Site types
Sites → Add site offers six kinds of site. The search box above them lists every application in the catalogue, marked Auto-Install (the panel installs it for you) or Assisted (the panel prepares the site and you complete the application's own installer).
| Type | What runs | Details |
|---|---|---|
| PHP Applications | PHP-FPM pool per site | WordPress, Moodle, Drupal, Laravel or any PHP app. PHP and WordPress sites |
| Node.js | Your app as a systemd service | Node.js sites |
| Python | gunicorn as a systemd service | Python sites |
| Static HTML | nginx serving files | A seeded index.html you replace with your build output. |
| Reverse Proxy | nginx proxying to an upstream URL | For services you run yourself. WebSockets are passed through. |
| Docker Compose | A container stack behind nginx | Administrators only. Docker Compose sites |
Create a site
- Point the domain's DNS at the server first if you want HTTPS straight away: an A record (and AAAA for IPv6) for
example.com. If Cloudflare proxies the domain, read HTTPS certificates before continuing. - Open Sites → Add site, choose a type or search for an application.
- Enter the domain. It must contain a dot and may use letters, digits, hyphens and dots.
- Fill in the type-specific fields: PHP version for PHP; Node version, app port and supervisor (systemd or PM2) for Node.js; app port and module for Python; upstream URL for a reverse proxy; image or compose file for Docker. Auto-install applications also ask for a site title, database engine and administrator credentials.
- Check the site user. It is derived from the domain (every label except the last, joined with hyphens, 30 characters at most), and you can change it. A site password is generated for SFTP.
- Create. The panel provisions the site and then requests a certificate in the background.
The site appears in the list as Online with a placeholder certificate. Within about a minute of DNS pointing at the server the padlock is real; the site's overview shows the certificate state and any issuance error.
What a site is on the server
Every site is its own Linux user, so one compromised application cannot read another's files. Creation happens in a fixed order: user, directories, log rotation, placeholder certificate, runtime (a PHP-FPM pool, or a port and a systemd unit), then the nginx server block, which is tested with nginx -t before it is enabled and reloaded once.
| Path | Purpose |
|---|---|
/home/<user>/htdocs/<domain>/ | Document root (your files). Owned by the site user. |
/home/<user>/logs/access.log, error.log | nginx logs for this site, rotated. Logs and monitoring |
/etc/nginx/sites-available/<domain>.conf | The server block. Managed by the panel; hand edits are overwritten on the next render. |
/etc/php/<ver>/fpm/pool.d/ | The site's PHP-FPM pool (PHP sites). |
aurapanel-site-<domain>.service | The systemd unit (Node.js, Python and Docker sites). |
/etc/aurapanel/ssl/<domain>.crt, .key | Certificate and key. |
Every server block gets HSTS, X-Content-Type-Options, X-Frame-Options, hidden nginx version, an ACME challenge location, and a rule that denies access to any *.log file under the document root.
To serve from a subdirectory of the document root (Laravel's public/, Moodle 5's public/), set Settings → General → Document root. It must stay inside the site's home directory.
Upload files
- File Browser tab: upload (large files are chunked), download, rename, move, copy, edit text files, change permissions, zip and unzip.
- SSH/FTP Users tab: create accounts that are either SFTP only (jailed to the site's home) or SSH + SFTP (a real shell as the site user), with a password, public keys, or both. A generated password is shown once.
- Anything else that writes as the site user works too:
rsync,git, a CI job over SSH.
Per-site controls
Security tab
- Force HTTPS redirect: on for new sites; it has no effect until a certificate exists.
- Basic authentication: a username and password in front of the whole site. Stored bcrypt-hashed in
/etc/aurapanel/htpasswd/<domain>. Leaving the password blank keeps the existing one. - Cloudflare: an API token for DNS-01 certificates and the edge shield. HTTPS certificates, Security and hardening.
Cron
Under Maintenance → Cron, add a schedule and a command. Jobs run as the site user, in the site's time zone, and are written to that user's crontab under a managed header. Schedule and command are both required; the schedule is validated as a cron expression.
Redirects
The Redirection screen redirects a hostname, or a path, to a site on this server with a 301 or 302. Each redirected hostname gets its own server block and certificate, so old-domain.com can redirect to a site over HTTPS. Redirects are removed with the site they point at.
From the command line
apcli site list
apcli site create example.com --type php --php 8.4
apcli site create api.example.com --type reverseproxy --upstream http://127.0.0.1:3001
apcli site upstream api.example.com # show the upstream
apcli site delete example.comThe system user is derived the same way as in the form when --user is omitted. The full reference is on the documentation index.
Delete a site
Deleting a site removes its server block, runtime unit or pool, databases, redirects, Linux user and home directory. After teardown the panel runs any executable in /etc/aurapanel/hooks.d/site-delete/ with AURAPANEL_DOMAIN, AURAPANEL_SITE_USER and AURAPANEL_DOCROOT in the environment, which is how out-of-panel services clean up after themselves. Take a backup first if you may want the content back.
Common messages
"a site for … already exists — choose a different domain"
Each domain can be one site. Delete the old site or use a subdomain.
"port … is already used by … — choose a different port"
Node.js, Python and Docker sites each bind a loopback port. Pick a free one; the panel suggests the next free port by default.
"No PHP runtime is installed on this server" (or the Node.js / Python equivalent)
Install the runtime under Services first (PHP Runtimes, Node Versions, or Packages for Python 3), then create the site.
"upstream must be a public address; loopback, link-local and private ranges are not allowed"
Only administrators may point a reverse proxy at a loopback or private address. Sign in as an administrator, or expose the service on a public address.