# dPanel - dNocs documentation > dPanel - dNocs (distributed Node & Operations Control system) is a web control panel for servers, applications and domains. It launches servers at AWS, Google Cloud, DigitalOcean, IDCloudHost and other providers, or connects a server you already run over SSH; installs databases and runtimes; deploys applications from GitHub; and manages DNS records, HTTPS load balancers, logs and team access. --- # What is dPanel - dNocs? Source: https://dnocs.devetek.app/docs/getting-started/what-is-dpanel dPanel - dNocs is a web control panel that launches or connects Ubuntu servers, deploys apps from GitHub, and manages DNS, HTTPS and logs. dPanel - dNocs (distributed Node & Operations Control system) is a web-based server control panel: a website where you run your own servers by clicking instead of typing commands. It launches Ubuntu servers in your own cloud account or connects a VPS you already run, then deploys your applications from GitHub, puts them behind an HTTPS load balancer, manages their DNS records and shows their logs, all from the browser. ## Who it is for - **Developers and small teams** who want their code running on their own servers without writing deployment scripts. - **Agencies and freelancers** who look after many client sites and want one place to see every server, application and domain. - **Ops engineers** who want one shared way for a team to create servers and ship releases, with roles instead of shared root passwords. You need no terminal on your own computer. dPanel signs in to your servers over SSH with a key it holds for you, and runs a small agent on each server to report its health. ## What dPanel does | Area | What you can do | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Servers | Launch a VM at a cloud provider, or connect any Ubuntu or Debian server over SSH. See live CPU, memory and disk, systemd services, users, open ports, files and logs, and manage the server's firewall. | | Software | Install databases, runtimes and web servers from a catalogue of tested modules, such as MariaDB, Go or Caddy. | | Applications | Build a GitHub repository on your server, run it as a systemd service, keep every build, and roll back in one step. | | Load balancers | Publish an application on a domain with a free Let's Encrypt HTTPS certificate, renewed for you. | | Domains | Manage the DNS records of a domain hosted at Cloudflare or DigitalOcean. | | Logs | Read application, load balancer, build and server logs, search them, and download up to 10 days back. | | Clusters | Group servers, and turn a group into a Kubernetes cluster with k3s or RKE2. | | Teams | Share a workspace with your team and give each person a role, from Viewer to Owner. | | Workers | Run your workspace's jobs on dPanel's shared workers, or on private workers you run yourself. | | Assistant | Ask questions in plain language, or let [Ask dPanel](../ai/overview.md) prepare changes for you to approve. | ## Supported providers and systems - **Cloud providers:** AWS EC2, Google Compute Engine, DigitalOcean Droplets, IDCloudHost, Alibaba Cloud ECS and Tencent Cloud CVM. The launch form also lists Biznet Gio. See [Cloud providers](../servers/cloud-providers/index.md). - **Your own server:** any VPS, bare-metal machine or home-lab box running Ubuntu or Debian that dPanel can reach over SSH. See [Connect your own server](../servers/connect-your-own-server.md). - **Operating system on launched servers:** Ubuntu 24.04 LTS or 26.04 LTS. - **Code:** GitHub repositories your GitHub account or organisation can read, built with the commands you give. - **DNS:** Cloudflare and DigitalOcean. dPanel does not resell servers or domains. Machines run in your own provider account, and your provider bills you directly. ## dPanel compared with managing a VPS by hand | Task | By hand on a VPS | With dPanel | | ------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------ | | Create a server | Click through the provider console, set up SSH keys and a firewall | Pick provider, region and size in one form; ready in about 10–20 minutes | | Install a database | `apt install`, edit config files, create a systemd unit | Pick the module, answer a few questions | | Deploy an app from GitHub | Clone, build, write a service file, restart, repeat on every change | Pick the repository and branch; press **Build and release** after a push | | Roll back a bad release | Find the old build, if you kept it | **Roll back** on any kept build | | HTTPS on a domain | Install a web server, set up Certbot, add the DNS record | Create a load balancer; dPanel adds the record and the certificate | | Read logs | SSH in, `journalctl` or `tail -f` | Search and download them in the browser | | Give a teammate access | Share a key or a password | Add them to the team with a role | You keep full access to the machine. dPanel works through SSH and standard Ubuntu tools, so you can still sign in yourself whenever you want. ## How to start Follow [Your first steps](./first-steps.md): sign in, pick a workspace, get a server, deploy your first app with a tutorial, and put it on your domain. New words are explained in the [Glossary](./glossary.md). ## Frequently asked questions ### Is there a dark theme? Yes. Press the moon icon at the bottom of the sidebar to switch between light and dark. Other dPanel services on the same domain, such as the database manager, follow the theme you pick. ### What does dNocs stand for? dNocs stands for distributed Node & Operations Control system. dPanel is the control panel you use in the browser; the full product name is dPanel - dNocs. ### Do I need to install anything? No. dPanel runs in your browser at dnocs.devetek.app. On each server it manages, dPanel installs its own agent over SSH for you. ### Which operating systems does dPanel support? Servers dPanel launches run Ubuntu 24.04 LTS or 26.04 LTS. A server you connect yourself can run Ubuntu or Debian. ### Who pays for the servers? Your cloud provider bills you directly, because dPanel creates machines inside your own provider account. dPanel does not resell servers. ### Can I still use SSH on my servers? Yes. dPanel has a terminal in the browser, and you can add your own public key to a server and connect with any SSH client. See [Connect over SSH](../servers/connect-over-ssh.md). ### What happens to my servers if I stop using dPanel? They keep running at your provider, with your applications as systemd services. Deleting a server you connected yourself only makes dPanel forget it; the machine is left alone. --- # Your first steps Source: https://dnocs.devetek.app/docs/getting-started/first-steps A beginner's path through dPanel - dNocs in six steps, from signing in to an app live on your own domain with HTTPS, linking the right page for each. New to dPanel - dNocs? Follow these six steps in order and, in about an hour, you go from an empty account to a website running on your own server at your own domain with HTTPS. Each step links to the page that walks you through it. Never run a server before? Read [How a website runs on your server](../tutorials/how-a-website-runs.md) first, and keep the [Glossary](./glossary.md) open for any word you don't know. ## Your first hour with dPanel 1. **Sign in.** Open [dnocs.devetek.app](https://dnocs.devetek.app) and sign in with Google or a username and password. See [Sign in and your profile](./sign-in.md). 2. **Pick a workspace.** A workspace is the box your servers, applications and domains live in. Use your personal workspace to try things out, or a team workspace to share with others. See [Workspaces](./workspaces.md). 3. **Get a server.** A server is the computer in a data centre your website runs on. Either way, dPanel first needs an [SSH key](./ssh-keys-and-cloud-projects.md), the password-free key it uses to sign in to the server. - **No server yet?** Connect your cloud account, such as AWS, Google Cloud or DigitalOcean, and launch one from dPanel. See [Create a cloud server](../servers/cloud-providers/create-a-cloud-server.md). - **Already rent a VPS?** Connect it over SSH instead. See [Connect your own server](../servers/connect-your-own-server.md). 4. **Deploy your first app.** [Connect GitHub](./connect-github.md), then follow a tutorial from start to finish: - [Deploy WordPress with MariaDB](../tutorials/deploy-wordpress.md), the simplest place to start. - [Deploy Laravel with PostgreSQL](../tutorials/deploy-laravel.md), for a PHP web application. 5. **Put it on a domain.** Add your domain under **Domain & DNS**, then create a load balancer: the front door that answers on your domain and gets a free HTTPS certificate. See [Domains and DNS](../networking/domains-and-dns.md) and [Load balancers](../networking/load-balancers.md). 6. **Keep an eye on it.** The [dashboard](./dashboard.md) tells you whether everything is all right, and [Reading logs](../logs/reading-logs.md) shows what your app is doing. You can also let the assistant do the clicking: describe what you want and approve each change. See [Ask dPanel](../ai/overview.md). ## How long each step takes | Step | Your time | Waiting for dPanel | | ------------------ | ------------- | ------------------------------------------ | | Sign in, workspace | 2 minutes | none | | SSH key | 1 minute | none | | Cloud server | 5 minutes | 10–20 minutes while the server is set up | | Your own server | 5 minutes | a few minutes while dPanel installs itself | | First app | 10–15 minutes | 5–15 minutes for software and the build | | Domain and HTTPS | 5 minutes | 1–10 minutes for DNS and the certificate | ## Before you start - **A GitHub account** with the code you want to run. The tutorials use public example repositories you can fork. - **A cloud account**, only if you want dPanel to launch a server for you. Your provider bills you for the server directly; dPanel does not resell servers. - **A domain name** at Cloudflare or DigitalOcean, so dPanel can create the DNS record for you. A domain elsewhere works too, but you add the record yourself. ## Frequently asked questions ### Do I need to know Linux or use a terminal? No. Every step happens in the browser. dPanel signs in to your server over SSH for you, installs software from a list, and shows logs on the page. ### Can I try dPanel without a domain? Yes. Your application runs without one; you only need a domain to publish it on the internet with HTTPS in step 5. ### Who bills me for the server? Your cloud provider, for every hour the server exists. dPanel does not resell servers. Delete a server you no longer use so it stops costing money. See [Delete a server](../servers/delete-a-server.md). ### Something went wrong. Where do I look? Start with [Common problems and fixes](../troubleshooting/faq.md). The dashboard's **Needs your attention** list also points at anything that failed. --- # Sign in and your profile Source: https://dnocs.devetek.app/docs/getting-started/sign-in Sign in to dPanel with Google or a username and password, create an account, and manage your profile, password, workers and public profile page. dPanel runs in your browser at [dnocs.devetek.app](https://dnocs.devetek.app), so there is nothing to install. Sign in with Google or a username and password, and you land on the dashboard. New to dPanel? Read [What is dPanel - dNocs?](./what-is-dpanel.md) first. ## Sign in The sign-in panel on the home page offers two ways in. | Way in | What you do | | --------------------- | -------------------------------------------------------------------------------- | | Google | Press the Google button at the top of the panel and pick your Google account. | | Username and password | Type your username and password under **Or sign in with**, then press **Login**. | After a successful sign-in you go straight to the **Dashboard**. If you are already signed in, the home page greets you instead and offers **Go to dashboard**, **View profile** and **Logout**. :::tip Signing in with Google needs no password of its own. Use it if your team already works in Google Workspace. ::: ## Create an account 1. On the home page, press **Sign Up** under **Don't have an account?**. 2. Fill in your email, a username, a password, and the password again. 3. Press **Sign Up**. dPanel registers the account and redirects you once it is ready. ## Forgot your password Press **Forgot password?** next to the password field. dPanel does not reset passwords by email yet; the dialog gives you the support contact to write to. ## Your profile At the bottom of the sidebar, press the settings icon on the card with your name, then **View Profile**. The same two buttons include **Logout**. The profile page has these parts: - **Personal information**: your name, username, email and the workspace you are working in now. - **Account security**: your password, and the **GitHub account** dPanel uses to read repositories. It reads **Connected** once you have linked GitHub. - **Workspace access**: every workspace you belong to, with your role in each. - **Workers**: where the jobs of the workspace you are in run. See [Workers on your profile](#workers-on-your-profile). - **Current session** and **Account controls**, on the right: the workspace and role this browser uses, and whether your password and GitHub access can be changed. [Screenshot: The profile page with personal information, account security, workspace access and the Workers card] ### Change your name, avatar or password 1. Press **Edit profile**. 2. Change **Full name** or **Avatar URL**. Email and username cannot be changed here. 3. To change the password, fill in **New password** and **Retype password**. It must be at least 8 characters. Leave both blank to keep the current one. 4. Press **Save changes**. ### Workers on your profile A worker is the program that runs a workspace's jobs: deployments, server setup and module installs. The **Workers** card shows the choice for the workspace you are in: - **Shared workers (dPanel)**: dPanel runs your jobs. Nothing to set up. This is the default. - **Private workers**: only workers you run yourself, on a VM or as a GitHub Actions workflow, take this workspace's jobs. Press **Add worker** to add one first. In a team workspace, only team owners and admins can change it. See [Workers](../workers/overview.md). ## Your public profile Every account has a public profile page at `/u/` followed by the username, such as `https://dnocs.devetek.app/u/prakasa`. It shows your name, avatar, username and the date you joined, and never your email address. Only people signed in to dPanel can open it. [Screenshot: A public profile page with the avatar, name, username and join date] Across dPanel, a person's name links to this page: the owner of a server, an SSH key or a cloud account, who ran a build, and who started an operation in **Recent activity**. Change what it shows with **Edit profile**. ## What happens next Pick the workspace you want to work in. See [Workspaces](./workspaces.md). Then take a look around [the dashboard](./dashboard.md), or follow [Your first steps](./first-steps.md). ## Frequently asked questions ### Can I sign in without a Google account? Yes. Create an account with **Sign Up** and sign in with your username and password. ### How do I reset a forgotten password? Press **Forgot password?**. dPanel does not reset passwords by email yet; the dialog gives you the support contact to write to. ### Can I change my username or email? Not from the profile page. **Edit profile** changes your full name, avatar and password. ### Who can see my public profile? People signed in to dPanel who open your `/u/` address or press your name in a list. It shows your name, avatar, username and join date only, never your email. --- # Workspaces Source: https://dnocs.devetek.app/docs/getting-started/workspaces How dPanel workspaces work: your personal workspace, shared team workspaces, and how to switch between them so you see the right servers and apps. A workspace in dPanel is the boundary (a separate box) around a set of servers, applications, load balancers, domains, cloud accounts and SSH keys. You only see what belongs to the workspace you are in, and you switch workspace from the top of the sidebar. ## Two kinds of workspace | Kind | Who sees it | Use it for | | -------- | ------------------------ | -------------------------------- | | Personal | Only you | Trying things out, side projects | | Team | Every member of the team | Shared servers and applications | Every account has a personal workspace. A team workspace is the same thing as a team: creating a team creates its workspace. See [Teams](../teams/teams.md). ## Switch workspace The current workspace is shown at the top of the sidebar, under the dnocs logo. 1. Press the workspace name at the top of the sidebar. 2. In **Select workspace**, find the one you want. The tabs **All**, **Personal** and **Teams** narrow the list, and **Search workspaces** finds one by name, in any letter case. The workspace you are in is marked **Current**. 3. Press the row. dPanel reloads the data for that workspace. [Screenshot: The Select workspace dialog listing the personal workspace and two team workspaces, with the current one marked] dPanel remembers your choice in this browser. The next time you open dPanel here, you are in the same workspace. :::note Switching workspace changes what every page shows. If a server or application seems to have disappeared, check the workspace name in the sidebar first. ::: ## From the same dialog - **New workspace** creates a team workspace. See [Create a team](../teams/teams.md#create-a-team). - The people icon at the end of a team row (**Manage workspace**) opens that team's members page. ## A resource stays in its workspace A server, application, load balancer, domain, cloud account or SSH key stays in the workspace it was created in. dPanel does not move resources between workspaces, so switch to the right workspace before you create something. To share your work with other people, create it in a [team workspace](../teams/teams.md). ## Frequently asked questions ### Where do I find my personal workspace? At the top of **Select workspace**, named **Personal workspace**, or under the **Personal** tab. Every account has one. ### Can I move a server or application to another workspace? No. Resources stay in the workspace they were created in. Create the resource again in the right workspace and delete the old one. ### Why does switching workspace change the Workers card on my profile? Each workspace chooses where its jobs run, on dPanel's shared workers or on private workers. The profile shows the choice for the workspace you are in. See [Workers](../workers/overview.md). --- # The dashboard Source: https://dnocs.devetek.app/docs/getting-started/dashboard The dPanel dashboard shows a workspace's health, its servers, apps, load balancers and domains, failed jobs, resource usage and recent activity. The dPanel dashboard is the first page after sign-in. It answers one question: is everything in this workspace all right? It shows a health verdict, one row of four tiles (servers, applications, load balancers and domains), failed jobs, and CPU, memory and disk usage across your servers. Open it any time from **Dashboard** in the sidebar. [Screenshot: The dashboard Overview tab: the health verdict, four tiles for servers, applications, load balancers and domains, platform activity and Needs your attention] ## The sidebar The sidebar on the left is how you move around dPanel. From top to bottom: | Item | What it opens | | ------------------- | -------------------------------------------------------------------------------------------------------------------- | | Workspace name | The workspace you are in. Press it to switch. See [Workspaces](./workspaces.md). | | **Dashboard** | This page. | | **Applications** | Your applications. See [How applications work](../applications/overview.md). | | **Servers** | Your servers and server groups. See [Servers in dPanel](../servers/overview.md). | | **Load Balancers** | Under **Backend**. Publish an application on a domain. See [Load balancers](../networking/load-balancers.md). | | **Domain & DNS** | Under **Backend**. Your domains and their DNS records. See [Domains and DNS](../networking/domains-and-dns.md). | | **Cloud Projects** | Under **Backend**. Your connected cloud accounts. See [SSH keys & cloud accounts](./ssh-keys-and-cloud-projects.md). | | **Secret Managers** | Under **Backend**. Opens the **SSH keys** page. See [SSH keys & cloud accounts](./ssh-keys-and-cloud-projects.md). | | Your name | The settings icon on your card shows **View Profile** and **Logout**. See [Your profile](./sign-in.md#your-profile). | At the very bottom, the **EN** button switches the language between English and Indonesian, and the moon icon switches between the light and dark theme. The theme is shared with other dPanel services on the same domain, such as the database manager. ## The tabs | Tab | What it shows | | ------------- | --------------------------------------------------------------------------------------------------------- | | **Overview** | A one-line verdict, four tiles, platform activity, resource usage, what needs a look, and recent activity | | **Activity** | The platform activity chart and the full **Recent activity** list | | **Resources** | Resource usage, **Server Health**, and short lists of servers, applications and load balancers | | **Workspace** | Team workspaces only: the team summary, members and cloud projects | ## Overview Read it from the top. 1. **The verdict.** Either everything is running normally, or a count of things that need your attention. 2. **Four tiles.** **Servers**, **Applications** and **Load balancers**, each with how many are ready and how many need a look, and **Domains**. Press a tile to open that list. Cloud accounts and SSH keys are not counted here; open them from the sidebar. 3. **Platform activity.** Every operation dPanel ran in this workspace, split into **Succeeded**, **Failed** and **In progress or cancelled**. Pick **24 hours**, **7 days** or **30 days**. Beside it: the number of operations, the success rate and how many failed. 4. **Resource usage.** CPU, memory and disk across your servers. Each chart shows the fleet average and the busiest single server. Pick **1 hour**, **24 hours** or **3 days**. 5. **Needs your attention.** Servers that are not running, servers whose agent (the small dPanel program on each server that reports its health) stopped reporting, and operations that failed. **Open server** takes you to the server in question. 6. **Recent activity.** The newest operations. A button such as **Show 7 more** below the list loads the rest. The **Activity** tab shows the full list. :::tip Usage appears a few minutes after a server becomes ready. Servers report every 30 seconds. ::: ## Activity **Recent activity** lists what dPanel did to your infrastructure in the last two days: server setup, module installs, deployments. Each entry says what ran, on which target, who started it and how long it took. The person's name links to their public profile. Open **Technical details** for the raw detail of a failed run. Press **Refresh** to load the newest entries. ## Resources This tab is for capacity planning. - **Resource usage**: the same CPU, memory and disk charts as on **Overview**. - **Server Health**: how many servers are **Ready servers**, **Provisioning** or **Needs attention**, how many report live usage (**Telemetry online**), and which providers host them. - Short lists of your newest servers, applications and load balancers, each with **View all**. ## Workspace Shown only in a team workspace. - **The summary** at the top: the team's name and ID, its IaC repository (the Git repository dPanel writes this workspace's infrastructure to), and counts of members, servers and cloud projects. **Manage team** opens the team page. - **Workspace Members**: who has access. **Manage** opens the team page. - **Cloud Projects**: the provider accounts this team can launch servers in. ## Lists, tables and cards Every list in dPanel (servers, applications, load balancers, domains, cloud accounts, SSH keys and teams) opens as a table. The view switch beside the search box changes it to **Card Grid View** or **Card List View**, and back to **Table View**. Each row ends with its actions, such as **Details**, or a **More** (⋯) menu with **Delete**. Search ignores upper and lower case: `wordpress` finds `WordPress`. The same goes for searching files and logs. ## Ask a question instead The **Ask dPanel** button at the bottom right of every page opens the AI assistant. Ask it, for example, "Did any job fail in the last 24 hours?". See [Ask dPanel](../ai/overview.md). ## If the dashboard says it cannot check **You cannot see this workspace's health** means dPanel would not let your account read execution and agent status in this workspace. Check that the workspace in the sidebar is one you belong to, then ask a workspace owner for access. See [Members and roles](../teams/members-and-roles.md). ## Frequently asked questions ### Why did the cloud projects and SSH keys tiles disappear? The dashboard now shows one row of four tiles: servers, applications, load balancers and domains. Open cloud accounts from **Cloud Projects** and SSH keys from **Secret Managers** in the sidebar. ### Why is the usage chart empty? Usage appears a few minutes after a server becomes ready, and only for servers whose agent reports in. A workspace without a ready server has nothing to chart. ### Why don't I see the Workspace tab? It appears only in a team workspace. Your personal workspace has no members or team settings to show. ### How do I switch to the dark theme? Press the moon icon at the bottom of the sidebar. dPanel remembers the choice, and other dPanel services on the same domain follow it. --- # Connect GitHub Source: https://dnocs.devetek.app/docs/getting-started/connect-github Connect GitHub to dPanel so it can read your repositories and deploy apps from GitHub, including repositories that belong to a GitHub organisation. dPanel deploys applications from GitHub repositories, so before your first application you link a GitHub account. You do it once per dPanel account, and dPanel then lists every repository and branch that account, and the GitHub organisations you install the dnocs-id GitHub App on, can read. ## What you need first - A GitHub account that can read the repositories you want to deploy. - For an organisation's repositories, permission to install a GitHub App in that organisation, or someone who has it. ## Connect 1. Open **Applications** in the sidebar. 2. Press **Connect GitHub** at the top of the page. 3. GitHub asks you to sign in and approve dPanel. Approve it. 4. You come back to dPanel. The button now shows your GitHub login with a check mark. Your profile shows the same link under **Account security**: **GitHub account** reads **Connected**. ## Add a GitHub organisation The repository picker in **Create Application** lists your own account and every organisation dPanel can read. 1. Open **Applications**, then **Create Application**. 2. Open the **GitHub team** list. 3. If the organisation is missing, choose **Add GitHub account**. It opens the dnocs-id GitHub App on GitHub. 4. Install the app on the organisation, and give it access to the repositories you want. 5. Back in dPanel, the organisation appears in **GitHub team**. ## When GitHub stops answering GitHub tokens expire. When dPanel can no longer confirm your account you see one of these: - **Reconnect GitHub** on the Applications page. - A banner on an application: **GitHub session expired**, with **Relogin GitHub**. - In the branch list: "GitHub would not confirm your account". Press the button and sign in to GitHub again. Nothing else changes. Your applications keep running while GitHub is disconnected; only reading repositories and branches stops. ## What happens next Create your first application. See [How applications work](../applications/overview.md) and [Create an application](../applications/create-an-application.md). You can also ask **Ask dPanel** which repositories and branches it can see, or to deploy one; see [Prompt cookbook](../ai/prompt-cookbook.md). ## Frequently asked questions ### Does dPanel change my code on GitHub? No. dPanel reads your repositories and branches to build them on your server. It does not push to them. ### Do I connect GitHub once per workspace? No, once per dPanel account. Every workspace you belong to uses the same link. ### My repository is private. Can dPanel deploy it? Yes, as long as the GitHub account you connected, or the dnocs-id GitHub App on the organisation, can read it. ### What happens to my apps if I disconnect GitHub? They keep running. Only reading repositories and branches stops, so you cannot start a new build until you reconnect. --- # SSH keys & cloud accounts Source: https://dnocs.devetek.app/docs/getting-started/ssh-keys-and-cloud-projects Create the SSH key dPanel signs in to your servers with, and connect an AWS, Google Cloud, DigitalOcean or other cloud account to launch VPS servers. Before dPanel can launch or connect your first server, it needs an SSH key (a password-free key it signs in to the server with), and to launch a new VPS (a virtual server you rent) it also needs a cloud account. Both live under **Backend** in the sidebar, and both are reused for every server after that. | You need | Where | Why | | --------------- | ---------------------------------------- | ------------------------------------------------ | | An SSH key | **Secret Managers** (opens **SSH keys**) | dPanel signs in to your servers with it | | A cloud account | **Cloud Projects** | dPanel creates machines in your provider account | You need a cloud account only to launch a new machine. To connect a server you already run, the SSH key is enough. ## Create an SSH key 1. In the sidebar, under **Backend**, open **Secret Managers**. It opens the **SSH keys** page. 2. Press **Create SSH key**. 3. Type a **Key name** you will recognise, such as `work-laptop`, and pick the **Key type**. Keep the first one unless a server refuses it. 4. Press **Generate SSH key**. dPanel generates the key pair and keeps the private half encrypted. [Screenshot: The SSH keys page with the first-time guide and four keys shared with the team] The private half is never shown, copied or sent anywhere. Open a key to see its public half and fingerprint. **Create a server with this key** takes you straight to the create-server page. ## Connect a cloud account The page is called **Cloud accounts**. In the sidebar it is **Cloud Projects**. 1. In the sidebar, open **Cloud Projects**. 2. Press **Connect a cloud account**. 3. Pick your provider and paste the credential it gives you. Each provider's page shows how to create one with the least access: [AWS](../servers/cloud-providers/provider-aws.md), [Google Cloud](../servers/cloud-providers/provider-gcp.md), [IDCloudHost](../servers/cloud-providers/provider-idcloudhost.md), [DigitalOcean](../servers/cloud-providers/provider-digitalocean.md), [Alibaba Cloud](../servers/cloud-providers/provider-alibabacloud.md), [Tencent Cloud](../servers/cloud-providers/provider-tencent.md). 4. Save. dPanel stores the key encrypted and never shows it again. See [Cloud credentials and security](../servers/cloud-providers/cloud-credentials-security.md). dPanel then reads which regions, sizes and images your account may launch, so the create-server form only offers real options. [Screenshot: The Cloud accounts page listing six connected provider accounts, all Ready] :::info[Who pays] dPanel does not resell servers. Machines are created inside your own provider account, and your provider bills you directly. ::: ## Status of a cloud account | Status | Meaning | | ------------------------------- | --------------------------------------------- | | Ready | dPanel can launch servers with it | | Waiting to connect / Connecting | dPanel is checking the credentials | | Could not connect | The key was refused. Check it at the provider | ## Sharing and removing - A key or account created in a team workspace is shared with that team: **Who can use it** reads **Shared with** and the team's name. One created in your personal workspace is yours alone. - The **Owner** column names the person who created it; their name links to their public profile. - A key or account stays in the workspace it was created in. It cannot be moved to another workspace. - **Update credentials**, in the **More** (⋯) menu on a cloud account's row, replaces the key inside the account, for example after you rotate it at the provider. Servers launched with it keep working. See [Rotating a credential](../servers/cloud-providers/cloud-credentials-security.md#rotating-a-credential). - **Delete**, in the same menu, disconnects the cloud account: dPanel forgets the API key after you confirm **Disconnect cloud account**. Servers already running at the provider keep running. ## What happens next Launch or connect your first server. [Before you start](../servers/before-you-start.md) explains key types and provider credentials in more detail, and [Create a cloud server](../servers/cloud-providers/create-a-cloud-server.md) walks through the form. You can also ask **Ask dPanel** to list your keys and cloud accounts and launch a server with them; see [Prompt cookbook](../ai/prompt-cookbook.md). ## Frequently asked questions ### Do I need a cloud account to use dPanel? No. A cloud account is only for launching a new server from dPanel. To use a server you already rent, the SSH key is enough. See [Connect your own server](../servers/connect-your-own-server.md). ### Can I download the private key? No. The private half stays encrypted in dPanel and is never shown. To sign in yourself, add your own public key to the server. See [Connect over SSH](../servers/connect-over-ssh.md). ### Is Secret Managers a place for passwords and API keys? Not today. **Secret Managers** holds SSH keys only. Keep application passwords in the application's [environment variables](../applications/environment-variables.md). ### Which key type should I pick? The first one, for current servers. Pick the other only if an older server refuses the key. --- # Ask dPanel (AI assistant) Source: https://dnocs.devetek.app/docs/getting-started/ask-dpanel Ask dPanel is the AI assistant built into dPanel. Open it from any page, ask in plain language, and approve the changes it proposes. Start here in two minutes. **Ask dPanel** is the AI assistant built into dPanel. Press **Ask dPanel** at the bottom right of any page, ask a question or describe what you want in plain language, and it answers from your workspace and this documentation. Any change it prepares waits on a card until you press **Approve**. [Screenshot: The dPanel assistant panel open beside the dashboard, with three example questions] ## Start in two minutes 1. Press **Ask dPanel** at the bottom right of any page. The **dPanel assistant** panel opens. 2. Press an example question, such as **Which of my servers are stopped?**, or type your own in **Ask about your servers, apps, domains…**. 3. Press Enter. While it works, the panel says **Checking dPanel…**. 4. Read the answer. **Checked:** under it lists what the assistant looked at. 5. When it proposes a change, read the card marked **Waiting for your approval**, then press **Approve** or **Reject**. The full walkthrough, with screenshots, is [Your first AI conversation](../ai/first-conversation.md). ## What you can ask - "How do I connect my own server?" (answered from the docs, with a link) - "Why is application Shop failing on server 145?" - "On server 145, create a MariaDB database named wordpress with a user named wp." - "Put application Shop on shop.example.com with HTTPS." - "On server 145, allow TCP port 8080 and apply the firewall." More in the [prompt cookbook](../ai/prompt-cookbook.md). ## Everything about the assistant The [AI assistant](../ai/overview.md) section covers it in full: - [What Ask dPanel is](../ai/overview.md): what it can and cannot do, and how it keeps you safe. - [Approve or reject changes](../ai/approvals-and-secrets.md): reading cards, secrets, and what happens when you close the chat. - [Diagnose problems with AI](../ai/diagnose-problems.md): let it find why something fails. - [Use AI in the terminal](../ai/ai-in-the-terminal.md): `dnocs ai chat` and `dnocs ai approve`. - [Use your own AI agent](../ai/your-own-ai-agent.md): Claude Code, Cursor and others, plus `llms.txt`. - [AI limits and privacy](../ai/limits-and-privacy.md): what it sees, stores and sends. ## Frequently asked questions ### Can the assistant change my servers without asking? No. Questions only read. Every change waits for you to press **Approve** on its card. ### Can it see other workspaces or other people's data? No. It works in your current workspace, with your own access, exactly like the pages you open yourself. ### Should I type passwords in the chat? Never. Messages go to an AI model service. When a change needs a password, the card gives you a field for it instead. See [Approve or reject changes](../ai/approvals-and-secrets.md). --- # Glossary Source: https://dnocs.devetek.app/docs/getting-started/glossary Plain one-sentence definitions of the words used in dPanel and its docs, from server, SSH key and module to load balancer, DNS, HTTPS, firewall and cluster. This glossary explains, in one plain sentence each, the words you meet in dPanel and in this documentation. If a page uses a word you don't know, look it up here. You can also ask **Ask dPanel**, the AI assistant, "What is a load balancer?". See [Ask dPanel](../ai/overview.md). ## Servers and software ### Server A computer that is always on and connected to the internet, which runs your website or app for visitors; in dPanel you connect one you have or launch a new one. See [Servers](../servers/overview.md). ### VM (virtual machine) or VPS A server rented from a cloud provider that runs as software on the provider's bigger machines; to you it behaves like a normal computer. ### Cloud provider A company that rents out servers by the hour or month, such as AWS, Google Cloud, DigitalOcean, IDCloudHost, Alibaba Cloud or Tencent Cloud. See [Cloud providers](../servers/cloud-providers/index.md). ### Cloud project (cloud account) The connection between dPanel and your account at a cloud provider, which lets dPanel launch servers there for you. See [SSH keys and cloud projects](./ssh-keys-and-cloud-projects.md). ### Ubuntu The free Linux operating system dPanel installs and expects on servers. ### SSH The secure way to log in to a server over the internet and run commands on it. ### SSH key A pair of matching files that lets a computer log in to a server over SSH without a password; the public half goes on the server and the private half stays secret. ### Agent dPanel's small program on each server, which reports the server's health and runs the jobs dPanel sends it. ### Server setup The first job dPanel runs on a new server: it installs the agent and prepares the machine; you can run it again if it failed. ### Module A piece of software dPanel installs on a server for you, such as PHP, Node.js, MariaDB, PostgreSQL, Caddy or Docker. See [Install software](../servers/install-software.md). ### Runtime (language) The software that runs code written in one language, such as PHP for WordPress or Node.js for a JavaScript app. ### Database The program that stores an application's data in tables, such as MariaDB, PostgreSQL, MongoDB or Redis. ### DB Manager dPanel's web tool for opening a MariaDB or PostgreSQL database in the browser, to browse, query, import or export data. ### Port A numbered door on a server that one program listens on, such as 443 for websites over HTTPS or 5432 for PostgreSQL. ### Firewall The guard on a server that decides which ports people can reach; dPanel manages Ubuntu's built-in firewall, ufw. See [Firewall](../servers/firewall.md). ### TCP and UDP The two basic ways programs send data over a network; websites and databases use TCP, while some games and voice services use UDP. ## Applications ### Application Your code, in a GitHub repository, that dPanel builds and runs on a server, such as a WordPress site or a Laravel app. See [Applications](../applications/overview.md). ### Repository The folder of code, with its history, that you keep on GitHub. ### Branch and commit A commit is one saved version of your code; a branch is a line of commits, such as `main`. ### Build (artifact) Your code turned once into a ready-to-run package from one commit; dPanel keeps every build so you can go back to an earlier one. ### Deployment (release) A build placed on a server and started, so visitors can use it. ### Rollback Going back to an earlier build when a new one has a problem. See [Deployments and rollback](../applications/deployments-and-rollback.md). ### Application definition The saved description of how to build and run your app: its language, build commands and start command, kept in dPanel or in a `.devetek` folder in your repository. ### Environment variable A named setting, such as `APP_ENV=production` or a database password, that your app reads when it starts. See [Environment variables](../applications/environment-variables.md). ### Service A program that Linux starts for you, keeps running in the background and restarts after a reboot; dPanel runs each deployment as one. ### Log A program's running diary, one line per event, which you read to find out what happened or what went wrong. See [Reading logs](../logs/reading-logs.md). ## Traffic and domains ### Domain A name people type to reach your site, such as `example.com`, which you buy from a domain registrar. ### Subdomain A name under your domain, such as `shop.example.com`. ### DNS The internet's address book, which turns a domain name into the address of the server that answers it. ### DNS record One entry in that address book, such as "shop.example.com points to 203.0.113.10". See [DNS records](../networking/dns-records.md). ### IP address The number that identifies a server on the internet, such as `203.0.113.10`. ### TLS, SSL and HTTPS HTTPS is the secure version of a web address, shown with a padlock; it relies on a TLS certificate (often still called SSL), which dPanel gets free from Let's Encrypt and renews for you. ### Load balancer The front door of your website: it answers on your domain, handles HTTPS, and passes each visitor's request to your application. See [Load balancers](../networking/load-balancers.md). ### Gateway The server a load balancer runs on, which receives the visitors' traffic. ### Engine The web server program a load balancer uses on its gateway: Caddy, Apache APISIX or HAProxy. ### L4 and L7 L7 load balancers route web traffic by address and path; L4 load balancers pass raw TCP or UDP connections, for example to a database. ### Cloudflare proxying An option that sends visitors through Cloudflare's network before your server, hiding the server's address. ## Organising your work ### Workspace A separate space with its own servers, applications and settings: your personal workspace, or a team workspace you share. See [Workspaces](./workspaces.md). ### Team The people who share a team workspace, each with a role such as Owner, Admin, Developer or Viewer that decides what they may do. See [Teams](../teams/teams.md). ### Job (execution) One piece of work dPanel runs for you, such as setting up a server, installing a module or deploying a build; each one is recorded with its result. ### Worker The program that carries out a workspace's jobs on your servers; dPanel's shared workers do it by default, or you can use your own. See [Workers](../workers/overview.md). ### GitHub Actions GitHub's built-in way to run scripts, called workflows, on GitHub's machines; one way to run a private worker. ### Server group A named set of servers you act on together. See [Server groups and clusters](../clusters/overview.md). ### Cluster and Kubernetes Kubernetes is a system that runs containers across several servers as one; a cluster is such a group of servers, built in dPanel with k3s or RKE2. ### Container An application packed together with everything it needs, so it runs the same on any server; Docker is the best-known tool for them. ### IaC (infrastructure as code) Writing down how servers are set up as files, so the same setup can be repeated; dPanel records its work as Ansible files. ## The AI assistant ### Ask dPanel The AI assistant built into dPanel, which answers questions and proposes changes for you to approve. See [Ask dPanel](../ai/overview.md). ### Approval card The box in the chat that shows a change the assistant proposed, with **Approve** and **Reject** buttons. See [Approve or reject changes](../ai/approvals-and-secrets.md). ### dnocs (CLI) dPanel's command-line tool, which you run in a terminal to work with dPanel and its assistant. See [Use AI in the terminal](../ai/ai-in-the-terminal.md). ### llms.txt A plain-text index of this documentation for AI tools; `llms-full.txt` holds every page. ## Frequently asked questions ### A word I need is missing. What do I do? Ask **Ask dPanel** "What does … mean in dPanel?". It answers from this documentation. ### Are "build" and "artifact" the same thing? Yes. dPanel's pages say build or artifact for the same ready-to-run package made from one commit. ### Are "deployment" and "release" the same thing? Yes. Both mean a build placed on a server and started. --- # Ask dPanel, the AI assistant Source: https://dnocs.devetek.app/docs/ai/overview Ask dPanel is the AI assistant built into dPanel. Ask in plain language; it reads your workspace, answers, and proposes changes that run only after you approve. **Ask dPanel** is the AI assistant built into dPanel. You type a question or a request in plain language, such as "Why is my website down?" or "Create a MariaDB database for WordPress", and it looks at your workspace, answers, and prepares any change for you to approve. Nothing changes until you press **Approve**. You don't need to know server commands to use it. If you have never run a server before, the assistant is a good way to learn: ask it what something means, and it answers from this documentation with a link to the page. [Screenshot: The dPanel assistant panel open beside the dashboard, with three example questions] ## Where to find it Press **Ask dPanel** at the bottom right of any page after you sign in. The **dPanel assistant** panel opens on the right. On a phone the button shows only its chat icon. [Screenshot: The round Ask dPanel button at the bottom right of the dashboard] You can also talk to the same assistant from a terminal with `dnocs ai chat`. See [Use AI in the terminal](./ai-in-the-terminal.md). ## What it can do | You want to… | What the assistant does | | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Learn how to do something in dPanel | Searches this documentation and answers with the steps and a link to the page | | See what you have | Lists and explains your servers (with CPU, memory and disk), applications, deployments, databases, domains, DNS records, load balancers, SSH keys, cloud accounts, server groups, clusters, workers and jobs | | Find out why something fails | Reads build and runtime logs, job errors, load balancer logs and certificates, then names the likely cause and the fix. See [Diagnose problems with AI](./diagnose-problems.md) | | Launch or set up a server | Proposes a new cloud server (with an estimated cost), runs server setup again, or installs software such as PHP, Node.js, MariaDB or PostgreSQL | | Add a database for your app | Proposes a MariaDB or PostgreSQL database and user; dPanel generates the password and shows it to you once. It also gives you the **DB Manager** link to browse the data | | Create, configure and deploy an application | Reads your GitHub repository, asks how to build and run it, picks a free port for you, sets environment variables, and proposes the deploy | | Publish an app on a domain | Proposes a load balancer with free HTTPS on Caddy, APISIX or HAProxy, or a TCP/UDP (L4) load balancer for something like a database | | Open or close a port | Proposes firewall rules and the apply that puts them on the server, and warns you when the firewall would block a new TCP/UDP load balancer | | Group servers or build a Kubernetes cluster | Proposes server groups and k3s or RKE2 clusters, and can install a failed cluster again | | Choose where jobs run | Tells you whether the workspace uses shared or private workers, and proposes switching | | See who changed something | Reads the workspace's audit history (needs the workspace admin level) | | Clean up | Proposes deletes in the right order, and tells you what must go first | See the [prompt cookbook](./prompt-cookbook.md) for ready-to-copy requests for each of these. ## What it cannot do - **It cannot change anything without you.