Public beta · Ubuntu 24.04 LTS · x86_64
The hosting control panel you install with one command.
A self-hosted alternative to cPanel, Plesk and DirectAdmin. PHP, WordPress, Node.js and container applications on one Ubuntu server, with automatic HTTPS. Free while it is in beta.
Beta means tested on real servers and not finished. Today's build is 0.3.5‑beta.1. Use a fresh server, expect updates, and read what it does not do first.
$ curl -fsSL https://get.klyrn.com | sudo bash ✔ Checking this server ✔ Profiling hardware and deriving tuning ✔ Preparing the operating system ✔ Creating KLYRN user, directories and keys ✔ Installing and configuring nginx ✔ Installing PHP 8.3 (FPM) ✔ Installing and securing MariaDB ✔ Configuring the firewall (ufw) ✔ Applying kernel network and filesystem limits ✔ Starting KLYRN services ✔ Verifying the complete installation KLYRN is installed and verified. Panel: https://51.75.165.38:7443 Setup token: (printed once, on the console)
Read out of 0.3.5‑beta.1, the build get.klyrn.com installs today, or measured on the test server.
Every number on this page comes from a command in the record; nothing is a projection.
What it runs
A site is a domain, a type and one action.
What the action does is the part that matters. One command, one button, or one API call: the same typed operation, the same audit entry, the same six things underneath.
klyrn site create example.com --type wordpress \
--admin-email you@example.com- A hosting account with its own Unix userHome directory nobody else can list. Another customer's PHP cannot read this site's files.
- A PHP-FPM master of the account's ownInside the account's systemd slice, so a CPU or memory limit reaches PHP. Confined by
open_basedir, shell functions off. - An nginx server block, tested before it is loaded
nginx -ton every render. A change that fails the test never reaches the running server. - A database and a user granted on it aloneFrom
localhost. Root stays on the Unix socket. - WordPress, configured properlyFresh salts, permalinks, HTTPS address,
FS_METHODdirect, and WP-Cron replaced by a real cron entry running as the account. - A Let's Encrypt certificateIssued on creation, renewed 30 days before expiry. If DNS does not point here yet, the site is served on HTTP and the certificate is retried every ten minutes.
Static and PHP
PHP 8.3 by default, other versions per site. Every account gets its own FPM master inside its own cgroup, so the limits you set are enforced by the kernel rather than counted.
klyrn site create example.com --type php
WordPress
Staging is a real second site: own vhost, pool, database and certificate. Pushing to live makes you type the domain, then takes a verified backup; if the backup fails, nothing changes.
klyrn site staging create example.com
Node.js
KLYRN clones as the account user, runs the build, health-checks the release and switches nginx to it. The previous release stays on disk, and rollback is one command.
klyrn app deploy app.example.com --git <repo>
Containers
Any image, or a Dockerfile KLYRN builds on your server and deploys by digest. Read-only root, every capability dropped, a sized volume, one tenant. A capability you switch on, not a default.
klyrn containers enable
Accounts, certificates, backups, limits and the reseller model work the same way on all four, because it is one panel and not a tab bolted onto one. Container applications are health-checked on their public address while the check runs: a known defect in this build, measured at 88 seconds.
Move from the old panel
Move first. Change DNS when you're ready.
KLYRN reads a cPanel or DirectAdmin backup, or connects to the old server over SSH: as root, as the cPanel account, or as any Unix user. Nothing is installed there. The old server keeps serving until you change a record.
-
1
Analyse
Every domain, database, database user, cron entry and
.htaccessdirective, as a plan you read before anything is written. Mailboxes are counted and reported; KLYRN does not host mail. -
2
Copy
Files stream in as the destination account, never as root. Database users are recreated with their original password hashes, so the application's own configuration still works.
-
3
Verify
Eleven checks on the new server (files, databases, domains, runtime, HTTP, SSL, redirects, cron,
.htaccess, DNS, mail) and a preview of every name before DNS moves. -
4
Cut over
A table of exactly which records to change. Lower the TTL first. Keep the old server for a week; nothing on it was modified.
Tested against archives KLYRN wrote itself; a real archive from a real cPanel or DirectAdmin server is the next step and has not happened yet. The parsers report rather than guess: anything not understood is a warning on the plan, never a silent omission.
How migration works, route by route What “verified” means, precisely
Hosting providers
Sell hosting, not licence tiers.
Resellers with their own customers and their own brand. Per-account disk, CPU and memory limits. Suspension that touches the vhost and nothing else. Deletion that makes you type the name and keeps the off-site copies anyway.
