Before you start
You need a server you can reach over SSH as root, or as a user with full sudo. Nothing else has to be installed first.
| Requirement | Detail |
|---|---|
| Operating system | Debian 12 or 13, or Ubuntu 22.04, 24.04 or 26.04 LTS, freshly installed. The installer checks the release and prints "supported"; on any other Debian or Ubuntu release it warns that the version is untested and continues. |
| Architecture | x86-64 (amd64) or ARM64 (arm64). Anything else stops the installer. |
| Resources | Designed for 1 vCPU, 1 GB RAM and 10 GB disk. 2 GB or more is comfortable once a database engine and PHP are running. With 2 GB of RAM or less the installer adds a 2 GB swap file. |
| Ports | 80, 443 and 8443 must be free. The installer stops if another program holds one of them. Your provider's firewall or security group must allow the same three ports in, plus 22 for SSH. |
| DNS | Not needed to install. You need it later, when you want the panel or a site on a real domain with HTTPS. |
Use a fresh server. The installer configures nginx, PHP-FPM and the database engines itself and does not try to adopt an existing web stack.
Run the installer
Sign in over SSH and run:
curl -fsSL https://aurapanel.net/installer.sh | bash 30 days free · no credit card required
https://aurapanel.net/installer.sh serves the bootstrap script published with every release (the earlier address, aurapanel.goaura.one/installer.sh, still works). It downloads the newest release package from GitHub, verifies its Ed25519 signature and SHA-256 checksum against a key embedded in the script, and refuses to continue if either check fails. It then installs the package and hands over to the main installer.
The main installer shows a checklist of optional components. Pick what this server needs; everything can be added later from the panel's Services screen.
| Component | Default | Source |
|---|---|---|
| nginx (mainline) | always | nginx.org repository |
| PHP-FPM | on, default version 8.4 | deb.sury.org |
| MariaDB | on, 11.8 | mariadb.org repository (10.11, 11.4 or 11.8) |
| PostgreSQL | off, 18 when chosen | apt.postgresql.org (16, 17 or 18) |
| Node.js | off | nodejs.org release tarballs |
| Python 3 | off | distribution packages |
| Redis, Typesense, Docker | off | distribution packages, Typesense release, get.docker.com |
| UFW firewall and fail2ban | on | distribution packages; UFW allows 22, 80, 443 and 8443 |
On a fresh virtual machine the panel is usually answering within a couple of minutes; the optional engines add to that.
Unattended installs
Pass flags after bash -s -- to skip the checklist. Any selection flag switches the installer to non-interactive mode.
curl -fsSL https://aurapanel.net/installer.sh | bash -s -- \
--yes --db=both --node=yes --php=yes --panel-domain=panel.example.com| Flag | Meaning |
|---|---|
--yes | Accept defaults without prompting. |
--port=8443 | Panel port. |
--panel-domain=… | Serve the panel on this hostname with a Let's Encrypt certificate (DNS must already point here). |
--db=mariadb|postgres|both|none | Database engines. --mariadb-version= and --postgres-version= pick releases. |
--php=yes|no, --php-version=8.3,8.4, --php-default=8.4 | PHP-FPM versions (8.1 to 8.5) and the default for new sites. |
--node=yes|no, --node-version=24 | Node.js runtime (18 to 24). |
--python=, --redis=, --typesense=, --docker=, --security= | Each yes or no. --security covers UFW and fail2ban. |
--swap=auto|yes|no | Swap file handling; auto adds 2 GB only when RAM is 2 GB or less. |
--dry-run | Print what would happen without changing the server. |
Every flag also has an environment variable of the form AURAPANEL_PORT, AURAPANEL_PANEL_DOMAIN, AURAPANEL_MARIADB and so on, for cloud-init and provisioning tools.
First sign-in
When it finishes, the installer prints the address to open: https://<server-ip>:8443, or https://<panel-domain> if you set one.
Without a panel domain the panel uses a self-signed certificate, so the browser shows a warning the first time. Accept it; the connection is still encrypted. Setting a panel domain replaces it with a Let's Encrypt certificate.
No password is printed anywhere. The first person to open the panel creates the administrator account, in a four-step setup:
- Administrator account. Name, email address and a password of at least 8 characters. This account has the admin role.
- Server time zone. Preselected from your browser; sets the host's zone so cron schedules and logs read in local time. Panel records stay in UTC. You can skip it.
- Outgoing email (SMTP). Used for panel notifications. Optional.
- Secure the account. Register a passkey, enable TOTP two-factor authentication, or skip for now. See Users, roles and access.
You land on the dashboard with no sites yet. The setup screen never appears again: once one user exists, the setup endpoint is closed.
Put the panel on a domain
- Create an A record (and an AAAA record if the server has IPv6) for a hostname such as
panel.example.com, pointing at the server. - In the panel, open Settings and set the panel domain. Or pass
--panel-domain=at install time. - The panel serves a placeholder certificate at once, requests a Let's Encrypt certificate in the background, and switches over when it is issued.
Clearing the panel domain reverts to https://<server-ip>:8443.
Trial and licence
Every install starts a 30-day trial automatically. It is recorded on the server itself; no account, card or network access is involved. apcli license status shows the days remaining.
To activate, open Licence in the panel and start device activation: the panel shows a short code, you enter it in the customer portal at goaura.one, and the panel picks up its token by itself. On a server without internet access, download the token from the portal and run apcli license activate <file>.
An activated panel checks in with the licensing service once a day. If the service is unreachable it keeps working for a 14-day grace period.
The panel becomes read-only: sites and services keep running, you can still sign in and look at everything, but any change (creating a site, editing settings, running a backup) is refused until a licence is active. Subscribing during or after the trial continues the same install.
To move a licence to another server, use Rebind in the portal. The old server sees the change at its next daily check, or immediately if you press Refresh on its Licence screen.
Update, re-run and uninstall
- Update from Settings → auraPanel Updates, or with
sudo aurapanel-update(--checkonly reports). Every update is signature-verified before it is applied; unsigned builds are refused. See Security and hardening. - Re-running the installer is safe. Same version installed: it makes sure the service is running. Older version installed: it tells you to run the updater instead.
- Uninstall with
sudo aurapanel-uninstall(--keep-databasesleaves MariaDB and PostgreSQL data). This removes the panel, nginx, the runtimes, the site users and their home directories. Take backups first.
Verifying a download by hand
Releases are published to github.com/goaura-one/aurapanel-releases with a SHA256SUMS file and an Ed25519 signature over it. The public key is installed on every host at /opt/aurapanel/share/release-ed25519.pub.
openssl pkeyutl -verify -pubin -inkey /opt/aurapanel/share/release-ed25519.pub \
-rawin -in SHA256SUMS -sigfile SHA256SUMS.sig
sha256sum -c --ignore-missing SHA256SUMSIf something goes wrong
"Run as root (sudo)."
The installer must run as root. Use sudo -i first, or prefix the command with sudo.
The installer stops because port 80, 443 or 8443 is in use
Something else (an existing Apache or nginx, another panel) holds the port. Stop and remove it, or use a fresh server.
The panel address does not load
Check the daemon with apcli status. If it is active, the block is almost always a provider firewall or security group that does not allow 8443 in. UFW on the server already allows it.
The browser warns about the certificate
Expected until a panel domain is set: the panel is using a self-signed certificate for the raw IP address. Set a panel domain to get a Let's Encrypt certificate.
More symptoms are in Troubleshooting.