** Every change waits on an approval card. See [Approve or reject changes](./approvals-and-secrets.md). - **It cannot see your secrets.** Passwords, tokens, keys and the values of environment variables are hidden from it; it sees variable names only. - **It cannot log in to your servers.** It has no shell and no SSH access. It works only through dPanel, as you. - **It cannot read the data inside your databases** or run SQL. It gives you the DB Manager link instead. - **It cannot do what your account cannot do.** Your role in the workspace still applies. See [Members and roles](../teams/members-and-roles.md). - **It only helps with dPanel.** Questions about anything else get a polite "I can only help with dPanel". - **Some things are not in chat yet**, such as creating SSH keys or DNS records, editing team members, or connecting a cloud account. It tells you so and points you to the right page. More in [AI limits and privacy](./limits-and-privacy.md). ## How it keeps you safe 1. **Reading runs right away.** Questions only read dPanel, so you get an answer at once. 2. **Changes wait for you.** Anything that creates, changes, deletes or costs money appears as a card marked **Waiting for your approval**, with exactly what will happen. It runs only when you press **Approve**, exactly as shown, and only once. 3. **Only you can approve.** A conversation belongs to the person who started it. Your teammates cannot see it or approve its cards, and the change runs with your own access. 4. **Secrets stay out of the chat.** A password you must supply is typed into a field on the card, never into the chat. A password dPanel generates for you is shown once on the card after you approve. 5. **Approvals expire.** An unanswered card expires after 24 hours. Ask again to get a fresh one. 6. **Everything is recorded.** Approved changes start ordinary dPanel jobs, which appear in the workspace's activity and audit history like any other change. ## Where to go next - [Your first AI conversation](./first-conversation.md): a short walkthrough with screenshots. - [Prompt cookbook](./prompt-cookbook.md): real requests for common tasks. - [Approve or reject changes](./approvals-and-secrets.md): how to read a card. - [Use your own AI agent](./your-own-ai-agent.md): let Claude Code, Cursor or another agent work through dPanel. - New to the words? See the [Glossary](../getting-started/glossary.md). ## Frequently asked questions ### Can asking a question cost me money? No. A question only reads dPanel. Only an approved change can cost money, and it costs what it would if you made it yourself: a new cloud server, for example, is billed by your cloud provider. The assistant says so before you approve, with an estimated price. ### Can the assistant change my servers without asking? No. Questions only read. Every change waits for you to press **Approve** on its card, or to run `dnocs ai approve` in a terminal. ### Which workspace does it work in? The one you are in when you ask. Switch workspace first to ask about another one. See [Workspaces](../getting-started/workspaces.md). ### Can I ask in Indonesian? Yes. Ask in Indonesian or English and it answers in the same language. ### Can my teammates see my conversations? No. A conversation is private to the person who started it. Teammates see the changes you approved, because they run as ordinary dPanel jobs. --- # Your first AI conversation Source: https://dnocs.devetek.app/docs/ai/first-conversation A step-by-step first chat with Ask dPanel, the dPanel AI assistant. Open the panel, ask a question, read the answer, and see what it checked. Your first conversation with **Ask dPanel**, the dPanel AI assistant, takes about two minutes: open the panel, ask a question, and read the answer. This page walks through it with screenshots. Nothing you do here changes your servers. You need a dPanel account and to be signed in. See [Sign in](../getting-started/sign-in.md). It helps, but is not required, to have one server; without one, ask a how-to question instead. ## 1. Open the assistant 1. Sign in and open any page, such as the **Dashboard**. 2. Press **Ask dPanel** at the bottom right. 3. The **dPanel assistant** panel opens. Under **Ask about your infrastructure** it offers three example questions. [Screenshot: The empty assistant panel with the heading Ask about your infrastructure and three example questions] The line under the title, **Works in your current workspace. Changes run only after you approve them.**, is the whole safety model in one sentence. The assistant sees only the workspace shown at the top of the sidebar. See [Workspaces](../getting-started/workspaces.md) if you have more than one. ## 2. Ask a question 1. Press **Which of my servers are stopped?**, or type your own question in **Ask about your servers, apps, domains…**. 2. Press Enter to send. Shift+Enter starts a new line instead. 3. While it works, the panel says **Checking dPanel… longer tasks can take a minute or two.** ## 3. Read the answer The answer appears under your question, often as a short table with each resource's ID and name. [Screenshot: The assistant answering that no servers are stopped, with a table of two ready servers and the line Checked: server list] Under the answer, **Checked:** lists what the assistant looked at to answer, such as **server list**. It is how you know the answer comes from your real workspace and not from a guess. The IDs in the answer are the same numbers you see in dPanel, so you can find the server or application yourself, or use the ID in your next question: "Show me the details of server 140". ## 4. Ask a how-to question The assistant also knows this documentation. Ask how to do something and it answers with the steps and a link to the page. [Screenshot: The assistant explaining how to roll back an application in five numbered steps, ending with a Docs link and Checked: docs search] Good first how-to questions: - "What is a load balancer, and do I need one?" - "How do I connect my own server to dPanel?" - "How do I roll back an application to an earlier build?" - "What does the Builds view on an application show?" ## 5. Keep going, or start over - **Ask a follow-up.** The assistant remembers the conversation, so "and which one uses the most disk?" works after a question about servers. - **Start over.** Press **New conversation** at the top of the panel to clear the chat. Starting a new conversation does not undo anything. - **Close the panel.** Press the **×**. dPanel remembers your last conversation for each workspace in this browser, so it is there when you open the panel again, with any card still waiting for approval. ## 6. Try your first change (optional) When you are ready, ask for something small, such as "On server 140, create a MariaDB database named blog with a user named blog". The assistant checks what it needs and shows a card marked **Waiting for your approval**. Read it, then press **Approve** to run it or **Reject** to drop it. See [Approve or reject changes](./approvals-and-secrets.md) before your first approval. ## Tips for good questions - **Be specific.** "Why did the last build of My Shop fail?" beats "Something is broken". - **Name things.** Use the server, application or domain name, or its ID. - **Say what you want, not how.** "Put my app on shop.example.com with HTTPS" is enough; the assistant works out the steps. - **Never paste a password, token or key** into the chat. See [AI limits and privacy](./limits-and-privacy.md). ## Frequently asked questions ### The panel says "Sign in to use the assistant". What do I do? Press **Sign in**. The assistant works with your own dPanel access, so it needs you signed in. ### The panel says "The assistant isn't available yet". What now? dPanel could not reach the assistant service. Wait a moment and press **Check again**. ### An answer failed with "The assistant could not answer this message". Is something broken? Usually not. Press **Try again**. If it keeps failing, ask a shorter, more specific question. ### Why does a long question take a minute or two? The assistant may read several things before it answers, such as a deployment, its build log and the server's disk usage. Each read takes a moment. --- # Prompt cookbook Source: https://dnocs.devetek.app/docs/ai/prompt-cookbook Copy-ready requests for Ask dPanel, the dPanel AI assistant: deploy WordPress or Laravel, add a database, open a port, add a domain, and fix a failing app. This cookbook collects requests you can copy into **Ask dPanel**, the dPanel AI assistant, for common tasks. Replace the names and numbers with your own. Questions run at once; anything that changes your workspace comes back as a card for you to approve. See [Approve or reject changes](./approvals-and-secrets.md). :::tip[How to write a good request] Say **what** you want and give the facts the assistant cannot know: which server, which repository and branch, which domain. Use IDs when you have them (`server 145`, `application 35`). You don't need to know the commands; the assistant works out the steps and asks when something is missing. ::: ## Find your way around | Goal | Request | | ------------------------- | ------------------------------------------------------------ | | See your servers | `Which of my servers are stopped?` | | See what runs where | `Which applications run on server 145, and on which ports?` | | Check recent jobs | `Did any job fail in the last 24 hours?` | | List domains | `List my domains and their DNS providers.` | | Check disk space | `Which of my servers is running out of disk?` | | Learn a concept | `What is a load balancer, and do I need one for my website?` | | Find a page in dPanel | `Where do I change an application's build commands?` | | See who changed something | `Who deleted a load balancer in this workspace this week?` | ## Launch a server ```text Create a VM in my Google Cloud project 7 named web-1: Ubuntu 24.04, 2 vCPU and 4 GB of memory, the cheapest machine type, 30 GB disk, region asia-southeast1, with SSH key 37. ``` The assistant looks up your cloud accounts, regions, machine types and SSH keys, then proposes the server with an **estimated** price. The real price is what your cloud provider charges. A new server takes 10 to 20 minutes to be ready; ask "Is server web-1 ready?" to check. To set up a server again after a failed setup: `Run server setup again on server 145.` Prefer the forms? See [Create a cloud server](../servers/cloud-providers/create-a-cloud-server.md). ## Install software on a server ```text Server 145 is ready. Propose installing MariaDB, PHP 8.5 and FrankenPHP on it. ``` Ask "Which versions of PostgreSQL can I install?" first if you are not sure. Approve one install at a time and wait for it to finish. See [Install software](../servers/install-software.md). ## Add a database for your app ```text On server 145, create a MariaDB database named wordpress with a user named wp. ``` For PostgreSQL: `On server 145, create a PostgreSQL database named shop with a user named shop.` (PostgreSQL names are lowercase.) The server needs MariaDB or PostgreSQL installed first; the assistant checks and proposes the install if it is missing. When you approve, dPanel creates the database and user and shows the generated password **once** on the card. Copy it straight away. To look inside your databases: `Which databases are on server 145? Give me the DB Manager links.` ## Deploy WordPress Ask in steps, approving each card and waiting for its job before the next: 1. `Server 145 is ready. Propose installing MariaDB, PHP 8.5 and FrankenPHP on it.` 2. `On server 145, create a MariaDB database named wordpress with a user named wp.` Save the generated password. 3. `Create an application named Blog from https://github.com/dPanel-ID/wordpress-example, branch main. Language PHP 8.5 with FrankenPHP, build command ./scripts/build.sh, start command ./scripts/start.sh. Runtime variables: WORDPRESS_DB_HOST=127.0.0.1:3306, WORDPRESS_DB_NAME=wordpress, WORDPRESS_DB_USER=wp, WORDPRESS_HOME=https://blog.example.com, WORDPRESS_SITEURL=https://blog.example.com, and WORDPRESS_DB_PASSWORD as a secret I type when approving.` On the card, type the password you saved in step 2. 4. `Deploy application Blog from main to server 145.` 5. `Put Blog on blog.example.com with HTTPS.` The step-by-step version with screenshots is [Deploy WordPress](../tutorials/deploy-wordpress.md). ## Deploy Laravel Ask in steps, approving each card and waiting for its job before the next: 1. `Server 145 is ready. Propose installing PostgreSQL, PHP 8.5, FrankenPHP and Node.js on it.` 2. `On server 145, create a PostgreSQL database named laravel with a user named laravel.` Save the generated password. 3. Create the application: ```text Create an application named Shop from https://github.com/dPanel-ID/laravel-example, branch main. Language PHP 8.5 with Node.js as an extra runtime, build command ./scripts/build.sh, start command ./scripts/start.sh. Runtime variables: APP_ENV=production, APP_DEBUG=false, APP_URL=https://shop.example.com, DB_CONNECTION=pgsql, DB_HOST=127.0.0.1, DB_PORT=5432, DB_DATABASE=laravel, DB_USERNAME=laravel, OCTANE_SERVER=frankenphp, and DB_PASSWORD as a secret I type when approving. ``` - If the repository has no `.devetek` definition, the assistant asks for the language, version, build commands and start command rather than guessing. It may suggest values from your `composer.json`, `package.json` or `.env.example`; confirm them. - **Don't choose a port.** dPanel picks a free port on the server when it deploys, and tells you which. - If the build also uses Node.js (for example `npm` to build front-end assets), say so, as above. dPanel puts only the runtimes declared on the application on the build's path; the assistant installs Node.js and declares it for you. Then: `Deploy application Shop from main to server 145.` and `Put Shop on shop.example.com with HTTPS.` The full walkthrough is [Deploy Laravel](../tutorials/deploy-laravel.md). ## Set environment variables | Goal | Request | | --------------------- | -------------------------------------------------------------------------------------------- | | Add a normal variable | `On application Shop, set the runtime variable APP_DEBUG=false.` | | Add a secret | `On application Shop, set MAIL_PASSWORD as a secret runtime variable I type when approving.` | | Add a build variable | `On application Shop, set the build variable NODE_ENV=production.` | | Check what is set | `Which environment variables does application Shop have?` (names only, never values) | Never write a secret value in the chat. Ask for it "as a secret I type when approving", and type the value in the field on the card. A change applies from the next deploy, so the assistant offers to deploy afterwards. See [Environment variables](../applications/environment-variables.md). ## Put an app on a domain ```text Put application Shop on shop.example.com with HTTPS. ``` - With a domain managed in dPanel, the assistant also creates the DNS record. See [Domains and DNS](../networking/domains-and-dns.md). - To pick the engine: `Use the APISIX engine.` (Caddy is the default; HAProxy is also available.) - Cloudflare proxying stays off unless you ask: `Proxy it through Cloudflare.` - The application needs a ready deployment first. To reach a database from outside with a TCP load balancer: ```text Create a TCP load balancer named pg-ext on server 145 that exposes its PostgreSQL on port 15432, reachable only from 203.0.113.7. ``` If the server's firewall is on, the assistant warns you that the port must be allowed too and offers the rule. See [Load balancers](../networking/load-balancers.md). ## Open or close a port | Goal | Request | | -------------------------- | ----------------------------------------------------------------------- | | See the rules | `Show the firewall rules on server 145.` | | Preview what would change | `What would change if I applied the firewall on server 145?` | | Open a port | `On server 145, allow TCP port 8080 from anywhere, then apply it.` | | Open a port to one address | `On server 145, allow TCP port 5432 only from 203.0.113.7, then apply.` | | Close a port | `On server 145, remove the rule for port 8080 and apply the firewall.` | Adding or removing a rule only changes the saved list; **applying** puts it on the server, so you approve two cards. SSH, and HTTP/HTTPS on servers with a load balancer engine, always stay open. See [Firewall](../servers/firewall.md). ## Read logs | Goal | Request | | -------------------- | ------------------------------------------------------------------ | | An app's recent logs | `Show the last errors in the runtime logs of application Shop.` | | Why a build failed | `Show the build log of the last failed build of application Shop.` | | Traffic to a domain | `Show the last requests to shop.example.com and any 5xx errors.` | | HTTPS certificate | `Check the HTTPS certificate of shop.example.com.` | See [Reading logs](../logs/reading-logs.md) to read them yourself. ## Debug a failing app ```text Why is application Shop failing on server 145? ``` ```text My site shop.example.com shows a 502 error. Find out why. ``` The assistant reads the deployment, its build and runtime logs and the server's usage, quotes the lines that matter, and proposes a fix. More in [Diagnose problems with AI](./diagnose-problems.md). ## Clusters, groups and workers | Goal | Request | | ---------------------- | ------------------------------------------------------------------------------------- | | See the options | `Which cluster engines can I use?` | | Build a cluster | `Create a k3s cluster named lab with server 150 as server and 151 and 152 as agents.` | | Retry a failed install | `Run the install of cluster 12 again.` | | Group servers | `Create a server group named web with servers 145 and 146.` | | Where jobs run | `Do my jobs run on shared or private workers?` | | Switch workers | `Switch this workspace to private workers.` | See [Server groups and clusters](../clusters/overview.md) and [Workers](../workers/overview.md). ## Clean up ```text Delete application Old Shop and everything it needs removed first. ``` Deletes cannot be undone. The assistant confirms the resource, shows its ID and name, and proposes deletes in the order dPanel accepts: load balancer, deployments, builds, then the application. Servers, load balancers and deployments are deleted in two steps: the first cleans them up, the second removes the record. ## Frequently asked questions ### Do I have to use these exact words? No. They are examples. Write the way you speak, in English or Indonesian; the assistant asks when something is missing. ### Can I ask for several changes at once? Yes. The assistant shows one card per change. Approve them one at a time and wait for each job, because dPanel runs one job at a time per server. ### What if I don't know an ID? Use the name, or ask first: "Which applications do I have?" The assistant never guesses an ID; if a name matches more than one thing, it asks which one. ### Why didn't the assistant pick a port for my app? It leaves the port to dPanel, which picks a free one on the server when it deploys. The deployment and the card tell you which port it took. --- # Approve or reject changes Source: https://dnocs.devetek.app/docs/ai/approvals-and-secrets How to read an Ask dPanel approval card, approve or reject it, type secrets safely, save generated passwords, and what happens when you close the chat. When you ask **Ask dPanel**, the dPanel AI assistant, for a change, it never makes the change by itself. It shows an **approval card** that says exactly what will happen, and the change runs only when you press **Approve**. Press **Reject** and nothing changes. ## What needs approval | Runs right away (read only) | Waits on a card (changes something) | | ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | | Listing and explaining servers, apps, domains, load balancers | Launching a cloud server, running server setup again | | Reading logs, certificates, jobs and audit history | Installing software (modules), creating databases | | Searching the documentation | Creating, updating or deploying an application, setting environment variables | | Checking what a firewall apply would change | Creating or re-routing load balancers, adding or removing firewall rules, applying the firewall | | Refreshing a server's module list from its agent | Creating server groups and clusters, switching between shared and private workers | | | Every delete | ## Read the card [Screenshot: An approval card marked Waiting for your approval, describing a change to an application's environment, with a field for the secret value and the Approve and Reject buttons] A card has four parts: 1. **The status**, at the top: **Waiting for your approval** means nothing has happened yet. 2. **The summary**: what will run, on which server or application, with which names and settings. For a cloud server it includes the size and the assistant's price estimate. For a load balancer it names the domain and the DNS record it creates. 3. **Secret fields**, only when the change needs a value you must supply. See [Secrets you type](#secrets-you-type). 4. **Approve** and **Reject**. Above the card, the assistant's message repeats the plan in plain words and gives the action ID, such as `aipa_dblto7q0ehgehnm7fugg`. You need that ID only in a terminal. Before you press **Approve**, check: - Is it the right server, application or domain? Compare the ID and name with what you see in dPanel. - Is it what you asked for, and nothing more? - For a delete: are you sure? Deletes cannot be undone. ## Approve or reject 1. Read the card. 2. Fill in any secret fields. 3. Press **Approve** to run the change, or **Reject** to drop it. [Screenshot: A card marked Rejected; nothing was changed, followed by the assistant confirming that no change was made] The card's status changes as the change runs: | Status | Meaning | | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | **Waiting for your approval** | Nothing has changed yet | | **Applying your decision** | dPanel is acting on your press of Approve or Reject | | **Approved and started** | dPanel started the change. Long jobs, such as a deploy, keep running; ask the assistant for progress | | **Approved; dPanel is still applying it** | The change is still being applied | | **Approved, but it did not start** | dPanel refused the change; the chat says why | | **Rejected; nothing was changed** | You rejected it | | **Expired; ask the assistant to propose it again** | Nobody answered within 24 hours | After an approval, the assistant reports what happened and often proposes the next step on a new card, such as the deploy after creating an application. Approve one change at a time, and wait for each job to finish before the next on the same server: dPanel runs one job at a time per server. ## Who can approve - **Only the person who started the conversation.** Conversations are private; your teammates cannot see them or approve their cards. - **With your own access.** The change runs as you, with your role in the workspace. If your role does not allow it, the card ends as **Approved, but it did not start** and the chat explains why. See [Members and roles](../teams/members-and-roles.md). - **Exactly once, exactly as shown.** The arguments are frozen when the card is created. Asking for the same change again shows the same card instead of a second one, so a change cannot run twice by accident. ## Secrets you type Some changes need a value only you know, such as the database password an application connects with. The assistant never asks for it in the chat. Instead the card shows a field for each value, under **Type the secret values below. They are sent with your approval only and never shown to the assistant.** 1. Type the value in the field, for example `WORDPRESS_DB_PASSWORD (runtime)`. 2. Press the eye icon (**Show value**) to check what you typed. 3. **Approve** stays grey until every field is filled. The value goes with your approval straight to dPanel. The assistant never sees it; it knows only the variable's name. ## Secrets dPanel generates When a change creates a password, such as the password of a new database user or a new database's admin password, dPanel generates it. After you press **Approve**, the card shows **Generated secrets: save them now**, with each value and a **Copy** button. :::warning[You see a generated password once] dPanel keeps no copy. Closing or reloading the panel hides the values for good. Copy each one into your password manager before you do anything else. You can change a database password later in DB Manager. ::: [Screenshot: An approval card for a new MariaDB database, saying dPanel generates the password and shows it once with the approval result] ## If you close the chat - **The conversation stays.** dPanel remembers your last conversation for each workspace in this browser. Open the panel again and it is there. - **Waiting cards come back.** A card still waiting when you closed the panel or reloaded the page shows **Approve** and **Reject** again when you reopen it. - **They stay approvable for 24 hours**, even when the panel is closed. After that the card shows **Expired; ask the assistant to propose it again**. - **Lost a card?** If you started a new conversation or switched browser, ask "Show me the approval for the database again". The assistant proposes the same change, and you get the same card back while it is still waiting. - **Generated secrets do not come back.** That is why you copy them at once. ## Approve from a terminal Every card has an action ID. In a terminal, run `dnocs ai approve ` to approve it or `dnocs ai approve --reject ` to reject it. See [Use AI in the terminal](./ai-in-the-terminal.md). ## Frequently asked questions ### What if I approve something by mistake? Ask the assistant to undo it, for example "Delete the database docs_demo I just created on server 140". The undo is a new change, so it comes back as a card too. Deletes cannot be undone, so read delete cards with extra care. ### Can I approve a change by typing "yes" in the chat? No. Only the **Approve** button or `dnocs ai approve` approves a change. Typing "yes" just sends a message. ### Why is the Approve button grey? The card has secret fields that are still empty. Fill in every field. ### Can a teammate approve a change I asked for? No. Only the person who started the conversation can approve its cards. A teammate can ask the assistant for the same change in their own conversation. ### I wrote a password in the chat by mistake. What now? Treat it as exposed: the message has already gone to the AI service. Change that password, and next time ask for it "as a secret I type when approving". --- # Diagnose problems with AI Source: https://dnocs.devetek.app/docs/ai/diagnose-problems Let Ask dPanel, the dPanel AI assistant, find why an app, build, server or load balancer fails. It reads logs and jobs, quotes the cause and proposes the fix. When something in dPanel fails, ask **Ask dPanel**, the dPanel AI assistant, "Why?". It gathers the evidence a person would: the deployment, its build and runtime logs, the failed job, the server's CPU, memory and disk, and for a website the load balancer's logs and HTTPS certificate. Then it quotes the lines that matter, names the likely cause, and proposes a fix you can approve. You don't need to know where the logs are. That is the point. ## Ask about the problem Describe what you see, and name the thing that fails: - `Why is application Shop failing on server 145?` - `Why did the last build of application Shop fail?` - `My site shop.example.com shows a 502 error. Find out why.` - `Did any job fail in the last 24 hours? Tell me why the most recent one failed.` - `Server 145 feels slow. Is it out of memory or disk?` - `Is the load balancer for shop.example.com healthy? Check its certificate and recent errors.` ## Read the diagnosis [Screenshot: The assistant checking a load balancer: tables for its status and its HTTPS certificate, the recent requests with their status codes, and a verdict] A good diagnosis has three parts: 1. **The evidence**: the error line from a log, the failed job's message, or a number such as "disk 97% full". 2. **The likely cause**, in plain words. 3. **The fix**, in dPanel. When the fix is a change, such as updating the build command and deploying again, the assistant proposes it as a card for you to approve. If the evidence is not conclusive, the assistant says what it checked and what it could not tell. **Checked:** under the answer lists every source it read, such as **deployment get**, **application logs** and **server usage**. ## What it looks at | Problem | What the assistant reads | Typical fixes it proposes | | -------------------------------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------- | | A build failed | The build's log | Fix the build command or a missing runtime, then deploy again | | An app does not start or crashes | The deployment, the runtime log, the server's memory and disk | Fix the start command or an environment variable, then deploy again | | A website shows an error | The load balancer, its access logs and certificate, and the application behind it | Re-route the load balancer, or fix the application | | A job failed | The job and its error | Run server setup again, install a missing module, retry | | A server is slow or full | CPU, memory and disk usage | A bigger server, or removing old builds | | A port does not answer | The server's firewall rules and what an apply would change | Allow the port and apply the firewall | ## Follow a long job Builds, deploys, installs and server setup take minutes. After you approve one, the assistant checks it once and reports. It does not keep watching. Ask again for progress: - `Is the deploy of Shop finished?` - `Did the MariaDB install on server 145 succeed?` You can also follow jobs yourself. See [Reading logs](../logs/reading-logs.md) and [Application logs](../applications/application-logs.md). ## When to look yourself The assistant reads the same logs you can open, so it can miss what the logs do not say. Look yourself, or ask a person, when: - the answer says the evidence is not conclusive; - the problem is inside your application's own code; - the problem is outside dPanel, such as your domain registrar or a third-party service. See [Troubleshooting](../troubleshooting/faq.md) for common problems and their fixes. ## Frequently asked questions ### Can the assistant read the data in my database to find a bug? No. It cannot run SQL or read your data. It can give you the DB Manager link so you can look yourself. ### Can it log in to my server to check something? No. It has no shell or SSH access. It reads what dPanel and the dPanel agent on the server report, such as logs and usage. ### Will it fix the problem without asking? No. Every fix is a card that waits for your **Approve**. See [Approve or reject changes](./approvals-and-secrets.md). ### The assistant says it "needed too many steps". What do I do? Ask about one thing at a time, and name it: "Why did the last build of application Shop fail?" rather than "What is wrong with everything?". --- # Use AI in the terminal Source: https://dnocs.devetek.app/docs/ai/ai-in-the-terminal Install the dnocs command-line tool, sign in, and talk to the dPanel AI assistant from a terminal with dnocs ai chat and dnocs ai approve. The dPanel AI assistant also works from a terminal through **dnocs**, the dPanel command-line tool. `dnocs ai chat` sends a message and prints the answer; `dnocs ai approve` approves or rejects a change it proposed. It is the same assistant as **Ask dPanel** in the web app, with the same rules: questions run at once, changes wait for your approval. Use it when you prefer the keyboard, or when you want a script or your own AI coding agent to work with dPanel. See [Use your own AI agent](./your-own-ai-agent.md). ## Install dnocs dnocs is a single file for macOS and Linux, on Intel/AMD (`amd64`) and Apple Silicon or ARM (`arm64`) machines. It is published at [github.com/dPanel-ID/artifacts](https://github.com/dPanel-ID/artifacts/tree/main/cli), one folder per version, and the file `cli/LATEST` names the newest version. 1. Open a terminal. 2. Download the newest version for your machine: ```bash VERSION=$(curl -fsSL https://raw.githubusercontent.com/dPanel-ID/artifacts/main/cli/LATEST) OS=$(uname -s | tr '[:upper:]' '[:lower:]') ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') curl -fsSLo dnocs "https://raw.githubusercontent.com/dPanel-ID/artifacts/main/cli/$VERSION/dpanelprod-cli-$OS-$ARCH" ``` 3. Make it runnable and put it on your path: ```bash chmod +x dnocs sudo mv dnocs /usr/local/bin/dnocs ``` 4. Check that it works: `dnocs --help` lists the commands. Each version folder also holds a `SHA256SUMS` file, if you want to check the download's checksum. ## Sign in and pick a workspace 1. Sign in with your dPanel username. dnocs asks for your password without showing it: ```bash dnocs auth login -u your-username ``` 2. Check who you are: `dnocs auth info`. 3. List your workspaces and choose one. Everything after this happens in that workspace: ```bash dnocs workspace list dnocs workspace set --id 5209311491061018854 ``` `dnocs workspace reset` goes back to your personal workspace. ## Ask a question ```bash dnocs ai chat "Which load balancers do I have, and which engine does each use?" ``` dnocs prints **Asking the dPanel assistant…**, then the answer, the tools it used after **Checked:**, and the conversation ID: ```text You have 2 load balancers, both using the Caddy engine: | ID | Name | Domain | Server | Status | | 31 | shop | shop.example.com | web-1 (145) | ready | | 46 | blog | blog.example.com | web-1 (145) | ready | Checked: loadbalancer_list Conversation: aic_dbltova0ehgehnm7fvhg ``` To ask a follow-up in the same conversation, pass that ID: ```bash dnocs ai chat --conversation aic_dbltova0ehgehnm7fvhg "and which of them use Cloudflare proxying?" ``` Without `--conversation`, every `dnocs ai chat` starts a new conversation. ## Approve or reject a change When you ask for a change, the answer ends with the card's details and the two commands you can run: ```text Waiting for your approval: aipa_dbltp7i0ehgehnm7g01g Add a firewall rule on server 145: allow port 8080/tcp from any. It is stored only; the server changes when the firewall is applied. approve: dnocs ai approve aipa_dbltp7i0ehgehnm7g01g reject: dnocs ai approve --reject aipa_dbltp7i0ehgehnm7g01g Conversation: aic_dbltp6q0ehgehnm7fvug ``` - **Approve:** `dnocs ai approve aipa_…`. The change runs once, exactly as proposed, with your session. The assistant then reports the outcome, and may propose the next step. - **Reject:** `dnocs ai approve --reject aipa_…`. It prints `rejected` and nothing changes. ### Secrets in the terminal - **Secrets you type:** when a change needs a value only you know, `dnocs ai approve` asks for each one without showing what you type, for example `WORDPRESS_DB_PASSWORD (runtime): `. In a script, pipe one value per line: `printf '%s\n' "$DB_PASSWORD" | dnocs ai approve aipa_…`. - **Generated secrets:** a generated password is printed once, under **Generated secrets, shown only this once. Save them now:**. dPanel keeps no copy. ## Follow the jobs Approving starts a job and returns at once. Follow it with: ```bash dnocs execution list --server-id 145 --limit 3 ``` Run it again until the job says `succeeded` or `failed`. If it failed, ask the assistant why: `dnocs ai chat "Why did the last job on server 145 fail?"`. ## Other dnocs commands dnocs does much more than chat. `dnocs --help` lists every command, and `dnocs --help` explains one. A few you will meet in these docs: | Command | What it does | | ------------------------- | ---------------------------------------------------- | | `dnocs server list` | Your servers | | `dnocs server setup` | Runs server setup again | | `dnocs server firewall` | Shows and changes a server's firewall | | `dnocs module list` | Software you can install on a server | | `dnocs application list` | Your applications | | `dnocs load-balancer log` | The requests a load balancer served | | `dnocs cluster kinds` | The Kubernetes engines and versions you can use | | `dnocs worker list` | Whether the workspace uses shared or private workers | ## Frequently asked questions ### Does dnocs work on Windows? There is no Windows build. Use it in WSL (Windows Subsystem for Linux) with the Linux file. ### I sign in to dPanel with Google. Can I use dnocs? `dnocs auth login` signs in with a dPanel username or email and a password; it has no Google sign-in. ### Are terminal and web conversations shared? They are the same kind of conversation, stored by dPanel for your account and workspace. The web panel shows the last conversation you had in that browser, and a terminal conversation continues with `--conversation`. You can approve a card from the web panel in the terminal with its action ID, as the same user in the same workspace. --- # Use your own AI agent Source: https://dnocs.devetek.app/docs/ai/your-own-ai-agent Let Claude Code, Cursor, Codex or another AI coding agent operate dPanel safely through the dnocs CLI and the dPanel assistant, and read the docs from llms.txt. If you already work with an AI coding agent, such as Claude Code, Cursor, Codex or GitHub Copilot, it can operate dPanel for you through **dnocs**, the dPanel command-line tool. The agent talks to the dPanel assistant with `dnocs ai chat`, and every change still goes through an approval with `dnocs ai approve`. It can also read this documentation from `llms.txt` and `llms-full.txt`. ## How it works 1. You install dnocs and sign in yourself. See [Use AI in the terminal](./ai-in-the-terminal.md). 2. You tell your agent how to use dPanel (the instructions below). 3. The agent asks the dPanel assistant for what you want, for example "Deploy my repository to server 145 and put it on shop.example.com". 4. The dPanel assistant proposes each change with an action ID (`aipa_…`). 5. The change runs only when `dnocs ai approve ` is run. The agent never calls the dPanel API or your cloud provider directly, and never changes a server by hand. Everything goes through the dPanel assistant, so every change is proposed, approved and recorded the same way as in the web app. :::warning[Decide who approves] The agent runs commands as you, with your dPanel session. If it may run `dnocs ai approve` itself, it can approve changes on your behalf. Tell it to show you each proposal and wait for your "yes" before approving, or run the approve commands yourself. Approve deletes and paid resources, such as new cloud servers, only after you have read them. ::: ## Give your agent the instructions Paste this into your agent's instructions file, such as `AGENTS.md`, `CLAUDE.md` or the Cursor rules, or into the chat: ```markdown ## dPanel dPanel (https://dnocs.devetek.app) runs my servers, applications, databases, domains and load balancers. Operate it only through the dnocs CLI and its assistant: - `dnocs ai chat ""` asks the dPanel assistant. Give it IDs and names. It reads what it needs and, for any change, proposes it and prints an action id (aipa\_…). Nothing changes yet. - `dnocs ai chat --conversation ""` continues the same conversation. - `dnocs ai approve ` runs one proposed change, exactly as proposed. `--reject` declines it. Show me each proposal and wait for my explicit yes before approving. - Approve one change at a time. Follow its job with `dnocs execution list --server-id --limit 3` until it says succeeded or failed; if it failed, ask the assistant why. - Never call the dPanel API or a cloud provider directly, never change a server by hand, and never put a password, token or key in a chat message. Secrets I must supply are prompted by `dnocs ai approve`; generated secrets are printed once by `dnocs ai approve`: hand them to me immediately. - Do not choose ports: dPanel picks a free one. For an app without a .devetek definition, tell the assistant the language and version, build commands and start command. - How-to questions: read https://dnocs.devetek.app/llms.txt and the pages it links to. ``` The dPanel team uses a fuller version of these instructions, the **dpanel-cli-ai** skill, to test dPanel end to end with AI agents (a server, MariaDB, a WordPress deploy, an HTTPS load balancer and the clean-up, all through `dnocs ai`). The rules above are its core. ## Good requests to give your agent - "Using dPanel, deploy this repository to server 145 and give it the domain shop.example.com with HTTPS." - "Using dPanel, find out why the last deploy of application Shop failed and propose a fix." - "Using dPanel, create a PostgreSQL database for this app on server 145 and set the app's database variables." - "Using dPanel, open port 8080 on server 145 for the staging API." More requests in the [prompt cookbook](./prompt-cookbook.md). ## Docs for AI: llms.txt and llms-full.txt The dPanel documentation is published in two plain-text files that AI tools can read: | File | What it holds | | -------------------------------------------------------- | ------------------------------------------------------------------------------------- | | [llms.txt](https://dnocs.devetek.app/llms.txt) | A short index: every documentation page with its title, link and one-line description | | [llms-full.txt](https://dnocs.devetek.app/llms-full.txt) | The whole English documentation as Markdown, page after page | Point your agent or chatbot at `llms.txt` to find the right page, or give it `llms-full.txt` to answer from everything at once. The dPanel assistant itself answers how-to questions from `llms-full.txt`. ## Frequently asked questions ### Does my agent need its own dPanel account? No. It uses the dnocs session you signed in with, so it works with your access and your role. Anything it approves runs as you. ### Can my agent skip the approval step? Not in dPanel: every change still needs `dnocs ai approve`. But an agent that is allowed to run commands can run that command itself, so tell it to wait for your yes, as in the instructions above. ### Can I give the agent my browser session instead of signing in? Sign in with `dnocs auth login` yourself instead. A session is as powerful as your password; keep it out of chats, files you share, and screenshots. ### Which agents work? Any agent that can run terminal commands, such as Claude Code, Cursor, Codex, Gemini CLI or GitHub Copilot in agent mode. --- # AI limits and privacy Source: https://dnocs.devetek.app/docs/ai/limits-and-privacy What the dPanel AI assistant can see and store, what it hides, where your messages go, its limits, and what to do when Ask dPanel is busy or unavailable. **Ask dPanel**, the dPanel AI assistant, works only inside dPanel, with your own access, in your current workspace. It never sees your passwords, tokens, keys or environment variable values. Your messages, and what the assistant reads to answer them, are sent to an AI model service to produce the answer, so never type a secret in the chat. ## What the assistant can see - **Only your current workspace.