Hcpanel

Free, open-source deployment for cPanel — Git push → build → deploy, like Vercel, but you own the server.

Hcpanel is built for developers who host on shared cPanel or a VPS: no SaaS subscription, no feature tiers, no vendor lock-in. Install once on your account, connect GitHub or GitLab, and ship.

Blueprint

This repo follows the cPanel Vercel-like deployment blueprint (webhook → build → daemon → proxy → optional preview DNS). See docs/BLUEPRINT_STATUS.md for what is implemented vs planned.

Open source promise

Price	$0 forever — MIT licensed
Features	Everything in the repo is included (webhooks, dashboard, previews, rollback, SSE logs, CLI)
Hosting	Self-hosted on your machine — your code never has to leave your server
Future work	New capabilities land in open source for all users, not behind a paywall

Contributing · Report a bug · Security

Features

• GitHub & GitLab webhook deployments with signature verification
• Build runner with resource limits and 10-minute timeout
• Process daemon with port assignment on 127.0.0.1
• Apache .htaccess reverse proxy generation
• Preview subdomains via cPanel UAPI (optional)
• Real-time build logs (SSE)
• Web dashboard (React + Tailwind)
• Rollback, proxy test, environment probe

Deploy in 3 steps

git clone https://github.com/gittare/Hcpanel.git
cd Hcpanel
npm install && npm run setup && npm run build:dashboard && npm start

Deploy your app (one command — auto-detects Next.js, Express, Node, static, FastAPI):

hcpanel quick /home/you/public_html/my-app
# or from your project folder:
cd my-app && hcpanel up

Open the dashboard at http://127.0.0.1:9877, paste your api_key, or use Quick deploy with the same folder path.

Optional: Git auto-deploy

After the first deploy, copy the webhook URL from the dashboard into GitHub/GitLab — every push redeploys automatically.

CLI

hcpanel quick [path]      # Easiest — create + deploy from folder path
hcpanel deploy <name>     # Redeploy an existing project
hcpanel projects          # List projects
hcpanel status            # Running apps
hcpanel probe             # Environment check

Add --wait to block until the build finishes.

Demo app: npm run deploy:demo

Quick install (Linux / cPanel server)

curl -fsSL https://raw.githubusercontent.com/gittare/Hcpanel/main/scripts/install.sh | bash

Or from this repo:

bash scripts/install.sh

Manual setup

cp config.example.toml ~/.deployer/config.toml
# Edit secrets — see install.sh for keys
npm install
npm run build:dashboard
npm run start:daemon   # terminal 1
npm run start:api      # terminal 2

Open http://127.0.0.1:9877 and sign in with api_key from ~/.deployer/secrets.json.

Git webhooks

1. Create a project in the dashboard (or POST /api/projects).
2. GitHub → Settings → Webhooks:
   • URL: https://YOUR_DOMAIN/api/webhooks/github/{projectId}
   • Secret: project webhook_secret
   • Events: Push
3. GitLab → Settings → Webhooks:
   • URL: https://YOUR_DOMAIN/api/webhooks/gitlab/{projectId}
   • Secret token: same webhook_secret
   • Trigger: Push events

Rollback

• POST /api/projects/:id/rollback — restore previous successful release
• POST /api/deployments/:id/rollback — redeploy a specific past release
• Optional body: { "rebuild": true } to run install/build before restart

Proxy test

POST /api/system/test-proxy with { "projectId": "..." } — verifies .htaccess, port, and HTTP upstream.

Security

Hcpanel is designed to run bound to localhost (127.0.0.1) on the API and process daemon. Put it behind your domain’s reverse proxy (Apache/nginx) for HTTPS; do not expose ports 9876/9877 or app ports 4000–5999 to the internet.

Control	Description
API auth	Authorization: Bearer <api_key> only (query-string keys are rejected)
Secrets file	~/.deployer/secrets.json should be mode 600
Webhooks	HMAC (GitHub) / token or signature (GitLab); 256 KB body limit + rate limit
Paths	Project root_path / docroot must stay under the cPanel user home
Build commands	JSON argv arrays only — no shell metacharacters
Notify URLs	SSRF guard blocks loopback and private IPs
Git	HTTPS or git@host:path only; shallow clone
Rate limit	Configurable via [security] rate_limit_max in config.toml

After npm install, run npm audit and keep dependencies updated.

Production notes

• Run as the cPanel user, not root.
• Whitelist apachectl -k graceful in sudoers if using userdata vhosts.
• Ensure mod_proxy is enabled or rely on .htaccess where allowed.
• Block ports 4000-5999 from external access in the host firewall.

Architecture

GitHub → API (webhook) → SQLite job queue → deploy orchestrator
  → git pull → npm build → process daemon → .htaccess proxy

License

MIT — use, modify, and distribute freely. Commercial use is allowed.

Support

Hcpanel is free to use. If it helps your workflow, you can support ongoing development: