jhd3197/ServerKit
ServerKit is a lightweight, modern server control panel for managing web applications, databases, and services on your VPS or dedicated server. Built with Python/Flask backend and React frontend. -...
875 stars · 96 forks
README
ServerKit Deploy, manage, and monitor servers. A lightweight, modern server control panel for managing web apps, databases, Docker containers, and security — without the complexity of Kubernetes or the cost of managed platforms. English | Español | 中文版 | Português
Quick Start · Screenshots · Features · Architecture · Roadmap · Docs · Contributing · Discord
📊 By the Numbers Everything below is measured from this repository, not estimated.
1,350+ REST endpoints across 109 blueprints — /api/v1/*, with OpenAPI + Swagger UI at /api/v1/docs
118 one-click app templates bundled in the repo, no registry account needed
4,300+ backend tests the whole suite runs on every change, with a CI-enforced floor on the collected count
1.75 MB gzipped web UI 60+ screens, assets served from your own box — no CDN
~180 MB resident the entire panel, single process — sits comfortably beside your apps on a 1 GB VPS
501 MB container image or install straight onto the host; Docker is optional for the panel itself
$0 MIT-licensed. No tiers, no seat limits, no upsell — and nothing phones home.
Self-hosted and Docker-native, on hardware you already pay for.
🚀 Quick Start
⏱️ Up and running in under 2 minutes
Option 1: One-Line Install (Recommended) curl -fsSL https://serverkit.ai/install.sh | bash
Works on Ubuntu 22.04+, Debian 12+, Fedora, and RHEL/Rocky/AlmaLinux 9+. Sets up everything automatically. Optional: PANEL_DOMAIN=panel.example.com sets the domain and tries Let's Encrypt; SERVERKIT_OFFLINE_TARBALL=... installs from a local tarball.
Update sudo serverkit update Atomic blue/green update with pre-flight checks, DB backup, migration, and automatic rollback. Use --dry-run to preview, --branch dev for dev builds, or --release [version] for release tarballs. Option 2: Docker git clone https://github.com/jhd3197/ServerKit.git cd ServerKit cp .env.example .env # then edit .env with your secrets docker compose up -d # access at http://localhost:5000 Runs the panel as a single container. Note a containerised panel cannot manage its own host — no systemd, no host nginx, no managed site vhosts; use Option 1 for that. It ships without nginx and never redirects to HTTPS, which makes it the right target to put your own reverse proxy in front of — see Running behind your own reverse proxy. Option 3: Manual Installation See the Installation Guide for step-by-step instructions. Requirements
Minimum Recommended
OS Ubuntu 22.04+ · Debian 12+ · Fedora · RHEL/Rocky/AlmaLinux 9+ Ubuntu 24.04 LTS
Arch x86_64 · ARM64 x86_64 · ARM64
CPU 1 vCPU 2+ vCPU
RAM 1 GB 2+ GB
Disk 10 GB 20+ GB
Docker 24.0+ (optional for the panel itself) Latest
The panel itself only needs ~180 MB of RAM and ~500 MB of disk — the rest is headroom for your apps. It runs happily on a 1 GB VPS, a spare laptop, or a Raspberry Pi (ARM64), so it's as much at home in a homelab as it is on production hardware.
📸 Screenshots
Captured from a mock-data demo build — every hostname, IP, domain, and metric below is fictional.
Dashboard Services
Live server metrics, KPI cards, and recent activity Static, Node.js, Python, PHP, and Docker apps
Docker WordPress
Containers, images, volumes, and networks with live CPU/RAM Per-site status, Quick Actions, and live health checks
Agent Fleet Marketplace
Fleet health, version rollouts, and command queue One-click app templates and installable extensions
Monitoring Security
Live gauges, alert rules, and notification channels Posture score, ClamAV, file integrity, firewall, Fail2Ban
View all screenshots
AI Assistant Service Detail
Prompture-powered assistant that runs tools on your infra Deployments, git connection, live usage, logs, and settings
Databases SQL Console
MySQL / PostgreSQL / SQLite explorer with a source tree Run SQL from the browser with a typed results grid
Domains DNS Zones
SSL status, expiry tracking, and auto-renewal Cloudflare, Route 53, DigitalOcean — full record editing
Backups Mail
Scheduled backups with S3/B2 sync and one-click restore Postfix, Dovecot, OpenDKIM, SpamAssassin, and Roundcube
Cron Jobs File Manager
Visual cron editor with human-readable timing Browse, edit, and upload files with per-mount disk usage
Logs & Terminal Servers
Log viewer, process list, journald, and SSH sessions Every server in one panel with live CPU/RAM/disk telemetry
Remote Access Settings
Expose NAT-ed services publicly via WireGuard-paired agents Profile, appearance/branding, users, and connections
Login
Email/password sign-in with SSO and 2FA support
🎯 Features
The core is feature-complete. New capabilities ship as installable extensions through the built-in Marketplace — the core stays lean and stable, with ongoing work focused on UI polish and community-reported fixes.