** Switch workspace to ask about another one. - **Only what your account can see.** It reads dPanel as you, through the same access as the pages you open. - **Names, not secrets.** dPanel removes passwords, tokens, keys, cookies and credentials from everything before the assistant reads it, and shows it the names of environment variables but never their values. - **Not your databases' data.** It cannot run SQL or read rows. - **Not your servers directly.** It has no shell and no SSH access; it reads what dPanel and the dPanel agent report, such as logs and usage. - **This documentation.** It answers how-to questions from the published dPanel docs. ## Where your messages go 1. Your message goes to dPanel. 2. dPanel sends it, with the conversation so far and the results of what the assistant reads, to an AI model service that writes the answer. Secrets are removed first, as above. 3. dPanel stores the conversation, so you can reopen it, and a record of every tool the assistant used, which is linked to the workspace's audit history. That is why the rule is simple: **never type a password, token or key in the chat**. If you did, treat that value as exposed and change it. The assistant will not repeat or use it, and asks you to type it on the approval card instead. See [Approve or reject changes](./approvals-and-secrets.md#secrets-you-type). ## Who can see your conversations - **You.** A conversation belongs to the person who started it, in the workspace it was started in. - **Not your teammates.** They cannot open your conversations or approve your cards. - **Your changes are visible as usual.** An approved change runs as an ordinary dPanel job, so it appears in the workspace's activity and audit history, like a change made from the pages. Your browser remembers which conversation was last open for each workspace, so the panel can show it again. Press **New conversation** to start a clean one. ## Limits | Limit | What it means | | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------- | | Only dPanel topics | Questions about anything else get "I can only help with dPanel" | | Approval cards expire after 24 hours | Ask again to get a fresh card | | One job at a time per server | Approve changes to the same server one by one | | It checks a long job once | After a deploy or install, ask again for progress | | Prices are estimates | Cloud server prices come from general public price knowledge, not from your provider's bill | | Not everything is in chat yet | For example creating SSH keys or DNS records, managing team members and connecting cloud accounts: use the pages | | Very broad requests | A request that needs too many steps stops; ask about one thing at a time | The assistant can make mistakes. Read every card before you approve it, and check important answers against the page in dPanel; every answer gives IDs and names so you can. ## When the assistant is busy or unavailable | Message | What to do | | --------------------------------------------------------------------------- | ----------------------------------------------------------------------- | | **The assistant isn't available yet** | dPanel could not reach the assistant. Press **Check again** in a moment | | **Sign in to use the assistant** | Press **Sign in**; your session has ended | | The assistant is busy right now. Please try again in a minute. | Too many requests at once. Wait a minute and press **Try again** | | The AI model is unavailable right now. Please try again later. | The AI model service is down. Try again later, or use the pages | | The assistant took too long to answer. Please try again. | Press **Try again**, or ask a narrower question | | That request needed too many steps. Please ask for something more specific. | Split the request, and name the server or application | Everything the assistant does, you can also do from the pages of dPanel or with the dnocs command-line tool, so you are never stuck when it is down. ## Frequently asked questions ### Does dPanel train an AI model on my conversations? dPanel stores your conversation so you can reopen it and so approved changes can be audited; it has no feature that trains a model on it. The AI model service receives each request to write the answer. Because the messages leave dPanel, keep secrets out of them. ### Can I delete a conversation? There is no delete button yet. **New conversation** starts a clean one, and the old one is no longer shown in your browser. ### Can the assistant see my environment variable values? No. It sees variable names only. A secret value you type on an approval card goes with your approval straight to dPanel. ### Is the assistant available in my personal workspace? Yes. It works in your personal workspace and in every team workspace you belong to, each with its own conversations. --- # How a website runs Source: https://dnocs.devetek.app/docs/tutorials/how-a-website-runs New to servers? The ideas behind every dPanel tutorial in plain words: server, module, database, repository, build, port, domain and HTTPS. You don't need to have run a server before to follow the dPanel tutorials in this section. This page explains, in plain words, the handful of ideas they use. Read it once; each tutorial then links back here when a word comes up. For any other word, see the [Glossary](../getting-started/glossary.md), and for the whole beginner path, [Your first steps](../getting-started/first-steps.md). ## The picture When someone opens your website, this is what happens: 1. They type your address, such as `blog.example.com`. **DNS** turns that name into the address of your **server**. 2. The **load balancer** on your server answers. It holds the **HTTPS certificate**, so the browser shows a padlock, and passes the visit on to your **application**. 3. Your application, such as WordPress or Laravel, builds the page. When it needs stored data, such as posts or users, it asks the **database** on the same server. 4. The page goes back the same way to the visitor. dPanel sets up every piece of that chain for you, from forms in the web app. The tutorials go through them in the order they have to exist: server, software, database, application, then the address. ## The words | Word | What it means here | | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Server** | A computer in a data centre that stays on all the time, rented from a cloud provider such as Google Cloud or AWS. dPanel launches it in your own cloud account and installs Ubuntu Linux on it. You pay the provider for it while it exists. | | **Module** | A piece of software dPanel installs on your server for you: a database such as MariaDB, a language such as PHP or Node.js, or a web server such as FrankenPHP. You pick it from a list instead of typing install commands. | | **Database** | Where an application stores its data. One database program (MariaDB or PostgreSQL) can hold many databases; each application gets its own, with its own user and password, so it can't touch the others. | | **Repository** | The folder of your application's code on GitHub. dPanel copies (clones) it to the server. | | **Build** | The commands that turn the code into something ready to run: downloading libraries, compiling, preparing files. They run on the server each time you deploy. | | **Runtime** | The language program a build or an application needs, such as PHP or Node.js. An application can need more than one: Laravel uses PHP to run and Node.js to build its pages' styles and scripts. | | **Environment variables** | Settings given to the application from outside its code, such as the database name and password. You type them in dPanel, so passwords never go into your repository. | | **Deploy / release** | Building the code on the server and starting it. Each deploy makes a new release; dPanel keeps the old ones so you can roll back. | | **Port** | A numbered door on the server. Your application listens on one, such as `9102`. dPanel picks a free one for you. Visitors never see it: the load balancer forwards to it. | | **Domain and DNS** | Your address on the internet, such as `example.com`, and the records that point names under it, such as `blog.example.com`, at a server. dPanel creates the record when the domain is in **Domain & DNS**. | | **Load balancer** | The front door of your website. It answers on the normal web ports (80 and 443), handles HTTPS, and sends each visit to the right application. | | **Firewall** | The guard on the server that decides which ports people can reach. dPanel keeps 22 (SSH) open, and 80 and 443 on a server that runs a load balancer. See [Firewall](../servers/firewall.md). | | **HTTPS and certificate** | The encryption that gives the padlock in the browser. dPanel gets a free certificate from Let's Encrypt and renews it for you. | ## What you need before any tutorial Set these up once; every tutorial uses them. 1. **A dPanel account**, signed in. See [Sign in](../getting-started/sign-in.md). 2. **GitHub connected**, so dPanel can read your code. See [Connect GitHub](../getting-started/connect-github.md). 3. **An SSH key and a cloud account** in dPanel. The SSH key lets dPanel reach your server securely; the cloud account is where the server is created and billed. See [Before you start](../servers/before-you-start.md). If you already have an Ubuntu machine, you can [connect it](../servers/connect-your-own-server.md) instead. 4. **A domain** added under **Domain & DNS**. See [Domains and DNS](../networking/domains-and-dns.md). ## Good habits from the start - **Do one thing at a time and wait for it to finish.** Installing software and deploying take a few minutes each. dPanel shows progress on the server's **Modules** tab, the application's page and the job list. - **Keep passwords in a password manager.** dPanel shows a generated password once. Copy it before you close the form. - **Never put a password in your code or in a chat**, including the [assistant](../ai/overview.md). Put it in an environment variable. - **Delete what you don't use.** A cloud server costs money every hour it exists, even when idle. ## Pick a tutorial - [Deploy WordPress with MariaDB](./deploy-wordpress.md): a blog or company site. The simplest place to start. - [Deploy Laravel with PostgreSQL](./deploy-laravel.md): a PHP web application that also needs Node.js to build. Prefer to chat? You can also do every tutorial with [Ask dPanel](../ai/overview.md): describe what you want, then approve each change. See the [Prompt cookbook](../ai/prompt-cookbook.md). ## Frequently asked questions ### Which tutorial should I start with? [WordPress](./deploy-wordpress.md). It needs one language (PHP) and one database, so it has the fewest moving parts. ### Do I need my own server? You need one server: either launched by dPanel in your cloud account, or one you already rent and connect over SSH. The tutorials work the same on both. ### How much does a tutorial cost? The server is billed by your cloud provider for every hour it exists, and a domain costs whatever your registrar charges. Delete the server when you are done to stop the cost. --- # Deploy WordPress with MariaDB Source: https://dnocs.devetek.app/docs/tutorials/deploy-wordpress Go from an empty dPanel account to a WordPress site on your domain with HTTPS: launch a server, install MariaDB, PHP and FrankenPHP, deploy and publish. This tutorial takes you from an empty dPanel account to a WordPress site answering on your own domain with HTTPS. You launch an Ubuntu server, install MariaDB, PHP and FrankenPHP on it, create a database for WordPress, deploy the [dPanel-ID/wordpress-example](https://github.com/dPanel-ID/wordpress-example) repository, and put a load balancer in front of it. It takes about 40 minutes, most of it waiting for the server and the installs. Every step happens in the dPanel web app; you never need SSH. :::tip[New to servers?] Read [How a website runs on your server](./how-a-website-runs.md) first. It explains every word this page uses, such as module, build, port and load balancer, in a few minutes. The [Glossary](../getting-started/glossary.md) has the rest. ::: ## What you need first - A dPanel account, signed in, in the workspace you want to use. See [Sign in](../getting-started/sign-in.md). - GitHub connected, with access to the repository you deploy. To follow along exactly, fork **dPanel-ID/wordpress-example** into your own account. See [Connect GitHub](../getting-started/connect-github.md). - An SSH key and a cloud account in dPanel, or a server of your own. See [Before you start](../servers/before-you-start.md). - A domain in **Domain & DNS**, so dPanel can create the DNS record for you. See [Domains and DNS](../networking/domains-and-dns.md). ## Step 1: Launch a server 1. Open **Servers**, press **Create Server**, then **Launch a server**. 2. Pick your **Provider**, **Cloud project** and **SSH key**. 3. Pick a **Region** near your visitors. 4. Set **Server name**, for example `wordpress-1`, keep **Ubuntu release** 24.04 LTS, and move the sliders to at least **2 vCPU** and **4 GB** RAM. 30 GB of storage is enough. 5. When the Review panel says **Ready to launch**, press **Launch server**. [Screenshot: The launch form with a provider, cloud project and SSH key selected] The server appears in the list. Wait until its status is **Ready**, usually 10 to 20 minutes. The full form is described in [Create a cloud server](../servers/cloud-providers/create-a-cloud-server.md). Already have a machine? [Connect your own server](../servers/connect-your-own-server.md) instead. **You should see:** the server listed under **Servers** with the status **Ready**. ## Step 2: Install MariaDB, PHP and FrankenPHP WordPress needs a database (MariaDB), the PHP language, and a web server that runs PHP (FrankenPHP). 1. Open the server and go to **Modules**. Press **Add module**. 2. Press **Install** on **MariaDB**. Set a **Root Password** you will remember, or keep the one suggested, and copy it somewhere safe. Press **Install role** and confirm. 3. Wait until MariaDB shows **Installed**. Then install **PHP** with **PHP Version** `8.5`. 4. When PHP is installed, install **FrankenPHP**. [Screenshot: The module catalogue on a server, grouped by category] Install one module at a time and let each finish: dPanel queues installs, and the **Modules** tab shows each one moving from installing to **Installed**. See [Install software](../servers/install-software.md). **You should see:** MariaDB, PHP and FrankenPHP on the **Modules** tab, each marked **Installed**. ## Step 3: Create the WordPress database 1. On **Modules**, press **Add module**, then **Manage** on **MariaDB**. 2. Under **Databases**, press **Create database**. 3. Enter **Database Name** `wordpress`, **Database User** `wp`, and a **Database Password** of at least 8 characters. Copy the password: you need it in step 4. 4. Press **Install role**. [Screenshot: The Create database form: database name, user and password] When it finishes, `wordpress` is listed under **Databases**. The user `wp` can reach only this database, from the server itself, which is how WordPress connects. **You should see:** `wordpress` listed under **Databases**, and the password saved somewhere safe. ## Step 4: Create and deploy the application 1. Open **Applications** and press **Create Application**. 2. **Repository**: pick your GitHub account, search for `wordpress-example`, select it, keep the **main** branch, and press **Continue**. 3. **Server & modules**: select your server. Under **Installed on selected server**, select **PHP** and **FrankenPHP** so they are reused, not installed again. Press **Continue**. 4. **App setup**: - **Application name**: `WordPress` (letters, numbers and spaces only). - **Required binaries**: **php 8.5**. - **Build steps**: `./scripts/build.sh`. - **Runtime command**: `./scripts/start.sh`. - **Application port**: keep the free port dPanel suggests. 5. **Environment**: under **Runtime variables**, paste the list below. Replace the password with the one from step 3 and the address with the domain you will publish in step 5. ```text WORDPRESS_DB_HOST=127.0.0.1:3306 WORDPRESS_DB_NAME=wordpress WORDPRESS_DB_USER=wp WORDPRESS_DB_PASSWORD=the-password-from-step-3 WORDPRESS_TABLE_PREFIX=wp_ WORDPRESS_HOME=https://blog.example.com WORDPRESS_SITEURL=https://blog.example.com WORDPRESS_MEMORY_LIMIT=256M ``` 6. **Preview**: check the summary and press **Deploy application**. [Screenshot: Step 3 of the form: the application name, the runtime, the build step, the runtime command and the port] dPanel clones the repository on the server, runs the build and starts WordPress as a service. Open the application to follow the build; it shows **Running** when the release is live, usually in 2 to 5 minutes. See [Create an application](../applications/create-an-application.md) and [Environment variables](../applications/environment-variables.md). **You should see:** the application marked **Running**. It is not on the internet yet: that is the next step. ## Step 5: Publish it on your domain with HTTPS 1. Open **Load Balancers** and press **Create a load balancer**. The form has four steps: **Gateway**, **Domain**, **Routing** and **Review**. 2. **Gateway**: under **Gateway server**, select the same server. Under **Web server engine**, pick **Caddy Server** and press **Install** if it is not installed yet. 3. **Domain**: under **Domain Name**, choose **Managed**, type the **Subdomain** (for example `blog`), and **Select domain**. 4. **Routing**: keep **L7** under **Routing mode**, and **HTTP / HTTPS** with **HTTPS** on under **Protocol and HTTPS**. In the first rule, set **Type** to **Application**, **Matching Path** to `/*`, and pick the **WordPress** application. 5. **Review**: when the review panel reads **Ready to create**, press **Create load balancer**. [Screenshot: Step 3 of the load balancer form: one rule sending /* to an application] dPanel creates the DNS record, configures the gateway and requests a free Let's Encrypt certificate. After a minute or two, open `https://blog.example.com/wp-admin/install.php`: the WordPress installer appears. Choose the language, the site title and your admin account, and your site is live. See [Load balancers](../networking/load-balancers.md). ## When something does not work | What you see | What to check | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | A module stays in installing, or fails | Open the server's **Logs**, or ask the assistant why the job failed. Install the module again after fixing the cause. | | The build fails | Open the application and read the build log of the failed release. See [Application logs](../applications/application-logs.md). | | "Error establishing a database connection" | The four `WORDPRESS_DB_*` variables must match the database from step 3. Fix them under the application's settings, then deploy again: a change applies from the next release. | | The domain does not answer | Wait a few minutes for DNS and the certificate. Check the load balancer's detail page and its logs. A red **Load balancer change failed** banner has **See why it failed**. | | Anything else | See [Common problems and fixes](../troubleshooting/faq.md). | ## Prefer to chat? Do the same with Ask dPanel [Ask dPanel](../ai/overview.md), the assistant at the bottom right of every page, can prepare each step above for you to approve, for example: > On server wordpress-1, create a MariaDB database named wordpress with a user named wp. It generates the database password and shows it once, on the approval card. When it creates the application, it asks for `WORDPRESS_DB_PASSWORD` as a field on the approval card, so the password never goes into the chat. More ready-made requests are in the [Prompt cookbook](../ai/prompt-cookbook.md). ## Clean up To remove the demo, delete in this order: the load balancer, the application, then the server. See [Load balancers](../networking/load-balancers.md#delete-a-load-balancer), [Update or delete an application](../applications/update-or-delete.md) and [Delete a server](../servers/delete-a-server.md). Deleting a cloud server also stops its cost at your provider. ## Frequently asked questions ### Can I use my own WordPress repository instead of the example? Yes, if it has a build script and a start script that serve WordPress on the port dPanel gives it. The example's `scripts/` folder shows what dPanel needs. ### Do I need a domain to try this? You need one for step 5, where the load balancer publishes the site with HTTPS. Steps 1 to 4 work without one. ### Why install one module at a time? dPanel queues installs on a server and runs them one after another. Waiting for each to show **Installed** makes it easy to see which one failed, if any. --- # Deploy Laravel with PostgreSQL Source: https://dnocs.devetek.app/docs/tutorials/deploy-laravel Go from an empty dPanel account to a Laravel app on your domain with HTTPS: a server, PostgreSQL, PHP, FrankenPHP, Node.js, two runtimes and a load balancer. This tutorial takes you from an empty dPanel account to a Laravel application answering on your own domain with HTTPS. You launch an Ubuntu server, install PostgreSQL, PHP, FrankenPHP and Node.js on it, create a database, deploy the [dPanel-ID/laravel-example](https://github.com/dPanel-ID/laravel-example) repository, and put a load balancer in front of it. Laravel differs from WordPress in two ways that matter here: - **It needs two runtimes.** The build runs Composer with PHP, then `npm` to build the front end with Vite. The application declares both PHP and Node.js, and dPanel puts only declared runtimes on the build's path. - **The build talks to the database.** It runs the migrations, so the database variables are needed while building as well as while running. It takes about 45 minutes, most of it waiting for the server and the installs. Every step happens in the dPanel web app; you never need SSH. :::tip[New to servers?] Read [How a website runs on your server](./how-a-website-runs.md) first. It explains every word this page uses, such as module, build, port and load balancer, in a few minutes. The [Glossary](../getting-started/glossary.md) has the rest. ::: ## What you need first - A dPanel account, signed in, in the workspace you want to use. See [Sign in](../getting-started/sign-in.md). - GitHub connected, with access to the repository you deploy. To follow along exactly, fork **dPanel-ID/laravel-example** into your own account. See [Connect GitHub](../getting-started/connect-github.md). - An SSH key and a cloud account in dPanel, or a server of your own. See [Before you start](../servers/before-you-start.md). - A domain in **Domain & DNS**, so dPanel can create the DNS record for you. See [Domains and DNS](../networking/domains-and-dns.md). ## Step 1: Launch a server 1. Open **Servers**, press **Create Server**, then **Launch a server**. 2. Pick your **Provider**, **Cloud project** and **SSH key**, then a **Region** near your users. 3. Set **Server name**, for example `laravel-1`, keep **Ubuntu release** 24.04 LTS, and move the sliders to at least **2 vCPU** and **4 GB** RAM. 30 GB of storage is enough. 4. When the Review panel says **Ready to launch**, press **Launch server**. Wait until the server's status is **Ready**, usually 10 to 20 minutes. See [Create a cloud server](../servers/cloud-providers/create-a-cloud-server.md), or [connect your own server](../servers/connect-your-own-server.md) instead. **You should see:** the server listed under **Servers** with the status **Ready**. ## Step 2: Install PostgreSQL, PHP, FrankenPHP and Node.js 1. Open the server and go to **Modules**. Press **Add module**. 2. Press **Install** on **PostgreSQL**. Note the administrator user and set its password, or keep the one suggested, and copy it somewhere safe. Press **Install role** and confirm. 3. When PostgreSQL shows **Installed**, install **PHP** with **PHP Version** `8.5`. 4. Then install **FrankenPHP**, which serves the application through Laravel Octane. 5. Then install **Node.js**. Note the version it installs, for example `26.13.0`: the application declares the same version in step 4. [Screenshot: The module catalogue on a server, grouped by category] Install one module at a time and let each finish. See [Install software](../servers/install-software.md). **You should see:** PostgreSQL, PHP, FrankenPHP and Node.js on the **Modules** tab, each marked **Installed**. ## Step 3: Create the Laravel database 1. On **Modules**, press **Add module**, then **Manage** on **PostgreSQL**. 2. Under **Databases**, press **Create database**. 3. Enter **Database Name** `laravel`, **Database User** `laravel`, and a **Database Password** of at least 8 characters. Copy the password: you need it in step 4. PostgreSQL names use lowercase letters, digits and underscores. 4. Press **Install role**. [Screenshot: The Databases section of the database module, with the Create database button] **You should see:** `laravel` listed under **Databases**, and the password saved somewhere safe. ## Step 4: Create and deploy the application 1. Open **Applications** and press **Create Application**. 2. **Repository**: pick your GitHub account, search for `laravel-example`, select it, keep the **main** branch, and press **Continue**. 3. **Server & modules**: select your server. Under **Installed on selected server**, select **PHP**, **FrankenPHP** and **Node.js** so they are reused, not installed again. Press **Continue**. 4. **App setup**: - **Application name**: `Laravel` (letters, numbers and spaces only). - **Required binaries**: check that **both** PHP 8.5 and Node.js are selected. dPanel selects every language module you picked in step 2 and stores all of them on the application, which is what puts `npm` on the build's path. FrankenPHP appears under **Other dependencies**. - **Build steps**: `./scripts/build.sh`. It installs the Composer and npm packages, builds the front end, generates the application key and runs the migrations. - **Runtime command**: `./scripts/start.sh`. It starts Laravel Octane on FrankenPHP, on the port dPanel gives it. - **Application port**: keep the free port dPanel suggests. 5. **Environment**: paste the database list into **both** **Build-time variables** and **Runtime variables**, with your password and your domain: ```text APP_ENV=production APP_DEBUG=false APP_URL=https://app.example.com DB_CONNECTION=pgsql DB_HOST=127.0.0.1 DB_PORT=5432 DB_DATABASE=laravel DB_USERNAME=laravel DB_PASSWORD=the-password-from-step-3 ``` Then add these to **Runtime variables** only: ```text OCTANE_SERVER=frankenphp OCTANE_DISABLE_CADDY_ADMIN=true LOG_CHANNEL=stderr ``` 6. **Preview**: check the summary and press **Deploy application**. [Screenshot: The App setup step for Laravel: Node.js 26.13.0 and PHP 8.5 both selected under Required binaries, FrankenPHP under Other dependencies] The first build takes 3 to 6 minutes. Open the application to follow it; it shows **Running** when the release is live. See [Create an application](../applications/create-an-application.md) and [Environment variables](../applications/environment-variables.md). :::warning[npm: command not found] If the build log stops at `npm: command not found`, Node.js is not declared on the application. Open the application's settings, add **nodejs** with the installed version under the additional languages, save, and deploy again. ::: **You should see:** the application marked **Running**. It is not on the internet yet: that is the next step. ## Step 5: Publish it on your domain with HTTPS 1. Open **Load Balancers** and press **Create a load balancer**. The form has four steps: **Gateway**, **Domain**, **Routing** and **Review**. 2. **Gateway**: under **Gateway server**, select the same server. Under **Web server engine**, pick **Caddy Server** and press **Install** if it is not installed yet. 3. **Domain**: under **Domain Name**, choose **Managed**, type the **Subdomain** (for example `app`), and **Select domain**. 4. **Routing**: keep **L7** under **Routing mode**, and **HTTP / HTTPS** with **HTTPS** on under **Protocol and HTTPS**. In the first rule, set **Type** to **Application**, **Matching Path** to `/*`, and pick the **Laravel** application. 5. **Review**: when the review panel reads **Ready to create**, press **Create load balancer**. After a minute or two, open `https://app.example.com/`: the Laravel welcome page appears. See [Load balancers](../networking/load-balancers.md). ## When something does not work | What you see | What to check | | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `npm: command not found` in the build log | Declare Node.js on the application, as in the warning above. | | The build fails at `php artisan migrate` | The `DB_*` variables must also be in **Build-time variables**, and match the database from step 3. | | The application starts, then stops | Read its runtime log. See [Application logs](../applications/application-logs.md). | | The domain does not answer | Wait a few minutes for DNS and the certificate, then check the load balancer's detail page and logs. A red **Load balancer change failed** banner has **See why it failed**. | | Anything else | See [Common problems and fixes](../troubleshooting/faq.md). | A variable change applies from the next release: deploy again after changing one. ## Prefer to chat? Do the same with Ask dPanel [Ask dPanel](../ai/overview.md) can prepare every step for you to approve. Name both runtimes when you ask it to create the application, for example: > Create an application named Laravel from github.com/my-org/laravel-example on server laravel-1. Language PHP 8.5 with Node.js as an extra runtime, build command ./scripts/build.sh, start command ./scripts/start.sh. It asks for `DB_PASSWORD` as a field on the approval card, so the password never goes into the chat. More ready-made requests are in the [Prompt cookbook](../ai/prompt-cookbook.md). ## Clean up Delete in this order: the load balancer, the application, then the server. See [Load balancers](../networking/load-balancers.md#delete-a-load-balancer), [Update or delete an application](../applications/update-or-delete.md) and [Delete a server](../servers/delete-a-server.md). ## Frequently asked questions ### Why does the application need Node.js if Laravel is PHP? The build runs `npm` to bundle the front end with Vite. dPanel puts only the runtimes declared on the application on the build's path, so Node.js must be declared next to PHP. ### Why do the database variables go in both lists? The build runs the migrations, so it needs the database while building. The running application needs it too. **Build-time variables** reach only the build; **Runtime variables** reach only the running service. ### Can I use MariaDB instead of PostgreSQL? Yes. Install **MariaDB**, create the database from its **Manage** page, and set `DB_CONNECTION=mysql` and `DB_PORT=3306`. --- # Servers in dPanel Source: https://dnocs.devetek.app/docs/servers/overview A server in dPanel is a Linux VPS it manages for you: launched at AWS, Google Cloud, DigitalOcean and others, or an Ubuntu server you connect over SSH. A server in dPanel is one Linux machine that the control panel looks after for you: a VPS dPanel launched in your own cloud account (AWS EC2, Google Compute Engine, a DigitalOcean Droplet, IDCloudHost, Alibaba Cloud ECS or Tencent Cloud CVM), or an Ubuntu or Debian server you already run and connect over SSH. A VPS (virtual private server) is a rented Linux computer in a data centre. dPanel installs a small program on it, the **agent**, which reports the server's health and carries out the jobs you start. New to these words? See the [Glossary](../getting-started/glossary.md). Once a server is in dPanel, you manage it from your browser. You don't need a terminal on your own computer. - See whether it is healthy, and how much CPU, memory and disk it uses. - Install software on it, such as a database or a language runtime, and open its databases in DB Manager. - Start, stop and restart the services running on it. - Manage its Linux user accounts. - Browse its files and read its logs. - Open a terminal on it. - Choose which ports the internet can reach with its [firewall](./firewall.md). - Deploy [applications](../applications/overview.md) to it, and put a [load balancer](../networking/load-balancers.md) with HTTPS in front of them. [Screenshot: The Servers page in table view, listing servers with their status, provider, system, address and owner] The list opens as a table. Switch to **Card Grid View** to see live CPU, memory and disk on each server's card. The search box ignores letter case, and the owner column names the person who created each server. ## The two ways to add a server Open **Servers**, then **Create Server**. The page offers both paths. [Screenshot: The Create Server page, offering Launch a cloud server or Connect your own server] | | Launch a cloud server | Connect your own server | | ---------------- | -------------------------------------------------------------------------------------- | ------------------------------------ | | Who it suits | You want a new machine and have a cloud account | You already have a machine running | | Providers | AWS, Google Cloud, DigitalOcean, IDCloudHost, Biznet Gio, Alibaba Cloud, Tencent Cloud | Any Ubuntu or Debian server over SSH | | What dPanel does | Creates the machine, then sets it up | Connects over SSH, then sets it up | | You need | A cloud account and an SSH key in dPanel | An SSH key, and the server's address | | Time | About 10 to 20 minutes | About 5 minutes | Either way, dPanel installs its agent and starts monitoring the machine. Servers dPanel launches run Ubuntu 24.04 LTS or 26.04 LTS. ## Where to go next - New to dPanel? Start with [Before you start](./before-you-start.md). - Launching a machine: [Create a cloud server](./cloud-providers/create-a-cloud-server.md). - Bringing your own: [Connect your own server](./connect-your-own-server.md). - Already have one: [Your server page](./your-server-page.md) explains every tab. - Control which ports can be reached: [Firewall](./firewall.md). - Many servers at once, or a Kubernetes cluster: [Server groups and clusters](../clusters/overview.md). You can also ask **Ask dPanel** to check a server or install something on it; see [Prompt cookbook](../ai/prompt-cookbook.md). ## Frequently asked questions ### Does dPanel host the server? No. A cloud server runs in your own account at the provider, which bills you directly. A server you connect stays wherever it already runs. ### Which operating system does a server need? Servers dPanel launches run Ubuntu 24.04 LTS or 26.04 LTS. A server you connect can run Ubuntu or Debian. ### Can I manage servers from a terminal instead? Yes. The `dnocs` CLI lists servers, runs setup again, installs modules and manages the firewall. See [AI in the terminal](../ai/ai-in-the-terminal.md). ### What is the agent and is it safe to remove? The agent is dPanel's program on the server. It reports usage and runs the jobs you start. Without it, the server page goes blank and jobs fail; **Reinstall** on the **Settings** tab puts it back. --- # Before you start Source: https://dnocs.devetek.app/docs/servers/before-you-start Before you add a server to dPanel, create an SSH key, and connect a cloud account if dPanel should launch the VPS. Both are set up once and reused. dPanel needs two things before your first server, and reuses both for every server after it: an SSH key to sign in to the machine, and, only if dPanel should launch a new VPS for you, a connected cloud account. ## An SSH key An SSH key is a pair of files that replaces a password when a computer signs in to a server. One half is public and is written onto the server. The other half is private and never leaves dPanel. You don't have to make one by hand. 1. In the sidebar, under **Backend**, open **Secret Managers**. It opens the **SSH keys** page. 2. Press **Create SSH key**. 3. Type a **Key name** you will recognise, such as `work-laptop`, and pick the **Key type**. 4. Press **Generate SSH key**. - **For current servers** is the right choice unless something refuses it. It is shorter and faster, and every current Linux accepts it. - **For older servers** is the fallback. It also asks for a key size. The private half is never shown again. dPanel keeps it encrypted and uses it for you. The key's page shows the public half, which is safe to copy anywhere, and a fingerprint you can compare with what a server reports. [Screenshot: The SSH keys page listing two keys with their type, who can use them and their owner] ## A cloud account You need this only to launch a new machine. To [connect your own server](./connect-your-own-server.md), the SSH key is enough. A cloud account is dPanel's link to your account at a cloud provider. It holds the credentials that let dPanel create machines for you. 1. In the sidebar, open **Cloud Projects**. The page is titled **Cloud accounts**. 2. Press **Connect a cloud account**. 3. Pick your provider and paste the credentials it gives you. How to create a least-privilege credential, step by step, is on each provider's page: [AWS](./cloud-providers/provider-aws.md), [Google Cloud](./cloud-providers/provider-gcp.md), [IDCloudHost](./cloud-providers/provider-idcloudhost.md), [DigitalOcean](./cloud-providers/provider-digitalocean.md), [Alibaba Cloud](./cloud-providers/provider-alibabacloud.md) and [Tencent Cloud](./cloud-providers/provider-tencent.md). Read [Cloud credentials and security](./cloud-providers/cloud-credentials-security.md) before you paste a key. :::info[Who pays for the machine] The machine is created inside your own cloud account, so your provider bills you directly. dPanel does not resell machines. ::: [Screenshot: The launch form with a cloud project and an SSH key ready to pick] ## What happens next Go to [Create a cloud server](./cloud-providers/create-a-cloud-server.md). More on keys and accounts, including sharing them with a team, is in [SSH keys and cloud accounts](../getting-started/ssh-keys-and-cloud-projects.md). ## Frequently asked questions ### Can I use an SSH key I already have? dPanel creates the key pair for you so the private half never leaves dPanel. To sign in from your own computer as well, add your own public key to the server; see [Connect over SSH](./connect-over-ssh.md). ### Do I need a cloud account to try dPanel? No. [Connect your own server](./connect-your-own-server.md) needs only an SSH key and a machine you can reach over SSH. ### Can my team use the same key and cloud account? Yes. Keys and cloud accounts created in a workspace can be used by its members. See [SSH keys and cloud accounts](../getting-started/ssh-keys-and-cloud-projects.md). --- # Connect your own server Source: https://dnocs.devetek.app/docs/servers/connect-your-own-server Connect a VPS, bare-metal or home-lab Ubuntu or Debian server you already run to dPanel over SSH. dPanel installs its agent in about 5 minutes. You can add a server you already run, at any hosting company or at home, to dPanel. dPanel signs in over SSH with one of your dPanel SSH keys, installs its agent, and the machine then works like any server dPanel launched. It takes about 5 minutes and needs no cloud account. ## What you need first - A server running Ubuntu or Debian that dPanel can reach over SSH from the internet. - A Linux user on it that can use `sudo`, or `root`. - An SSH key in dPanel. You can also create one inside the form. ## Connect it 1. Open **Servers**, then **Create Server**, then **Connect a server**. 2. Under **Choose an SSH key**, pick a key, or press **Create SSH key**. 3. Copy the command under **Authorize the key on your server** and run it once on the server. It adds the key's public half to `~/.ssh/authorized_keys`. 4. Tick **I added this key to the server**. 5. Under **Where is the server?**, fill in **Server address** (an IPv4 address, hostname or domain), **SSH port** and **Linux user**. 6. When the **Review** panel reads 3/3, press **Connect server**. [Screenshot: The Connect your own server form, with an SSH key selected and the command to authorize it] :::warning[Run the command on the right machine] Run the command as the same user you enter in **Linux user**. Setup stops early if dPanel cannot log in with the key. ::: ## What happens next dPanel saves the server, then installs its agent over SSH. Follow the progress on the server page. It usually takes about 5 minutes. When the badge reads **Ready**, the server works like any other. See [Your server page](./your-server-page.md). :::info[Deleting a server you connected] dPanel only forgets a server you connected yourself. Your machine keeps running. See [Delete a server](./delete-a-server.md). ::: ## Frequently asked questions ### Which operating systems can I connect? Ubuntu and Debian. dPanel installs its agent and modules with the standard tools of those systems. ### Does dPanel need the root password? No. dPanel signs in with an SSH key, never a password. The Linux user you enter must be `root` or able to use `sudo`. ### Does my server need a public IP address? dPanel must be able to reach the **Server address** and **SSH port** you enter. A server behind a home router needs the SSH port forwarded to it, or a public address. ### What happens if I remove the server from dPanel? dPanel forgets it and your machine keeps running, with everything on it. See [Delete a server](./delete-a-server.md). ### Setup failed. How do I try again? Fix the cause shown under **See what happened** (often the key is not in `authorized_keys`, or the user can't use `sudo`), then press **Reinstall** on the server's **Settings** tab. From the terminal, `dnocs server setup --id ` does the same. --- # Cloud providers Source: https://dnocs.devetek.app/docs/servers/cloud-providers The six cloud providers dPanel launches servers on: AWS EC2, Google Compute Engine, DigitalOcean, IDCloudHost, Alibaba Cloud ECS and Tencent Cloud CVM. dPanel launches Ubuntu servers in your own account at six cloud providers: **AWS** (EC2), **Google Cloud** (Compute Engine), **IDCloudHost**, **DigitalOcean** (Droplets), **Alibaba Cloud** (ECS) and **Tencent Cloud** (CVM). Each one has its own page: how to create a least-privilege credential, how to connect it, the launch-form fields, and the provider's gotchas. Whichever you pick, the finished server is the same: same agent, same tabs, same modules. ## At a glance | | [AWS](./provider-aws.md) | [Google Cloud](./provider-gcp.md) | [IDCloudHost](./provider-idcloudhost.md) | [DigitalOcean](./provider-digitalocean.md) | [Alibaba Cloud](./provider-alibabacloud.md) | [Tencent Cloud](./provider-tencent.md) | | ---------------------- | --------------------------------------------------- | ----------------------------------------- | ---------------------------------------- | ------------------------------------------ | ------------------------------------------- | ------------------------------------------ | | Credential | Access key + secret key | Service account JSON key | API key | API token | AccessKey ID + secret | SecretId + SecretKey | | Location | Region | Region, then zone | Region, such as `jkt01` | Region | Region, then zone | Region, then zone | | Size | CPU and RAM sliders, cheapest `t3a`/`t3` type first | CPU and RAM sliders, an E2 machine type | CPU and RAM sliders, exact size | CPU and RAM sliders, cheapest Droplet | CPU and RAM sliders, cheapest ECS type | CPU and RAM sliders, cheapest CVM type | | Network | `dpanel-network`, created on first use | `dpanel-network`, created on first use | Chosen for you per region | Provider default, or a VPC you pick | `dpanel-network`, created on first use | `dpanel-network`, created on first use | | Firewall | Security group per server, TCP 22, 80, 443 | Firewall rule per server, TCP 22, 80, 443 | None created by dPanel | None created by dPanel | Security group per server, TCP 22, 80, 443 | Security group per server, TCP 22, 80, 443 | | Login user | `ubuntu` | `ubuntu` | **Default User**, `dpanel` by default | **Default User**, `dpanel` by default | `root` | `ubuntu` | | Disk | 20 to 500 GB | 20 to 500 GB | 20 to 500 GB | Comes with the Droplet size | 40 to 500 GB | Provider default | | Extra step in the form | None | None | **Access**: user and bootstrap password | **Access**: user | None | None | The launch form also lists **Biznet Gio**. It follows the same steps, with its own **Product** and **Billing Cycle** pickers instead of the size sliders, and is not covered in detail here. Whichever provider you use, the finished server runs Ubuntu 24.04 LTS or 26.04 LTS. ## Before any provider - An SSH key in dPanel. See [Before you start](../before-you-start.md). - A credential that can do only what dPanel needs. Each provider page gives the minimum. - Read [Cloud credentials and security](./cloud-credentials-security.md) once. It explains what dPanel keeps and what happens if you revoke a key, and how to replace one. The launch itself is the same for every provider: [Create a cloud server](./create-a-cloud-server.md). ## Frequently asked questions ### Which provider should I pick? The one you already have an account with. dPanel works the same on every provider once the server is up. If you have none, any of them is fine for a first server. ### My provider is not listed. Can I still use dPanel? Yes. Create the machine at your provider yourself, then [connect your own server](../connect-your-own-server.md) over SSH. ### Do I pay dPanel for the machine? No. The provider bills you for the machine directly; dPanel does not resell machines. --- # Create a cloud server Source: https://dnocs.devetek.app/docs/servers/create-a-cloud-server Launch an Ubuntu VPS at AWS, Google Cloud, DigitalOcean, IDCloudHost, Alibaba Cloud or Tencent Cloud from dPanel, step by step, in 10 to 20 minutes. dPanel launches a new Ubuntu server (a VM) in your own cloud account from one form: pick the provider, the region, the size and the Ubuntu release, and dPanel creates the machine, installs its agent and opens SSH, HTTP and HTTPS. It is ready in about 10 to 20 minutes. This walkthrough uses Google Cloud. The other providers ask the same questions in the same order. The differences are on [Cloud providers](./index.md), with a page for each provider. ## What you need first - An SSH key and a cloud account in dPanel. See [Before you start](../before-you-start.md). - Enough quota at your provider for one more machine. ## Open the form Open **Servers**, then **Create Server**, then **Launch a server**. The form is one page with three numbered steps. The **Review** panel on the right fills in as you answer. Its counter, such as **3/9**, is how many answers dPanel has so far. ## Step 1: Provider and project 1. **Provider**: pick where the machine runs. 2. **Cloud project**: pick which of your cloud accounts pays for it. **Add project** connects another. 