azerioid-stack-manager README

The project's README from github.com/azerioid/azerioid-stack-manager. As one markdown file: README.md.

AZERIOID Stack Manager

One host. One panel. A full Linux web stack you control.

AZERIOID Stack Manager is a self-contained stack manager and web control panel for operators who run sites on a single Linux server. One installer bootstraps Caddy, a dedicated PHP 8.4 FPM pool, and a SQLite-backed admin UI on Laravel 13 + Livewire 4. Everything else — Nginx, Apache, databases, cache, PHP site runtimes, Node.js, Supervisor, mail, rootless Docker — installs on demand from the dashboard or the matching CLI, using official upstream packages.

Built for VPS and bare-metal operators who want a clean bootstrap, a real UI for day-two work, and a privileged broker that keeps package installs and host changes out of the web app process.

Screenshots

Captured from a live Ubuntu 24.04 panel host (UI anonymized where needed). Reflects the post–v1.6 Virtual Hosts redesign and current Mail / runtime pages.

Overview Virtual hosts
Overview Virtual hosts
Virtual hosts · row actions Docker runtime filter
Virtual hosts actions Docker vhosts
Mail Databases
Mail Databases
Terminal File Manager + editor
Terminal File Manager
Components Security
Components Security

What ships out of the box vs on demand

Bootstrap (automatic)

Piece Role
Caddy Panel vhost on port 3169; front door on :80/:443 for sites
PHP 8.4 FPM Dedicated panel pool — isolated from site PHP versions
SQLite Panel state under /var/lib/azerioid-panel/
Broker Privileged host driver (sudoers); UI never runs apt/dnf itself
Queue worker Background component install/remove jobs

On demand (Components page or azerioid component)

Category Components
Web engines Nginx, Apache (loopback backends; Caddy terminates TLS)
Databases MariaDB, PostgreSQL, MongoDB
Cache / KV Redis, Memcached
Runtimes PHP 8.1–8.3 (site pools); Node.js 20 / 22 / 24
Process manager Supervisor (programs run as azerioid-supervised, never root)
Per-vhost app runtimes Opt-in: PHP-FPM (default), Laravel Octane / FrankenPHP, PM2 Node cluster, rootless Docker — chosen at create time or enabled later
Mail Postfix + Dovecot + OpenDKIM (opt-in; authenticated submission only, virtual mailboxes, DKIM/SPF/DMARC guidance, direct or smarthost outbound)
Tools Adminer (panel session–gated SQL UI; MariaDB / PostgreSQL / SQLite — not MongoDB)

Feature highlights

Proven on supported distros in operator testing — not marketing vapor:

Honest limits: single admin (no multi-user RBAC yet). Archive extract is not offered in the File Manager (zip-slip scoped out). Mail ships without webmail, spam filtering, quotas, or catch-all addresses; deliverability still depends on reverse DNS you set at your VPS provider. Octane is Laravel-only; PM2 is Node-only; Docker compose host mounts are bounded by what azerioid-supervised can already access (not equivalent to root).

Supported operating systems

Verified end-to-end on the current stack (Laravel 13 + Livewire 4, including mail / Octane / PM2 / rootless Docker paths where those features apply):

OS Support Notes
Ubuntu 24.04 Supported Verified
Debian 12 / 13 Supported Verified
AlmaLinux 9+ Supported Verified with SELinux Enforcing
Rocky Linux 9+ Supported Verified with SELinux Enforcing (same EL path as AlmaLinux)
CentOS Stream 9+ Supported Verified with SELinux Enforcing (same EL path; ID=centos)
RHEL / Oracle Linux 9+ Supported (same EL path) Same installer/SELinux helpers
Fedora Not supported Installer refuses correctly

Requirements: root, outbound HTTPS, git.

Quick start

git clone https://github.com/azerioid/azerioid-stack-manager.git stack-manager && cd stack-manager
chmod +x stack-manager.sh
sudo ./stack-manager.sh

Interactive install (TTY) prompts for:

Non-interactive example:

sudo ./stack-manager.sh --non-interactive --access=public --create-admin=true [email protected]
# Set ADMIN_PASSWORD in the environment — never pass passwords on argv

Tunnel access after a default install:

ssh -L 3169:127.0.0.1:3169 user@host
# open http://127.0.0.1:3169/setup  (or /login if an admin was created)

Optional hardening flags: --firewall=true, --fail2ban=true, --require-totp=true. Full list: sudo ./stack-manager.sh --help.

On any public install, change the admin password immediately after first login if you used a weak or default value.

Security model (brief)

Details: docs/SPEC.md, docs/DECISIONS.md, docs/port-ownership.md.

