Documentation

Installing, updating and rolling back.

Prerequisites

The installer checks all of this before it touches the machine, and stops with a report if anything blocking is missing — nothing is installed or modified when preflight fails. It is still worth reading first, because two of these (the DNS record and outbound port 25) cannot be fixed from the server itself.

Operating system

Ubuntu	22.04 LTS or newer — 24.04 LTS recommended
Debian	12 or newer
Rocky Linux / AlmaLinux	9 or newer
RHEL / CentOS / Oracle Linux	9 or newer

64-bit, with systemd. Older releases are refused rather than half-supported: they cannot run the PHP versions the panel offers your customers.

Hardware

CPU	1 vCPU minimum. 2 or more if you will run mail scanning — Rspamd and ClamAV are what actually consume CPU on a hosting box.
Memory	1.8 GB minimum, enforced. 2 GB is workable; 4 GB is the honest number once mail, DNS and MariaDB are all running with real sites on them.
Disk	15 GB free minimum, enforced. Allow 20 GB for the system, then whatever your customers’ sites, mail and backups need on top.
Network	A public IPv4 address and a working default route. The panel binds services to it and your licence binds to it.

A clean server

A freshly provisioned machine with the operating system on it and nothing else. This is the requirement people most often skip, so it is a hard refusal rather than a warning. The installer stops if it finds:

any other hosting control panel already installed
a previous or partial VedrixCP install

The installer configures nginx or Apache, PHP-FPM, MariaDB, Postfix, Dovecot, PowerDNS and a firewall. On a machine already running those it would fight with whatever is there, and you would be left with two half-working systems. It does clean installs only — it will not resume or repair. To wipe a failed attempt and start again:

bash install.sh --rollback

Hostname and DNS

Pick the name the panel will live at — panel.yourcompany.com is the usual shape — and point an A record at the server’s IP before you install. The installer issues a Let’s Encrypt certificate during the run, and that can only succeed if the name already resolves to the machine.

Set the system hostname to the same FQDN. Mail servers judge you on it, and a box still calling itself localhost will have its mail treated accordingly.

Ports

80, 443	Websites, and the certificate challenge
2087	Admin panel
2083	Customer panel
2096	Webmail
25, 587, 465, 143, 993, 110, 995	Mail, if you install it
53 (TCP and UDP)	DNS, if you install it
20, 21 and 40000–41000	FTP and its passive range, if you install it
22	SSH — also how the panel reaches additional servers

Outbound port 25 is the one to check with your provider. AWS, Google Cloud, Azure, Oracle Cloud and Hetzner block it by default on new accounts. Nothing on the server can detect this — mail simply never arrives — so ask them to open it, or plan to relay through a provider such as Amazon SES or Mailgun.

The agent listens on 8765 for the panel’s own use. It must never be open to the internet: the panel reaches nodes through an SSH tunnel, so that port stays bound to the machine and the firewall keeps it closed.

Access and credentials

Root	Direct root, or a user with full `sudo`
Licence key	From your account after purchase. The free tier needs one too — the download will not start without it.
Admin email	Where the panel sends its own alerts, and the certificate expiry notices

Virtual machines and containers

KVM, Xen, VMware, Hyper-V and bare metal are all fine. LXC and other containers work with reduced kernel-level features — a container shares the host’s kernel, so live kernel patching and some firewall behaviour are the host’s to control, not the panel’s. The installer detects this and tells you before continuing.

SELinux is left enforcing on RHEL-family systems and the panel ships policy for it. Turning SELinux off to make a control panel work is a trade nobody should be asked to make.

Tools the installer needs — run this first

The installer fetches everything else it needs on its own. It cannot fetch the downloader, because you need one before there is an installer to run, and minimal server images ship one or neither. One line settles it.

Ubuntu and Debian:

apt-get update && apt-get install -y curl wget ca-certificates gnupg tar

Rocky, AlmaLinux, RHEL:

dnf install -y curl wget ca-certificates gnupg2 tar

ca-certificates is on that list for a reason worth knowing: without it every HTTPS download fails with a certificate error that reads like our server being broken rather than a package being absent.

If you do not want everything

Mail, DNS and FTP can each be left out — useful when you already run mail elsewhere or your DNS is at Cloudflare:

--skip-mail    --skip-dns    --skip-ftp

These are install-time choices. Adding a component later means a reinstall, so decide now if you can.

Install

With curl:

curl -fsSL https://get.vedrixcp.com/install.sh -o /tmp/vedrixcp-install.sh && bash /tmp/vedrixcp-install.sh --licence YOUR-LICENCE-KEY

or with wget:

wget -O /tmp/vedrixcp-install.sh https://get.vedrixcp.com/install.sh && bash /tmp/vedrixcp-install.sh --licence YOUR-LICENCE-KEY

Replace YOUR-LICENCE-KEY with the key from your account. Every licence has its own, so there is no key to copy from this page.

Both commands download the installer to a file and then run it, rather than piping it straight into bash. That is deliberate: a pipeline runs whatever the download produced, and if the download fails that is an empty script — which does nothing, reports nothing, and looks exactly like an installer that refused to start. The && means a failed download stops there, with the error on screen.

It asks for the panel hostname and an administrator email, then shows a summary and waits for you to confirm before changing anything. To skip the questions — for an unattended or scripted install — pass them instead:

--hostname panel.yourcompany.com --admin-email you@yourcompany.com --unattended

It takes roughly ten to twenty minutes. At the end it prints the panel URL and the administrator login it created.

Import the signing key

The installer does this for you. Run it yourself if you would rather check the release before running anything:

curl -fsSL https://get.vedrixcp.com/vedrixcp-signing.asc | gpg --import

Confirm the key is in your keyring:

gpg --list-keys releases@vedrixcp.com

Verify the download yourself

Fetch the release and its signature, then check one against the other:

curl -fsSL -H "X-Vedrixcp-Licence: YOUR-KEY" https://get.vedrixcp.com/releases/latest/download/vedrixcp.tar.gz -o vedrixcp.tar.gz
curl -fsSL -H "X-Vedrixcp-Licence: YOUR-KEY" https://get.vedrixcp.com/releases/latest/download/vedrixcp.tar.gz.asc -o vedrixcp.tar.gz.asc
gpg --verify vedrixcp.tar.gz.asc vedrixcp.tar.gz

A good signature prints Good signature from "VedrixCP Releases". If it does not, stop and tell us — do not install it.

Update

vedrixcp update
vedrixcp health

An update takes a restore point first and rolls itself back automatically if the health checks fail afterwards. Once you have clicked around and are satisfied:

vedrixcp mark-stable

Security releases can install themselves unattended — that is on by default and can be turned off in the panel. Feature releases wait for you, and a major version never installs itself.

Roll back

vedrixcp rollback

Restores the last restore point, including the database.

Adding a second server

In the panel, open Servers and press Add server. It gives you one command to run as root on the new machine; the machine installs the agent, generates its own credentials and joins itself. It arrives switched off for new accounts until you enable it.

The panel reaches nodes over an SSH tunnel. The agent never needs a port open to the internet.

Uninstall

vedrixcp uninstall

Removes the panel. It does not delete customer data, databases or mail unless you tell it to — deleting those by default is not a decision software should make.