3. **SSH key**: pick the key dPanel uses to reach the machine. **Create SSH key** makes one here. [Screenshot: Step 1 of the launch form, with Google Cloud, a cloud project and an SSH key selected] ## Step 2: Location - **Region** is the part of the world the machine runs in. Pick one close to your users. - **Zone** is one data centre inside that region. Any of them is fine. Google Cloud, Alibaba Cloud and Tencent Cloud ask for one. - **Network** is filled in for you. On most providers dPanel creates `dpanel-network` the first time it launches in a region, then reuses it. Only SSH, HTTP and HTTPS are open. ## Step 3: Size and image 1. **Server name** is how the machine appears in dPanel and at your provider. 2. **Ubuntu release**: 24.04 LTS is selected by default; 26.04 LTS is marked **Newest**. LTS means years of security updates. 3. **Size**: move the **CPU** and **RAM** sliders to the size you want, and **Storage** to the disk size in GB. [Screenshot: Step 3 of the launch form with the CPU, RAM and Storage sliders and the size dPanel will launch] The card under the sliders says exactly what you will get: - **You get**: providers that take any CPU and memory pair, such as Google Cloud and IDCloudHost, launch exactly that size. - **Cheapest match**: providers with fixed instance types, such as AWS, DigitalOcean, Alibaba Cloud and Tencent Cloud, launch the cheapest type with at least that much CPU and memory. **Rounded up from** says when the type is bigger than you asked for, and the card shows the monthly price when the provider gives one. | Slider | Range | | ------- | ----------------------------------------------------------------------------------------------------------- | | CPU | 1, 2, 4, 8 or 16 vCPU. A value the provider cannot serve is crossed out. | | RAM | 1 to 64 GB. Moving CPU moves RAM to the nearest pair the provider sells. | | Storage | 20 to 500 GB in 10 GB steps (40 to 500 GB on Alibaba Cloud). DigitalOcean and Tencent Cloud set it for you. | On a provider with fixed types, **Choose the instance type yourself** opens the provider's full list instead of the sliders. **Use the size sliders instead** goes back. Biznet Gio keeps its own **Product** and **Billing Cycle** pickers. :::tip[Start small] 1 vCPU and 2 GB RAM is enough to try dPanel with one small application. You can launch a bigger server later and move your applications to it. ::: ## Launch When the Review panel says **Ready to launch**, every answer is in. 1. Press **Launch server**. 2. In **Server setup started**, press **Open server** to watch it come up, or **Create another**. **Clear form** starts over. ## What happens next A blue banner says dPanel is setting the server up. Expect 10 to 20 minutes: 1. The provider creates the machine. 2. dPanel installs its agent and reads what is on the machine. 3. dPanel opens the ports it needs. When the banner goes and the badge reads **Ready**, the server is yours to use. Next, [install software](../install-software.md) on it or [create an application](../../applications/create-an-application.md). :::warning[If setup fails] A red banner says so and offers **See what happened**, with the reason the provider or the setup gave. The usual causes are a cloud account without enough quota, and credentials that have expired. To try again, use **Reinstall** on the server's **Settings** tab. See [Common problems](../../troubleshooting/faq.md#servers). ::: :::tip[Your provider bills from now] The machine is billed by your provider while it exists, even while setup runs. [Delete it](../delete-a-server.md) when you are done. ::: ## Frequently asked questions ### How long does it take to launch a server? About 10 to 20 minutes from **Launch server** to **Ready**. Most of it is the provider creating the VM and dPanel installing its agent. ### Which Ubuntu versions can I launch? Ubuntu 24.04 LTS and 26.04 LTS. dPanel picks the provider's current image for the release you choose. ### How much does a server cost? Your provider bills you at its own prices, because the server runs in your account. On providers with fixed instance types, the size card shows the provider's monthly price when it is available. ### Can I choose an exact instance type, such as t3.small? Yes, on AWS, DigitalOcean, Alibaba Cloud and Tencent Cloud. Press **Choose the instance type yourself** under the sliders and pick from the provider's list. ### Which login user does the server get? `ubuntu` on AWS, Google Cloud and Tencent Cloud, `root` on Alibaba Cloud, and the **Default User** you set (`dpanel` by default) on DigitalOcean and IDCloudHost. See [Connect over SSH](../connect-over-ssh.md). --- # AWS EC2 Source: https://dnocs.devetek.app/docs/servers/provider-aws Connect AWS to dPanel with a least-privilege IAM user and policy, then launch an Ubuntu EC2 server from the control panel in your own AWS account. dPanel launches Ubuntu EC2 instances in your own AWS account. It signs in with the access key of a dedicated IAM user that you create for it, limited by the minimum IAM policy on this page to managing EC2 instances it tagged, in the regions you allow. ## What you need first - An AWS account with billing set up. - Permission in that account to create IAM users and policies. - An SSH key in dPanel. See [Before you start](../before-you-start.md). ## 1. Create a dedicated IAM user Never give dPanel your root user's keys, or an administrator's. 1. Sign in to the AWS console as an administrator, and open **IAM**. 2. Go to **Policies**, then **Create policy**, and switch to the **JSON** editor. 3. Paste the [policy below](#minimum-iam-policy). Replace the regions in `aws:RequestedRegion` with the ones you will use. 4. Name it `dpanel-ec2`, and create it. 5. Go to **Users**, then **Create user**. Name it `dpanel`. Leave console access off. 6. On **Set permissions**, choose **Attach policies directly**, and tick `dpanel-ec2`. 7. Open the new user, go to **Security credentials**, then **Create access key**. Pick **Third-party service** as the use case. 8. Copy the **Access key** and the **Secret access key**. AWS shows the secret only once. AWS guides: [Create an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html), [Manage access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html), [Create a policy in JSON](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html). :::tip[Use a separate account if you can] A dedicated AWS account for dPanel, inside AWS Organizations, keeps anything dPanel does away from your other workloads. Add a [budget alert](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-create.html) to it. ::: ## Minimum IAM policy These are the EC2 calls dPanel makes, read from its code: | Where | What it does | Actions | | ---------------------------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | dPanel API (discovery) | Lists regions, instance types, images, subnets, VMs | `DescribeRegions`, `DescribeInstanceTypes`, `DescribeImages`, `DescribeSubnets`, `DescribeInstances` | | Network, first launch only | Creates `dpanel-network`: VPC, gateway, subnet, route | `CreateVpc`, `ModifyVpcAttribute`, `CreateInternetGateway`, `AttachInternetGateway`, `CreateSubnet`, `ModifySubnetAttribute`, `CreateRouteTable`, `CreateRoute`, `ReplaceRoute`, `AssociateRouteTable` | | Security group, every launch | `dpanel-`, TCP 22, 80 and 443 | `CreateSecurityGroup`, `AuthorizeSecurityGroupIngress`, `RevokeSecurityGroupIngress`, `AuthorizeSecurityGroupEgress`, `RevokeSecurityGroupEgress`, `UpdateSecurityGroupRuleDescriptionsIngress` | | Instance | Launches, starts and terminates it | `RunInstances`, `StartInstances`, `TerminateInstances`, `CreateTags` | | Delete | Removes the server's security group | `DeleteSecurityGroup` | dPanel needs no IAM, S3 or `iam:PassRole` permission. It attaches no instance profile, and it puts your SSH key on the server through cloud-init, so it doesn't need `ec2:ImportKeyPair` either. Every resource dPanel creates is tagged `managed-by = dpanel`. The policy uses that tag so dPanel can only terminate instances and delete security groups that it created. ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "DpanelDiscovery", "Effect": "Allow", "Action": [ "ec2:DescribeRegions", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstanceTypes", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceAttribute", "ec2:DescribeVpcs", "ec2:DescribeVpcAttribute", "ec2:DescribeSubnets", "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupRules", "ec2:DescribeTags" ], "Resource": "*" }, { "Sid": "DpanelCreate", "Effect": "Allow", "Action": [ "ec2:RunInstances", "ec2:CreateVpc", "ec2:ModifyVpcAttribute", "ec2:CreateInternetGateway", "ec2:AttachInternetGateway", "ec2:CreateSubnet", "ec2:ModifySubnetAttribute", "ec2:CreateRouteTable", "ec2:CreateRoute", "ec2:ReplaceRoute", "ec2:AssociateRouteTable", "ec2:CreateSecurityGroup", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupEgress", "ec2:UpdateSecurityGroupRuleDescriptionsIngress" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestedRegion": ["ap-southeast-1", "ap-southeast-3"] } } }, { "Sid": "DpanelTagOnlyItsOwnResources", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/managed-by": "dpanel" } } }, { "Sid": "DpanelTagOnCreate", "Effect": "Allow", "Action": "ec2:CreateTags", "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateVpc", "CreateInternetGateway", "CreateSubnet", "CreateRouteTable", "CreateSecurityGroup" ] } } }, { "Sid": "DpanelManageOnlyItsOwnResources", "Effect": "Allow", "Action": [ "ec2:StartInstances", "ec2:TerminateInstances", "ec2:DeleteSecurityGroup" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/managed-by": "dpanel" } } } ] } ``` :::warning[Verify] The calls in the first table come straight from dPanel's code. A few actions in the JSON, such as `DescribeInstanceStatus`, `DescribeTags` and `DescribeSecurityGroupRules`, are made inside the Ansible `amazon.aws` modules dPanel uses, not by dPanel itself. If a launch fails with `UnauthorizedOperation`, the error names the missing action. Add it and try again. Servers created before dPanel started tagging them may lack the `managed-by` tag; deleting one of those needs `TerminateInstances` without the tag condition. ::: ## 2. Connect it to dPanel 1. In the sidebar, open **Cloud Projects**. The page is titled **Cloud accounts**. 2. Press **Connect a cloud account**. 3. Fill in **Connection name**, for example `AWS production`. 4. Under **Cloud provider**, pick **AWS**. 5. Paste **Access key** and **Secret key**. 6. Press **Connect cloud account**. [Screenshot: The Connect Cloud Account form with AWS selected and the Access key and Secret key fields empty] dPanel saves the account as **Ready** straight away. It does not test the key on save. The first real test is the launch form: if **Region** stays empty or shows an error, the key or its policy is wrong. ## 3. AWS fields in the launch form [Screenshot: The launch form with AWS selected] | Field | What to pick | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Region** | Any region your key may use, such as `ap-southeast-1`. | | **Size** | Move **CPU**, **RAM** and **Storage** (20 to 500 GB). dPanel launches the cheapest `t3a` or `t3` type that fits, then `c6a`, `m6a`, `c6i` or `m6i` for bigger sizes. **Choose the instance type yourself** lists every type in that region, such as `t3.small`. | | **Ubuntu release** | 24.04 LTS or 26.04 LTS. dPanel looks up the matching image in that region. | | **Network** | `dpanel-network`. You don't choose it. | There is no **Access** step for AWS. dPanel signs in as `ubuntu`. ## 4. Launch Follow [Create a cloud server](./create-a-cloud-server.md). Pick AWS in step 1. ## AWS gotchas - **The network appears on first launch.** In each region, the first launch creates a VPC named `dpanel-network` (`10.88.0.0/16`), an internet gateway, a public subnet and a route table. Later launches reuse them. Deleting a server never removes them. - **VPC quota.** AWS allows 5 VPCs per region by default. If the region is full, the first launch fails until you free one or raise the quota. - **One security group per server**, named `dpanel-`, open to the internet on TCP 22, 80 and 443. dPanel deletes it with the server. - **Public IP.** The instance gets an auto-assigned public IPv4 address. AWS bills public IPv4 addresses by the hour, and the address can change if you stop and start the instance outside dPanel. - **Names must be unique.** dPanel refuses a server name that a running or stopped instance in the region already has. - **Billing runs from launch.** You pay AWS for the instance, its EBS volume and its public IP while they exist, even while setup runs or fails. ## Security - The key can create and destroy EC2 resources in the regions you allowed. With the policy above it can't touch IAM, S3, databases or instances it didn't tag. - To rotate the key, create a new one for the same IAM user and replace it with **Update credentials** on the cloud account. See [Rotating a credential](./cloud-credentials-security.md#rotating-a-credential). - To cut dPanel off, deactivate the access key in IAM. Running servers keep running. See [what happens when you revoke](./cloud-credentials-security.md#if-you-revoke-a-credential). - More in [Cloud credentials and security](./cloud-credentials-security.md). ## Frequently asked questions ### What IAM permissions does dPanel need on AWS? Only EC2: the describe calls that fill the launch form, the calls that create `dpanel-network` and a security group, and `RunInstances`, `TerminateInstances` and `CreateTags`. The [minimum IAM policy](#minimum-iam-policy) above lists them, and needs no IAM, S3 or `iam:PassRole` permission. ### Can I keep dPanel to one AWS region? Yes. The policy's `aws:RequestedRegion` condition limits launches to the regions you name. Edit the list before you attach the policy. ### Which EC2 instance type does dPanel launch? The cheapest `t3a` or `t3` type with at least the CPU and RAM you pick, or a `c6a`, `m6a`, `c6i` or `m6i` type for bigger sizes. Press **Choose the instance type yourself** to pick any type, such as `t3.small`. ### Does deleting the server in dPanel terminate the EC2 instance? Yes. dPanel terminates the instance and deletes its security group. The `dpanel-network` VPC stays, so later launches in that region reuse it. --- # Google Compute Engine Source: https://dnocs.devetek.app/docs/servers/provider-gcp Create a least-privilege service account in a dedicated project, connect it to dPanel, and launch a Compute Engine server. dPanel launches Ubuntu Compute Engine VMs in one of your Google Cloud projects. It signs in with the JSON key of a service account that you create for it, in a dedicated project, with only the permissions listed on this page. ## What you need first - A Google Cloud project with billing linked. A new project just for dPanel is best. - The **Compute Engine API** enabled in that project. - Permission to create service accounts, custom roles and keys in that project. - An SSH key in dPanel. See [Before you start](../before-you-start.md). ## 1. Create a dedicated project and service account Run these with the [gcloud CLI](https://cloud.google.com/sdk/docs/install), signed in as a project owner. Replace `my-dpanel-project` and `BILLING_ACCOUNT_ID`. ```bash # A project only dPanel uses gcloud projects create my-dpanel-project gcloud billing projects link my-dpanel-project --billing-account=BILLING_ACCOUNT_ID gcloud services enable compute.googleapis.com --project=my-dpanel-project # The custom role with only what dPanel calls (see the list below) gcloud iam roles create dpanelCompute --project=my-dpanel-project \ --title="dPanel Compute" \ --permissions=compute.regions.list,compute.zones.list,compute.machineTypes.list,compute.machineTypes.get,compute.subnetworks.list,compute.subnetworks.use,compute.subnetworks.useExternalIp,compute.networks.get,compute.networks.create,compute.networks.updatePolicy,compute.firewalls.get,compute.firewalls.create,compute.firewalls.update,compute.firewalls.delete,compute.instances.list,compute.instances.get,compute.instances.create,compute.instances.delete,compute.instances.setMetadata,compute.instances.setTags,compute.instances.setLabels,compute.disks.create,compute.images.useReadOnly,compute.globalOperations.get,compute.zoneOperations.get # The service account, with that role and nothing else gcloud iam service-accounts create dpanel --project=my-dpanel-project \ --display-name="dPanel" # A new service account takes a few seconds to appear, and binding it too # early fails with "does not exist". This retries for up to a minute. for attempt in 1 2 3 4 5 6; do gcloud projects add-iam-policy-binding my-dpanel-project \ --member="serviceAccount:dpanel@my-dpanel-project.iam.gserviceaccount.com" \ --role="projects/my-dpanel-project/roles/dpanelCompute" \ --condition=None && break sleep 10 done # The JSON key you upload to dPanel gcloud iam service-accounts keys create dpanel-key.json \ --iam-account=dpanel@my-dpanel-project.iam.gserviceaccount.com ``` Keep `dpanel-key.json` safe, upload it, then delete your local copy. Prefer the console? Google's guides: [Create a project](https://cloud.google.com/resource-manager/docs/creating-managing-projects), [Create a custom role](https://cloud.google.com/iam/docs/creating-custom-roles), [Create a service account](https://cloud.google.com/iam/docs/service-accounts-create), [Create a service account key](https://cloud.google.com/iam/docs/keys-create-delete). :::info[Your organization may block keys] Some organizations enforce the policy `iam.disableServiceAccountKeyCreation`. dPanel needs a JSON key, so an administrator has to allow it for this project. ::: ## Minimum permissions Read from dPanel's code: | Where | What it does | Permissions | | -------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | dPanel API (discovery) | Lists regions, zones, machine types, subnets and VMs | `compute.regions.list`, `compute.zones.list`, `compute.machineTypes.list`, `compute.subnetworks.list`, `compute.instances.list`, `compute.instances.get` | | Network, first launch only | Creates `dpanel-network` (auto-mode VPC) | `compute.networks.get`, `compute.networks.create` | | Firewall, every launch | One ingress rule per server, TCP 22, 80, 443 | `compute.firewalls.get`, `compute.firewalls.create`, `compute.firewalls.update`, `compute.networks.updatePolicy` | | Instance | Creates the VM with your SSH key, network tag and labels | `compute.instances.create`, `compute.instances.setMetadata`, `compute.instances.setTags`, `compute.instances.setLabels`, `compute.disks.create`, `compute.images.useReadOnly`, `compute.subnetworks.use`, `compute.subnetworks.useExternalIp`, `compute.machineTypes.get` | | Delete | Removes the VM and its firewall rule | `compute.instances.delete`, `compute.firewalls.delete` | | Waiting on operations | Polls create and delete until they finish | `compute.zoneOperations.get`, `compute.globalOperations.get` | dPanel attaches no service account to the VMs it creates, so you don't need `roles/iam.serviceAccountUser`. If you'd rather use predefined roles, the closest set is `roles/compute.instanceAdmin.v1` plus `roles/compute.securityAdmin` (firewall rules) plus `roles/compute.networkAdmin` (the network, first launch only). Those roles grant far more than dPanel uses. :::warning[Verify] The discovery permissions come from dPanel's own API calls. The rest come from the Ansible `google.cloud` modules dPanel runs, and the exact set those modules check can vary by version. If a launch fails with `Required '…' permission`, add the named permission to the custom role with `gcloud iam roles update`. ::: ## 2. Connect it to dPanel 1. In the sidebar, open **Cloud Projects**. The page is titled **Cloud accounts**. 2. Press **Connect a cloud account**. 3. Fill in **Connection name**, for example `GCP production`. 4. Under **Cloud provider**, pick **Google Cloud**. 5. Upload `dpanel-key.json`. dPanel shows the **Project ID** and **Client Email** it found, and masks the **Private Key**. 6. Press **Connect cloud account**. [Screenshot: The Connect Cloud Account form with Google Cloud selected, waiting for a service account JSON upload] dPanel saves the account as **Ready** without testing it. The launch form is the first real test: if **Region** stays empty or errors, check the key and the role. ## 3. Google Cloud fields in the launch form [Screenshot: Step 1 of the launch form with Google Cloud selected] | Field | What to pick | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Region** | Where the VM runs, such as `asia-southeast2`. | | **Zone** | One zone in that region, such as `asia-southeast2-a`. | | **Size** | Move **CPU** and **RAM**. dPanel picks an E2 machine type: `e2-micro`, `e2-small` or `e2-medium` (shared core) for 1 vCPU, a standard E2 type when one matches, or an E2 custom type. | | **Ubuntu release** | 24.04 LTS or 26.04 LTS, from Google's public Ubuntu image family. | | **Storage** | Boot disk size, 20 to 500 GB. 20 by default. | | **Network** | `dpanel-network`. You don't choose it. | There is no **Access** step for Google Cloud. dPanel signs in as `ubuntu`. [Screenshot: Step 3 for Google Cloud, with the CPU, RAM and Storage sliders and the E2 machine type dPanel will launch] ## 4. Launch Follow [Create a cloud server](./create-a-cloud-server.md). Pick Google Cloud in step 1. ## Google Cloud gotchas - **Enable the API first.** Without the Compute Engine API, every list in the launch form fails. - **The network appears on first launch.** The first launch creates an auto-mode VPC named `dpanel-network`, which has a subnet in every region. Later launches reuse it. Deleting a server never removes it. - **One firewall rule per server**, named `dpanel-c--m--ingress`, open to the internet on TCP 22, 80 and 443 for that server's network tag only. dPanel deletes it with the server. - **Quotas.** New projects have low CPU and external IP quotas per region. A launch that fails with `QUOTA_EXCEEDED` needs a quota increase in the console. - **Ephemeral IP.** The VM gets an ephemeral external IP. It can change if the VM is stopped and started outside dPanel. - **Billing runs from launch.** You pay for the VM, its disk and its external IP while they exist. ## Security - The key can create and delete VMs, disks and firewall rules in this one project. In a dedicated project, that's all it can reach. - A service account key does not expire by default. To rotate it, create a new key for the same service account and replace it with **Update credentials** on the cloud account. The **Project ID** must stay the same. See [Rotating a credential](./cloud-credentials-security.md#rotating-a-credential). - To cut dPanel off, delete the key or disable the service account. Running servers keep running. See [what happens when you revoke](./cloud-credentials-security.md#if-you-revoke-a-credential). - More in [Cloud credentials and security](./cloud-credentials-security.md). ## Frequently asked questions ### Who pays for the server? Google Cloud bills you directly, because the server runs in your own account. dPanel does not resell machines. Delete the server in dPanel when you are done, so the provider stops charging. See [Delete a server](../delete-a-server.md). ### Can I also use the dPanel firewall on this server? Yes. The dPanel [firewall](../firewall.md) runs on the server itself, behind Google Cloud's own network rules, so a port must be open in both to be reached. ### What happens to my servers if I revoke the credential? They keep running, but dPanel can no longer launch or delete machines with it. See [Cloud credentials and security](./cloud-credentials-security.md#if-you-revoke-a-credential). --- # DigitalOcean Droplets Source: https://dnocs.devetek.app/docs/servers/provider-digitalocean Create a custom-scoped DigitalOcean API token, connect it to dPanel, and launch an Ubuntu Droplet in your own DigitalOcean team. dPanel launches Ubuntu Droplets in your own DigitalOcean team. It signs in with a custom-scoped personal access token that you create for it, limited to Droplets, SSH keys and the lists the launch form reads. ## What you need first - A DigitalOcean team with billing set up. A separate team just for dPanel keeps its access contained. - An SSH key in dPanel. See [Before you start](../before-you-start.md). ## 1. Create a custom-scoped token DigitalOcean lets you choose exactly what a token may do. Don't give dPanel a **Full Access** token. 1. In the [DigitalOcean control panel](https://cloud.digitalocean.com), go to **API**, then **Tokens**. 2. Press **Generate New Token**, and name it `dpanel`. 3. Pick an expiry. 90 days is a good balance; you will have to [rotate](./cloud-credentials-security.md#rotating-a-credential) it when it ends. 4. Under **Scopes**, choose **Custom Scopes** and tick only these: | Scope | Why dPanel needs it | | -------------------------------------------------- | ---------------------------------------------------- | | `droplet:create`, `droplet:read`, `droplet:delete` | Create the Droplet, wait for it, delete it later | | `ssh_key:create`, `ssh_key:read` | Import your dPanel SSH key as `dpanel-` | | `regions:read` | The **Region** list | | `sizes:read` | The **Size** sliders and the Droplet size list | | `image:read` | The Ubuntu image list | | `vpc:read` | The networks in a region | 5. Press **Generate Token**, and copy it. DigitalOcean shows it only once. DigitalOcean guides: [Create a personal access token](https://docs.digitalocean.com/reference/api/create-personal-access-token/), [Token scopes](https://docs.digitalocean.com/reference/api/scopes/). :::warning[Verify] The list above comes from the API calls in dPanel's code (`/v2/regions`, `/v2/sizes`, `/v2/images`, `/v2/vpcs`, `/v2/droplets`) and the Ansible `digitalocean.cloud` modules it runs (`droplet`, `droplets_info`, `ssh_key`). DigitalOcean sometimes requires extra read scopes for a create action, such as `actions:read` while waiting for a Droplet. The token page tells you which scopes a create scope depends on; accept them. If a launch fails with `403`, the error names the missing scope. ::: ## 2. Connect it to dPanel 1. In the sidebar, open **Cloud Projects**. The page is titled **Cloud accounts**. 2. Press **Connect a cloud account**. 3. Fill in **Connection name**, for example `DigitalOcean SGP`. 4. Under **Cloud provider**, pick **DigitalOcean**. 5. Paste the token into **API token**. 6. Press **Connect cloud account**. [Screenshot: The Connect Cloud Account form with DigitalOcean selected and the API token field empty] dPanel saves the account as **Ready** without testing it. The launch form is the first real test: if **Region** stays empty or errors, check the token and its scopes. ## 3. DigitalOcean fields in the launch form [Screenshot: The launch form with DigitalOcean selected] | Field | What to pick | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Region** | The datacenter, such as `sgp1`. | | **Size** | Move **CPU** and **RAM**. dPanel launches the cheapest Basic Droplet that fits, such as `s-1vcpu-2gb`; the disk comes with it. **Choose the instance type yourself** lists every size. | | **Ubuntu release** | 24.04 LTS or 26.04 LTS. | | **Network** | The region's default VPC, unless you pick another. | DigitalOcean adds a fourth step, **Access**, with **Default User**: the Linux user dPanel creates and signs in as. `dpanel` by default. ## 4. Launch Follow [Create a cloud server](./create-a-cloud-server.md). Pick DigitalOcean in step 1. ## DigitalOcean gotchas - **An SSH key appears in your team.** Each launch imports your dPanel public key as `dpanel-` under **Settings**, **Security**. Deleting the server does not remove it. - **No firewall from dPanel.** dPanel creates no Cloud Firewall. A new Droplet accepts traffic on every port until you add one. Allow TCP 22, 80 and 443 if you add a firewall, or dPanel and your apps stop working. - **Droplet limit.** New teams can only run a few Droplets. A launch that fails with a limit error needs a higher limit from DigitalOcean. - **No backups.** dPanel turns on neither DigitalOcean backups nor monitoring. Enable them in the control panel if you want them; backups cost extra. - **Billing runs from launch.** You pay for the Droplet while it exists, even when it is powered off. ## Security - With custom scopes, the token can create, read and delete Droplets and SSH keys, and read regions, sizes, images and VPCs. It can't touch Spaces, databases, DNS or billing. - With **Full Access**, it can do anything in the team, so don't. - To rotate the token, create a new one in the same team and replace it with **Update credentials** on the cloud account. See [Rotating a credential](./cloud-credentials-security.md#rotating-a-credential). - To cut dPanel off, delete the token under **API**, **Tokens**. Running servers keep running. See [what happens when you revoke](./cloud-credentials-security.md#if-you-revoke-a-credential). - More in [Cloud credentials and security](./cloud-credentials-security.md). ## Frequently asked questions ### Who pays for the server? DigitalOcean bills you directly, because the server runs in your own account. dPanel does not resell machines. Delete the server in dPanel when you are done, so the provider stops charging. See [Delete a server](../delete-a-server.md). ### Can I also use the dPanel firewall on this server? Yes. The dPanel [firewall](../firewall.md) runs on the server itself, behind DigitalOcean's own network rules, so a port must be open in both to be reached. ### What happens to my servers if I revoke the credential? They keep running, but dPanel can no longer launch or delete machines with it. See [Cloud credentials and security](./cloud-credentials-security.md#if-you-revoke-a-credential). --- # IDCloudHost VPS Source: https://dnocs.devetek.app/docs/servers/provider-idcloudhost Create an IDCloudHost API key, connect it to dPanel, and launch an Ubuntu cloud VPS in Indonesia from your own IDCloudHost billing account. dPanel launches Ubuntu cloud VMs in Indonesia in your own IDCloudHost account. It signs in with an API key from your IDCloudHost profile and charges your IDCloudHost billing account. ## What you need first - An IDCloudHost account with a billing account that has credit or a payment method. - An SSH key in dPanel. See [Before you start](../before-you-start.md). ## 1. Create the API key 1. Sign in to the [IDCloudHost console](https://console.idcloudhost.com). 2. Open your profile, then the **API** page. The direct link is [console.idcloudhost.com/user-profile/api](https://console.idcloudhost.com/user-profile/api). 3. Create a new API key for dPanel, and give it a name you will recognise, such as `dpanel`. 4. Copy the key. IDCloudHost's API reference: [api.idcloudhost.com](https://api.idcloudhost.com/). :::warning[Verify: scopes] dPanel's code uses a single API key, sent in the `apikey` header. We could not confirm from the code whether IDCloudHost lets you limit a key to some actions or resources. Assume the key can do anything your user can do in the console, including spending credit. If your account has team or sub-user features, create the key under a user that can only manage cloud VMs. ::: ### What dPanel calls | Purpose | IDCloudHost API | | --------------------------- | ---------------------------------------------------------- | | List locations | `GET /v1/config/locations` | | List Ubuntu templates | `GET /v1/config/vm_images/plain_os` | | List networks in a location | `GET /v1/{location}/network/networks` | | List billing accounts | `GET /v1/payment/billing_account/list` | | Create, read and delete VMs | `POST`, `GET` and `DELETE /v1/{location}/user-resource/vm` | | Read a VM's IP addresses | `GET /v1/{location}/network/ip_addresses` | ## 2. Connect it to dPanel 1. In the sidebar, open **Cloud Projects**. The page is titled **Cloud accounts**. 2. Press **Connect a cloud account**. 3. Fill in **Connection name**, for example `IDCloudHost Jakarta`. 4. Under **Cloud provider**, pick **IDCloudHost**. 5. Paste the key into **API key**. The panel links to the IDCloudHost API page if you still need one. 6. Press **Connect cloud account**. [Screenshot: The Connect Cloud Account form with IDCloudHost selected and the API key field empty] dPanel saves the account as **Ready** without testing it. The launch form is the first real test: if **Region** stays empty or errors, check the key. ## 3. IDCloudHost fields in the launch form [Screenshot: The launch form with IDCloudHost selected] | Field | What to pick | | ------------------- | --------------------------------------------------------------------------------------------------- | | **Region** | The location, such as `jkt01`. | | **Billing Account** | Leave it on **Auto-select billing account** to use your default active account, or pick one. | | **Network** | Chosen for you from the location's networks. If none exists, create one in the IDCloudHost console. | | **Size** | Move **CPU** (2 to 16 vCPU) and **RAM** (2 to 64 GB). IDCloudHost launches exactly that size. | | **Storage** | 20 to 500 GB. | | **Ubuntu release** | 24.04 LTS or 26.04 LTS. | IDCloudHost adds a fourth step, **Access**: - **Default User**: the first Linux user. `dpanel` by default, and dPanel signs in as this user. - **Bootstrap Password**: that user's initial password. IDCloudHost requires one. dPanel still signs in with your SSH key. ## 4. Launch Follow [Create a cloud server](./create-a-cloud-server.md). Pick IDCloudHost in step 1, and fill in **Access** before you press **Launch server**. ## IDCloudHost gotchas - **Credit.** IDCloudHost charges the billing account. With no credit or payment method, creation fails at the provider. - **Creation is asynchronous.** dPanel waits up to 10 minutes for the VM to appear before it gives up. A busy location can be slow. - **No firewall from dPanel.** dPanel creates no firewall rules on IDCloudHost. Whatever the provider allows by default stays open, so check the VM's network settings in the console if you need to restrict ports. - **A network must exist.** If the location has no network, the launch form says so. Create one in the IDCloudHost console, then refresh. - **Billing runs from launch.** You pay for the VM while it exists. ## Security - The key can do what your IDCloudHost user can do. Treat it like your console password. - To rotate the key, create a new one for the same IDCloudHost account and replace it with **Update credentials** on the cloud account. See [Rotating a credential](./cloud-credentials-security.md#rotating-a-credential). - To cut dPanel off, delete the key in the IDCloudHost API page. Running servers keep running. See [what happens when you revoke](./cloud-credentials-security.md#if-you-revoke-a-credential). - More in [Cloud credentials and security](./cloud-credentials-security.md). ## Frequently asked questions ### Who pays for the server? IDCloudHost bills you directly, because the server runs in your own account. dPanel does not resell machines. Delete the server in dPanel when you are done, so the provider stops charging. See [Delete a server](../delete-a-server.md). ### Can I also use the dPanel firewall on this server? Yes. The dPanel [firewall](../firewall.md) runs on the server itself, behind IDCloudHost's own network rules, so a port must be open in both to be reached. ### What happens to my servers if I revoke the credential? They keep running, but dPanel can no longer launch or delete machines with it. See [Cloud credentials and security](./cloud-credentials-security.md#if-you-revoke-a-credential). --- # Alibaba Cloud ECS Source: https://dnocs.devetek.app/docs/servers/provider-alibabacloud Create an Alibaba Cloud RAM user with an AccessKey, connect it to dPanel, and launch an Ubuntu ECS server in your own Alibaba Cloud account. dPanel launches Ubuntu ECS instances in your own Alibaba Cloud account. It signs in with an AccessKey that belongs to a RAM user you create for it, with only the ECS and VPC permissions listed on this page. ## What you need first - An Alibaba Cloud account that can buy pay-as-you-go servers: real-name verification done and a payment method added. See [the account must be allowed to buy](#the-account-must-be-allowed-to-buy). - Permission in that account to create RAM users. - An SSH key in dPanel. See [Before you start](../before-you-start.md). ## 1. Create a RAM user for dPanel Never give dPanel the AccessKey of your Alibaba Cloud account itself. 1. Sign in to the Alibaba Cloud console and open **RAM** (Resource Access Management). 2. Go to **Identities**, then **Users**, and press **Create User**. 3. Name it `dpanel`. Under **Access Mode**, tick **Using permanent AccessKey to access** (OpenAPI access) and leave console access off. 4. Copy the **AccessKey ID** and the **AccessKey Secret**. Alibaba Cloud shows the secret only once. 5. Back on the user list, choose **Add Permissions** for `dpanel`, and grant the system policies `AliyunECSFullAccess` and `AliyunVPCFullAccess`. Alibaba Cloud guides: [Create a RAM user](https://www.alibabacloud.com/help/en/ram/user-guide/create-a-ram-user), [Create an AccessKey](https://www.alibabacloud.com/help/en/ram/user-guide/create-an-accesskey-pair), [Grant permissions to a RAM user](https://www.alibabacloud.com/help/en/ram/user-guide/grant-permissions-to-the-ram-user). ### What dPanel does with the key | Where | What it does | API actions | | -------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | dPanel API (discovery) | Lists regions, zones, instance types, images, vSwitches, VMs | `DescribeRegions`, `DescribeZones`, `DescribeAvailableResource`, `DescribeInstanceTypes`, `DescribeImages`, `DescribeVSwitches`, `DescribeInstances` | | Network, first launch only | Creates `dpanel-network` and a vSwitch in the zone | `CreateVpc`, `CreateVSwitch` | | Every launch | Imports your SSH key and opens TCP 22, 80 and 443 | `ImportKeyPair`, `CreateSecurityGroup`, `AuthorizeSecurityGroup` | | Instance | Launches it, pay-as-you-go, with a public IP | `RunInstances` | | Delete | Deletes the instance, its security group and its key pair | `DeleteInstance`, `DeleteSecurityGroup`, `DeleteKeyPairs` | :::warning[Verify] The discovery calls come straight from dPanel's code. The launch and delete calls are made through the Ansible `alibaba.alicloud` collection, which may make a few more read calls. The two system policies above cover all of them. If you write a narrower custom policy and a launch fails, the error names the missing action. ::: ## 2. Connect it to dPanel 1. In the sidebar, open **Cloud Projects**. The page is titled **Cloud accounts**. 2. Press **Connect a cloud account**. 3. Fill in **Connection name**, for example `Alibaba production`. 4. Under **Cloud provider**, pick **Alibaba Cloud**. 5. Paste **AccessKey ID** and **AccessKey secret**. 6. Press **Connect cloud account**. [Screenshot: The Connect Cloud Account form with Alibaba Cloud selected and the AccessKey ID and AccessKey secret fields empty] dPanel saves the account as **Ready** straight away. It does not test the key on save. The first real test is the launch form: if **Region** stays empty or shows an error, the key or its permissions are wrong. ## 3. Alibaba Cloud fields in the launch form [Screenshot: The launch form with Alibaba Cloud selected] | Field | What to pick | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Region** | Where the server runs, such as `ap-southeast-5` (Jakarta). | | **Zone** | A zone inside the region, such as `ap-southeast-5a`. | | **Network** | `dpanel-network`. You don't choose it. | | **Size** | Move **CPU** and **RAM**. dPanel launches the cheapest type in stock in that zone, `ecs.e-` first, then `ecs.u1-`, `ecs.c7` or `ecs.g7`. **Choose the instance type yourself** lists them all, such as `ecs.e-c1m2.large`. | | **Ubuntu release** | 24.04 LTS or 26.04 LTS. dPanel picks the current Alibaba Cloud image for that release. | | **Storage** | System disk, 40 to 500 GB, ESSD. | There is no **Access** step for Alibaba Cloud. dPanel signs in as `root` with your SSH key. ## 4. Launch Follow [Create a cloud server](./create-a-cloud-server.md). Pick Alibaba Cloud in step 1. ## Alibaba Cloud gotchas ### The account must be allowed to buy If the launch fails with `Forbidden.RiskControl`, Alibaba Cloud has blocked purchases on the account. This is not a key or permission problem. Finish real-name verification, add a payment method, and check that the account has no overdue payment, then launch again. A new account can stay blocked until Alibaba Cloud reviews it. ### Other things to know - **The network appears on first launch.** In each region, the first launch creates a VPC named `dpanel-network` (`10.88.0.0/16`). Each zone gets its own vSwitch, `dpanel-network-`, the first time a server lands there. Deleting a server never removes them. - **One security group per server**, named `dpanel-`, open to the internet on TCP 22, 80 and 443. dPanel deletes it with the server. - **One key pair per server**, named `dpanel--key`, holding the public half of your SSH key. dPanel deletes it with the server. - **Names are host names.** Use 2 to 63 letters, numbers or dashes, starting with a letter. dPanel refuses a name that another instance in the region already has. - **Public IP and bandwidth.** The instance gets a public IPv4 address, billed by traffic, capped at 100 Mbps. - **Billing runs from launch.** You pay Alibaba Cloud for the instance, its disk and its traffic while they exist, even while setup runs or fails. Delete a server you no longer need. ## Security - The key can create and destroy ECS and VPC resources in the account. Keep it on its own RAM user so you can revoke it without touching anything else. - To rotate the key, create a new AccessKey for the same RAM user and replace it with **Update credentials** on the cloud account. See [Rotating a credential](./cloud-credentials-security.md#rotating-a-credential). - To cut dPanel off, disable or delete the AccessKey in RAM. Running servers keep running. See [what happens when you revoke](./cloud-credentials-security.md#if-you-revoke-a-credential). - More in [Cloud credentials and security](./cloud-credentials-security.md). ## Frequently asked questions ### Who pays for the server? Alibaba Cloud bills you directly, because the server runs in your own account. dPanel does not resell machines. Delete the server in dPanel when you are done, so the provider stops charging. See [Delete a server](../delete-a-server.md). ### Can I also use the dPanel firewall on this server? Yes. The dPanel [firewall](../firewall.md) runs on the server itself, behind Alibaba Cloud's own network rules, so a port must be open in both to be reached. ### What happens to my servers if I revoke the credential? They keep running, but dPanel can no longer launch or delete machines with it. See [Cloud credentials and security](./cloud-credentials-security.md#if-you-revoke-a-credential). --- # Tencent Cloud CVM Source: https://dnocs.devetek.app/docs/servers/provider-tencent Create a Tencent Cloud CAM sub-user with an API key and payment rights, connect it to dPanel, and launch an Ubuntu CVM server. dPanel launches Ubuntu CVM instances in your own Tencent Cloud account. It signs in with an API key (a SecretId and a SecretKey) that belongs to a CAM sub-user you create for it, with only the permissions listed on this page. ## What you need first - A Tencent Cloud account that can buy pay-as-you-go servers, with identity verification done and a balance or payment method. - Permission in that account to create CAM sub-users and grant them payment rights. - An SSH key in dPanel. See [Before you start](../before-you-start.md). ## 1. Create a CAM sub-user for dPanel Never give dPanel the API key of your root account. 1. Sign in to the Tencent Cloud console as the root account or an administrator, and open **CAM** (Cloud Access Management). 2. Go to **Users**, then **User List**, and create a **custom sub-user**. Name it `dpanel`. 