🚀 Apps & Deployment
One-Click WordPressPHP-FPM 8.x sites published at real subdomains, with URL-swap previews, custom domains, and wildcard HTTPS. Any StackFlask/Django on Gunicorn, Node.js on PM2, static sites — from Git, Docker, a manual path, or a zip upload.
Docker & ComposeImage-update detection with one-click apply, auto-sleep for idle containers, CPU-driven auto-scaling, live logs, and terminal access. Marketplace100+ one-click app templates on a declarative schema with auto-resolved secrets, hosts, and URLs — nothing hardcoded.
Build PacksZero-Dockerfile deploys: inspects a repo and generates a Dockerfile + compose from a build plan. AutomationsNode-based visual automation for tasks, deployments, and CI/CD — cron, webhook, and event triggers, running in a managed container. Ships as an extension.
Previews & SnapshotsEphemeral PR preview environments, plus immutable, secret-masked config snapshots with diff and one-click restore. Projects & EnvironmentsWorkspace → Project → Environment grouping, and a WordPress prod/staging/dev pipeline with code/DB promotion.
🏗️ Infrastructure
Domains & SSLNginx virtual hosts, automatic Let's Encrypt with renewal, hardened TLS 1.2+/AEAD, Cloudflare-aware configs, automatic CAA. DNS ZonesFull record management across Cloudflare, Route 53, and DigitalOcean — propagation checks and dynamic DNS for changing IPs.
DatabasesMySQL/MariaDB and PostgreSQL with user management, a live source tree, and a browser SQL console. Cloud ProvisioningSpin up servers on DigitalOcean, Hetzner, Vultr, and Linode with cost tracking.
Connections HubGit providers, clouds, DNS, registrars, SMTP relays, and S3/B2 storage — every external account in one place, encrypted at rest. BackupsScheduled app/database/file backups to S3, B2, or local with retention policies, one-click restore, and optional client-side encryption.
Files, FTP & CronWeb file manager with S3/B2 bucket browsing, vsftpd user management, and a visual cron editor. Email ServerPostfix + Dovecot with DKIM/SPF/DMARC, SpamAssassin, Roundcube webmail, and forwarding rules.
🔒 Security
Web Application FirewallPer-app ModSecurity v3 + OWASP Core Rule Set with detect/block modes and tunable paranoia. Passkeys & 2FAWebAuthn passwordless sign-in (hardware keys, Touch ID, Windows Hello) plus TOTP with backup codes.
Malware & IntegrityClamAV scanning with quarantine, file-integrity monitoring, and Lynis vulnerability audits. SSH & HardeningFail2ban, SSH key management, IP allow/block lists, and automatic OS security updates.
Container ScanningPer-image CVE scanning with grype and SBOM generation with syft. Encrypted SecretsProvider credentials and secrets sealed with Fernet, plus an inbound webhook gateway for external automation.
🖥️ Multi-Server
Cross-Platform AgentGo agent for Linux, Windows, and macOS — HMAC-SHA256 auth over a real-time WebSocket gateway. Native Windows service + MSI, .deb/.rpm, ARM64. More → Fleet ManagementInventory, approval queue, staged version rollouts, LAN auto-discovery, and an offline command queue.
Easy EnrollmentShort-code pairing with fingerprint verification or pre-shared tokens; host credentials stored AES-GCM-encrypted. More → Fleet MonitorCross-server heatmaps, metric comparisons, alert thresholds, anomaly detection, and capacity forecasting.
Server TemplatesExpected-state templates with drift detection, compliance dashboards, and auto-remediation. Remote Access TunnelsExpose a private/NAT'd service through an edge server over agent-managed WireGuard — no port forwarding.
Guided OnboardingValidate → prerequisites → Docker → pair agent, with a live progress log. Per-Server ProxyOpt-in Dockerized Traefik or Caddy per server with compose preview; host nginx stays the default.
