cpleks is a control panel you install on your own Ubuntu or Debian server to run its websites, certificates, databases, mail, DNS and backups from one screen.
It runs our own servers today. It will be available to everyone once it has run them a while longer.
Everything on this list is in the current release. What is not built yet has its own list further down the page.
nginx sites with aliases and subdomains, each under its own Linux user. PHP in the versions your system can install, side by side, with per-site limits; Node.js, Python and ASP.NET Core apps kept running behind nginx; or plain static files. One-click WordPress, redirects, password-protected folders, HTTPS-only per site, and scheduled tasks.
Free certificates from Let’s Encrypt for every site, requested and renewed on their own — including wildcard certificates for domains whose DNS this server answers. A new server starts on Let’s Encrypt’s test service, so a domain not yet pointed here costs nothing; a one-time step as root switches it to real certificates.
Keep DNS where it is, and the panel lists the records your provider needs and checks them live. Or switch on the server’s own nameserver (NSD): a zone per site, each record checked before it is saved.
MariaDB or MySQL, and PostgreSQL: databases and users per site, and downloads of a database to your browser. MariaDB and MySQL databases also restore from this server’s own backups. MongoDB installs and is secured from its card, but is not yet managed per site.
Mailboxes with size limits, forwarders, IMAP over TLS, authenticated sending on port 587, optional POP3, filters and out-of-office replies, and Roundcube webmail on its own address. Outgoing mail leaves straight from the server if you allow it, or, with Postfix, through a relay you choose.
A web file manager that uploads, unpacks, copies, renames and sets permissions. SFTP locked to each account’s home, with keys managed in the panel and extra accounts for contractors; FTPS, TLS only, on Pure-FTPd, vsftpd or ProFTPD.
A backup set holds every account’s files and databases (MariaDB, MySQL, PostgreSQL) and the panel’s own records; files and MariaDB or MySQL databases restore from it item by item, and the newest seven sets are kept. Add an off-server destination — S3, B2 or an SFTP host — and a fresh set is copied there with restic every night, by a process that never deletes. Every Sunday a rehearsal restores the latest set’s files and MariaDB or MySQL dumps into scratch space and reports whether they load; a PostgreSQL dump is checked for being whole, not loaded.
The panel checks for a new release every day and installs it when you press Update — only if its signature verifies. It takes a snapshot first and rolls itself back if the new version does not come up healthy.
A default-deny firewall that undoes its own change after ten minutes unless you confirm you can still reach the server, an outbound filter for customers’ code, a hardened host baseline, and sign-in with an authenticator app or a security key.
Hosting accounts, each its own Linux user and home. Plans with limits, feature switches and the modules an account may use; suspend and close accounts; and see the panel exactly as a customer sees it, under a bar that says so.
Every change is written to a hash-chained audit log that you can filter, export and verify, and that can be sent to another machine.
A message to ntfy, Slack, Discord or any HTTPS endpoint when a certificate is failing, a backup copy or the Sunday rehearsal fails, a security update is waiting, or the panel itself stops.
No terminal sessions, no hand-edited config files, no “it worked on the other server”. Every change goes through the same checked path, and the panel says what it did in plain words.
A control panel is a remote root shell with a login form in front of it. cpleks is built so that the login form reaches as little of that shell as possible.
/var/lib/cplex/staging/nginx/12 files, wholenginx -t -c staged.confsyntax is okrename(2) staging → /etc/nginx/cplex.datomic swapsystemctl reload nginxno dropped connectionEvery setting you change is written in full to a staging folder, checked by the program that will read it, and swapped in with one rename. A check that fails changes nothing: the old configuration keeps serving.
Signs in over HTTPS on port 8443.
The panel. Reads every request, checks every permission, keeps the database. It cannot change the system itself.
The service that changes the system. No web server, no templates. It answers a closed list of typed operations and nothing else.
The root service has no operation that means “run this”. Every program it starts has a fixed path and a fixed list of arguments, and the build fails if any code assembles a shell command out of text.
Requests name a site or an account by number. The root service works out every file, folder, user and service name itself, from its own records, so no request can point it at a file of its choosing.
Nothing edits a live configuration file. Each change is written in full to a staging folder, checked by the program that will read it, and moved into place in one step. A check that fails changes nothing, and “Repair this server” rebuilds every file from the database.
What this is not: an audit. No outside firm has reviewed cpleks yet. The rules above are held by the build and its tests, not by a certificate.
Screens from the panel as it ships, with example data.
Install, remove, switch on and off — from the panel. The Modules screen has a card for every option, and each card says where the software comes from and what installing it would change before you press anything.
Each of these is a limit of the current release, said here rather than found later.
cpleks runs our own websites, mail and databases today, on our own servers. It will be available to everyone when it has earned it there. Availability and pricing will be announced on this page.
Questions, or want to hear first? Write to tunc@oyuncakliseyler.com.
Yes. Each hosting account is its own Linux user with its own home, plans set its limits and features, and you can suspend or close it. Reseller accounts cannot be created yet, and the panel does no billing: invoicing stays with the tool you already use.
For one server run by one team, it covers websites, certificates, mail, DNS, databases, files and backups. It does not import cPanel accounts, does not read .htaccess files, and does not manage several servers.
The ones your system can actually install: the panel asks your package manager rather than keeping a list. On Ubuntu 26.04 that is the system’s own PHP 8.5; on Ubuntu 24.04, the system’s own 8.3 plus the versions Ondřej Surý’s archive publishes for it, if you choose to add that archive.
No. Every installer works without one and the panel is fully usable. A key turns on updates; add it while installing, or later on the Licence card in the panel’s Settings.
Yes. The full offline pack installs with no network at all, and the Licence card can activate by copying one line to your account on cpleks.com from any other device and pasting the answer back. Updates through the panel need the server to reach cpleks.com at least once every 30 days.
Until then: the guide shows every screen, and what each button does on the server.