3. Give it **Programmatic access** only. Leave console access off. 4. Attach the preset policies `QcloudCVMFullAccess` and `QcloudVPCFullAccess`. 5. Grant the sub-user **payment rights**, so it can pay for the pay-as-you-go servers it launches. See [the sub-user must be allowed to pay](#the-sub-user-must-be-allowed-to-pay). 6. Open the sub-user, go to **API key**, and create a key. Copy the **SecretId** and the **SecretKey**. Tencent Cloud shows the SecretKey only once. Tencent Cloud guides: [Create a sub-user](https://www.tencentcloud.com/document/product/598/13674), [Manage API keys](https://www.tencentcloud.com/document/product/598/32675), [Grant permissions](https://www.tencentcloud.com/document/product/598/10602). ### What dPanel does with the key | Where | What it does | API actions | | -------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | | dPanel API (discovery) | Lists regions, zones, instance types, images, subnets, VMs | `DescribeRegions`, `DescribeZones`, `DescribeZoneInstanceConfigInfos`, `DescribeImages`, `DescribeSubnets`, `DescribeInstances` | | Network, first launch only | Creates `dpanel-network` and a subnet in the zone | `CreateVpc`, `CreateSubnet` | | Every launch | Imports your SSH key and opens TCP 22, 80 and 443 | `ImportKeyPair`, `CreateSecurityGroup`, `CreateSecurityGroupPolicies` | | Instance | Launches it, pay-as-you-go, with a public IP | `RunInstances` | | Delete | Deletes the instance, its security group and its key pair | `TerminateInstances`, `DeleteSecurityGroup`, `DeleteKeyPairs` | :::warning[Verify] The discovery calls come straight from dPanel's code. The launch and delete calls are made through the Ansible `susunola.tencentcloud` collection, which may make a few more read calls. The two preset policies above cover all of them. If you write a narrower custom policy and a launch fails, the error names the missing action. ::: ## 2. Connect it to dPanel 1. In the sidebar, open **Cloud Projects**. The page is titled **Cloud accounts**. 2. Press **Connect a cloud account**. 3. Fill in **Connection name**, for example `Tencent production`. 4. Under **Cloud provider**, pick **Tencent Cloud**. 5. Paste **SecretId** and **SecretKey**. 6. Press **Connect cloud account**. [Screenshot: The Connect Cloud Account form with Tencent Cloud selected and the SecretId and SecretKey fields empty] dPanel saves the account as **Ready** straight away. It does not test the key on save. The first real test is the launch form: if **Region** stays empty or shows an error, the key or its permissions are wrong. ## 3. Tencent Cloud fields in the launch form [Screenshot: The launch form with Tencent Cloud selected] | Field | What to pick | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Region** | Where the server runs, such as `ap-jakarta`. | | **Zone** | A zone inside the region, such as `ap-jakarta-1`. | | **Network** | `dpanel-network`. You don't choose it. | | **Size** | Move **CPU** and **RAM**. dPanel launches the cheapest `SA2`, `SA5` or `S5` type on sale in that zone. **Choose the instance type yourself** lists them all, such as `SA5.MEDIUM2`. | | **Ubuntu release** | 24.04 LTS or 26.04 LTS. dPanel picks the current Tencent Cloud image for that release. | There is no **Access** step for Tencent Cloud. dPanel signs in as `ubuntu` with your SSH key; Tencent Cloud's Ubuntu images don't allow `root` to log in. ## 4. Launch Follow [Create a cloud server](./create-a-cloud-server.md). Pick Tencent Cloud in step 1. ## Tencent Cloud gotchas ### The sub-user must be allowed to pay If the launch fails with `UnauthorizedOperation` and a message about **payment rights**, the sub-user may manage servers but not pay for them. This is not a key problem. Sign in as the root account, grant the `dpanel` sub-user payment rights (the finance permission for purchases) in CAM, and launch again. Check too that the account has a balance or a payment method. ### Other things to know - **The network appears on first launch.** In each region, the first launch creates a VPC named `dpanel-network` (`10.88.0.0/16`). Each zone gets its own subnet, `dpanel-network-`, the first time a server lands there. Deleting a server never removes them. - **One security group per server**, named `dpanel-`, open to the internet on TCP 22, 80 and 443, with outbound traffic allowed. dPanel deletes it with the server. - **One key pair per server**, named `dpanel__`, because Tencent Cloud allows only letters, numbers and underscores there. dPanel deletes it with the server, even when the launch failed. - **Names are host names.** Use 2 to 63 letters, numbers or dashes, starting with a letter. dPanel refuses a name that another instance in the region already has. - **Disk.** The system disk is the size and type Tencent Cloud picks for the image. The launch form has no storage slider for Tencent Cloud. - **Public IP and bandwidth.** The instance gets a public IPv4 address, billed by traffic, capped at 100 Mbps. - **Billing runs from launch.** You pay Tencent Cloud for the instance, its disk and its traffic while they exist, even while setup runs or fails. Delete a server you no longer need. ## Security - The key can create and destroy CVM and VPC resources in the account, and pay for them. Keep it on its own sub-user so you can revoke it without touching anything else. - To rotate the key, create a new API key for the same sub-user and replace it with **Update credentials** on the cloud account. See [Rotating a credential](./cloud-credentials-security.md#rotating-a-credential). - To cut dPanel off, disable or delete the API key in CAM. Running servers keep running. See [what happens when you revoke](./cloud-credentials-security.md#if-you-revoke-a-credential). - More in [Cloud credentials and security](./cloud-credentials-security.md). ## Frequently asked questions ### Who pays for the server? Tencent Cloud bills you directly, because the server runs in your own account. dPanel does not resell machines. Delete the server in dPanel when you are done, so the provider stops charging. See [Delete a server](../delete-a-server.md). ### Can I also use the dPanel firewall on this server? Yes. The dPanel [firewall](../firewall.md) runs on the server itself, behind Tencent Cloud's own network rules, so a port must be open in both to be reached. ### What happens to my servers if I revoke the credential? They keep running, but dPanel can no longer launch or delete machines with it. See [Cloud credentials and security](./cloud-credentials-security.md#if-you-revoke-a-credential). --- # Cloud credentials and security Source: https://dnocs.devetek.app/docs/servers/cloud-credentials-security What dPanel stores when you connect a cloud account, what the API key can do, and how to limit, rotate, replace and revoke your cloud credentials safely. To launch servers for you, dPanel holds an encrypted credential (an API key) for your cloud account. This page says plainly what dPanel stores, what that key can do, and how to limit, rotate and revoke it, so you can decide how much to trust it and how to limit the damage if something goes wrong. ## The risk, in one paragraph A cloud credential lets whoever holds it spend your money and touch your infrastructure. When you connect one, you trust dPanel's operators, its servers and its code with it. If dPanel's database and its encryption key were both stolen, or dPanel had a bug or a malicious change, an attacker could use your credential to launch machines on your bill, or delete the ones dPanel can reach. dPanel can't remove that risk for you. You can make it small: give dPanel a credential that can only manage VMs, in an account or project that holds nothing else, with a spending limit. ## What dPanel stores | What | How | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | The credential | In dPanel's database, each field encrypted with AES using a key that dPanel's server reads from a key file. The key is not stored in the database. | | Connection name and provider | In plain text. | | Who owns it | The workspace it was created in. Everyone in that workspace can launch servers with it. Nobody can read it back. | Once saved, the credential is never sent back to a browser. The page shows the account, never the key. dPanel decrypts the credential in two places: 1. **On dPanel's server**, to fill the launch form: listing regions, sizes, images and networks, and checking whether a server name is taken. 2. **On dPanel's worker**, to create or delete a VM. The credential travels with the job and is used by the provider's Ansible modules, which run with logging of secrets turned off. :::warning[Verify] The encryption is AES in CFB mode, with a symmetric key held next to the application rather than in a cloud KMS or HSM. It protects a stolen database backup. It does not protect against someone with access to dPanel's running server and its key file. We could not confirm from the code how long the worker keeps the job's credential file after a run. ::: ## What each credential can do | Provider | With the minimum we recommend | With a broad credential | | ------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | | AWS | Create and terminate EC2 instances it tagged, and their network and security groups, in the regions you allow | Everything your IAM user or root user can do | | Google Cloud | Create and delete VMs, disks and firewall rules in one project | Everything in every project the account can reach | | IDCloudHost | Everything your IDCloudHost user can do; we could not confirm scoped keys (verify) | The same | | DigitalOcean | Create, read and delete Droplets and SSH keys; read regions, sizes, images and VPCs | Everything in the team | | Alibaba Cloud | Create and delete ECS instances, VPCs, vSwitches, security groups and key pairs in the account | Everything in the Alibaba Cloud account | | Tencent Cloud | Create, pay for and delete CVM instances, VPCs, subnets, security groups and key pairs in the account | Everything in the Tencent Cloud account | The minimum for each one is on its page: [AWS](./provider-aws.md#minimum-iam-policy), [Google Cloud](./provider-gcp.md#minimum-permissions), [IDCloudHost](./provider-idcloudhost.md#1-create-the-api-key), [DigitalOcean](./provider-digitalocean.md#1-create-a-custom-scoped-token), [Alibaba Cloud](./provider-alibabacloud.md#1-create-a-ram-user-for-dpanel), [Tencent Cloud](./provider-tencent.md#1-create-a-cam-sub-user-for-dpanel). ## Least privilege, in practice :::danger[Never use root or owner credentials] Don't connect your AWS root user, an AWS administrator, a Google Cloud owner, or a DigitalOcean **Full Access** token. If that credential leaks, everything in the account goes with it. ::: 1. **Use a dedicated account or project.** An AWS account, a Google Cloud project, or a DigitalOcean team that holds only what dPanel launches. A leak then can't reach your databases, storage or other servers. 2. **Use a dedicated identity.** A separate IAM user, service account or token named `dpanel`, so you can see what it did and revoke it alone. 3. **Grant the minimum.** Use the policy, role or scopes on the provider's page. 4. **Cap the spend.** Set a budget alert at the provider: [AWS Budgets](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-create.html), [Google Cloud budgets](https://cloud.google.com/billing/docs/how-to/budgets), [DigitalOcean billing alerts](https://docs.digitalocean.com/platform/billing/). On IDCloudHost, keep only the credit you mean to spend in the billing account. 5. **Limit regions.** On AWS, the policy's `aws:RequestedRegion` condition keeps launches to the regions you name. 6. **Watch the audit log.** AWS CloudTrail, Google Cloud Audit Logs and the DigitalOcean security history show every call made with the credential. ## Rotating a credential You can replace the key inside an existing cloud account without disconnecting it. The account keeps its ID, so servers launched with it keep working and can still be deleted. 1. Create a new key at the provider for the same identity. AWS allows two access keys per user, and Google Cloud several keys per service account. On DigitalOcean and IDCloudHost, create a second token or API key. 2. In the sidebar, open **Cloud Projects**. On the account's row, open the **More** (⋯) menu and choose **Update credentials**. 3. Fill in the same fields as when you connected the account, then press **Save credentials**. 4. Confirm the new key works: open the launch form and check that the regions load. 5. Delete or deactivate the old key at the provider. [Screenshot: The Update credentials dialog for a cloud account, with empty credential fields and Save credentials] From the command line, run `dnocs cloud-project update-credentials --id `. It asks for each field, like `dnocs cloud-project create`. For a multi-line value such as the Google Cloud service account JSON, answer the prompt with `@path/to/key.json` to read it from a file. You can also pass every field at once with `--credential-file credential.json`, a JSON object such as `{"project_id":"my-project","service_account_json":"..."}`, and skip the confirmation with `--yes`. dPanel checks the new key before it saves it: - Every required field must be filled in. - On Google Cloud, the **Project ID** must be the same as the account's current one. To use another project, connect a new cloud account. - dPanel calls the provider with the new key: it lists regions, and on IDCloudHost the billing accounts. If the provider refuses the key, nothing is saved, the old key stays in use, and the error says the provider rejected the credential. The new key is stored encrypted, like the old one, and is never shown again. In a team workspace, updating credentials needs the cloud-project **admin** level: Owner, Admin, DevOps, or a cloud-project admin role. :::warning[Use a key for the same account] On AWS, DigitalOcean, IDCloudHost, Alibaba Cloud and Tencent Cloud, dPanel can't confirm that the new key belongs to the same account as the old one. Make sure it does. Otherwise dPanel can't delete the servers launched with the old key. ::: If the old key has leaked, don't wait: update the credentials with a new key now, then revoke the old one at the provider. ## If you revoke a credential Revoking means deleting or deactivating the key at the provider. Here is what happens to servers launched with it: - **They keep running.** dPanel reaches a server over SSH and through its agent, not through the cloud credential. Applications, logs, the terminal and modules all keep working. - **New launches fail.** The launch form can't list regions or sizes, and creation fails at the provider. - **Deleting a server only half works.** dPanel can't destroy the VM at the provider. The server stays in **Deleting** or **Deleted**, dPanel won't remove its record until the provider confirms, and **the VM keeps running and billing** at the provider. Delete it yourself in the provider's console. - **The cloud account can't be disconnected** while servers still reference it. To fix a revoked or expired key, create a new key for the same account and [update the credentials](#rotating-a-credential). New launches and server deletion work again. ## Removing a cloud account from dPanel 1. Delete every server launched with it. See [Delete a server](../delete-a-server.md). 2. In the sidebar, open **Cloud Projects**. 3. On the account's row, open the **More** (⋯) menu, choose **Delete**, and confirm **Disconnect cloud account**. dPanel deletes the stored credential. That does not revoke the key at the provider: delete it there too. [Screenshot: The Cloud accounts page listing connected provider accounts] ## Frequently asked questions ### Can anyone read my cloud API key back from dPanel? No. Once saved, the key is never sent back to a browser or shown again, to you or to your teammates. dPanel decrypts it only on its own server and worker to call your provider. ### How do I replace a leaked or expired key? Create a new key at the provider, choose **Update credentials** on the cloud account in dPanel, save it, then revoke the old key at the provider. The account keeps its ID, so your servers keep working. See [Rotating a credential](#rotating-a-credential). ### What happens to my servers if I revoke the key? They keep running, and applications, logs and the terminal keep working. Only new launches and deleting servers at the provider stop until you add a working key. --- # Register a private machine Source: https://dnocs.devetek.app/docs/servers/register-a-private-machine Add a PC, a home server or a VM behind a router to dPanel with one command. It needs no public IP and no open port. A private machine is a computer that nothing on the internet can reach: a PC, a home server, or a VM behind a router. dPanel never connects to it. Instead, you run one command on the machine, which installs the dPanel agent, and the agent keeps an outgoing connection to dPanel. The machine then shows up on your servers page. ## What you need first - A Linux machine with systemd, such as Ubuntu or Debian, on Intel/AMD (`amd64`) or ARM (`arm64`). - A terminal on that machine where you can use `sudo`. - Internet access from the machine. It only connects out, so no port forwarding is needed. ## Register it 1. Install the dnocs command line tool on the machine. Follow [Install dnocs](../ai/ai-in-the-terminal.md#install-dnocs). 2. Sign in, and pick the workspace the machine belongs to (skip this to keep it in your personal space): ```bash dnocs auth login -u dnocs workspace list dnocs workspace set --id ``` 3. Register the machine: ```bash sudo dnocs machine register ``` dnocs asks you to confirm, installs the agent, and waits until the server is ready. That usually takes under a minute. The server now appears on your [servers page](/servers) with a **Private** badge. ## What you can do with it | You can | Not yet | | --- | --- | | See CPU, memory and disk usage | Deploy automatically on every GitHub push | | Browse and edit files | | | Start, stop and restart services | | | Read logs | | | Manage Linux users | | | Install modules such as MariaDB, Redis or Docker | | | Build and deploy applications | | | Open a terminal in the browser or with `dnocs server exec` | | ## How modules and apps get installed A private machine runs its own installer, so nothing on the internet needs to reach it. The first time you install a module or deploy an app, the agent sets up the installer on the machine (Python and Ansible, about a minute and a half), then the installer runs the job on the machine itself and stops again after 10 quiet minutes. If the machine is off or offline when you start an install, the install waits and then fails; start it again once the machine is back. A private machine can never have a load balancer or a domain: nothing on the internet can reach it. Apps you deploy to it listen on the machine itself, so you open them on your own network at the machine's address and the app's port, for example `http://192.168.1.20:3000`. ## Register it again Running `sudo dnocs machine register` again on the same machine keeps the same server in dPanel and gives its agent a new credential. A machine belongs to one workspace at a time, and a workspace can hold up to 10 private machines. ## Remove it Delete the server in dPanel (from its page, or with `dnocs server delete --id `). dPanel removes it at once, and the agent's credential stops working. Then stop the agent on the machine: ```bash sudo systemctl disable --now dpanel-active-agent ``` --- # Your server page Source: https://dnocs.devetek.app/docs/servers/your-server-page Every tab of a dPanel server page: live CPU and memory, modules, systemd services, Linux users, open ports, files, logs and settings. Every server in dPanel has one page, and everything you can do to that server is on it: live usage, installed modules, systemd services, Linux users, open ports, files, logs and settings. Open it from **Servers** by selecting the server's row. ## The header The header shows the name, the status, the address, the Ubuntu release and where it runs, then a line of facts: the SSH login dPanel uses (such as `ubuntu@203.0.113.10:22`), the agent version, the workspace, who created the server and when. | Control | What it does | | -------------------- | ----------------------------------------------------------------------------------------- | | Refresh (↻) | Reads the server's status, usage, services and modules again. | | **Edit server** (✎) | Changes the address, SSH login and agent ports dPanel uses. | | **Open terminal** | Opens a shell in the browser. See [Connect over SSH](./connect-over-ssh.md). | | **More actions** (⋯) | **Reinstall server** runs setup again; **Delete server** removes it. See the table below. | Select the status badge to see what the status means. While dPanel is setting a server up, a blue banner says so, with **Follow the logs**. If setup fails, a red **Setup did not finish** banner offers **See what happened**. ## Overview **Live usage** reads CPU, memory and disk from the agent every few seconds while the page is open. Below it are counts of applications, load balancers, databases and modules, then **Server details** (address, SSH login, operating system, agent, provider, ownership, **Created by** and when it was added) and **What runs here**. [Screenshot: A server page on the Overview tab] ## Modules Everything dPanel installed, one row per module, with its versions and status: **Installed**, **Installing**, **Failed**, or **Mixed**. **Add module** opens the catalogue. **Refresh inventory** asks the agent again and drops modules it no longer reports. The counts include top-level modules only; databases you create on MariaDB or PostgreSQL live inside that module's **Manage** view. Some rows have a shortcut: **Open database** on MariaDB and PostgreSQL opens DB Manager, a database tool in your browser, already pointed at this server; **Manage firewall** on the Firewall module opens the [Firewall](./firewall.md) view. See [Install software](./install-software.md). [Screenshot: The Modules tab listing installed modules, with Manage firewall on the Firewall row and Open database on the MariaDB row] ## Services Every systemd unit the agent can see. A service is a program Linux keeps running in the background, such as a database or a web server. Use the row's actions to start, stop, restart or reload one. Most servers have well over a hundred units, and many sit in **Dead** or **Exited** on purpose. A **Needs attention** count on a fresh machine is normal. [Screenshot: The Services tab listing systemd units] ## Users The Linux accounts on the machine, with their UID, home directory and login shell. **Add user** creates a managed account. Most entries on a fresh server belong to the system, so leave them alone. [Screenshot: The Users tab listing Linux accounts] ## Network Three tiles switch the view: - **Active ports**: which ports are open, which process holds each one, where connections come from (**Allow from**), their state, and a **Firewall** column that says whether a firewall rule lets the outside reach each port. An application listening on its port shows up here as **LISTEN**. Check this view when something can't be reached. - **Interfaces**: the server's network cards and their IPv4 and IPv6 addresses. - **Firewall**: whether the firewall is **On** or **Off**, its rules, and **Review and apply**. See [Firewall](./firewall.md). [Screenshot: The Network tab on Active ports: a table of ports with their process, state and a Firewall column reading Allowed from anywhere or No allow rule] ## Files **Open file manager** lets you browse folders as a tree or a table, upload files, create folders and preview text files. [Screenshot: The Files tab with the Open file manager button] ## Logs The newest lines of one log file, parsed into time, level, source and message. 1. Pick a file in the log source picker. **Auth** is first. 2. Pick how many lines to read: 20, 50, 100, 200 or 500. 3. Type in **Filter log lines** to narrow them. 4. Select a line to open the **Log entry** panel, with the full message and **Copy raw line**. **Refresh** reads the file again. The menu beside it turns on **Auto-refresh**: off by default, or every 30 seconds, minute or 5 minutes. [Screenshot: The Logs tab of a server, showing parsed log lines] :::note[Server logs have no time range] This tab reads the newest lines of a file. The time range, paging and download are on application and load balancer logs. See [Reading logs](../logs/reading-logs.md). ::: ## Settings The changes you rarely need, each saying what it does. | Card | Button | What it does | | ----------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Connection | **Edit connection** | Changes the address, SSH login and agent ports dPanel uses. | | Setup | **Reinstall** | Runs server setup again: reconnects over SSH, reinstalls the agent and refreshes the inventory. Installed modules and your data stay. | | Danger zone | **Delete server** | Removes the server. See [Delete a server](./delete-a-server.md). | **Setup** is hidden while a server is being set up or deleted, and on a deleted server, because there is nothing to reinstall then. A server stays in the workspace it was created in; it cannot be moved to another one. From the terminal, `dnocs server setup --id 140` does the same as **Reinstall**. Add `--force` to run it even while the server still reads in progress, for example when a setup hung. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install `dnocs`. [Screenshot: The Settings tab with the Connection, Setup and Danger zone cards] ## Frequently asked questions ### How do I find a server quickly? Type in the search box on **Servers**. The search ignores letter case, so `WEB` finds `web-01`. ### Why does the header show a person's name? **Created by** names the person who added the server, so a team can see who to ask. Select the name to open their public profile. ### What does Reinstall change on my server? It reconnects over SSH, reinstalls the dPanel agent and refreshes the inventory. Installed modules, applications and data stay as they are. ### Where do I open a database that runs on this server? On the **Modules** tab, press **Open database** on the MariaDB or PostgreSQL row. See [Install software](./install-software.md#manage-the-database). ### Why does a port I opened not work from outside? Check the **Firewall** column on **Network → Active ports**. **No allow rule** means the firewall blocks it; add a rule in [Firewall](./firewall.md). Also check that the program listens on `0.0.0.0` rather than `127.0.0.1`. --- # Install software Source: https://dnocs.devetek.app/docs/servers/install-software Install a database such as MariaDB, a runtime such as Go, or a web server on an Ubuntu server from the dPanel module catalogue, without SSH. dPanel installs software on a server through modules: open the server's **Modules** tab, press **Add module**, pick one, and dPanel installs it for you. A module is a tested recipe for a database, a language runtime or a tool: you answer a few questions, and dPanel installs, configures and starts it on the server as a systemd service (a program Linux keeps running in the background), then keeps track of what it put there. You don't need SSH or `apt`. New to these words? See the [Glossary](../getting-started/glossary.md). ## Open the catalogue 1. Open the server and go to **Modules**. 2. Press **Add module**. The **Module catalog** groups what is available. Filter by category or type in **Search modules**. Modules already on the server are marked **Installed**, with **Manage** instead of **Install**. | Category | Examples | | --------------------------------- | ------------------------------------------------------------------ | | **Containers** | Docker, and k3s or RKE2 for a one-server Kubernetes | | **Databases** | MariaDB, PostgreSQL, MongoDB, Redis | | **Infrastructure** | Caddy Server, Apache APISIX and HAProxy, the load balancer engines | | **Programming Languages Runtime** | Node.js, Bun, Go, PHP, Python, Ruby, UV | | **Security** | Firewall, managed from the server's [Firewall](./firewall.md) view | | **Utilities** | FFmpeg, FrankenPHP | [Screenshot: The module catalogue with 20 modules in six categories: Containers, Databases, Infrastructure, Programming Languages Runtime, Security and Utilities] ## Pick a version Where a module installs a version of something, its version field is a list of the newest releases, newest first. Keep the first one unless your application needs an older one. Need a release that is not listed? If the list ends with **Custom version…**, pick it and type the release, in the same format as the listed ones (for example `1.26.4`). dPanel checks the format before it installs. [Screenshot: The Go install form with the Go Version list open: 1.27.3, 1.27.2, 1.27.1, 1.27.0, 1.26.10 and Custom version…] ## Install a database 1. Press **Install** on the module you want, for example **MariaDB**. 2. The form lists the **Roles to run** and asks only for what it can't decide for you. For MariaDB that is **MariaDB Version**, **Root Password** and **Bind Address**. 3. Press **Install role** and confirm. [Screenshot: The MariaDB install form, with version, root password and bind address] :::warning[Choose the password yourself] The root password is required and must be at least 8 characters. There is no default, because a database installed with a published default password is open to anyone who knows it. dPanel stores it only on the server and never shows it again, so keep your own copy somewhere safe. ::: ## What happens next The module appears on the **Modules** tab as **Installing**. A database takes a few minutes. When it is done: - The **Modules** tab shows it as **Installed**, with its version. - The **Overview** tab lists it under **What runs here**. - The **Services** tab shows its service running. If it reads **Failed**, open the module to see why, fix the cause, and install it again. ## The Modules tab The **Modules** tab lists one row per module with its versions and status (**Installed**, **Installing**, **Failed**, or **Mixed** when versions differ). The **Modules**, **Installed** and **Needs attention** counts include top-level modules only: databases you create on MariaDB or PostgreSQL appear inside that module's **Manage** view, not as their own rows. [Screenshot: The Modules tab with Caddy Server, Firewall, FrankenPHP, MariaDB and PHP installed, Manage firewall on the Firewall row and Open database on the MariaDB row] - **Refresh inventory** asks the agent what is on the server now. A module the agent no longer reports, for example one you removed by hand, drops off the list. - Select a version chip to see what dPanel recorded about that install. **Uninstall** there removes the record from dPanel only; the software stays on the server. - **Open database** (MariaDB, PostgreSQL) and **Manage firewall** (Firewall) are shortcuts. See below and [Firewall](./firewall.md). :::tip[Runtimes for applications] You don't have to install a language runtime first. When you [create an application](../applications/create-an-application.md), you pick its runtime as a dependency, and dPanel installs it on the server. ::: ## Manage the database Once MariaDB or PostgreSQL reads **Installed**, its row on the **Modules** tab has **Open database**. It opens the database manager at `dbmanager.devetek.app` in a new tab, already signed in with your dPanel account and pointed at that server. 1. Press **Open database**. You can also open the module and press **Open database** there. 2. Check the engine, enter the database user (MariaDB uses `root`, PostgreSQL uses the admin user you chose) and the password you set when you installed it. 3. Press **Connect**. From there you can browse tables, run queries, and create databases and users with read-only or read-write access. The database manager reaches the database through the server's SSH connection, so the database never needs to be open to the internet. You can open it on servers you can edit: your own servers, and servers in a workspace where you have editor access or more. ## Create a database for an application An application such as WordPress or Laravel needs its own database and a user that can only reach it. You create both from the database server's own module, without its administrator password: 1. On the **Modules** tab, press **Add module**, then **Manage** on **MariaDB** or **PostgreSQL**. It must already be **Installed**. 2. Under **Databases**, press **Create database**. The section lists the databases you created on this server. [Screenshot: The Databases section in MariaDB's Manage view, with one database and the Create database button] 3. Enter **Database Name** and **Database User**, and a **Database Password** of at least 8 characters. PostgreSQL names use lowercase letters, digits and underscores. 4. Press **Install role**. [Screenshot: The Create database form: database name, user and password] dPanel creates the database and the user, gives the user every privilege on that database only, and lets it sign in from the server itself (`127.0.0.1`), which is how an application on the same server connects. Creating the same database name again with a new password changes the user's password. Point the application at it with runtime variables: host `127.0.0.1`, port `3306` for MariaDB or `5432` for PostgreSQL, the database name, the user and the password. See [Environment variables](../applications/environment-variables.md). You can also ask **Ask dPanel** to install a module or create an application database for you; it generates the password and shows it to you once. See [Prompt cookbook](../ai/prompt-cookbook.md). ## From the terminal The `dnocs` CLI installs the same modules. Install it with [AI in the terminal](../ai/ai-in-the-terminal.md). ```bash dnocs module list --server-id 140 # the catalog for this server dnocs module install nodejs --server-id 140 --var nodejs.nodejs_version=22 dnocs module install postgresql --server-id 140 --generate-secrets dnocs module installed --server-id 140 # what is installed, with IDs ``` `--generate-secrets` creates any required password, such as a database admin password, and saves it to a file only you can read; it prints the file's path, never the value. ## Many servers at once A server group installs the same module on every member in one operation, and shows the result per server. Groups are under **Servers**, then **Server groups**. See [Generic server groups](../clusters/generic-groups.md). ## Frequently asked questions ### Do I need to install a runtime before I deploy an application? No. When you [create an application](../applications/create-an-application.md), you pick its runtime as a dependency and dPanel installs it on the server. ### Why don't my application databases show on the Modules tab? They belong to their database server. Open **Add module**, then **Manage** on MariaDB or PostgreSQL, and look under **Databases**. ### I removed software by hand. Why is it still listed? dPanel shows what the agent last reported. Press **Refresh inventory**; modules the agent no longer finds drop off the list. ### Does Uninstall remove the software from my server? No. **Uninstall** on a version chip removes dPanel's record only. The package, its data and its service stay on the server. ### Can I install a version that is not in the list? Yes, on modules that allow it: pick **Custom version…** and type the release, in the same format as the listed versions. --- # Connect over SSH Source: https://dnocs.devetek.app/docs/servers/connect-over-ssh Open an SSH terminal to your server in the browser with dPanel, or connect from your own machine with ssh and your own public key. dPanel gives you an SSH terminal in the browser: press **Open terminal** at the top of a server page, and dPanel signs in with the key it holds and opens a shell. Most of the time you won't need one, because the tabs cover services, users, files and logs. [Screenshot: A shell session on the server, inside the browser] You install nothing on your computer, and you don't need the private key. The session belongs to the login user dPanel set up. The server header shows it, for example `dpanel@203.0.113.10:22`. | Provider | Login user | | -------------------------------- | ------------------------------ | | Google Cloud, AWS, Tencent Cloud | `ubuntu` | | Alibaba Cloud | `root` | | DigitalOcean, IDCloudHost | `dpanel` | | A server you connected | The **Linux user** you entered | ## From your own machine If you prefer your own terminal, connect with any SSH client using the login in the server header. ```bash ssh ubuntu@203.0.113.10 ``` For that to work, your computer's own public key has to be on the server. The key dPanel generated stays inside dPanel. Add yours to the server's `authorized_keys`, through the browser terminal or the file manager. ```bash echo "ssh-ed25519 AAAA... you@example.com" >> ~/.ssh/authorized_keys ``` Paste your own public key in place of the example. On your machine it is usually `~/.ssh/id_ed25519.pub`. ## Frequently asked questions ### Do I need to install anything to use the browser terminal? No. **Open terminal** works in the browser with the key dPanel holds. ### Can I run commands as root? The login user can use `sudo`, so start a command with `sudo` when it needs administrator rights. ### Why does `ssh` from my computer say permission denied? Your computer's public key is not on the server yet. Add it to `~/.ssh/authorized_keys` as shown above, as the same login user. ### Is there a terminal command instead of the browser? `dnocs server exec` runs a shell script on a server through dPanel. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install `dnocs`. --- # Firewall Source: https://dnocs.devetek.app/docs/servers/firewall Choose which ports of a server can be reached from the internet, review the change, and let dPanel apply it safely, from the web or the dnocs CLI. dPanel manages each server's firewall for you: you keep a list of rules in dPanel, review what will change, and dPanel applies the whole list to the server at once, without locking itself out. A firewall decides which network traffic may reach your server; with it on, only the ports you allow can be reached from the internet and everything else is blocked. Under the hood dPanel uses ufw, the firewall built into Ubuntu. A **port** is a numbered door on the server that one program listens on, such as 443 for a website or 22 for SSH. New to these words? See the [Glossary](../getting-started/glossary.md). ## Open the firewall 1. Open **Servers** and select your server. 2. Go to the **Network** tab and select the **Firewall** tile. If the **Firewall** module is installed, the **Modules** tab also shows **Manage firewall** on its row, which opens the same view. [Screenshot: The Firewall view of a server: Refresh, Turn off firewall, Add rule and Review and apply at the top, the status strip, and the rules table with three locked System rules and one rule added by you] ## How it works 1. **Add rule** for each port people must reach, such as 443 for a website. Nothing changes on the server yet. 2. **Review and apply.** dPanel compares your rules with the firewall on the server and lists what it will add, remove and keep. Press **Apply firewall** when it looks right. 3. dPanel runs a job on the server. The view shows **Applying the firewall** and refreshes by itself until the job finishes. :::tip[The first apply installs the firewall] A server that never had a firewall shows **The firewall module is not installed yet**. The first apply installs it, then sets your rules. Turning it on asks you to tick **I understand that turning the firewall on blocks every port without an allow rule**, then press **Turn on and apply**. ::: ## Add a rule Press **Add rule**. The panel asks three things: | Section | Field | What to enter | | -------------------- | ------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | | **What to allow** | **Action** | **Allow**, **Deny**, **Limit** or **Reject**. See the table below. | | | **Port** | One port (`443`), a range (`8000:8100`), or empty for every port. A range needs **TCP** or **UDP**. | | | **Protocol** | **TCP** for almost everything (websites, SSH, databases), **UDP** for things like DNS or VPNs, or **Any**. | | **Who can connect** | **From** | Empty for anyone, one address (`203.0.113.10`) or a network (`10.0.0.0/8`). | | **Docker container** | **This port belongs to a Docker container** | Turn on when the port is published by a Docker container. See [Docker ports](#docker-ports). | | **Note** | **Note** | A reminder of why the rule exists, shown in the rules table. | [Screenshot: The Add rule panel with Action, Port, Protocol, From, the Docker container switch and Note] | Action | Meaning | | ---------- | ----------------------------------------------------------------------------------------- | | **Allow** | Let the traffic in. | | **Deny** | Drop it without an answer. | | **Reject** | Refuse it and tell the sender. | | **Limit** | Let it in, but block an address that connects too often. Useful for SSH. Host ports only. | :::warning[An empty rule opens everything] With no port and no address, an **Allow** rule lets everyone reach every port. The panel warns you before you add it. ::: Adding or removing a rule only changes what dPanel stores. The server picks it up on the next apply. ## Review and apply **Review and apply** shows exactly what the apply would do: **Changes** (such as turning the firewall on or a new default), **Will be added**, **Will be removed**, and **Kept, not managed by dPanel**. It also confirms **SSH stays open, so dPanel can always reach the server.** [Screenshot: The Review and apply dialog: one change to the routed default, nothing added or removed, SSH stays open, and the Apply firewall button] If nothing differs, it says **Nothing to change: the server already matches.** Opening the review changes nothing; only **Apply firewall** does. ## The status strip | Item | What it tells you | | ---------------------- | ---------------------------------------------------------------------------------------------------------------------- | | **Firewall** | **On** or **Off**, and the default for traffic no rule matches (normally: incoming deny, outgoing allow, routed deny). | | **Docker ports** | **Filtered** or **Not filtered**, with a switch. See [Docker ports](#docker-ports). | | **Stored and applied** | The version of your rules and the version the server runs. **Changes not applied yet** means you still need to apply. | | **Last apply** | The result of the last job (**Succeeded**, **Failed** and so on), or **Applying** while one runs. | **Server differs from dPanel** appears when someone changed the firewall on the server by hand. Review and apply to put your stored rules back. ## Rules and who added them The **Added by** column says where each rule came from: | Added by | Meaning | | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **System** | Rules that keep dPanel working: SSH, and ports 80 and 443 on servers that run a dPanel load balancer engine. Locked, always first. | | **Legacy** | Rules adopted from an older setup and kept on purpose. Locked. | | **You** | Rules added in the web, the CLI or by the assistant. You can remove them. | | **Other** | Rules dPanel generates for a TCP/UDP load balancer on this server: its port, open to the addresses in its allow list. Locked; they change with the load balancer. | You cannot remove locked rules. Removing other rules on a workspace server needs the workspace admin role; if you lack it, dPanel shows the reason. ## Docker ports Docker publishes container ports past the normal firewall, so a host rule does not protect them. To control them: 1. Turn on the switch in **Docker ports** in the status strip. 