CLI examples

azerioid status
azerioid vhost list --json
azerioid vhost add --domain=app.example.com --type=php --php=8.4 --root=/data/www/app.example.com --tls=auto
azerioid vhost add --domain=api.example.com --type=php --php=8.4 --runtime=octane --tls=auto
azerioid vhost octane enable --domain=api.example.com
azerioid vhost octane reload --domain=api.example.com
azerioid vhost pm2 enable --domain=node.example.com --instances=2 --entry=server.js
azerioid vhost docker enable --domain=app.example.com --mode=image --image=nginx:alpine --internal-port=80
azerioid db add --engine=mariadb --name=appdb --user=appdb
azerioid component install redis
azerioid component install mail   # refuses foreign Exim/Sendmail unless --option=confirm=REPLACE-MTA
azerioid component install adminer
azerioid process create --vhost=app.example.com --command='node server.js' --name=app-node
azerioid mail hostname set --hostname=mail.example.com
azerioid mail domain enable --domain=app.example.com
azerioid mail mailbox add [email protected]   # password printed once
azerioid mail status   # “Direct mail delivery: available” or “…blocked… configure a relay”
azerioid mail smarthost set --host=smtp.provider.example --port=587 --username=apikey
# relay password: AZERIOID_RELAY_PASSWORD=… (never argv)
azerioid mail dns --domain=app.example.com
azerioid panel update check
azerioid panel update apply --v=v1.6.0 --confirm

Secrets (DB passwords, DNS tokens, backup passphrase, TOTP re-auth, mail/smarthost passwords) go through the environment or one-time stdout — not argv flags. Full surface: azerioid help.

Uninstall

Panel only:

sudo ./deploy/uninstall.sh --drop-db --remove-bootstrap

Full teardown (panel + broker-managed components + added repos). Intentionally retains site trees under /data/www and panel/broker logs under /var/log/azerioid-panel (audit trail after reinstall):

sudo ./deploy/uninstall.sh --full

License

MIT — see web/composer.json.

Contributing

Issues and pull requests: azerioid/azerioid-stack-manager. Architecture decisions live in docs/DECISIONS.md; keep ADR history intact when proposing changes.

azerioid-stack-manager (azerioid/azerioid-stack-manager)

mailserver
Searching Database…

What is this?AZERIOID Stack Manager is a self-contained stack manager and web control panel for operators who run sites on a single Linux server. It bootstraps Caddy, a dedicated PHP-FPM pool and a SQLite-backed admin UI, then lets you add web servers, databases, cache, mail, Node.js and rootless Docker on demand.
Is this a library I install in code, or a standalone server app?It is a standalone self-hosted web application plus a matching CLI (azerioid), built on Laravel 13 + Livewire 4 with a SQLite panel database — not a library you import into another project.
How do I get it running on my server?Run the interactive installer with root privileges (sudo ./stack-manager.sh), which prompts for access mode (tunnel or public), panel port, TOTP, firewall and fail2ban; non-interactive flags are also supported for scripted installs.
What does my server need before installing this?You need root access, outbound HTTPS, and git. It runs on Ubuntu 24.04, Debian 12/13, AlmaLinux/Rocky/CentOS Stream 9+, and RHEL/Oracle Linux 9+; Fedora is explicitly not supported.
What are the current limitations?There's no multi-user RBAC yet (single admin only), archive extraction is intentionally left out of the File Manager, and the bundled mail server ships without webmail, spam filtering, quotas or catch-all addresses.
Who is this built for?VPS and bare-metal operators running a single Linux box who want a clean bootstrap plus a real day-two UI for sites, databases, mail and processes, instead of hand-rolling server config.
Does it work on any Linux distro?No — it's verified on Ubuntu 24.04, Debian 12/13, AlmaLinux 9+, Rocky Linux 9+, CentOS Stream 9+ and RHEL/Oracle Linux 9+ (EL path with SELinux enforcing); Fedora is explicitly refused by the installer.
Are secrets like DNS tokens and passwords kept safe?DNS-01 API tokens and mail/smarthost secrets are stored root-only and are never accepted via command-line arguments; other secrets go through the environment or one-time stdout.
What can I install on demand beyond the bootstrap stack?From the Components page or the azerioid CLI you can add Nginx or Apache, MariaDB/PostgreSQL/MongoDB, Redis/Memcached, PHP 8.1-8.3 or Node.js 20/22/24 runtimes, Supervisor, a full mail stack (Postfix+Dovecot+OpenDKIM), and rootless Docker.
How does HTTPS get set up for my sites?Caddy terminates TLS and supports automatic Let's Encrypt HTTP-01, self-signed/internal TLS, and DNS-01 via Cloudflare or DigitalOcean (lightly tested compared to internal TLS).
Can each site run on its own engine or runtime?Yes — each virtual host independently picks Caddy, Apache or Nginx as its engine, and can opt into Laravel Octane (FrankenPHP), PM2 cluster mode for Node, or rootless Docker instead of the default PHP-FPM.
Is the panel exposed to the internet by default?No, the default access mode is a localhost tunnel (127.0.0.1:3169); public HTTPS access on the host IP is an explicit install-time choice.
Creator
azerioid
Size
6.3 MB
Stars
710
Age
1mo
Commits · 90 Days