Automated provisioning
Order to running VM in seconds: template clone, resources, cloud-init, IPs and firewall in one resumable pipeline that cleans up after itself when a node misbehaves.
Self-hosted control panel · Proxmox VE
CorePanel turns a Proxmox VE cluster into a hosting business: automated provisioning, a clean client portal, WHMCS billing and hard multi-tenant security. Self-hosted on your hardware, installed with one command.
$ ./corepanel-install.sh
[corepanel] Panel domain: panel.example.com
[corepanel] Admin e-mail: admin@example.com
[corepanel] Installing packages…
[corepanel] Creating the database…
[corepanel] Requesting the TLS certificate…
[corepanel] Installing services…
CorePanel installed.
Panel: https://panel.example.com
Admin: admin@example.com
Password: shown once, stored nowhere01Platform
Built on the Proxmox VE API you already trust. CorePanel adds the automation, the customer experience and the guardrails on top.
Order to running VM in seconds: template clone, resources, cloud-init, IPs and firewall in one resumable pipeline that cleans up after itself when a node misbehaves.
Customers reinstall, resize, snapshot, back up, watch live graphs and open a console themselves, without ever seeing your nodes, hostnames or topology.
noVNC and serial consoles proxied through an origin-hiding relay. Customers connect through your panel domain; node addresses never reach the browser.
Proxmox Backup Server or local storage, schedules with retention, per-plan quotas, protected backups and configurable freeze behaviour that game servers never notice.
Websocket-driven status, gauges and task progress. Power states land in the UI in under a second. No refresh button culture.
Pools, automatic leases, extra addresses pushed into running guests, per-pool resolvers and a full assignment history for every address.
02Security
Shared infrastructure is only as good as its isolation. CorePanel enforces at the hypervisor, not just in the UI.
Every guest is locked to its leased addresses at the host firewall: spoofed IPs and stolen ARP go nowhere. Attempts are detected, audited and alarmed to your staff within minutes.
Node API tokens and credentials are envelope-encrypted at rest (AES-256-GCM with a ChaCha20 fallback) and decrypted only at the moment of use. They never appear in logs, jobs or API responses.
Two-factor authentication is mandatory for staff, permissions are role-scoped and deny-by-default, and every action lands in an append-only audit log with before/after detail.
Clients see opaque labels, never node names, origin IPs or cluster layout. Even websocket payloads are stripped before they leave the operator plane.
03Billing
A first-class WHMCS module drives the full service lifecycle over a scoped, signed API. No glue scripts.
Paid order provisions automatically. Sell with an OS choice or let customers pick later: the server exists, billed and visible, installed on their first login.
Overdue suspends and stops the guest. Payment unsuspends and boots it. Termination cleans up the VM, the addresses and, after your grace period, the backups.
Package changes resize live where possible, disks only ever grow, and signed webhooks keep WHMCS informed of everything the panel does.
04Install
A fresh Debian 13 server, a domain pointed at it, and the installer does the rest: packages, database, TLS with auto-renewal, services, admin account. Verbose the whole way, you see everything it does.
$ ./corepanel-install.sh
[corepanel] Installing CorePanel for https://panel.example.comThe one-command installer is available to early-access partners. Request access.
CorePanel is in active development with hosting providers. Talk to us about early access and licensing.