2. Add a rule with **This port belongs to a Docker container** turned on, using the container's port. 3. Review and apply. While Docker filtering is off, Docker rules are stored but have no effect. ## Rules not managed by dPanel **Not managed by dPanel** lists rules someone added on the server by hand. Applying keeps them. **Adopt** stores them in dPanel so they show up as your rules; it adopts every rule dPanel can represent at once, not only the one you selected. Rules dPanel cannot represent are skipped and left alone. If this section says the live firewall cannot be read, the firewall module is not installed yet or the server's agent is too old. That is normal before the first apply. ## Safety: SSH and automatic rollback - SSH always stays open, so dPanel can still reach the server. If a change would close SSH, the review says so and dPanel refuses to apply it. - If SSH or the dPanel agent stop working after a change, the server restores its previous firewall by itself within a few minutes, and the job is marked failed. ## Turn the firewall off **Turn off firewall** queues a job that switches the firewall off, so every port can be reached again. Your rules are kept for the next time you apply. ## See which ports are open On the **Network** tab, the **Active ports** view has a **Firewall** column: for each port in use it says **Allowed from anywhere**, **Allowed from** a number of sources, or **No allow rule**. While the firewall is off it says **Not enforced: the firewall is off**. See [Your server page](./your-server-page.md#network). ## From the terminal The `dnocs` CLI manages the same firewall. Install it with [AI in the terminal](../ai/ai-in-the-terminal.md); find the server ID with `dnocs server list`. ```bash dnocs server firewall show --server-id 140 # the rules dPanel stores dnocs server firewall allow --server-id 140 --port 443 --proto tcp --comment "Website" dnocs server firewall plan --server-id 140 # what an apply would change; changes nothing dnocs server firewall apply --server-id 140 --wait # add --enable the first time, to turn it on ``` | Command | What it does | | --------- | --------------------------------------------------------------------------- | | `show` | The firewall dPanel stores, with each rule's ID. | | `live` | The firewall as it is on the server right now, read through the agent. | | `allow` | Adds an allow rule. `--rate-limit` makes it a **Limit** rule. | | `deny` | Adds a deny rule. | | `remove` | Removes a stored rule by `--rule-id` from `show`. | | `plan` | Shows what an apply would change. | | `apply` | Applies the stored rules as a job. `--enable` turns a disabled firewall on. | | `disable` | Turns the firewall off as a job; rules are kept. | | `import` | Adopts the rules already on the server. | `allow` and `deny` take `--port`, `--proto` (`tcp`, `udp` or `any`), `--from`, `--comment` and `--docker` (for a Docker-published port). You can also ask **Ask dPanel** to add a rule and apply it; it warns you when the firewall would block a new TCP or UDP load balancer. See [Prompt cookbook](../ai/prompt-cookbook.md). ## Frequently asked questions ### Will turning the firewall on lock me out of my server? No. SSH is a locked **System** rule, the review refuses any change that would close it, and the server rolls back by itself if SSH or the agent stop working after an apply. ### I added a rule but the port is still blocked. Why? Adding a rule only stores it. Press **Review and apply** and then **Apply firewall**; the rule reaches the server when the job reads **Succeeded**. ### Do I need rules for my websites? Not for ports 80 and 443 on a server that runs a dPanel load balancer: dPanel adds them as **System** rules. Add rules for other ports people must reach, such as a database you open to one office address. ### Why can't a server with the firewall on join a Kubernetes cluster? Kubernetes manages its own network rules and would clash with the host firewall. Turn the firewall off before you add the server to a cluster. See [Server groups and clusters](../clusters/overview.md). ### Does the firewall replace my cloud provider's firewall? No, it works on the server itself. A provider firewall (such as an AWS security group) still applies in front of it, so a port must be open in both. --- # Delete a server Source: https://dnocs.devetek.app/docs/servers/delete-a-server Delete a server you no longer need in dPanel: what it destroys at your cloud provider, and why a server you connected yourself keeps running. Deleting a server in dPanel destroys a cloud VM at your provider, or only disconnects a server you connected yourself. Your provider bills a cloud machine for as long as it exists, so remove one as soon as you are done with it. ## What you need first Deletion is refused while applications or load balancers still use the server. Delete those first: - [Delete an application](../applications/update-or-delete.md) - [Load balancers](../networking/load-balancers.md) ## Delete it 1. Open the server and go to **Settings**. 2. In **Danger zone**, press **Delete server**. The same command is in the header, under **More actions** (⋯). 3. Read **What happens**. 4. Type the server's name to confirm, then press **Delete server**. [Screenshot: The Delete server dialog, listing what happens and asking for the server name] :::danger[This cannot be undone] For a server dPanel launched, deleting uninstalls the agent and destroys the machine at your cloud provider, with its disk and everything on it. For a server you connected yourself, dPanel only forgets it and your machine keeps running. ::: ## What happens next The server shows **Deleting** while the provider tears the machine down, then reads **Deleted**. Check two places: 1. The **Servers** list. 2. Your provider's own console. dPanel reports what the provider told it, so a delete that half fails at the provider shows up there. ## Frequently asked questions ### Why is Delete server refused? Applications or load balancers still use the server, or it is a node of a Kubernetes cluster. Delete those first, or uninstall and delete the cluster. See [Server groups and clusters](../clusters/overview.md). ### Can I get a deleted server back? No. A cloud server's disk is destroyed at the provider. Back up anything you need before you delete it. ### Does deleting a server I connected myself wipe it? No. dPanel only forgets it; the machine and everything on it keep running. --- # Groups and clusters Source: https://dnocs.devetek.app/docs/clusters/overview What a server group is in dPanel, the difference between a generic group and a cluster, and what Kubernetes, k3s and RKE2 are, explained in plain words. Once you have more than one server, you start doing the same thing many times: install Node.js on every web server, upgrade the agent everywhere, reboot them all after an update. A **server group** puts those servers under one name so you do it once. Some software goes further: it needs several servers to **work together as one system**, so that if one server dies the others carry on. That is a **cluster**. In dPanel, a cluster is built on a server group, so you create both in the same place. [Screenshot: The Server groups page with two Kubernetes groups, kube-rke and kube-k3s, each Ready with two servers] ## Two kinds of group When you press **New group**, dPanel first asks **What should this group be?** | | Generic group | Cluster group (Kubernetes) | | -------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------ | | What it is | A saved list of servers | Servers that run one Kubernetes cluster together | | The servers | Stay independent. Each one does its own job | Share the work. Apps move between them | | What you do with it | Install a module, deploy, refresh, reboot or upgrade on all at once | Run containerized apps that keep running when a server fails | | If one server fails | Only that server's result fails; the others still succeed | The cluster moves its apps to the servers that are still up | | Changing its servers | Add or remove servers any time | Fixed when you create it | | Example | "All production web servers": install PHP 8.5 on 12 servers | "kube-k3s": a small Kubernetes cluster on two VMs or three Raspberry Pis | Think of a generic group as a **mailing list**: one message, everybody gets a copy, each person acts alone. A cluster is a **team**: the members split the work and cover for each other. Guides: [Generic groups](./generic-groups.md), [Kubernetes with k3s](./kubernetes-k3s.md) and [Kubernetes with RKE2](./kubernetes-rke2.md). ## What Kubernetes is **Kubernetes** (often written **K8s**) runs your applications in **containers** across several servers and keeps them running for you. A container is an application packed together with everything it needs to run, so it starts the same way on any server. More words like these are in the [Glossary](../getting-started/glossary.md). - You tell it what you want, for example "two copies of my web app". - It decides which server runs each copy. - If a copy crashes, it starts a new one. If a whole server goes down, it starts the copies on another server. - It spreads requests over the copies, so one busy copy doesn't slow everyone down. A Kubernetes cluster has two roles: | Role | Also called | What it does | | ---------- | --------------------- | ------------------------------------------------------------------------------------- | | **Server** | control plane, master | The brain: stores the cluster's state and decides where apps run. It can run apps too | | **Agent** | worker node | The muscle: runs your apps. Add more agents to get more capacity | One server is enough to start. For a cluster that survives losing a server, use **three servers** (an odd number, so they can always agree on who is in charge). ## k3s or RKE2 dPanel installs Kubernetes with one of two **engines**. Both are certified Kubernetes, so the same apps and `kubectl` commands work on either. | | k3s | RKE2 | | ------------------ | ------------------------------------------------ | ----------------------------------------------------- | | In one line | Lightweight Kubernetes in a single small program | Security-focused Kubernetes from Rancher, CIS-ready | | Runs on | amd64, arm64 and armhf (Raspberry Pi) | amd64 and arm64 | | Smallest server | 1 CPU, 1 GB memory (2 GB comfortable) | 2 CPU, 4 GB memory | | Good for | Learning, small VMs, Raspberry Pis, edge sites | Production, regulated work, teams that need hardening | | Install time | About 10 minutes for two servers | About 12 minutes for two servers | | Step-by-step guide | [Kubernetes with k3s](./kubernetes-k3s.md) | [Kubernetes with RKE2](./kubernetes-rke2.md) | Not sure? Start with **k3s**. You can create an RKE2 cluster later on other servers. :::tip[Just one machine?] You don't need a group for a single machine. `k3s` and `rke2` are also ordinary modules: open the server, go to **Modules**, and install one there to get a one-server Kubernetes. See [Install software](../servers/install-software.md). ::: ## Rules that keep your servers safe - **A server can be in one group only.** The picker marks servers that are **Already in a group**. The Kubernetes wizard does not offer deleted servers. - **A cluster's servers change only through the cluster.** You can't remove a server from a cluster group by hand, and a server that is a cluster node can't be deleted. This stops a half-removed node from breaking the cluster. - **Kubernetes owns its servers.** dPanel refuses servers that already run Docker, k3s or RKE2, and servers with the dPanel [firewall](../servers/firewall.md) turned on, because they would fight over the same network rules. - **One region for the control plane.** Servers with the **Server** role must be in the same region. Cluster members talk to each other all the time, and a slow link between regions makes the cluster unstable. An **Agent** in another region is allowed, but dPanel warns you that its traffic crosses regions. - **Permissions.** Creating, uninstalling and deleting a cluster needs the **cluster editor** and **server editor** permissions in the workspace. Owners and admins have both. ## From the terminal The `dnocs` CLI has the same commands: `dnocs server group` for groups and `dnocs cluster` for clusters (`kinds`, `create`, `detail`, `install`, `uninstall`, `delete`). `dnocs cluster kinds` lists the engines and versions you can pick. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install it. You can also ask **Ask dPanel** to create a group or a cluster for you; it shows the plan for your approval first. See [Prompt cookbook](../ai/prompt-cookbook.md). ## Frequently asked questions ### Do I need a cluster to run my application? No. Most applications run fine on one server as a dPanel [application](../applications/overview.md). Use a cluster when an app must keep running if a server fails, or when you already work with Kubernetes. ### How many servers does a cluster need? One is enough to start. For a control plane that survives losing a server, give three servers the **Server** role. The number of **Server** nodes must be odd, up to seven. ### Can I turn an existing generic group into a cluster? No. Pick the type when you press **New group**. Deleting a cluster does the opposite: the group stays as a generic group with the same servers. ### Which engine should I choose? Start with **k3s**. It is lighter and runs on Raspberry Pi. Pick **RKE2** for hardened production servers with at least 4 GB of memory. --- # Generic server groups Source: https://dnocs.devetek.app/docs/clusters/generic-groups Create a generic server group in dPanel and install a module, deploy an artifact, refresh inventory, reboot or upgrade the agent on every server at once. A generic group in dPanel is a saved list of servers. Every action you run on the group runs on each of its servers, and you follow each server's result in one place. The servers stay independent: one failing doesn't stop the others. ## Create a generic group 1. Open **Servers**, then **Server groups**, and press **New group**. 2. Under **What should this group be?**, keep **Generic** and press **Next**. 3. Type a **Name**, for example "Production web", and an optional **Description**. Press **Next**. 4. Check the **Review** and press **Create group**. [Screenshot: The first step of New group: What should this group be? with Generic selected and Kubernetes next to it] The group starts empty. On its page, press **Add servers** and pick the servers. A server can be in one group only. ## Run an action on every server Open the group and go to **Operations**. Under **Run on this group**: [Screenshot: A generic group's Operations tab: Run on this group with Install module, Deploy artifact, Refresh inventory, Reboot and Upgrade agent, above an empty Operation history] | Action | What it does | | --------------------- | ----------------------------------------------------------- | | **Install module** | Installs a module from the catalog on every server | | **Deploy artifact** | Deploys one build of an application to every server | | **Refresh inventory** | Re-reads the installed modules and services on every server | | **Reboot** | Restarts every server; their applications are briefly down | | **Upgrade agent** | Installs a dPanel agent release on every server | Each action records the servers in the group at that moment, then runs on each of them. **Operation history** lists everything that ran, newest first, with how many servers succeeded and failed. **Open** shows each server's result and links to its execution. If some servers failed, **Retry failed servers** runs the action again only on those. ## Change or delete the group - **Add servers** and **Remove** change who is in the group. **Replace servers** sets the whole list at once. - **Edit** changes the name and description. - **Delete group** removes the group only. The servers keep running as they are, and past operations and their logs stay. ## From the terminal `dnocs server group` manages the same groups: `list`, `create`, `detail`, `add-server`, `remove-server`, `replace-members`, `update`, `delete`, and `operations` to list or run the actions above. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install `dnocs`. ## Frequently asked questions ### Does deleting a group delete its servers? No. The servers keep running exactly as they are; they are simply no longer grouped. Past operations and their logs stay. ### Why can't I add a server to my group? A server can be in one group only, so it is probably in another group already. Remove it there first. **Already in group** in the picker means it is in this group. ### What happens if an action fails on some servers? The other servers still succeed. Open the operation in **Operation history** to read each server's error, fix it, then press **Retry failed servers**. ### Does an action include servers I add later? No. Each action records the servers in the group when you start it. Run it again to include new servers. --- # Kubernetes with k3s Source: https://dnocs.devetek.app/docs/clusters/kubernetes-k3s Create a k3s Kubernetes cluster on your dPanel servers step by step, run your first app, and serve it on your own domain with HTTPS. This guide builds a real k3s cluster, **kube-k3s**, on two servers and serves a web app from it at `https://kube-k3s.devetek.app`. Follow along with your own servers and domain; it takes about 30 minutes, most of it waiting. k3s is the lightweight engine: one small program, happy on 2 GB of memory and on a Raspberry Pi. For hardened production, see [Kubernetes with RKE2](./kubernetes-rke2.md). New to the words? Read [Server groups and clusters](./overview.md) first. ## Before you start You need servers that dPanel already manages and that read **Ready**. This guide uses two: | Server | Role in the cluster | Size | | ---------- | ------------------- | ------------------------- | | kube-k3s-1 | **Server** | 2 CPU, 4 GB, Ubuntu 24.04 | | kube-k3s-2 | **Agent** | 2 CPU, 4 GB, Ubuntu 24.04 | - **Size:** 2 GB of memory or more per server. amd64, arm64 or armhf (Raspberry Pi) all work. - **System:** Ubuntu. This guide was tested on Ubuntu 24.04. - **Same region** for every server, not in any group, without Docker, k3s or RKE2, and with the dPanel firewall off. A fresh server launched from dPanel meets all of this. See [Create a cloud server](../servers/cloud-providers/create-a-cloud-server.md). ## 1. Start a Kubernetes group 1. Open **Servers**, then **Server groups**, and press **New group**. 2. Under **What should this group be?**, choose **Kubernetes** and press **Next**. [Screenshot: New group, step Type: the Kubernetes card selected next to Generic, with PostgreSQL, MariaDB, Redis and Kafka marked Coming soon] ## 2. Pick the servers and their roles 1. **Name**: `kube-k3s`. **Description**: anything that helps, for example "k3s cluster serving kube-k3s.devetek.app". 2. Under **Servers**, tick **kube-k3s-1** first, then **kube-k3s-2**. Type in **Search servers** to find them quickly. 3. Each picked server appears at the top with a role switch. The first one gets **Server** (the control plane), the others **Agent** (apps only). Press the other button to change a role. [Screenshot: Two picked servers: kube-k3s-1 with the Server role and kube-k3s-2 with the Agent role, above the server picker] ## 3. Choose k3s Scroll down to **Engine**: 1. Pick **k3s**. 2. **Version**: keep the newest, `v1.37.1+k3s1` here. 3. **Built-in ingress**: leave it **off**. dPanel's load balancer brings web traffic in (step 8), and k3s's own ingress would take ports 80 and 443 away from it. [Screenshot: The Engine choice with k3s selected, version v1.37.1+k3s1 and Built-in ingress off] Press **Next**. ## 4. Review and install The **Review** lists what will be installed where: k3s as **Server** on kube-k3s-1 and as **Agent** on kube-k3s-2. Press **Create and install**. [Screenshot: The Review step: group kube-k3s, type Kubernetes, engine k3s, version v1.37.1+k3s1, k3s installed as Server on kube-k3s-1 and as Agent on kube-k3s-2] dPanel creates the group and starts one install job over both servers: the server first, then the agent. [Screenshot: The Installing step: Installing kube-k3s, status Installing, last execution cluster_install Queued, and a warning that one server is a single point of failure] :::info[The single point of failure warning] With one **Server**, the cluster stops accepting changes if that server goes down; apps already running keep running. That is fine for learning and small projects. Use three servers with the **Server** role when the cluster must survive losing one. ::: You can close the wizard; the install keeps going. It took about 11 minutes here. ## 5. Check the cluster Open the group (**Open group page**, or select it in **Server groups**). The **Cluster** tab shows the engine and version, the **API endpoint**, the last execution, and every node with its role. When the install is done, the status and both nodes read **Ready**. [Screenshot: The kube-k3s group on the Cluster tab: Kubernetes, k3s v1.37.1+k3s1, status Ready, API endpoint on port 6443, cluster_install Succeeded, and two nodes, Server and Agent, both ready] ## 6. Open a terminal on the Server node You talk to Kubernetes with `kubectl`, run in a terminal on the node with the **Server** role. dPanel opens that terminal in your browser; you need no SSH key or tool on your computer. 1. On the **Cluster** tab, select **kube-k3s-1** in the **Nodes** table. (Or open **Servers** and select it there.) 2. At the top right of the server's page, press **Open terminal**. [Screenshot: The kube-k3s-1 server page header with the Open terminal button at the top right] A terminal opens at the bottom of the page, signed in as the server's login user. Run: ```bash sudo k3s kubectl get nodes ``` Both nodes read `Ready`. k3s ships `kubectl` inside the `k3s` command, so every command starts with `sudo k3s kubectl`. ## 7. Run your first app In the same terminal, create `hello.yaml`: run `nano hello.yaml`, paste the text below, then press `Ctrl+O`, `Enter` and `Ctrl+X`. It runs two copies of a tiny web page and opens it on port `30080` of every node (a **NodePort**): ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: hello spec: replicas: 2 selector: matchLabels: { app: hello } template: metadata: labels: { app: hello } spec: containers: - name: hello image: hashicorp/http-echo:1.0 args: [ '-listen=:8080', '-text=Hello from kube-k3s, a k3s cluster on dPanel', ] ports: - containerPort: 8080 --- apiVersion: v1 kind: Service metadata: name: hello spec: type: NodePort selector: { app: hello } ports: - { port: 80, targetPort: 8080, nodePort: 30080 } ``` Apply it and check it: ```bash sudo k3s kubectl apply -f hello.yaml sudo k3s kubectl get pods -o wide curl http://127.0.0.1:30080 ``` Kubernetes puts one copy on each node, and `curl` answers with the page: [Screenshot: The browser terminal on kube-k3s-1: kubectl get nodes shows two Ready nodes, kubectl get pods shows one hello pod on each node, and curl answers Hello from kube-k3s, a k3s cluster on dPanel] ## 8. Serve it on your domain with HTTPS A dPanel [load balancer](../networking/load-balancers.md) on the **Server** node brings web traffic into the cluster: 1. Open **Load Balancers** and press **Create a load balancer**. 2. **Gateway server**: **kube-k3s-1**. **Web server engine**: **Caddy Server**. 3. **Domain Name**: **Managed**, **Subdomain** `kube-k3s`, and your domain. Keep **HTTPS** on. 4. **Routing mode**: **L7**. **Routes**: **Type** **Proxy Pass**, **Matching Path** `/*`, address `127.0.0.1` and port `30080`. 5. Press **Create load balancer**. On a fresh server the first load balancer also installs Caddy, which took about 11 minutes here; later ones take about a minute. When it reads **Ready**, open `https://kube-k3s.your-domain`. The page reads `Hello from kube-k3s, a k3s cluster on dPanel`, with a valid HTTPS certificate. :::tip[Why 127.0.0.1 works] A NodePort is open on **every** node, and Kubernetes forwards it to a running copy, even one on another node. So the gateway sends traffic to itself on port 30080 and still reaches both copies. ::: ## Uninstall, install again or delete On the group's **Cluster** tab: - **Uninstall** removes k3s from both nodes. Apps in the cluster stop and their data on the nodes is removed. The servers and the group stay; the cluster reads **Uninstalled**. - **Install again** shows when an install failed or after an uninstall. It installs on the same servers with the same roles and version. - **Delete cluster** works on an uninstalled, failed or never-installed cluster. The group stays as a generic group; delete it to free the servers for another cluster. Delete the load balancer first if you made one for the cluster. ## Not available yet - Adding or removing nodes after the install, and upgrading the Kubernetes version. - Downloading a kubeconfig for `kubectl` on your own computer. Use **Open terminal** on the Server node for now. - Opening the cluster ports in the dPanel firewall automatically; that is why nodes need the firewall off. ## Troubleshooting | What you see | Fix | | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | A server can't be picked: **Already in a group** | Remove it from its group first, or pick another server. | | Creating fails: the server already runs Docker, k3s or RKE2 | Use a fresh server, or uninstall that software first. If you removed it by hand, press **Refresh inventory** on the server's **Modules** tab so dPanel sees it is gone. | | The status reads **Failed** | Open the last execution from the **Cluster** tab to read the error, fix it, then press **Install again**. | | `kubectl` says permission denied | Start the command with `sudo k3s kubectl`. | | The domain doesn't answer | Check `curl http://127.0.0.1:30080` on kube-k3s-1 first, then the load balancer's status and **Logs**. | ## From the terminal The same cluster can be created with the `dnocs` CLI, using the server IDs from `dnocs server list`: ```bash dnocs cluster create --name kube-k3s --engine k3s --server --agent dnocs cluster detail --id ``` `dnocs cluster install` installs again after a failure, and `dnocs cluster uninstall` and `dnocs cluster delete` remove it. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install `dnocs`. ## Frequently asked questions ### How long does the install take? About 10 minutes for two servers. You can close the wizard; the install keeps running and the **Cluster** tab shows its progress. ### Can I add a node to the cluster later? Not yet. The servers and their roles are fixed when you create the cluster. To change them, uninstall and delete the cluster, then create a new one. ### How do I use kubectl from my own computer? Downloading a kubeconfig is not available yet. Use **Open terminal** on the **Server** node and run `sudo k3s kubectl` there. ### The install failed. What now? Open the last execution from the **Cluster** tab to read the error, fix the cause, then press **Install again**. It uses the same servers, roles, engine and version. --- # Kubernetes with RKE2 Source: https://dnocs.devetek.app/docs/clusters/kubernetes-rke2 Create a RKE2 Kubernetes cluster on your dPanel servers step by step, run your first app, and serve it on your own domain with HTTPS. This guide builds a real RKE2 Kubernetes cluster with dPanel, **kube-rke**, on two servers and serves a web app from it at `https://kube-rke.devetek.app`. Follow along with your own servers and domain; it takes about 30 minutes, most of it waiting. RKE2 is Rancher's security-focused Kubernetes: CIS-ready defaults, the Canal network plugin, and its control plane (etcd, API server, scheduler) running as visible pods. It needs bigger servers than k3s and runs on amd64 and arm64 only. For small machines or a Raspberry Pi, see [Kubernetes with k3s](./kubernetes-k3s.md). New to the words? Read [Server groups and clusters](./overview.md) first. ## Before you start You need servers that dPanel already manages and that read **Ready**. This guide uses two: | Server | Role in the cluster | Size | | ---------- | ------------------- | ------------------------- | | kube-rke-1 | **Server** | 2 CPU, 4 GB, Ubuntu 24.04 | | kube-rke-2 | **Agent** | 2 CPU, 4 GB, Ubuntu 24.04 | - **Size:** 2 CPU and 4 GB of memory or more per server, amd64 or arm64. RKE2 runs more system pods than k3s; smaller servers struggle. - **System:** Ubuntu. This guide was tested on Ubuntu 24.04. - **Same region** for every server, not in any group, without Docker, k3s or RKE2, and with the dPanel firewall off. A fresh server launched from dPanel meets all of this. See [Create a cloud server](../servers/cloud-providers/create-a-cloud-server.md). ## 1. Start a Kubernetes group 1. Open **Servers**, then **Server groups**, and press **New group**. 2. Under **What should this group be?**, choose **Kubernetes** and press **Next**. [Screenshot: New group, step Type: the Kubernetes card selected next to Generic, with PostgreSQL, MariaDB, Redis and Kafka marked Coming soon] ## 2. Pick the servers and their roles 1. **Name**: `kube-rke`. **Description**: anything that helps, for example "RKE2 cluster serving kube-rke.devetek.app". 2. Under **Servers**, type `kube-rke` in **Search servers**, then tick **kube-rke-1** first and **kube-rke-2** second. 3. Each picked server appears at the top with a role switch. The first one gets **Server** (the control plane), the others **Agent** (apps only). Press the other button to change a role. [Screenshot: The Configuration step with name kube-rke, a description, and two picked servers: kube-rke-1 with the Server role and kube-rke-2 with the Agent role] ## 3. Choose RKE2 Scroll down to **Engine**: 1. Pick **RKE2**. On amd64 servers with enough memory it is already selected. 2. **Version**: keep the newest, `v1.37.1+rke2r1` here. 3. **Built-in ingress**: leave it **off**. dPanel's load balancer brings web traffic in (step 8), and RKE2's ingress-nginx would take ports 80 and 443 away from it. [Screenshot: The Engine choice with RKE2 selected, version v1.37.1+rke2r1 and Built-in ingress off] Press **Next**. ## 4. Review and install The **Review** lists what will be installed where: RKE2 as **Server** on kube-rke-1 and as **Agent** on kube-rke-2. Press **Create and install**. [Screenshot: The Review step: group kube-rke, type Kubernetes, engine RKE2, version v1.37.1+rke2r1, RKE2 installed as Server on kube-rke-1 and as Agent on kube-rke-2] dPanel creates the group and starts one install job over both servers: the server first, then the agent. [Screenshot: The Installing step: Installing kube-rke, status Installing, engine RKE2 v1.37.1+rke2r1, last execution cluster_install Queued, and the single point of failure warning] :::info[The single point of failure warning] With one **Server**, the cluster stops accepting changes if that server goes down; apps already running keep running. Use three servers with the **Server** role when the cluster must survive losing one. ::: You can close the wizard; the install keeps going. It takes about 12 minutes: RKE2 pulls more images than k3s. ## 5. Check the cluster Open the group (**Open group page**, or select it in **Server groups**). The **Cluster** tab shows the engine and version, the **API endpoint**, the last execution, and every node with its role. When the install is done, the status and both nodes read **Ready**. [Screenshot: The kube-rke group on the Cluster tab: Kubernetes, RKE2 v1.37.1+rke2r1, status Ready, API endpoint on port 6443, cluster_install Succeeded, and two nodes, Server and Agent, both ready] ## 6. Open a terminal on the Server node You talk to Kubernetes with `kubectl`, run in a terminal on the node with the **Server** role. dPanel opens that terminal in your browser; you need no SSH key or tool on your computer. 1. On the **Cluster** tab, select **kube-rke-1** in the **Nodes** table. (Or open **Servers** and select it there.) 2. At the top right of the server's page, press **Open terminal**. [Screenshot: The kube-rke-1 server page header with the Open terminal button at the top right] A terminal opens at the bottom of the page. RKE2 keeps `kubectl` and its kubeconfig in its own folders, so set them once per terminal: ```bash sudo -i export PATH=$PATH:/var/lib/rancher/rke2/bin export KUBECONFIG=/etc/rancher/rke2/rke2.yaml kubectl get nodes ``` Both nodes read `Ready`. RKE2 names them after dPanel's server IDs, such as `dpanel-186`. The rest of this guide assumes that root shell. ## 7. Run your first app In the same terminal, create `hello.yaml`: run `nano hello.yaml`, paste the text below, then press `Ctrl+O`, `Enter` and `Ctrl+X`. It runs two copies of a tiny web page and opens it on port `30080` of every node (a **NodePort**): ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: hello spec: replicas: 2 selector: matchLabels: { app: hello } template: metadata: labels: { app: hello } spec: containers: - name: hello image: hashicorp/http-echo:1.0 args: [ '-listen=:8080', '-text=Hello from kube-rke, a RKE2 cluster on dPanel', ] ports: - containerPort: 8080 --- apiVersion: v1 kind: Service metadata: name: hello spec: type: NodePort selector: { app: hello } ports: - { port: 80, targetPort: 8080, nodePort: 30080 } ``` Apply it and check it: ```bash kubectl apply -f hello.yaml kubectl get pods -o wide curl http://127.0.0.1:30080 ``` Kubernetes puts one copy on each node, and `curl` answers with the page: [Screenshot: The browser terminal on kube-rke-1: kubectl get nodes shows dpanel-186 and dpanel-187 Ready, kubectl get pods shows one hello pod on each node, and curl answers Hello from kube-rke, a RKE2 cluster on dPanel] ## 8. Serve it on your domain with HTTPS A dPanel [load balancer](../networking/load-balancers.md) on the **Server** node brings web traffic into the cluster: 1. Open **Load Balancers** and press **Create a load balancer**. 2. **Gateway server**: **kube-rke-1**. **Web server engine**: **Caddy Server**. 3. **Domain Name**: **Managed**, **Subdomain** `kube-rke`, and your domain. Keep **HTTPS** on. 4. **Routing mode**: **L7**. **Routes**: **Type** **Proxy Pass**, **Matching Path** `/*`, address `127.0.0.1` and port `30080`. 5. Press **Create load balancer**. On a fresh server the first load balancer also installs Caddy, which takes about 10 minutes; later ones take about a minute. When it reads **Ready**, open `https://kube-rke.your-domain`. The page reads `Hello from kube-rke, a RKE2 cluster on dPanel`, with a valid HTTPS certificate. :::tip[Why 127.0.0.1 works] A NodePort is open on **every** node, and Kubernetes forwards it to a running copy, even one on another node. So the gateway sends traffic to itself on port 30080 and still reaches both copies. ::: ## Uninstall, install again or delete On the group's **Cluster** tab: - **Uninstall** removes RKE2 from both nodes (it runs RKE2's own uninstall script). Apps in the cluster stop and their data on the nodes is removed. The servers and the group stay; the cluster reads **Uninstalled**. - **Install again** shows when an install failed or after an uninstall. It installs on the same servers with the same roles and version. - **Delete cluster** works on an uninstalled, failed or never-installed cluster. The group stays as a generic group; delete it to free the servers for another cluster. This guide's cluster went through all three: it was first created from the command line, uninstalled, deleted with its group, and created again on the same two servers through the wizard above. Delete the load balancer first if you made one for the cluster. ## Not available yet - Adding or removing nodes after the install, and upgrading the Kubernetes version. - Downloading a kubeconfig for `kubectl` on your own computer. Use **Open terminal** on the Server node for now. - Opening the cluster ports in the dPanel firewall automatically; that is why nodes need the firewall off. ## Troubleshooting | What you see | Fix | | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RKE2 is greyed out | One of the servers is 32-bit ARM (armhf). Use [k3s](./kubernetes-k3s.md) there. | | A server can't be picked: **Already in a group** | Remove it from its group first, or pick another server. | | Creating fails: the server already runs Docker, k3s or RKE2 | Use a fresh server, or uninstall that software first. If you removed it by hand, press **Refresh inventory** on the server's **Modules** tab so dPanel sees it is gone. | | The status reads **Failed** | Open the last execution from the **Cluster** tab to read the error, fix it, then press **Install again**. | | `kubectl: command not found` | Run the `sudo -i` and two `export` lines from step 6 in that terminal first. | | The domain doesn't answer | Check `curl http://127.0.0.1:30080` on kube-rke-1 first, then the load balancer's status and **Logs**. | ## From the terminal The same cluster can be created with the `dnocs` CLI, using the server IDs from `dnocs server list`: ```bash dnocs cluster create --name kube-rke --engine rke2 --server --agent dnocs cluster detail --id ``` `dnocs cluster install` installs again after a failure, and `dnocs cluster uninstall` and `dnocs cluster delete` remove it. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install `dnocs`. ## Frequently asked questions ### How long does the install take? About 12 minutes for two servers. You can close the wizard; the install keeps running and the **Cluster** tab shows its progress. ### Can I add a node to the cluster later? Not yet. The servers and their roles are fixed when you create the cluster. To change them, uninstall and delete the cluster, then create a new one. ### How do I use kubectl from my own computer? Downloading a kubeconfig is not available yet. Use **Open terminal** on the **Server** node and run `kubectl` there after the `sudo -i` and `export` lines from step 6. ### The install failed. What now? Open the last execution from the **Cluster** tab to read the error, fix the cause, then press **Install again**. It uses the same servers, roles, engine and version. --- # How applications work Source: https://dnocs.devetek.app/docs/applications/overview How dPanel deploys an app from GitHub. It builds your repository on your own server, runs it as a systemd service and keeps every build for rollback. An application in dPanel is your code from a GitHub repository, built and running as a service on one of your own servers. dPanel does not host the code itself: it reads the repository and branch you point it at, runs your build commands on the server, starts the result, and keeps each build so you can roll back. A **service** here means a systemd service: a program Linux starts for you, keeps running in the background and restarts after a reboot. You never have to set it up by hand. See the [Glossary](../getting-started/glossary.md) for this and other terms. ## The three steps 1. **Point at a repository.** Connect GitHub and pick the repository and branch to build from. 2. **dPanel builds it.** Each build is kept, so you can see what shipped and roll back to an earlier one. 3. **It runs on your server.** dPanel installs the build and starts it as a systemd service. :::info[Builds stay on the server] A build is not shared between machines. Each server builds and installs the application on its own. ::: ## What you need first - A server that is **Ready**. See [Create a cloud server](../servers/cloud-providers/create-a-cloud-server.md). - A GitHub account connected to dPanel. See [Connect GitHub](../getting-started/connect-github.md). - A repository with a build command and a start command. A single script for each is enough. ## The Applications page Open **Applications** in the sidebar. The page lists every application in the current workspace, with counts at the top. [Screenshot: The Applications page in table view, listing an application with its status, source repository, server and address] | Status | What it means | | --------------- | ------------------------------------------------------------------ | | Running | The service is up on its server. | | Building | A build or a release is in progress. | | Needs attention | The last build or release failed. Open the application to see why. | | Not running | Nothing has been released yet, or the service is stopped. | The list opens as a table, with the status, the source repository, the servers and the public address of each application. Use **Search by application name** to find one quickly; upper and lower case do not matter. Select a row to open the application. The GitHub button in the header shows which account dPanel reads repositories with, such as **Connected to GitHub as** your login. If it says **Reconnect GitHub**, GitHub stopped accepting the saved sign-in. Sign in again before you build. ## The application page Each application has four tabs. | Tab | Use it to | | ----------- | ----------------------------------------------------------------------- | | Overview | See what is serving right now, open the site, read logs, or redeploy. | | Deployments | Browse builds and releases, build again, or roll back. | | Logs | Read the running service's logs, and the load balancer's if it has one. | | Settings | Review and edit how it is built and run, or delete it. | People are shown by name: who ran each build, who owns the application. Select a name to open that person's [public profile](../teams/public-profiles.md). ## Next steps - [Create an application](./create-an-application.md) from a GitHub repository. - [Deployments and rollback](./deployments-and-rollback.md): release a new commit, or go back to an earlier build. - [Environment variables](./environment-variables.md) for settings and secrets. - Publish it on a domain with HTTPS through a [load balancer](../networking/load-balancers.md). ## Frequently asked questions ### Does dPanel host my code? No. Your code stays in your GitHub repository, and it runs on a server you own. dPanel connects the two: it clones the repository on the server, builds it there and starts it. ### Can one application run on several servers? Yes. Each server builds and runs its own copy. Release a build to more than one server from **Build and release**, and see each copy under **On servers**. ### What does "Needs attention" mean? The last build or release failed. Open the application, go to **Deployments**, and press **Logs** on the failed build. The last lines usually name the step and the error. ### Can I manage applications from the terminal? Yes. The dnocs command-line tool has `dnocs application list`, `detail`, `create`, `deploy` and `delete`. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install it. --- # Create an application Source: https://dnocs.devetek.app/docs/applications/create-an-application Deploy an app from GitHub with dPanel: pick the repository, a ready server, the runtime and build commands, and dPanel runs it as a service. To deploy an app from GitHub with dPanel, you fill in a five-step form: the repository and branch, the server and runtime, the build and start commands, the environment, and a final preview. dPanel then clones, builds and starts your code as a systemd service on your server. This walkthrough deploys [dPanel-ID/go-example](https://github.com/dPanel-ID/go-example), a small Go web service. Any repository works the same way. Expect it to take 5 to 15 minutes, most of it the first build. ## What you need first - A server that is **Ready** in this workspace. - GitHub connected. The GitHub button at the top of the page shows your login with a tick. - The commands that build and start your code. For go-example they are `./scripts/build.sh` and `./scripts/start.sh`. Open **Applications** and press **Create Application**. The form has five steps. The stepper at the top marks each one done, and the bar at the bottom says what is still missing before **Continue** unlocks. ## Step 1: Repository 1. Open **GitHub team** and pick the account or organization that owns the repository. **Add GitHub account** at the end of the list connects another one. 2. Type in **Search repositories** and press Enter. 3. Select the repository. dPanel reads its details, and shows it under **Selected repository**. 4. Check **Branch**. It defaults to the repository's default branch. 5. Press **Continue**. [Screenshot: Step 1 of the form, with dPanel-ID/go-example selected and the main branch chosen] ## Step 2: Server & modules 1. Under **Select Server**, select the server that will run the application. Only servers that are **Ready** are listed; use **Search server...** if you have many. If none is ready, the list says **No ready servers found**: add a server, or wait for one to finish setup. 2. Under **Select dependencies**, add what the application needs to build and run. Type in **Search modules**, then press **Add** on a module. For go-example that is **Go**. 3. The module's options open beside the list. Required fields are marked. Check them, then press **Save options**. 4. Press **Continue**. A **module** is a piece of software dPanel installs on the server for you, such as a language runtime or a database. See the [Glossary](../getting-started/glossary.md). If a module is already on the server, it appears under **Installed on selected server**. Select it there to reuse it instead of installing it again. Databases you created inside MariaDB or PostgreSQL, such as **PostgreSQL Database**, are not listed: they belong to their database server, not to the application. To give the application a database, create one on the server first, then pass its details as runtime variables in step 4. See [Create a database for an application](../servers/install-software.md#create-a-database-for-an-application). [Screenshot: Step 2 of the form, with the server selected and the Go module added, showing its Go Version option] ## Step 3: App setup 1. **Application name**: how the application appears in dPanel. Use letters, numbers and spaces only. 2. **Required binaries**: the language runtime from the modules you picked. It is selected for you. 3. **Build steps**: one or more commands run inside the cloned repository. **Choose file** picks a script from the repository; **Add step** adds another command. 4. **Runtime command**: the command systemd uses to start the application. 5. **Application port**: dPanel suggests a free port between 7000 and 10000. **Ports already in use** lists the ports you cannot take. 6. Press **Continue**. [Screenshot: Step 3 of the form: the application name, the Go runtime, the build step, the runtime command and the application port] :::warning[Letters, numbers and spaces] dPanel rejects a name with hyphens or other symbols, such as `go-example`. The field turns red and explains why, and the flow stays incomplete until you fix it. Use a name like `Go Example`. ::: :::tip The form starts with `./scripts/build.sh` as the build step and `./scripts/start.sh` as the runtime command. Replace them if your repository uses other commands. ::: ## Step 4: Environment Add variables the build or the service needs, one `KEY=value` per line. **Build-time variables** are used only while building; **Runtime variables** are given to the running service. Both are optional. See [Environment variables](./environment-variables.md). ## Step 5: Preview Check the summary: application, repository, branch, server, commands, port, and whether each environment is **Configured**. Press **Deploy application**. [Screenshot: The Preview step, summarising the application before it is deployed] ## What happens next A dialog confirms **Successfully created your app!