📊 Monitoring & Alerts
Real-Time MetricsCPU, RAM, disk, and network over WebSocket, with historical retention and uptime tracking. GPU MonitoringNVIDIA utilization, memory, temperature, and per-process/per-container usage.
Status PagesPublic pages with HTTP/TCP/DNS/Ping checks, component monitoring, and incident management. NotificationsDiscord, Slack, Telegram, HTML email, and webhooks — per-user channels, severity filters, and quiet hours.
👥 Team & Access
WorkspacesMulti-tenant isolation with quotas and member management. RBACAdmin/developer/viewer roles with granular per-feature read/write permissions.
SSO & OAuthGoogle, GitHub, OpenID Connect, and SAML 2.0 with account linking. API KeysTiered keys with rate limiting, fine-grained scopes, usage analytics, and OpenAPI docs.
Audit LoggingEvery user action tracked, with a detailed activity dashboard. Webhooks & Shared ConfigOutbound subscriptions with HMAC signatures and retries, plus shared tags and variable groups.
🎨 Customization
Lean by DefaultThe setup wizard installs only the extensions matching your use cases — add more anytime from the Marketplace. Sidebar PresetsFull, Web Hosting, Email Admin, DevOps, or Minimal views with collapsible groups and per-user layouts.
Your Brand8 preset accent colors plus a custom hex picker, and white-label logo, name, or banner. Dashboard WidgetsToggle and reorder widgets to fit your workflow.
🏗️ Architecture
Nginx terminates TLS and splits traffic two ways: panel requests go to the Flask API, everything else is proxied to the Docker container serving that domain. The panel keeps its own state in SQLite or PostgreSQL, runs background work through a job scheduler and notification bus, and loads optional functionality from the extension runtime. Remote servers are managed by a Go agent that connects back over a Socket.IO namespace.
View as ASCII diagram ┌──────────────────┐ │ INTERNET │ └────────┬─────────┘ │ ▼ ┌──────────────────────────────────────────────────────────────────────────┐ │ YOUR SERVER │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ NGINX (Reverse Proxy) │ │ │ │ :80 / :443 │ │ │ │ │ │ │ │ app1.com ──┐ app2.com ──┐ api.app3.com ──┐ /api/v1/ ──┐ │ │ │ └───────────────┼──────────────┼──────────────────┼──────────────┼────┘ │ │ │ proxy_pass │ proxy_pass │ proxy_pass │ │ │ ▼ ▼ ▼ │ │ │ ┌────────────────────────────────────────────────────────────┐ │ │ │ │ DOCKER CONTAINERS │ │ │ │ │ │ │ │ │ │ ┌───────────┐ ┌───────────┐ ┌───────────┐ │ │ │ │ │ │ WordPress │ │ Flask │ │ Node.js │ ... │ │ │ │ │ │ :8001 │ │ :8002 │ │ :8003 │ │ │ │ │ │ └─────┬─────┘ └───────────┘ └───────────┘ │ │ │ │ └──────────┼─────────────────────────────────────────────────┘ │ │ │ │ ▼ │ │ │ ┌─────────────────────────────────┐ │ │ │ │ SERVERKIT PANEL │ │ │ │ │ React SPA · Flask REST API │ │ │ │ │ Socket.IO · Jobs · Notify │ │ │ │ │ Extension runtime │ │ │ │ │ Gunicorn -w 1 (threaded) │ │ │ │ └────────────────┬────────────────┘ │ │ ▼ │ │ │ ┌──────────────────────────────────┐ ┌─────────────▼────────────────┐ │ │ │ DATABASES │ │ PANEL STATE │ │ │ │ MySQL :3306 PostgreSQL :5432 │ │ SQLite (default) or │ │ │ │ Redis :6379 MongoDB :27017 │ │ PostgreSQL · Alembic │ │ │ └──────────────────────────────────┘ └──────────────────────────────┘ │ └───────────────────────────────────────────────────────┼──────────────────┘ │ Socket.IO /agent (HMAC) │ + HTTP long-poll fallback ▼ ┌──────────────────────────────────────┐ │ REMOTE SERVERS — Go agent fleet │ │ server A · server B · server C │ └──────────────────────────────────────┘
View Full Architecture Documentation → — Request flow, extension platform, template system, port allocation, jobs, notifications, and the agent fleet.
