is a small site in its own right. It appears in the side menu under its parent, and opening it (or its Overview button) gives it its own pages:
- Overview — its type, SSL, DNS, folder, issues and removal.
- Files — jumps to its own folder in the file manager.
- PHP or Node — its own PHP version, or its own Node app, independent of the parent site.
It keeps all of this while living inside the parent account's user and slice, so it never crosses the account's isolation.
Backups Everyone
Take a backup of an account, and send it off the server so a lost server is never a lost backup. Add a destination — MEGA or any S3-compatible storage (Backblaze B2, Wasabi, Cloudflare R2) — test it, then create backups and restore from them in a click.
Updating the panel Admin
The panel checks an official channel for new versions. When one is available, a banner offers to update. The update is verified twice — its checksum and a cryptographic signature — and refused if either fails, so only a genuine build from the real publisher is ever installed. The panel installs it and restarts itself; your sites keep running.
How your data is kept safe
- Privilege separation — a small privileged helper does the real work; the web face has no powers of its own and only asks for named operations.
- Per-account isolation — a Linux user and slice per account, with CPU, memory, process and disk limits, enforced by SELinux. An attacker inside one site never reaches another.
- Verified updates — every update is checksum- and signature-checked before it is installed.
- Local records — sign-ins and commands are logged on the server itself; no external service is involved.