Reseller accounts need a Business or Enterprise licence, and neither is on sale yet. Everything on this page runs in the beta today; what you cannot do yet is pay for the edition that includes resellers. What that means in practice.
- A storefront, in the free beta today
- Plans, checkout, orders and renewals, on your own server. How selling works.
- Nothing counted on a paid edition
- Sites, domains, databases, accounts, WordPress sites and applications are unlimited. The server is the limit.
- Add a server with one command
- A connection code is 160 random bits, single use, fifteen minutes, stored only as its SHA-256. The server calls out; nothing central opens a port on it.
- Recovery per server
- Each server writes its own recovery manifest to its own bucket prefix; a replacement machine rebuilds one server's worth of sites.
Reliability and security
Root never talks to the internet.
Two processes from one binary. The one facing the network cannot become root, open the database or run a program. The one that can is not on the network.
- Accounts are hostile to each other
- Own Unix user, own PHP-FPM master inside its own cgroup, a grant per database, a sandboxed unit per app. A CPU, memory or process limit set on the account is enforced by the kernel on PHP and on Node.js applications. Cron is outside every limit and the panel says so.
- Operations, not commands
- Core exposes a closed registry: create site, create database, issue certificate. Programs get argument lists, never a shell; a CI check forbids process execution anywhere else.
- A backup counts when it has been read back
- Every archive is listed back and every SHA-256 in its manifest checked before a job may say “verified”. Copies to your own bucket are encrypted on the server before they leave it, and rotating the key adds one rather than retiring one.
- Self-repair with a circuit breaker
- A failed check gets only the repair it declares. Three repairs in thirty minutes opens the circuit and asks for a human. It never deletes data, kills a customer process or changes a firewall rule.
- Signed, checked, rolled back
- Releases are ed25519-signed with the key built into the binary. An update that fails its post-checks swaps the previous release back on its own, and only one update can run at a time, enforced by the kernel, not by a flag.
- Browser
-
klyrn-web user klyrn
Sign-in, sessions, the REST API, live events and the panel's static files. Nothing else.
- become root
- open the database
- execute a program
- use a shell
- make outbound HTTP
- write outside its state directory
- Unix socket, mode 0660 root:klyrn · peer credentials checked by the kernel · the actor is re-authorised against core's own records
-
klyrn-core root · never on the network
A closed registry of typed operations: create site, create database, issue certificate, and so on. Each has its own request type, validator, authoriser and audit entry. No operation takes a command string or an unconstrained path.
- nginx · php-fpm · mariadb · systemd · ufw · filesystem
No customers to quote yet. Here is what was run instead.
- InstallEleven stages verified in 53 s on a clean 3-vCPU VPS; six chaos scenarios (apt lock, 61 MB free, dead resolver, non-root, re-run,
--plan) each refused with the stage, the cause, the log and the resume command. - MigrationFive routes end to end: cPanel archive, DirectAdmin archive, SSH as root, SSH as the cPanel account, SSH files from any server. Each produced a site answering on HTTPS with a Let's Encrypt certificate.
- BackupsA 1.1 GB backup uploaded to a bucket in 64 MB parts, fetched, every checksum verified, and restored. Keys rotated and both generations restored after the local copies were deleted.
- UpdatesSeven broken releases served to a real server, all seven refused. A release built to fail its post-checks rolled back with the version, the symlink, the panel and the site intact.
- LimitsA 25% CPU quota measured at 25.00% of one core over ten seconds, 220 of 222 periods throttled. A PHP script inside a 384 MB account killed by the kernel at about 389 MB.
- IsolationReseller isolation proven over real HTTP: 36 assertions, every cross-account id substitution refused. A second site's PHP cannot read the first site's files, or
/etc/hostname.
Each row is a real run recorded with its command and its result. The record, build by build, and what is still open.
KLYRN VM · private beta
The second product: virtual machines on hardware you own.
A controller, KVM nodes, and the same rule the panel is built on: the machine dials out, and nothing reaches into a hypervisor. It is in private beta, its page lists what it does not do yet, and every figure on that page was measured on real hardware.
- 0 of 1,995
- probes interrupted while a node agent replaced itself
- 314 ms
- from a customer pressing create to a task accepted
Editions
Free is the one you can have today.
Install it and you are running the Free edition: one server, five sites, the whole panel, no card and no account required. The paid editions never limit what you host, and they are not on sale yet: no price is set.
- Free Free One server, five sites, the full panel. Available now. Install Free
- Pro Not on sale yet One licensed server, no limits, standard support. Email me at launch
- Business Not on sale yet Several servers, resellers and packages, priority support. Email me at launch
- Enterprise Not on sale yet Servers at scale, custom terms, an agreed response time. Email me at launch