🗺️ Roadmap ServerKit's core is feature-complete — every planned core phase has shipped, from the first Flask + React infrastructure to multi-server fleets, SSO, the automation engine, and the extension marketplace. Development now happens in three places:
🧩 Extensions — new functionality ships as installable extensions through the Marketplace (100+ one-click templates and growing). The core stays lean; you install only what you need. Browse the catalog → 🎨 Themes — the panel's look is community-extensible too: 17 built-in themes, one-click installs from the gallery, and a live Theme Studio to build and share your own. See every theme → ✨ Core polish — ongoing UI/UX refinements and fixes for issues reported by the community. No new core features are planned.
Full history: ROADMAP.md
📖 Documentation
Document Description
Architecture System design, request flow, diagrams
Installation Guide Complete setup instructions
Deployment Guide CLI commands and production deployment
Agent Install & run the multi-server agent (Linux/Windows/macOS) — separate repo
Extensions Registry The curated extension marketplace index.json — separate repo
Theming Build & share panel themes — token reference, Theme Studio, and the submit flow
Themes Registry The curated community themes registry — separate repo
Templates Registry The curated app template catalog index.json — separate repo
Registries Which catalogs are published as registries, and the test for whether a new one should be
Agent Pairing Secure short-code agent enrollment
API Reference REST API endpoints
New Features Endpoint & page reference for the latest dev features
Enhancements Guide to the ten developer-experience, team/scale, fleet, and security capabilities
Changelog Release history and notable changes
Roadmap Development roadmap and planned features
Contributing How to contribute
🧱 Tech Stack
Layer Technology
Backend Python 3.11, Flask, SQLAlchemy, Flask-SocketIO, Flask-Migrate
Frontend React 18, Vite, SCSS, Recharts
Database SQLite / PostgreSQL
Web Server Nginx, Gunicorn (single threaded worker — -w 1 --threads N)
Containers Docker, Docker Compose
Security ClamAV, Lynis, Fail2ban, ModSecurity v3 + OWASP CRS, grype, syft, TOTP (pyotp), Fernet encryption
Auth JWT, OAuth 2.0, OIDC, SAML 2.0, WebAuthn / passkeys
Email Postfix, Dovecot, SpamAssassin, Roundcube
Agent Go (multi-server), HMAC-SHA256, WebSocket
🤝 Contributing Contributions are welcome! Please read CONTRIBUTING.md first. fork → feature branch → commit → push → pull request
Priority areas: Marketplace extensions, UI/UX improvements, documentation, test coverage.
💛 Support ServerKit ServerKit is free and open source. If it saves you time, you can help keep it going:
⭐ Star the repo — it costs nothing and helps a lot 💖 GitHub Sponsors ☕ Buy Me a Coffee
💎 Crypto
Asset Network Address
USDT TRC-20 · Tron TTiCtqLauF1iSW2YGB3b78KmRxRqoLCgeL
USDT / ETH ERC-20 · Ethereum 0xD13D5355Fa214e8317fea2ff192a065BaeC13527
BTC Bitcoin bc1qatx67n3qxdvuv3arc9j8aytk34f22g02k9c7vr
SOL Solana AWXzqtBEgUfteHPQtDegsZ6D5y57M3GGdKPD8rR7h6xu
TRC-20 has the lowest fees — usually under a dollar — so it's the friendliest option for a small donation. ERC-20 gas can cost more than the donation itself. QR codes are generated locally by scripts/generate-funding-qr.mjs, which checksum-validates every address before encoding.
🔭 Related Projects Faro — A modern desktop client for SFTP, FTP, SSH, and S3-compatible storage, from the same author. Save a server once, then browse its files in a dual-pane view and open a terminal against the same SSH session — plus drag-and-drop transfers, one-way directory sync, and edit-in-place. It even has an Agent Bridge that lets Claude Code (or any MCP agent) run commands on a box through your authenticated session, with per-command approval and no shared credentials.
ServerKit manages your servers from the browser; Faro is the desktop companion for hands-on file transfer, shells, and ad-hoc work across all your boxes. Grab a build →
LocalKit — Spin up local WordPress sites in one click. Each site runs as its own isolated Docker Compose project, and you can push code or push/pull databases straight to your ServerKit server through the serverkit-localkit extension. DeviceKit — A unified Android device fleet & test-automation platform. Control a fleet of devices from one dashboard — run automations, stream screens in real time, catch visual regressions, and debug failures with AI-powered analysis.
💬 Community
Join the Discord to ask questions, share feedback, or get help with your setup.
ServerKit — Simple. Modern. Self-hosted. Report Bug · Request Feature Made with ❤️ by Juan Denis