Introduction

XAXA is a free control panel for Ubuntu and Debian servers. It installs a production web stack with one command and gives you a fast, simple web UI to run PHP, Node.js, Python, static and reverse-proxy sites.

What you get

• Sites — PHP 8.2–8.5, Node.js, Python, static files and reverse proxies. Every site runs as its own Linux user with its own PHP-FPM pool.
• SSL/TLS — free Let's Encrypt certificates with automatic renewal, or your own certificate. The certificate library installs one wildcard on many sites at once.
• Databases — MariaDB (default) or MySQL 8, with per-site databases and users.
• Security — UFW firewall, fail2ban, IP and bot blocking, basic auth, Cloudflare-only mode and two-factor login.
• Backups — nightly zstd archives of files and databases, one-click restore and copies to S3-compatible storage.
• Deploy & files — Git push-to-deploy, one-click WordPress/Laravel, site cloning for staging, a browser file manager and terminal.
• Operations — cron jobs, logs, uptime and SSL monitoring, live server metrics, service restarts and a full audit log.
• Teams & automation — users who only see their assigned sites, a REST API with tokens, and the xaxa CLI.

How it is different

XAXA's web UI never runs as root. It runs as the unprivileged xaxa user and asks a single root-owned agent to do privileged work. The agent re-validates every value, runs commands without a shell and refuses anything outside its allow-list. Read the security model for details.

The UI is server-rendered HTML with HTMX: no heavy JavaScript bundle, so it stays fast on a 1 GB VPS.

Next steps

1. Check the requirements.
2. Install XAXA on a fresh server.
3. Add your first site.