** Press **OK** to go back to the list. dPanel then: 1. Creates a playbook for this application (the list of setup steps its worker runs), and installs the modules you picked. 2. Clones the branch on the server and runs the build steps. 3. Installs the result and starts it as a service. The application shows **Building** until the release finishes, then **Running**. Open it to follow the build, and see [Deployments and rollback](./deployments-and-rollback.md). You can also ask **Ask dPanel** to do this for you; see [Prompt cookbook](../ai/prompt-cookbook.md). :::note[Give it a public address] A new application listens on its port on the server. To serve it on a domain with HTTPS, put a load balancer in front of it. See [Load balancers](../networking/load-balancers.md). ::: ## Frequently asked questions ### Which languages and frameworks can I deploy? Any that run on Ubuntu. You pick the runtime, such as Go, as a module in step 2, and give the commands that build and start your code in step 3. dPanel runs them as you wrote them. ### My build needs more than one runtime Add every runtime as a module in step 2, such as PHP and Node.js for a Laravel app that builds its front end with `npm`. Step 3 selects all of them under **Required binaries** and stores them on the application. Only selected runtimes are on the build's path, so a missing one fails with `command not found`. You can add one later under the application's settings. See [Deploy Laravel with PostgreSQL](../tutorials/deploy-laravel.md). ### Why does the form refuse my application name? The name may only contain letters, numbers and spaces. `my-app` or `my_app` is refused; use `My App` instead. ### Why is my server not in the list? Only servers that are **Ready** can host an application. A server that is still being set up, failed setup or was deleted is not listed. See [Your server page](../servers/your-server-page.md). ### Can I deploy from a GitHub organisation? Yes. Install the dnocs-id GitHub App on the organisation with **Add GitHub account**, and it appears under **GitHub team**. See [Connect GitHub](../getting-started/connect-github.md#add-a-github-organisation). ### Where is my database in the dependency list? It is not a dependency. Pick the database server, such as **MariaDB** or **PostgreSQL**, if the application needs it on the same server. The databases you created inside it are not listed; connect to them with runtime variables. See [Create a database for an application](../servers/install-software.md#create-a-database-for-an-application). ### How long can a build take? 20 minutes by default. A slow build can get up to 3 hours. See [Build timeout](./build-timeout.md). ### How do I give the application a domain with HTTPS? Create a [load balancer](../networking/load-balancers.md) that routes your domain to the application. dPanel adds the DNS record and a Let's Encrypt certificate. --- # Environment variables Source: https://dnocs.devetek.app/docs/applications/environment-variables Set build-time and runtime environment variables for an app in dPanel, keep secrets out of your repository, and apply new values with a release. dPanel passes environment variables to your application from two separate lists, so a setting only the build needs never reaches the running service, and secrets such as API keys stay out of your Git repository. An **environment variable** is a named setting, such as `PORT=9307`, that your program reads when it starts instead of having the value written into the code. See the [Glossary](../getting-started/glossary.md). | List | Used | Typical contents | | -------------------- | ------------------------------ | -------------------------------------- | | Build-time variables | Only while the build steps run | `CGO_ENABLED=0`, `NODE_ENV=production` | | Runtime variables | By the running service | A port, a database address, API keys | ## Set them when you create the application In step 4, **Environment**, type one `KEY=value` pair per line in **Build-time variables** or **Runtime variables**. [Screenshot: The Environment step, with one build-time variable and two runtime variables] ```bash PORT=9307 APP_ENV=production ``` :::tip[Match the port] If your code reads its port from a variable, as go-example reads `PORT`, set it to the same value as **Application port** in step 3. Otherwise dPanel and your service expect different ports. ::: ## Change them later 1. Open the application and go to **Settings**. 2. Under **Build** or **Run**, find **Environment variables** and press **Edit**. 3. Add, change or remove variables, then press **Save**. 4. Release again with **Build and release** or **Redeploy**, so the service starts with the new values. See [Deployments and rollback](./deployments-and-rollback.md). You can also change both lists in **Edit settings**, the full form. See [Update or delete an application](./update-or-delete.md). You can also ask **Ask dPanel** to do this for you; see [Prompt cookbook](../ai/prompt-cookbook.md). Secret values are never typed in the chat: the approval card asks for them, and the assistant only sees the names. ## Keeping secrets safe - dPanel never shows a variable's value after you save it. **Settings** lists the names only, with the value masked. - Keep secrets in **Runtime variables** unless the build really needs them. - Do not commit secrets to the repository. dPanel passes these variables in for you. ## Frequently asked questions ### Do I need to redeploy after changing a variable? Yes. The running service keeps the values it started with. Release again with **Build and release** or **Redeploy** so it starts with the new ones. ### Can I see a secret after I saved it? No. dPanel masks every value once it is saved. Keep your own copy in a password manager, or set a new value. ### Should a database password be a build-time or a runtime variable? Runtime. Only the running service connects to the database, so the build never needs it. ### Can I put variables in a .env file in my repository? You can, but anything committed to Git can leak. Keep secrets in dPanel's **Runtime variables** instead. --- # Deployments and rollback Source: https://dnocs.devetek.app/docs/applications/deployments-and-rollback Release a new commit with Build and release, follow the build onto your server, and roll back to an earlier build in dPanel without rebuilding. In dPanel, every push you want to ship becomes a build, and every build is kept, so you can release the latest commit or roll back to an earlier build in one step. Two words matter here. A **build** is your code packaged once, from one commit. A **release** is that build placed on one server. ## What is running now Open the application. The **Overview** tab starts with **Current deployment**: the commit, branch, the person who released it, the server and address that are serving right now, and the release status. [Screenshot: The Overview tab: the current deployment, the counters, the details and the recent builds] | Button | What it does | | --------- | -------------------------------------------------------- | | Visit | Opens the application's public address, when it has one. | | View logs | Opens the **Logs** tab. | | Redeploy | Builds and releases again. | Below it, **Serving now**, **Last build**, **Builds kept** and **Port** sum up the application, and **Recent builds** lists the last few attempts. ## Build and release a new version Use this after you push a commit, or after you change a setting. 1. Press **Redeploy** on the Overview tab, or **Build and release** on the Deployments tab. 2. In the **New Artifact** panel, pick the **Branch**. dPanel builds its latest commit. 3. Under **Deployment target**, check the server. The first one is selected for you. 4. Press **Save**. [Screenshot: The New Artifact panel, with the Branch picker and the Deployment target server list] The build appears at the top of the list as **Building**, then **Passed** or **Failed**. A passed build is released to the server, and its release reads **On the server**. ## The Deployments tab **Builds and releases** has two views. - **Builds**: every build, newest first, with its build ID, commit, branch, how long it took, who ran it and when. A build that has been released to a server carries a **Used** badge, and one being released right now carries **In Progress**. - **On servers**: each server the application is released to, with its service state. Switch views with the **Builds** and **On servers** toggle beside **Build and release**. [Screenshot: The Deployments tab of DB Manager: three builds, each with its build ID, commit, branch, the person who ran it, its release status and the Logs, Roll back and Delete buttons] ### Who ran each build Every build card names the person who started it, with their avatar, for example after **Build and release**, **Redeploy** or a deploy from the command line or **Ask dPanel**. The releases under **On servers** name who released them. Select a name to open that person's [public profile](../teams/public-profiles.md). dPanel never shows an email address or a raw user ID here. ### Read a build's logs Press **Logs** on a build. **Artifact Logs** opens with that build's output: the clone, each build step, and the service start. See [Reading logs](../logs/reading-logs.md#build-logs). [Screenshot: The Artifact Logs window, showing the output of one build] ### Roll back 1. Find the build you want to go back to, and press **Roll back**. 2. In **Rollback Deployment**, tick the servers to roll back. 3. Press **Rollback**. dPanel releases that build again on those servers. Nothing is rebuilt. ### Manage releases on a server In **On servers**, each release has **Start**, **Restart** and **Stop** for its service, and **Delete**. A deleted release can be brought back with **Restore**, or removed for good with **Delete permanently**. ### Delete a build Press **Delete** on a build to remove it from the list. dPanel asks you to confirm first. dPanel refuses to delete a build that a release still uses, or one that is still building. Delete the release under **On servers** first. From the terminal, list the builds with `dnocs application detail artifact list --id `, then delete one with `dnocs application detail artifact delete --id --artifact-id `. The same rules apply. A server cannot be deleted while builds made on it remain. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install dnocs. ## Statuses | Build | Release | Meaning | | --------- | ------------- | ---------------------------------------------- | | - | Waiting | Queued for a worker, or about to start. | | Building | Releasing | Work in progress. | | Passed | On the server | Built and running. | | Passed | Not released | Built, but not placed on any server right now. | | Failed | Failed | Something stopped it. Read the logs. | | Cancelled | Cancelled | Stopped before it finished. | When a build fails, start with its **Logs**. The last lines usually name the step and the error. A build stopped after 20 minutes ends with `context deadline exceeded`; see [Build timeout](./build-timeout.md). See also [Troubleshooting](../troubleshooting/faq.md). ## Frequently asked questions ### What is the difference between a build and a release? A build is your code packaged once, from one commit. A release is that build placed on one server and started there. One build can be released to several servers, and released again later in a rollback. ### Does a rollback rebuild my code? No. dPanel releases the build it already has, so a rollback takes seconds to minutes, not the length of a build. ### Who started this build? The build card names the person who ran it. Select the name to open their public profile. ### Why can't I delete a build? A release still uses it, or it is still building. Delete the release under **On servers** first, or wait for the build to finish. --- # Application logs Source: https://dnocs.devetek.app/docs/applications/application-logs Read an application's runtime logs and the HTTP requests reaching it through a load balancer in dPanel, with time range, level filter and search. dPanel shows two kinds of log for an application: what the running service prints (its runtime logs), and every HTTP request that reached it through a load balancer. Open the application and go to **Logs**, or press **View logs** on the Overview tab. A **log** is the running record of what a program did, one line per event. A **load balancer** is the public front door that receives visitors' requests for your domain and passes them to the application. See the [Glossary](../getting-started/glossary.md). [Screenshot: The Logs tab of an application: the runtime source, time range, filter, Download and Refresh above the log table] ## Two sources | Source | What it shows | | ------------- | ------------------------------------------------------------------------------------------------------------------------- | | Runtime | What the service writes to its output while it runs. The table is titled **Application Logs**. | | Load balancer | Every request that reached the load balancer in front of the application. The table is titled **Load balancer requests**. | [Screenshot: The Load balancer source on DB Manager's Logs tab: eight requests to dbmanager.devetek.app, each read as method, address and path, status and time, such as GET dbmanager.devetek.app/api/info → 401 · 7 ms] **Load balancer** only appears when a load balancer serves this application. Without one, the tab opens straight onto the runtime logs. ## Read a request line Each load balancer row is one request, marked **HTTP**, written as: ```text GET dbmanager.devetek.app/api/info → 401 · 7 ms ``` That is the method, the address and path that was asked for, the status code the visitor got back, and how long it took. The **Source** column shows the domain. The level follows the status: a `5xx` status (the server failed) is **error**, a `4xx` status (the request was refused or not found) is **warn**, anything else is **info**. Select the row to see every detail in the **Log entry** panel, such as the visitor's IP address and the request headers. Runtime logs follow the active deployment. If the application has no run command or no server yet, the tab says there are no runtime logs. ## Find what you need 1. Pick a **Time range**. The tab opens on **Last 10 minutes**; go back as far as 10 days. 2. Type in **Filter this page** to keep only lines that contain your text. Upper and lower case do not matter. 3. Select a level chip, such as **error**, to keep only that level. 4. Select a line to open it in full in the **Log entry** panel. The controls are the same in every log view. See [Time range and refresh](../logs/time-range-and-refresh.md) and [Download logs](../logs/download-logs.md). ## Build logs are somewhere else The output of a build, such as a failing compile, is not in this tab. Open **Deployments**, find the build, and press **Logs**. See [Deployments and rollback](./deployments-and-rollback.md#read-a-builds-logs). For the server's own log files, such as `auth.log` or the web server, see [Reading logs](../logs/reading-logs.md#server-logs). :::tip[Nothing in the window?] **No runtime logs in this window.** means nothing was printed in that period. Pick a wider time range first. If it stays empty, check that the service is running on the **Deployments** tab, under **On servers**. ::: ## Frequently asked questions ### Why does every request show warn? The status codes were `4xx`: pages that do not exist (`404`) or requests that need a sign-in (`401`). Bots that scan for files such as `/.env` cause many of these. They are normal unless your own pages return them. ### Can I read load balancer requests from the terminal? Yes. `dnocs load-balancer log --id ` prints the same request lines, newest first. Add `--since 24h` to look further back (up to `240h`, 10 days), `--page 2` for older lines, or `--json` for every field. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install dnocs. ### How far back can I read? 10 days, for both sources. See [Time range and refresh](../logs/time-range-and-refresh.md). --- # Update or delete an app Source: https://dnocs.devetek.app/docs/applications/update-or-delete Change an application's build steps, start command, port and variables in dPanel, or delete it and stop its systemd service on every server. You can change how a dPanel application is built and run at any time, from one setting to the whole form, or delete it. Changes take effect from the next release. ## Review the setup Open the application and go to **Settings**. **How this application is set up** shows three blocks. | Block | Shows | | ---------- | ------------------------------------------------------------------------------------- | | Repository | The repository, its language and framework. | | Build | The language runtime, the build steps, and the build-time environment variables. | | Run | The service name, the port, the start command, and the runtime environment variables. | [Screenshot: The Settings tab, with the Repository, Build and Run blocks and the Danger zone] ## Make a quick change Each item with an **Edit** button opens a panel for just that part. | Edit next to | Opens | Change | | ------------------------------------------ | -------------------------- | ----------------------------------------- | | Language | Edit Setup Configuration | The language and its version. | | Build steps, Environment variables (Build) | Edit Build Configuration | The build steps and build-time variables. | | Start command, Environment variables (Run) | Edit Runtime Configuration | The start command and runtime variables. | Press **Save** in the panel. The change applies from the next release, so release again with **Build and release** or **Redeploy**. ## Change everything at once **Edit settings** at the top of the application opens **Update Application**. It is the same five-step form you created the application with, filled in with the current values: server and modules, name, commands, port and environment. 1. Press **Edit settings**. 2. Walk through the steps and change what you need. 3. On **Preview**, tick **Run bootstrap playbooks** if you changed modules or the server's dependencies need to be applied again. 4. Press **Save changes**. [Screenshot: The Update Application form, opened from Edit settings] dPanel updates the application definition (the saved description of how to build and run it) and submits the playbook inputs for it. ## Delete an application The **Danger zone** sits at the bottom of **Settings**. 1. Press **Delete this application**. 2. Confirm in the **Delete Application** dialog. :::danger[This cannot be undone] Deleting removes the application, its builds and its release history from dPanel, and stops the service on every server it runs on. Your server and your Git repository are left untouched. ::: ## Frequently asked questions ### Do my changes apply straight away? No. They apply from the next release. Press **Build and release** or **Redeploy** after saving. ### When should I tick Run bootstrap playbooks? When you added or changed modules, such as a new runtime version. dPanel then installs them on the server again before the next build. ### Does deleting an application delete my repository or server? No. Your Git repository and your server stay. dPanel stops the service and removes the application, its builds and its release history. ### Can I delete an application from the terminal? `dnocs application delete` deletes an application that has no deployments. Delete its releases first, or use **Delete this application** in the web UI. --- # Build timeout Source: https://dnocs.devetek.app/docs/applications/build-timeout dPanel stops a build after 20 minutes by default. Set build.timeout between 1 minute and 3 hours to give a slow application build more time. dPanel stops a build after **20 minutes** by default, and you can raise the limit per application up to 3 hours with `build.timeout`. Every build and release runs as one job: clone, runtime setup, build steps and service start. A **build** is the job that turns your repository into something that can run, for example by compiling it. See the [Glossary](../getting-started/glossary.md). Most applications finish well inside that. A build that compiles a lot, such as a Docker image with many PHP extensions on a small server, may not. When the limit is reached the build fails, and its log ends with `context deadline exceeded`. ## Give a build more time Set `build.timeout` in the application definition. It is a duration such as `45m`, `90m` or `2h`, between `1m` and `3h`. ```yaml build: timeout: 90m ``` dPanel checks the value when it starts a build. A value it cannot read, such as `90 minutes`, or one outside 1 minute to 3 hours, stops the build with an error that says so. Leave it out to keep the default. :::note[Not in the web form yet] The **Create Application** and **Update Application** forms have no field for the timeout. Set it in a `.devetek/*.yml` application definition and pass it with the dnocs command-line tool's `--definition` option, on `dnocs application create` or `dnocs application deploy`. ::: ## Before you raise it - Read the failed build's **Logs** first. A step that hangs waiting for input fails the same way, and more time will not help. - Try a bigger server. A build that takes an hour on the smallest size often takes minutes on the next one. See [Create a cloud server](../servers/cloud-providers/create-a-cloud-server.md). - See all of a build's output in [Deployments and rollback](./deployments-and-rollback.md#read-a-builds-logs). ## Frequently asked questions ### What is the longest build dPanel allows? 3 hours. Set `build.timeout: 3h`. Anything longer is refused when the build starts. ### Does the timeout include starting the service? Yes. The limit covers the whole job: clone, runtime setup, build steps and service start. ### Can I set the timeout in the web form? Not yet. Put `build.timeout` in a `.devetek/*.yml` definition and pass it with `dnocs application deploy --definition`. --- # Load balancers and HTTPS Source: https://dnocs.devetek.app/docs/networking/load-balancers Create a load balancer in dPanel to publish an app on your domain with free Let's Encrypt HTTPS, path routing and DNS set up for you. A load balancer in dPanel publishes your application on a domain with HTTPS. It takes the traffic arriving at the domain, gets and renews a free Let's Encrypt SSL certificate, and forwards each request to an application or to a port on a server. With a domain managed in dPanel, it also creates the DNS record for you. dPanel builds the load balancer on one of your own servers, the **gateway**, and runs a web server engine (Caddy) there. Nothing runs outside your servers. ## What you need first - **A ready server** to act as the gateway, with ports 80 and 443 reachable from the internet. Servers dPanel launches have them open. See [Servers](../servers/overview.md). - **A domain.** Either add the zone to dPanel under **Domain & DNS** so dPanel can create the record ([Domains and DNS](./domains-and-dns.md)), or use a hostname you manage yourself. - **Something to send traffic to**: a dPanel [application](../applications/overview.md), or a service listening on a port. :::warning[Pick a name nobody uses] With a managed domain, dPanel creates a new DNS record. It refuses a subdomain that already has one, so existing records are never overwritten. Use a fresh name, such as `app`. ::: ## Create a load balancer Open **Load Balancers** in the sidebar and press **Create a load balancer**. The form has three numbered steps. The **Load balancer** review panel on the right reads **Start with a gateway server** until you pick one, then counts what is still missing. ### Step 1: Gateway 1. Under **Gateway server**, pick the server that will answer public traffic. Each row shows the server's name, status, address and operating system. Only ready servers can be picked; any other row says **Only ready servers can run a load balancer.** 2. Under **Web server engine**, pick **Caddy Server**. If it is already on the server, it is listed under **Reported on selected gateway** as **Installed**. If not, find it under **Install an engine** and press **Install**. [Screenshot: Step 1: the Gateway step, with a ready gateway server selected and Caddy Server installed] ### Step 2: Domain and HTTPS 1. Under **Domain Name**, pick the mode: - **Managed**: type a **Subdomain**, then **Select domain** from your domains in **Domain & DNS**. dPanel creates the DNS record for you. - **External**: type a hostname you manage yourself, and point its DNS at the gateway's public address. 2. Under **Protocol and HTTPS**, the protocol is **HTTP / HTTPS** for websites and APIs. 3. Leave **HTTPS** on. dPanel requests the certificate and renews it for you. Turn it off only for a plain-HTTP setup. [Screenshot: Step 2: a managed subdomain on terpusat.me, HTTP / HTTPS, with HTTPS on] ### Step 3: Routing 1. Under **Routing mode**, pick **L7** for websites and HTTP APIs. It routes by path, such as `/api`. **L4** forwards raw TCP or UDP ports, for databases and other non-HTTP services, without looking at paths. 2. Under **Routes**, set up the first **Rule**: - **Type**: **Application** sends traffic to a dPanel application. **Proxy Pass** sends it to an address and port. - **Matching Path**: `/*` takes every request. A path ending in `/*` shows a **Wildcard** badge. - **Application**: pick the application. dPanel uses the application's server and port. 3. Press **Add New Rule** to send other paths elsewhere, such as `/api/*`. [Screenshot: Step 3: L7 routing with one rule sending /* to an application] ### Create it When the review panel reads **Ready to create**, every answer is in: gateway server, engine, domain, HTTPS, routing mode and routes. Press **Create load balancer**. [Screenshot: The review panel reading Ready to create, with the gateway server, engine, domain, HTTPS, routing mode and routes] ## What happens next You land on the list with **Load balancer created successfully.** The row reads **In Progress** while dPanel: 1. Creates the DNS record. For a managed domain this is an `A` record from the host to the gateway's public address. 2. Installs Caddy on the gateway if it is not there yet. 3. Publishes the routes and requests the HTTPS certificate. This usually takes about a minute. The first load balancer on a server also installs Caddy, which takes about 10 minutes. The row then reads **Ready**, and the counters at the top move it to **Serving traffic**. [Screenshot: The Load balancers list in table view, with each load balancer's engine, status, gateway server and address, and routing] ## Check that it is live Open the host in a browser, or check it from a terminal: ```bash curl -sI https://app.example.com ``` A live load balancer answers like this: ```text HTTP/2 200 alt-svc: h3=":443"; ma=2592000 content-type: text/html; charset=utf-8 server: dPanel ``` What a healthy one shows: | Check | What you should see | | ----------- | ------------------------------------------------------------------------- | | DNS | The host resolves to the gateway server's public address | | Plain HTTP | `308 Permanent Redirect` to the `https://` address | | HTTPS | `HTTP/2 200`, served by your application, with `server: dPanel` | | Certificate | Issued by Let's Encrypt for your host, valid for 90 days, renewed for you | | Protocols | HTTP/2, plus HTTP/3 (QUIC) advertised in `alt-svc` | :::tip[A new name can take a minute to resolve] If `curl` says it cannot resolve the host right after creation, your own resolver may have cached the "not found" answer. Wait a few minutes, or test against a public resolver such as `dig @1.1.1.1 app.example.com`. ::: ## The detail page Select a load balancer in the list to open its page. The header shows the domain, the status, when it was last updated and **Open site**, then four facts: **Status**, **Routes** (with the routing mode), **Gateway server** and **Engine**. | Tab | Use it to | | ------------- | ----------------------------------------------------------------------------------------------- | | **Graph** | Follow a request from the domain to the load balancer, the gateway, the routes and the targets | | **Upstreams** | See every backend in order, with its match path, destination and port. **Add backend** adds one | | **Logs** | Read the requests the gateway handled | | **Config** | Turn **Enable SSL** or **Enable Cloudflare proxy** on or off | [Screenshot: The load balancer detail page: the header with its four facts, and the traffic graph from domain to application] [Screenshot: The Upstreams tab with one backend sending /* to an application] Changes on **Upstreams** and **Config** are drafts until you press **Save changes**. Saving updates the routing definition and runs the gateway setup again. **Reset draft** throws the draft away. [Screenshot: The Config tab with Enable SSL and Enable Cloudflare proxy] ## Load balancer logs The **Logs** tab lists the requests reaching the gateway, titled **Load balancer requests**. The same requests appear on the application's **Logs** tab under the **Load balancer** source. See [Application logs](../applications/application-logs.md). [Screenshot: The Logs tab: time range, filter, Download and Refresh above the request table] - **Time range**: the last 10 minutes by default. Pick a preset up to **Last 10 days**, or a **Custom range** within the last 10 days. - **Paging**: 200 lines per page, newest first. The footer reads, for example, **Lines 1–200 of 201, newest first**, with the page buttons. - **Download**: **This page**, or **Everything in this time range**, as a `.log` file. - **Refresh** loads the newest lines. **Auto-refresh** is off by default; turn it on for every 30 seconds, minute or 5 minutes. The shared controls are explained in [Time range and refresh](../logs/time-range-and-refresh.md) and [Download logs](../logs/download-logs.md). ## Delete a load balancer 1. In the list, open the **More** (⋯) menu on the load balancer's row and choose **Delete**. 2. Confirm **Delete Load Balancer**. dPanel removes the routes from the gateway, and the row reads **Deleted**. Your application and the gateway server keep running. A load balancer stays in the workspace it was created in; it cannot be moved to another one. :::warning[Check the DNS record] Check at your DNS provider whether the record dPanel created is still there after a delete, and remove it from the domain's [DNS records](./dns-records.md) if you no longer need the name. ::: :::note A server that still hosts a load balancer cannot be deleted. Delete the load balancer first. ::: ## Frequently asked questions ### Is the SSL certificate free? Yes. dPanel gets a Let's Encrypt certificate for your host and renews it before it expires, at no cost. It is valid for 90 days at a time. ### Do I need Cloudflare? No. dPanel can create the DNS record at Cloudflare or DigitalOcean, or you can point any hostname at the gateway yourself with **External**. **Enable Cloudflare proxy** on the **Config** tab is only for domains hosted at Cloudflare. ### Can one load balancer serve several applications? Yes. Add one route per path, such as `/*` for the website and `/api/*` for the API, each sending traffic to a different application or address. ### Which web server does dPanel use? Caddy. dPanel installs it on the gateway server the first time, and the response header reads `server: dPanel`. ### Why can't I pick my server as the gateway? Only servers that are ready can run a load balancer. A server still being set up, or one whose setup failed, is shown but cannot be picked. --- # Domains and DNS Source: https://dnocs.devetek.app/docs/networking/domains-and-dns Add a domain hosted at Cloudflare or DigitalOcean to dPanel with a scoped API token, so it can manage DNS records and point names at your servers. dPanel manages DNS for domains you already own. Add a domain hosted at Cloudflare or DigitalOcean with an API token, and dPanel reads its records, lets you search them, and creates the `A` record that points a name at your server when a load balancer uses the domain. **DNS** is the internet's address book: it turns a name such as `app.example.com` into the IP address of a server. A **DNS record** is one entry in that book, and the **zone** is all the records of one domain. See the [Glossary](../getting-started/glossary.md). dPanel does not sell or transfer domains, and it never changes your registrar. You keep buying domains where you do today. What dPanel needs is access to whoever answers DNS for the domain. ## What you need first - A domain whose DNS is hosted at **Cloudflare** or **DigitalOcean**. - An API token from that provider that can read and edit DNS records for the zone. :::tip Use a scoped token. At Cloudflare, a token limited to "DNS edit" on that one zone is enough. ::: [Screenshot: The Domains & DNS page in table view, listing devetek.app and terpusat.me, both at Cloudflare, owned by one person and shared with the dPanel team] Each row shows the domain, its **DNS provider**, its **Ownership** (the person who added it, by name, and the team it is shared with) and when it was last modified. Select the person's name to open their [public profile](../teams/public-profiles.md). The search box above the table finds a domain by name; upper and lower case do not matter. ## Add a domain 1. Open **Domain & DNS** in the sidebar. 2. Press **Add a domain**. 3. **Domain**: the zone you want dPanel to manage, such as `example.com`. A subdomain works too. 4. **Description**: optional. A note for your teammates, such as "Production marketing domain". 5. **Provider**: pick where the zone is hosted. 6. **API token**: paste the provider token. 7. When the review reads **Ready to add**, press **Add domain**. [Screenshot: The Add Domain form with domain, provider and API token] ## What happens next dPanel reads the zone first and lists the records already there. Nothing is changed until you use the domain somewhere, for example as a **Managed** domain on a load balancer. ## The domain page Select a domain in the list, or press **Details** on its row, to open its own page. It shows: - **DNS provider**, the number of **Records** in the zone, the **Owner** workspace and when the domain was **Added**. - **Refresh**, which reads the zone again, and **Open site**, which opens `https://` and the domain in a new tab. - **DNS records**: every record in the zone, which you can search, filter by type and delete. See [DNS records](./dns-records.md). [Screenshot: The terpusat.me domain page: Cloudflare as DNS provider, 47 records, the dPanel workspace as owner and the date added, above the DNS records table] ## Use the domain on a load balancer On a load balancer, choose **Managed** under **Domain Name**, type a **Subdomain** and pick the domain. dPanel creates an `A` record from that name to the gateway server's public address. It refuses a name that already has a record, so existing records stay untouched. See [Load balancers and HTTPS](./load-balancers.md). ## Share or delete a domain - A domain added in a team workspace is shared with that team. A domain stays in the workspace it was added in; it cannot be moved to another one. - To remove a domain from dPanel, open the **More** (⋯) menu on its row, choose **Delete**, and confirm **Delete Domain**. This only removes it from dPanel; the zone and its records stay at your DNS provider. ## Frequently asked questions ### Which DNS providers does dPanel support? Cloudflare and DigitalOcean. Your domain can be registered anywhere, as long as its DNS is hosted at one of them. ### Do I have to move my domain to dPanel? No. dPanel never sells, registers or transfers domains. It only uses an API token to read and write DNS records at your DNS provider. ### Can I add a DNS record by hand in dPanel? Not yet. dPanel creates records itself when a load balancer uses the domain. You can search, copy and delete records on the domain page. ### Is my DNS API token safe? The token is sent once, when you add the domain, and never shown again. The review never displays it, and dPanel shows **Stored securely** in its place. ### Can I list my domains from the terminal? Yes. `dnocs domain list` prints each domain with its ID and provider. A load balancer created from the terminal uses that ID. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install dnocs. --- # Search and delete DNS records Source: https://dnocs.devetek.app/docs/networking/dns-records Find any DNS record of a domain in dPanel by name or content, filter A, CNAME, MX or TXT records by type, copy a value, or delete a record you no longer need. Every domain in dPanel has its own page listing all of its DNS records (the entries that point a name at an address), read live from Cloudflare or DigitalOcean. You can search the records by name or content, narrow them to one record type, copy a name or value, and delete a record, without opening your DNS provider's console. ## Open a domain's records 1. Open **Domain & DNS** in the sidebar. 2. Select the domain, or press **Details** on its row. 3. Scroll to **DNS records**. The count beside the search box, such as **47 records**, is the size of the zone. [Screenshot: The DNS records table of terpusat.me with the search box, the record type chips and the Type, Name, Content and TTL columns] Each row shows the record's **Type**, **Name**, **Content** and **TTL** (time to live: how long other computers may remember the answer before asking again). A name at the zone apex reads **root**, and a Cloudflare TTL of 1 second reads **Auto**. Records come 20 to a page; use the page buttons below the table for more. ## Find a record 1. Type part of a name or a value in **Search records, e.g. demo**. The list updates as you type, upper and lower case do not matter, and the text that matched is highlighted. 2. To narrow the list to one record type, press a chip: **A**, **AAAA**, **CNAME**, **MX**, **TXT**, **NS**, **SRV** or **CAA**. Press it again, or **All**, to see every type. 3. The count changes to the number of matches, such as **2 matches**. [Screenshot: Searching terpusat.me for demo, which finds the docs-demo and wordpress-demo records] When nothing matches, the table says so, for example **No A records match "demo".**, and **Clear search and filter** shows every record again. ## Copy a name or a value On a record's row, press **Copy name** or **Copy content**. dPanel confirms with **Copied** and the value. Use it to paste a record into a support ticket, or to check what an old name pointed at. ## Delete a record 1. On the record's row, press **Delete**. 2. Confirm **Delete Domain Record**. :::warning[It takes effect at once] Deleting a record removes it at your DNS provider straight away. Anything that still uses that name stops resolving. ::: There is no form to add a record by hand. dPanel creates the `A` record itself when a [load balancer](./load-balancers.md) uses a **Managed** domain. ## Frequently asked questions ### Can I search DNS records by IP address? Yes. The search matches a record's content as well as its name, so typing an IP address finds every record that points at it. ### Why does a record show TTL Auto? Cloudflare uses a TTL of 1 second to mean "automatic", and lets Cloudflare pick the real value. dPanel shows it as **Auto**. ### Are the records up to date? Yes. dPanel reads the zone from your DNS provider each time you open the page, search, or press **Refresh** at the top of the page. ### What should I clean up after deleting a load balancer? Check whether its `A` record is still in the zone. Search for the host name and delete the record if you no longer need the name. ### Is the search case-sensitive? No. `Demo`, `DEMO` and `demo` find the same records. --- # Teams Source: https://dnocs.devetek.app/docs/teams/teams Create a team workspace in dPanel to share servers, applications and cloud accounts with your team, then rename it or delete it when you are done. A team in dPanel is a shared workspace (a separate space with its own servers, applications and settings; see the [Glossary](../getting-started/glossary.md)). Servers, applications, load balancers, domains, cloud accounts and SSH keys created in it belong to the team, and every member can reach them according to their [role](./members-and-roles.md). Use a team so colleagues never have to share a server password or SSH key. [Screenshot: The Teams page in table view, listing a team with its status, your role and its member count] The page starts with counts: the teams you belong to, those **Owned by you**, those **Shared with you**, and your **Active workspace**. The table lists each team with its **Status**, **Your role**, **Members**, and when it was created and updated. ## Create a team 1. Open the workspace switcher at the top of the sidebar and press **New workspace**. Or open **Teams** and press **Add Team**. 2. **Workspace name**: a name your team will recognise in pickers, such as "Backend Squad". 3. Add a description if it helps teammates who switch in later. 4. Press **Create workspace**. You are the **Owner** of the new team. ## What happens next Switch to the new workspace (see [Workspaces](../getting-started/workspaces.md)), then add the people you work with. See [Members and roles](./members-and-roles.md). ## Open a team On the **Teams** page, select a team's row, or press **Details** (the eye icon) on it. The team page shows its member count, **Your role**, its status and when it was created, then the **Members** table with each member's name, `@username`, roles and when they joined. Below the members, the **Workers** card shows **Where jobs run** for this team: **Shared workers (dPanel)** or **Private workers**. Only team owners and admins can change it; everyone else sees it read-only. See [Workers overview](../workers/overview.md). ## Rename a team 1. Open the team. 2. Press **Edit**. 3. In **Edit Team**, change **Team Name** or the description. 4. Save. ## Delete a team 1. On the **Teams** page, press **Delete** (the bin icon) on the team's row. Only teams **Owned by you** can be deleted. 2. Confirm **Delete Team**. :::danger[Move what you need first] Deleting a team removes the workspace. Resources in a team cannot be moved to another workspace, so delete the team only when you no longer need anything in it. Delete its servers first if you want your cloud provider to stop billing for them. See [Delete a server](../servers/delete-a-server.md). ::: ## Frequently asked questions ### What is the difference between my personal workspace and a team? Your personal workspace is yours alone. A team is a workspace you share: everything created in it belongs to the team, and each member works within their role. ### Can I move a server from my personal workspace into a team? Yes, once, with the dnocs command-line tool: `dnocs transfer server --id --to ""`. Add `--include-dependencies` to move its SSH key and cloud project too. You need editor rights in the team. After that the server stays in the team; it cannot move to another workspace or back. The same works for applications, domains, load balancers, cloud projects and SSH keys. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install dnocs. ### Who can delete a team? Only its owner. The **Delete** button shows only on teams **Owned by you**. ### Can a team run jobs on its own workers? Yes. An owner or admin can switch the team to **Private workers** on the team page. See [Workers overview](../workers/overview.md). --- # Members and roles Source: https://dnocs.devetek.app/docs/teams/members-and-roles Add people to a dPanel team and pick their role, from Viewer to Owner, so each person can see, deploy or delete only what they should. In dPanel, each member of a team has one or more roles, and a role decides what that person can see, create, change and delete in the team's workspace: from **Viewer**, who can only look, to **Owner**, who can do everything. [Screenshot: A team page with its member count, your role and status, above the Members table with roles and join dates] ## Add a member The person needs a dPanel account first. Ask them to sign up, then: 1. Open **Teams** and open the team. 2. Press **Add Member**. 3. In **Add New People**, open **Select a user…** and search by username or name. Upper and lower case do not matter. 4. Under **Workspace roles**, choose what they should get. See the table below. Owner and Admin are **Protected**: only a workspace owner can give them. 5. Press **Add member**. They see the team in their workspace switcher straight away. ## The roles Every role uses the same three levels on every kind of resource: | Level | Read | Create | Update | Delete | | ---------- | ---- | ------ | ------ | ------ | | **Viewer** | Yes | No | No | No | | **Editor** | Yes | Yes | Yes | No | | **Admin** | Yes | Yes | Yes | Yes | Preset roles apply across the whole workspace. | Role | Can do | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | **Owner** | Everything, including members, roles, billing, destructive operations and ownership transfer | | **Admin** | Create, read, update and delete every resource, and manage members | | **DevOps** | Editor on cloud projects, servers, databases, load balancers, secrets, domains and applications; reads everything else; cannot delete | | **Developer** | Editor on applications, builds and deployments; reads everything else; cannot delete | | **Viewer** | Read-only access to every resource and its status | | **Billing** | Billing, packages and subscriptions | For finer control, each kind of resource also has its own **Viewer**, **Editor** and **Admin** role: Workspace, Cloud Project, Server, Application, Database, Domain, Load Balancer, Billing and Secret. For example, **Application Editor** can create and deploy applications but cannot delete them. :::tip Start people on the narrowest role that lets them do their job. **Developer** suits most people who only ship code; **Viewer** suits anyone who only needs to look. ::: ## Change a member's roles 1. Open the team. 2. On the member's row, press **Manage roles**. 