I built AdminServer — a lightweight, security-first hosting panel for AlmaLinux/Rocky/RHEL

Description and use

AdminServer is a lightweight hosting control panel for RHEL-family servers that enforces per-account isolation, automates hardening checks, supports per-subdomain runtimes, offers off-server backups, and provides secure signed updates.

Problem

Need a small, fast hosting control panel that enforces isolation and hardening by default, without relying on SSH for everyday tasks.

Outcome

AdminServer delivers a lightweight, security-first hosting panel that isolates each site, automates hardening, supports per-subdomain runtimes, and offers secure updates and backups, all accessible via a browser without SSH.

Workflow

• 1. Install AdminServer with a single command: bash curl -fsSL https://aamrpr.github.io/adminserver-site/install.sh | sudo bash
• 2. Create Linux user accounts; each becomes a systemd slice with CPU, memory, process, and disk limits enforced by SELinux.
• 3. Use the Security Center to run 28+ hardening checks and apply fixes with one click.
• 4. Configure per-account and per-subdomain PHP/Node.js runtimes; runtimes are centrally installed and read-only.
• 5. Set up off-server backups to MEGA or S3-compatible storage.
• 6. Manage files via drag‑and‑drop or Monaco editor, databases with phpMyAdmin, DNS with PowerDNS, mail with Postfix/Dovecot, and obtain Let’s Encrypt certificates.
• 7. Update AdminServer securely using signed packages verified by checksum and Ed25519 signature.

Evidence

I wanted a hosting control panel that was small, fast, and took isolation and hardening seriously by default — not as an afterthought.

Source

Real per-account isolation — each account is its own Linux user and systemd slice, with CPU, memory, process and disk limits, enforced by SELinux.

Source

A Security Center — 28+ hardening checks (firewall, SELinux, SSH, kernel, service isolation…), each explained in plain words and fixable in one click, with a safe rollback.

Source

Off-server backups — to MEGA or any S3-compatible storage (Backblaze B2, Wasabi, Cloudflare R2).

Source

Signed self-update — updates are verified by checksum and an Ed25519 signature before install; a tampered package is refused.

Source