3. Tick the roles they should have. **Select group** ticks a whole group; **Clear** unticks everything. 4. Press **Save roles**. Saving replaces the member's role set. A member holds one preset role, so ticking **Admin** replaces **Developer** or **DevOps**. Owner and Admin are marked **Protected**. Only a workspace owner can tick them, or change or remove a member who holds one. For everyone else they are shown but disabled. ## Remove a member 1. Open the team. 2. On the member's row, press **Remove from team**. 3. Confirm **Remove Member**. They lose access to the team's workspace immediately. Resources they created stay with the team. ## Check your own roles Your **Profile** lists every workspace with your role in it. **View active workspace roles** shows the full role list for the workspace you are in. ## Resources stay in their workspace Servers, applications, load balancers, domains, cloud accounts and SSH keys stay in the workspace they were created in, so create shared resources in the team workspace from the start. The one exception: a resource in your personal workspace can be moved into a team once, with `dnocs transfer`. See [Teams](./teams.md#can-i-move-a-server-from-my-personal-workspace-into-a-team) and [Workspaces](../getting-started/workspaces.md). ## See who did what Across dPanel, people are shown by name with their avatar: who ran a build, who owns a server or a domain, who did each action in the dashboard's activity. Select a name to open their [public profile](./public-profiles.md). ## Frequently asked questions ### Which role should a developer get? **Developer**. It can create applications, build and deploy them, and read everything else, but cannot delete anything. ### Who can give someone the Owner or Admin role? Only a workspace owner. Owner and Admin are marked **Protected**; for everyone else they are shown but disabled. ### Does a new member need a dPanel account? Yes. Ask them to [sign up](../getting-started/sign-in.md#create-an-account) first, then find them by username or name in **Add New People**. ### What happens to resources when I remove a member? They stay with the team. The member loses access to the team's workspace immediately. --- # Public profiles Source: https://dnocs.devetek.app/docs/teams/public-profiles Every dPanel user has a profile page at /u/username. dPanel shows people by name across lists and links each name to that profile, never to an email. Every dPanel user has a public profile page at `/u/`, such as `/u/prakasa`. Wherever dPanel shows a person, such as who ran a build or who owns a server, it shows their name and avatar and links to that page, instead of an email address or a user ID. [Screenshot: The public profile page of @prakasa: avatar, display name, username and the date they joined] ## What a profile shows | Shown | Never shown | | ---------------------------- | --------------------- | | Display name and `@username` | Email address | | Avatar | Workspaces and roles | | **Joined** date | Servers, applications | A profile is visible to anyone signed in to dPanel. Your servers, applications and teams stay private to the workspaces they belong to. ## Where names appear Select any name to open that person's profile. | Page | Who is named | | ------------------------ | -------------------------------------------------- | | An application | Who ran each build, and who released it on servers | | Applications, Servers | The owner of each one, or its team | | Load balancers, Domains | The owner | | Cloud projects, SSH keys | The owner | | Dashboard activity | Who did each recent action | | A server group's runs | Who started the run | See [Deployments and rollback](../applications/deployments-and-rollback.md#who-ran-each-build) for builds. ## Open a profile 1. Select a person's name anywhere in dPanel. 2. Or type the address yourself: `https://dnocs.devetek.app/u/` followed by the username. Upper and lower case do not matter. If nobody has that username, the page says **No one goes by @username**. Check the spelling: the person may also have changed it. ## Frequently asked questions ### Can other people see my email on my profile? No. A profile never shows an email address. Teammates see your email only in a team's **Members** list. ### Who can open my profile? Anyone signed in to dPanel who knows your username. It shows only your name, username, avatar and join date. ### Where do my name and avatar come from? From your dPanel account. Change your full name or avatar with **Edit profile** on your **Profile** page; the username and email cannot be changed there. See [Sign in and your profile](../getting-started/sign-in.md#change-your-name-avatar-or-password). ### Why does a list show a team name instead of a person? On **Applications** and some other lists, a resource that belongs to a team shows the team's name as its owner. Open the resource to see who ran each build. --- # Workers overview Source: https://dnocs.devetek.app/docs/workers/overview Workers run your dPanel jobs, such as deployments and module installs. Use dPanel's shared workers, or your own GitHub Actions workflow or VM. A **worker** in dPanel is the program that runs your workspace's jobs: setting up a server, installing a module, deploying an application, applying a load balancer. It connects to your servers over SSH (the secure way to log in to a server remotely) and reports back to dPanel. See the [Glossary](../getting-started/glossary.md). You do not need to set anything up. **dPanel's shared workers** run every job unless you choose your own. [Screenshot: The Workers card on the Profile page, with Shared workers (dPanel) selected, Private workers off and an Add worker button] ## Shared or private | | Shared workers (dPanel) | Private workers (yours) | | ------------------ | -------------------------------- | ------------------------------------------------------------------------- | | Setup | None | Add a GitHub workflow or a VM | | Who runs your jobs | dPanel | Only the workers you add | | Good for | Getting started, most workspaces | Servers reachable only from your network, your own CI minutes, compliance | Each workspace chooses on its own, in the **Workers** card under **Where jobs run**: your personal workspace on **Profile**, a team on its team page. Only team owners and admins can change a team's workers; other members see the card read-only. The option marked **Current** is the one in use. ## Two kinds of private worker | | GitHub workflow | VM | | -------------- | ---------------------------------------------------------------------------------- | ------------------------------------------- | | How it runs | dPanel starts your workflow when a job is waiting. One run takes one job and ends. | Runs all the time and asks dPanel for jobs. | | Secret to keep | None. The run signs in with GitHub's identity token. | A token, shown once when you add it. | | Setup | One short workflow file | Install and run the executor on the machine | | Guide | [GitHub Actions worker](./github-actions.md) | [VM worker](./vm.md) | :::tip[Easiest start] A GitHub workflow worker takes about five minutes and needs no server and no secret. Start with [GitHub Actions worker](./github-actions.md). ::: ## Where jobs wait When a workspace uses private workers, its jobs go **only** to those workers. If none of them is running, jobs wait until one is. Switching back to **Shared workers (dPanel)** sends new jobs to dPanel again; your workers stay registered so you can switch back later. ## From the terminal The dnocs command-line tool manages the workers of the workspace you selected. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install it. | Command | What it does | | --------------------------------------------------------------------------- | ----------------------------------------------------------------- | | `dnocs worker list` | Shows the mode (shared or private) and your private workers. | | `dnocs worker add --type github --name ci --repository acme/dpanel-workers` | Registers a GitHub workflow worker and prints the workflow file. | | `dnocs worker add --type vm --name office --executor-id office-01` | Registers a VM worker and prints its token once. | | `dnocs worker mode private` or `dnocs worker mode shared` | Sends jobs only to your workers, or back to dPanel's. | | `dnocs worker rotate-token --id ` | Gives a VM worker a new token; the old one stops working at once. | | `dnocs worker remove --id ` | Removes a private worker. | You can also ask **Ask dPanel** to do this for you; see [Prompt cookbook](../ai/prompt-cookbook.md). ## Frequently asked questions ### Do I need my own worker? No. dPanel's shared workers run every job by default. Add your own only if your servers are reachable only from your network, you want jobs to run on your own CI minutes, or you need to for compliance. ### What happens to waiting jobs if my private worker is down? They wait. Jobs of a workspace on **Private workers** go only to its own workers. Start the worker again, or switch back to **Shared workers (dPanel)**. ### Do I lose my workers when I switch back to shared? No. They stay registered. Switch to **Private workers** again whenever you like. ### Can a team and my personal workspace use different workers? Yes. Each workspace has its own setting. --- # GitHub Actions worker Source: https://dnocs.devetek.app/docs/workers/github-actions Run dPanel jobs on GitHub Actions in five minutes. Register a repository, commit a short workflow using dPanel-ID/worker-action, and switch over. A GitHub Actions worker runs your dPanel workspace's jobs in your own GitHub repository. GitHub Actions is GitHub's built-in way to run scripts, called workflows, on GitHub's machines. dPanel starts your workflow whenever a job is waiting; each run takes one job, runs it against your server over SSH, and ends. There is no token to copy: the run signs in to dPanel with its GitHub identity token, and dPanel checks that it comes from the repository and workflow you registered. ## Before you start - A GitHub repository you can push to. A new, private repository is fine. - Servers you already connected to dPanel. Nothing else to prepare on them. :::info[No SSH keys to add] You do **not** add any SSH key to GitHub, to the repository's secrets or to your servers. With each job, dPanel gives the run the same SSH access it already uses for your server, and the run forgets it when it ends. The only thing to check: if a firewall on your server allows SSH (port 22) only from certain IP addresses, GitHub's runners cannot connect. In that case use a [VM worker](./vm.md) inside your network instead. ::: ## 1. Register the repository in dPanel 1. Open **Profile** for your personal workspace, or open your team's page for a team. 2. In **Workers**, press **Add worker** and choose **GitHub workflow**. 3. **Name**: anything that helps you tell workers apart, such as "GitHub CI". 4. **Repository**: `owner/name`, or paste the GitHub link. 5. Leave **Workflow file** as `dpanel-worker.yml` and **Branch or tag** as `main` unless you need others. 6. Press **Add worker**. [Screenshot: The Add worker dialog on the GitHub workflow tab, with Name GitHub CI, Repository acme/dpanel-workers, Workflow file dpanel-worker.yml and Branch or tag main] dPanel shows the workflow file for your workspace. Copy it. [Screenshot: The GitHub CI added dialog showing the workflow file .github/workflows/dpanel-worker.yml that uses dPanel-ID/worker-action@v1 with the workspace value] [Screenshot: The end of the GitHub CI added dialog with three steps: commit the file, install the dnocs-id GitHub App, switch to private workers] ## 2. Add the workflow file Commit the file as `.github/workflows/dpanel-worker.yml` on the branch you registered: ```yaml name: dPanel worker on: repository_dispatch: types: [dpanel-worker] workflow_dispatch: permissions: contents: read id-token: write jobs: worker: runs-on: ubuntu-24.04 timeout-minutes: 60 steps: - uses: dPanel-ID/worker-action@v1 with: workspace: group:1234567890 ``` Replace `group:1234567890` with the value dPanel gave you. It names your workspace: `group:` for a team, `user:` for your personal workspace. :::info[What the action does] [`dPanel-ID/worker-action`](https://github.com/dPanel-ID/worker-action) checks the identity permission, installs Ansible, downloads the dPanel executor and verifies its checksum, then runs one job. Optional inputs: `manager-url`, `executor-version` and `idle-timeout`. ::: ## 3. Let dPanel start the workflow Install the dPanel GitHub App (**dnocs-id**) on the repository. dPanel uses it only to start your workflow with a `repository_dispatch` event, which needs the **Contents: read and write** permission. ## 4. Switch to private workers Back in **Workers**, choose **Private workers** and confirm **Switch to private workers**. From now on every job of this workspace runs on your workflow. [Screenshot: The Workers card listing a VM worker office-vm-01 and a GitHub workflow worker acme/dpanel-workers, with the Private workers option next to Shared workers] ## Check that it works Run any job, for example install a module on one of your servers. Within a few seconds a **dPanel worker** run appears in your repository's **Actions** tab. It takes the job and ends when the job is done; the job's progress shows in dPanel as usual. You can also press **Run workflow** in the **Actions** tab: with no job waiting, the run signs in, waits two minutes and ends successfully, which shows the setup is right. ## How many runs Each job gets its own run, so several jobs run at the same time, up to 10 per workspace. Jobs on the same server still run one after another. ## Troubleshooting | What you see | Fix | | ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The run fails with "Add 'permissions: id-token: write'" | Add the `permissions` block from the file above. | | No run starts when a job is waiting | Install the **dnocs-id** app on the repository, and check the workspace is on **Private workers**. | | The run starts but takes no job | The `workspace` value, repository, workflow file or branch differs from what you registered in dPanel. | | The job fails to connect to your server | A firewall blocks SSH (port 22) from GitHub's runners. Open port 22 on that server, or use a [VM worker](./vm.md) inside your network. No key is missing: dPanel supplies it. | To stop, choose **Shared workers (dPanel)** again, or remove the worker. The workflow file stays in your repository; delete it there if you no longer need it. ## Frequently asked questions ### Does this use my GitHub Actions minutes? Yes. Each job runs as one workflow run in your repository, so it counts toward that repository's Actions minutes. A public repository's runs are free on GitHub's standard runners. ### Do I need to store a dPanel token in GitHub? No. The run signs in with GitHub's own identity token. That is why the workflow needs `permissions: id-token: write`. ### Can I register the worker from the terminal? Yes. `dnocs worker add --type github --name ci --repository owner/name` registers it and prints the workflow file. Add `--workflow` or `--ref` if yours differ from `dpanel-worker.yml` and `main`. ### How many jobs run at once? Up to 10 per workspace, one job per run. Jobs on the same server still run one after another. --- # VM worker Source: https://dnocs.devetek.app/docs/workers/vm Run your dPanel jobs on a server or VM you control. Add a VM worker in dPanel, copy its token once, and run the dPanel executor on the machine as a service. A VM worker is a server or VM (virtual machine: a computer rented or run in software) that takes your dPanel workspace's jobs. It runs all the time, asks dPanel for jobs, and runs them against your servers over SSH. Use it when your servers are reachable only from your own network. ## Before you start - A Linux server or VM (Ubuntu 22.04 or 24.04) that can reach your servers over SSH and `https://pawon.devetek.app` over HTTPS. You do not add SSH keys: dPanel gives the worker your servers' SSH access with each job. - Python 3 and `pip`. ## 1. Add the worker in dPanel 1. Open **Profile** for your personal workspace, or your team's page. 2. In **Workers**, press **Add worker** and choose **VM**. 3. **Name**: for example "Office VM". 4. **Executor ID**: 2 to 63 lowercase letters, digits or hyphens, for example `office-vm-01`. 5. Press **Add worker**. [Screenshot: The Add worker dialog on the VM tab, with Name Office VM and Executor ID office-vm-01] dPanel shows a **token** and the settings for the machine. **Save the token now**: it is shown only once. [Screenshot: The Office VM added dialog with a masked worker token and the environment for the executor: token, workspace ID, manager URL and worker ID]') ## 2. Install the executor on the machine ```bash python3 -m pip install --user "ansible-core>=2.16,<2.17" jmespath base=https://raw.githubusercontent.com/dPanel-ID/artifacts/main/executor version=$(curl -fsSL "$base/LATEST") curl -fsSL -o dpanelprod-executor "$base/$version/dpanelprod-executor-linux-amd64" curl -fsSL "$base/$version/SHA256SUMS" | sed 's/dpanelprod-executor-linux-amd64/dpanelprod-executor/' | grep ' dpanelprod-executor$' | sha256sum -c - chmod +x dpanelprod-executor && sudo mv dpanelprod-executor /usr/local/bin/ ``` Use `dpanelprod-executor-linux-arm64` on an ARM machine. ## 3. Run it as a service Create `/etc/dpanel-worker.env` with the settings dPanel showed you (readable only by root): ```bash DPANEL_EXECUTOR_MANAGER_URL=https://pawon.devetek.app DPANEL_EXECUTOR_TOKEN=dpw_your_token DPANEL_EXECUTOR_WORKSPACE_ID=group:1234567890 DPANEL_EXECUTOR_WORKER_ID=office-vm-01 ENV=production ``` Then create `/etc/systemd/system/dpanel-worker.service`: ```ini [Unit] Description=dPanel worker After=network-online.target [Service] EnvironmentFile=/etc/dpanel-worker.env WorkingDirectory=/var/lib/dpanel-worker ExecStart=/usr/local/bin/dpanelprod-executor Restart=always User=dpanel-worker [Install] WantedBy=multi-user.target ``` ```bash sudo useradd --system --create-home --home-dir /var/lib/dpanel-worker dpanel-worker sudo chmod 600 /etc/dpanel-worker.env sudo systemctl daemon-reload && sudo systemctl enable --now dpanel-worker ``` Run Ansible as that user too: install it with `sudo -u dpanel-worker python3 -m pip install --user ...` if you created a new user. ## 4. Switch to private workers In **Workers**, choose **Private workers** and confirm. The worker's **Last seen** time updates once it asks for jobs. [Screenshot: The Workers card listing a VM worker office-vm-01 and a GitHub workflow worker acme/dpanel-workers, with the Private workers option next to Shared workers] :::tip[Run several jobs at once] Set `DPANEL_EXECUTOR_SLOTS=3` in the settings file to let one VM run three jobs at the same time. ::: ## Lost the token? Press **New token** on the worker. The old token stops working right away; put the new one in `/etc/dpanel-worker.env` and restart the service with `sudo systemctl restart dpanel-worker`. ## Frequently asked questions ### Which machine can be a VM worker? Any Linux server or VM, Ubuntu 22.04 or 24.04, that can reach your servers over SSH and `https://pawon.devetek.app` over HTTPS. It can sit inside your private network. ### How do I know the worker is connected? Its **Last seen** time in the **Workers** card updates once it asks dPanel for jobs. A worker that never connected reads **Not seen yet**. ### Can I add a VM worker from the terminal? Yes. `dnocs worker add --type vm --name office --executor-id office-01` prints the token once. `dnocs worker rotate-token --id ` gives it a new one. ### What happens when I remove a VM worker? It stops taking jobs and its token stops working. Stop the executor service on the machine too, with `sudo systemctl disable --now dpanel-worker`. --- # Reading logs Source: https://dnocs.devetek.app/docs/logs/reading-logs Where to find server, application, load balancer and build logs in dPanel, and how to read, filter and search the log table by level and text. dPanel shows four kinds of log in the browser, so you don't need SSH, `journalctl` or `tail -f`: server log files, application runtime logs, load balancer request logs and build logs. They share one table, so once you can read one you can read them all. A **log** is a program's running record of what it did, one line per event, such as "started", "request served" or an error. See the [Glossary](../getting-started/glossary.md). ## Where logs live | Log | Where to find it | What it covers | | ------------------------ | ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------- | | Server logs | Server page, **Logs** tab | Log files on the machine: system, security, provisioning, the dPanel agent, and the web server. | | Application runtime logs | Application page, **Logs** tab, **Runtime** | What your service prints while it runs. | | Load balancer logs | Application page, **Logs** tab, **Load balancer**; or the load balancer's own **Logs** tab | Requests reaching the load balancer. | | Build logs | Application page, **Deployments**, **Logs** on a build | The output of one build: clone, build steps, service start. | ## The log table [Screenshot: An application's Logs tab: the log source, time range, filter, Download and Refresh controls above the table] Each row is one line, with these columns: | Column | Shows | | ------- | ------------------------------------------------------------------------------------------------------------------------------ | | # | The line's number in the time range. | | Time | When it was written, in your time zone. | | Level | debug, info, notice, warn, error or fatal, when the line says. | | Source | The file, service or domain it came from. | | Message | The text. A **JSON** badge means the line carries structured data; an **HTTP** badge means it is a request to a load balancer. | Page 1 holds the newest lines. Inside a page, lines read from top to bottom in the order they were written, with the newest at the bottom, and the table scrolls to the newest line for you. The footer says so, for example **Lines 1–200 of 1,250, newest first**. **Query** above the table folds open to show the exact search dPanel ran for this page. You only need it when you report a problem. ## Load balancer requests Load balancer logs show each request as one readable line, marked **HTTP**: [Screenshot: Load balancer requests to dbmanager.devetek.app, with level chips Warn 5 and Info 3, and rows such as GET dbmanager.devetek.app/api/info → 401 · 7 ms] `GET dbmanager.devetek.app/api/info → 401 · 7 ms` reads as: the method, the domain and path asked for, the status code sent back, and how long it took. The level follows the status code: `5xx` is **error**, `4xx` is **warn**, the rest is **info**. Open the entry to see every field, such as the visitor's IP address, the protocol and the request headers. A TCP or UDP load balancer (L4, which forwards raw connections such as a database port instead of web pages) logs connections, not requests. The command-line tool prints each as a line such as `TCP 203.0.113.10 -> 10.0.0.12:5432 · in 78 B, out 199 B · 3ms`: the client, the upstream it reached, the bytes each way, and how long the connection lasted. ## Narrow it down - **Filter this page** keeps the lines that contain your text. Upper and lower case do not matter, so `error` also finds `ERROR`. It searches the lines already loaded, not the whole time range. For a request, it also matches the readable line, so `→ 500` finds server errors. - **Level chips** sit above the table, one per level present, with a count. Select **error** to see only errors; select **All** to go back. The chips are hidden when every line has the same level. - When nothing matches, **Clear search** removes both filters. ## Open one entry Select a row, or its **Open entry** button. The **Log entry** panel opens beside the table with: - **Message**: the full text, never cut off. - **Structured payload**: any JSON in the line, pretty-printed. - **Context**: time, level and source, shown at the top of the panel. - **Raw line**: exactly what was written. **Copy raw line** copies it. [Screenshot: The Log entry side panel beside a server's log table, showing the level, time, source, message and raw line of one entry] ## Server logs The server's **Logs** tab reads the newest lines of one log file. 1. Open the server and go to **Logs**. 2. Pick a file in **Log source**. They are grouped as Overview, System, Security, Provisioning, dPanel and Network. **Auth** is selected first; **All VM logs** reads them together. 3. Pick how many lines to read: 20, 50, 100, 200 or 500. [Screenshot: The Logs tab of a server, with the log source and line count pickers] :::note[No time range on server logs] Server logs read the newest lines of a file, not a time window. The time range, paging and download described in [Time range and refresh](./time-range-and-refresh.md) apply to application and load balancer logs. ::: ## Build logs **Artifact Logs** opens over the page with the newest 500 lines of that build. It has **Filter this page**, the level chips, **Download**, and **Refresh** with **Auto-refresh**, which is handy while a build is still running. Select a line to expand it in place. ## Frequently asked questions ### How far back can I read logs in dPanel? Application and load balancer logs go back 10 days. Server logs show the newest 20 to 500 lines of a file, and build logs the newest 500 lines of a build. ### Does Filter this page search the whole time range? No. It searches the lines already loaded on the current page. To look further back, go to an older page or narrow the time range. See [Time range and refresh](./time-range-and-refresh.md). ### Can I follow logs live? Yes. Turn on **Auto-refresh** next to **Refresh**, every 30 seconds, minute or 5 minutes. It pauses while you read an older page. ### Can I save logs to a file? Yes. Application and load balancer logs have **Download**, for one page or the whole time range. See [Download logs](./download-logs.md). ### Can I read load balancer logs from the terminal? Yes. `dnocs load-balancer log --id ` prints each request as `GET host/path → 200 · 148ms`, newest first. Use `--since` to look back up to `240h`, `--page` and `--limit` (up to 500) to page, and `--json` for every field. Find the ID with `dnocs load-balancer list`. See [AI in the terminal](../ai/ai-in-the-terminal.md) to install dnocs. ### Is the filter case-sensitive? No. **Filter this page** and every search box in dPanel ignore upper and lower case. --- # Time range and refresh Source: https://dnocs.devetek.app/docs/logs/time-range-and-refresh Pick a log time range up to 10 days back, page through older lines 200 at a time, and turn on auto-refresh to follow application logs live. In dPanel you can read application and load balancer logs from the last 10 minutes up to 10 days back, 200 lines per page, and refresh them by hand or automatically. These controls are on application runtime logs and load balancer logs; see [Reading logs](./reading-logs.md) for where each log lives. ## Choose a time range The view opens on **Last 10 minutes**. 1. Open the time range menu, left of **Filter this page**. 2. Pick a preset: **Last 10 minutes**, **Last 1 hour**, **Last 6 hours**, **Last 24 hours**, **Last 3 days**, **Last 7 days** or **Last 10 days**. [Screenshot: The time range menu, with its presets and the custom range option] ### A custom range 1. In the same menu, choose **Custom range**. 2. Set **From** and **To**. Times are in your time zone, shown as an offset such as UTC+07:00. 3. Press **Apply**. The form tells you what is wrong before it runs the search: | Message | Fix | | ---------------------------------------- | ------------------------------ | | Enter both a start and an end. | Fill in both fields. | | The start must be before the end. | Swap them. | | Logs are only kept for the last 10 days. | Move the start forward. | | The end can't be in the future. | Set the end to now or earlier. | :::info[10 days back] Logs can be read up to 10 days back. dPanel holds every range to that limit, so an older start is moved up to the edge of the window. ::: ## Page through older lines A page holds 200 lines. Page 1 is the newest 200; page 2 the 200 before them, and so on. Inside a page the lines run in time order, newest at the bottom. The footer says where you are, such as **Lines 1–200 of 1,250, newest first**. - With a known total, use the page numbers. - Otherwise, use **Newer** and **Older**. [Screenshot: The footer of a load balancer log: Lines 1–200 of 201, newest first, with page buttons 1 and 2] **Filter this page** and the level chips work on the page you are on. To search further back, move to an older page or narrow the time range. ## Refresh Press **Refresh** to load the newest lines. The table keeps showing the current lines while it loads. ## Auto-refresh The button beside **Refresh** sets **Auto-refresh**. It is **Off** by default. 1. Open the menu next to **Refresh**. 2. Pick **Every 30 seconds**, **Every minute** or **Every 5 minutes**. The button shows the interval, such as **30s**. 3. Pick **Off** to stop. [Screenshot: The Refresh button and the Auto-refresh menu with its intervals] Auto-refresh pauses while you are on an older page, so the lines do not move under you. It picks up again when you go back to the first page. The server **Logs** tab and **Artifact Logs** have the same **Refresh** and **Auto-refresh** controls. ## Frequently asked questions ### Why are older lines missing? dPanel keeps application and load balancer logs for 10 days. Anything older is gone. Download what you need to keep. See [Download logs](./download-logs.md). ### Why does the newest line sit at the bottom? Inside a page, lines read like a book, in the order they were written. The table scrolls to the bottom for you, so the newest line is in view. ### Which time zone are the times in? Yours, from your browser. The column header shows the offset, such as **Time (GMT+4)**. ### Does auto-refresh cost anything? No. It only reads the logs again at the interval you pick. --- # Download logs Source: https://dnocs.devetek.app/docs/logs/download-logs Download application and load balancer logs from dPanel as a .log file: one page, or a whole time range of up to 100,000 lines. dPanel downloads application and load balancer logs as a plain `.log` file, either the page you are on or every line in the time range, up to 100,000 lines. Download a log when you need to search it with your own tools, or attach it to a support request. ## Application and load balancer logs 1. Set the time range you want. See [Time range and refresh](./time-range-and-refresh.md). 2. Press **Download**. The menu reads **Download as a .log file**. 3. Choose what to save: - **This page**: the lines on the page you are on. - **Everything in this time range**: every page, fetched one after another. The file name says what is in it: the name of the log and the time window, such as `db-manager_2026-11-05T01-00Z_to_2026-11-05T01-10Z.log`, with `_page-2` added for a single page. Lines are saved oldest first, as plain text you can open in any editor. Each line holds the time in UTC, the level, and the line exactly as it was written. :::note[Request details are not in the file] A load balancer writes each request as the short message `handled request`, with the method, path and status kept as separate fields. The download saves that message, not the readable `GET … → 200` line. To save request details, use `dnocs load-balancer log --id --json`. ::: [Screenshot: The Download menu: This page, 200 lines on page 1, or Everything in this time range, 201 lines] A long download shows its progress, such as **Downloading 12,000 / 40,000 lines**. Press **Cancel download** to stop it. :::warning[Up to 100,000 lines at once] **Everything in this time range** stops at 100,000 lines. For a bigger range, the option says **More than 100,000 lines** and is unavailable. Narrow the time range, or download page by page. ::: ## Build logs In **Artifact Logs**, press **Download**. The file is named after the commit, such as `build-04ccf00a1b2c.log`, and holds the lines shown, up to the newest 500. ## Before you share a log A log can hold anything your code printed, including tokens or personal data. Read it before you send it anywhere. ## Frequently asked questions ### How many lines can I download? Up to 100,000 lines at once with **Everything in this time range**. Narrow the time range, or download page by page, for more. ### Can I download server logs? Not as a file. Server logs show the newest 20 to 500 lines of one file. Select a line and use **Copy raw line**, or read it over SSH. See [Connect over SSH](../servers/connect-over-ssh.md). ### What format is the file? Plain text with a `.log` extension, one line per log entry, oldest first. --- # Common problems and fixes Source: https://dnocs.devetek.app/docs/troubleshooting/faq Fixes for common dPanel problems: servers, cloud launches, builds, GitHub, load balancers, firewalls, HTTPS, DNS, logs, workers and the AI assistant. This page collects the problems dPanel users run into most, with what you see and what to do. Each answer starts with the message or symptom as dPanel shows it. If yours is not here, ask [Ask dPanel](../ai/diagnose-problems.md) to look into it, or [contact support](#getting-help). Words you don't know are explained in the [Glossary](../getting-started/glossary.md). ## Servers ### The server page says "Setup did not finish" The red banner means the provider or the setup stopped with an error. Press **See what happened** to read the reason. The usual causes are a cloud account without enough quota, and credentials that have expired or lack a permission. Each provider's page lists the quotas and permissions to check: see [Cloud providers](../servers/cloud-providers/index.md). Fix the cause at your provider, then open the server's **Settings** tab and use **Reinstall** under **Setup**, or **Reinstall server** under **More actions** (⋯), to run setup again. See [Create a cloud server](../servers/cloud-providers/create-a-cloud-server.md). ### A launch fails with a provider error Read the reason under **See what happened**. These come up most: | Error from the provider | What to do | | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `QUOTA_EXCEEDED`, or a VPC or Droplet limit | Raise the quota or limit at the provider, or free one up. | | `Forbidden.RiskControl` (Alibaba Cloud) | Finish real-name verification and add a payment method. See [Alibaba Cloud](../servers/cloud-providers/provider-alibabacloud.md#the-account-must-be-allowed-to-buy). | | `UnauthorizedOperation` about payment (Tencent) | Grant the sub-user payment rights. See [Tencent Cloud](../servers/cloud-providers/provider-tencent.md#the-sub-user-must-be-allowed-to-pay). | | No credit, or billing refused (IDCloudHost) | Top up the billing account. See [IDCloudHost](../servers/cloud-providers/provider-idcloudhost.md). | ### The size card says "This provider can't serve that CPU and memory pair" The provider sells no machine with exactly that CPU and RAM. Move one of the sliders to another value. Values the provider cannot serve are crossed out. ### A cloud account reads "Could not connect" The provider refused the key. Check it at the provider, then replace it with **Update credentials** in the account's **More** (⋯) menu. See [Rotating a credential](../servers/cloud-providers/cloud-credentials-security.md#rotating-a-credential). ### I cannot delete a server Deletion is refused while applications or load balancers still use the server. Delete those first, then try again. See [Delete a server](../servers/delete-a-server.md). ### A port is blocked after I turned on the firewall With the firewall on, only ports with an **Allow** rule can be reached; everything else is blocked. SSH (22) always stays open, and 80 and 443 stay open on a server that runs a dPanel load balancer. For anything else, such as a database port published by a TCP load balancer, add an **Allow** rule for that port and protocol, then review and apply. Check the **Firewall** column under **Active ports** on the server's **Network** tab to see which ports are allowed. See [Firewall](../servers/firewall.md). ### A firewall change failed and the old rules came back If SSH or the dPanel agent stop working after a change, the server restores its previous firewall by itself within a few minutes and marks the job failed. Check the rules you added, then apply again. See [Safety: SSH and automatic rollback](../servers/firewall.md#safety-ssh-and-automatic-rollback). ### The dashboard says "No contact" with a server The dPanel agent on that server has not reported in for a while. The server may be off, overloaded or out of network. Open it from **Needs your attention** with **Open server** and check whether it is reachable. ## Applications ### Continue stays disabled on the App setup step Check the **Application name**. It may only contain letters, numbers and spaces. A name such as `my-app` or `my_app` is refused, and the field explains why under it. Use `My App` instead. The bar at the bottom of the form lists anything else still missing. ### "No ready servers found" when I pick a server Only servers that are **Ready** can host an application. Wait until a new server finishes setup, fix a server whose setup failed, or press **Add new server**. See [Servers in dPanel](../servers/overview.md). ### "Port … is already used on this server" Another service already listens on that port. Pick a port that is not listed under **Ports already in use**. dPanel suggests a free one between 7000 and 10000 when you start. ### The build failed Open **Deployments**, find the build marked **Failed**, and press **Logs**. The last lines usually name the step and the error. Fix it in your repository or in **Settings**, then press **Build and release**. See [Deployments and rollback](../applications/deployments-and-rollback.md#read-a-builds-logs). ### The build stops after about 20 minutes Every build and deployment job has a time limit of 20 minutes by default, and its log ends with `context deadline exceeded`. A build that compiles a lot, or a server with little CPU, can hit it. Raise the limit per application with `build.timeout` in the application definition, as a duration between `1m` and `3h`: ```yaml build: timeout: 90m ``` The web form does not have this field yet. Set it in the definition file you deploy with the dPanel command-line tool. Otherwise, a larger server shortens the build. See [Build timeout](../applications/build-timeout.md). ### "GitHub session expired" or "Reconnect GitHub" GitHub no longer confirms your saved account. Press **Reconnect GitHub** or **Relogin GitHub** and sign in to GitHub again. Your applications keep running in the meantime. See [Connect GitHub](../getting-started/connect-github.md). ### My GitHub organisation is not in the list Open **GitHub team** in **Create Application** and choose **Add GitHub account**. Install the dnocs-id GitHub App on the organisation, and give it access to the repository. ## Load balancers, HTTPS and DNS ### The load balancer shows "Load balancer change failed" The red banner on the list and on the load balancer's page means the last change did not finish. Press **See why it failed** to read the reason; in the table, press the failed status instead. The reason reads like `Load balancer create failed. Ansible task failed on : . Detail: …`, where the step names what dPanel was doing on the gateway (Ansible is the tool dPanel uses to run setup steps on a server). Check, in this order: 1. The gateway server is **Ready** and the dashboard does not show **No contact** with it. 2. The engine is installed on the gateway. The first load balancer on a fresh server installs it, which takes about 10 minutes. 3. With a **Managed** domain, the domain still connects under **Domain & DNS**, and the name is not already in the zone. 4. The application is running, and the **How the gateway reaches this application** choice fits where it runs. Fix the cause, then delete the failed load balancer and create it again. **Ask dPanel** can also update an existing load balancer for you to approve. See [Load balancers](../networking/load-balancers.md). ### A TCP or UDP load balancer does not answer on its port An L4 load balancer listens on the port you chose. If the gateway's firewall is on and has no **Allow** rule for that port and protocol, connections are dropped. Add the rule and apply it. See [Firewall](../servers/firewall.md). When you ask **Ask dPanel** to create such a load balancer, its approval card warns you when the firewall would block the port. ### I cannot pick my server as the gateway Only ready servers can run a load balancer. Wait until setup finishes, or fix the server first. ### The site does not resolve right after I created the load balancer Your resolver may have cached the "not found" answer from before the record existed. Wait a few minutes, or check with a public resolver: `dig @1.1.1.1 app.example.com`. With an **External** domain, check that you pointed its DNS at the gateway's public address yourself. ### The HTTPS certificate is not issued Let's Encrypt must reach the gateway on ports 80 and 443, and the name must already resolve to the gateway. Check both; Caddy on the gateway keeps retrying and gets the certificate once it can. Servers dPanel launches have 80 and 443 open; on DigitalOcean or IDCloudHost, or a server you connected, check your own firewall. ### dPanel refuses my subdomain With a **Managed** domain, dPanel will not overwrite an existing DNS record. Pick a name that is not in the zone yet; search the domain's [DNS records](../networking/dns-records.md) to check. ## Workers and jobs ### Jobs wait and never start A job such as a deployment, a server setup or a module install sits waiting. If your workspace uses **Private workers**, its jobs go only to your own workers, and wait until one of them is running. Start your worker, or switch the workspace back to **Shared workers (dPanel)** on your profile or team page. See [Workers](../workers/overview.md). ## Logs ### "This application has no run command or server yet" Runtime logs come from the running service. An application without a start command, or not yet released to a server, has none. Finish its setup and release it first. ### The logs are empty Logs only show the time range you picked. Widen the range; the longest is 10 days. If the application was just released, wait a minute and press **Refresh**. See [Reading logs](../logs/reading-logs.md). ### "More than 100,000 lines" and I cannot download **Everything in this time range** stops at 100,000 lines. Narrow the time range, or download page by page. See [Download logs](../logs/download-logs.md). ### Search does not find something I can see Searches ignore upper and lower case, so `WordPress` and `wordpress` find the same thing. If a list still shows nothing, check that you are in the right workspace, and clear any filter beside the search box. ## Workspaces and access ### My servers or applications have disappeared You are probably in a different workspace. Check the workspace name at the top of the sidebar and switch back. See [Workspaces](../getting-started/workspaces.md). ### I cannot find Migrate Ownership dPanel does not move resources between workspaces, so the action is hidden. A server, application, load balancer, domain, cloud account or SSH key stays in the workspace it was created in. Create new resources in the right workspace. ### "You cannot see this workspace's health" Every member of a workspace can read its execution and agent status. If you still see this, you are probably not a member of the selected workspace: check the workspace switcher, or ask a workspace owner to add you. See [Members and roles](../teams/members-and-roles.md). ### The assistant says it "isn't available yet" **The assistant isn't available yet** means dPanel could not reach the assistant service, or the assistant is not turned on for you. Press **Check again** after a moment. The rest of dPanel keeps working without it. See [Limits and privacy](../ai/limits-and-privacy.md). ### Where is Secret Managers for my passwords? **Secret Managers** in the sidebar opens the **SSH keys** page; it holds SSH keys only. Keep application passwords in [environment variables](../applications/environment-variables.md). ## Getting help Most list pages end with **Help & Support**: - **Documentation** opens these guides. - **Chat team** opens a WhatsApp chat with the dPanel team. - **Email support** writes to the team by email. When you write, include the name of the server or application, what you pressed, and what you saw. ## Frequently asked questions ### Where do I see why something failed? On the item itself: a server shows **See what happened**, a load balancer **See why it failed**, and a build its log under **Deployments**. The dashboard's **Needs your attention** list collects every recent failure in one place. ### Can the assistant fix a problem for me? It can read what failed and propose a fix, such as a firewall rule or a corrected setting. Nothing changes until you approve it. See [Diagnose problems](../ai/diagnose-problems.md). ### Does a failure on one server affect my other servers? No. Each job runs against one server, and a failed job leaves the others alone.