Self-hosted infrastructure stack

Run the server. Bill the client. One stack, not a stitched‑together toolchain.

TulioCP is an open-source Linux server control panel for hosting, DNS, mail, and databases. TulioBilling is its native billing and client-management companion. No per-account license fees, no vendor lock-in — the code is GPL-3.0 and Apache-2.0, and it runs on infrastructure you already control.

Panel (in apt)
TulioCP 1.10.6 · GPL-3.0
Billing
TulioBilling · Apache-2.0
Packages
Debian 13 (trixie) · amd64
admin@edge01 — panel cli
v-add-domain admin example.com
# web, dns, and mail records in one pass
v-add-letsencrypt-domain admin example.com
# issues the cert and schedules its renewal
v-backup-user admin
# archives the user to the configured target
# each exits 0 and prints nothing on success

Live panel, published login

Sign in to a running TulioCP install. The credentials are on this page.

panel.tuliocp.com is a production deployment running TulioCP's built-in read-only demo mode. Sign in with the published account and open anything — users, domains, DNS zones, mail, databases, backups, the file manager, the logs.

  • Read-only, so no change you make is saved. The panel refuses every state-changing action itself — creating, editing, deleting, suspending, restarting. Nothing you do there is written and nothing persists.
  • The API is disabled. /api/ answers Error: Disabled, so this login is a way to look at the interface, not a way to drive the panel over HTTP.
  • Everyone has this password. Never reuse it. It is printed publicly here, so treat the session as public: don't type anything into the panel you wouldn't post on this page, and never use demo as a password on a TulioCP install of your own or anywhere else.
  • Not the TulioBilling demo. billing.tuliocp.com is a separate application with its own demo caveats — self-registration is closed there and no login is published for it. These credentials work on the panel only.

Read-only demo credentials

Username
admin
Password
demo
Open the panel login

The port is part of the address — :8083 is the panel; :443 on the same host is an ordinary web server.

Two products, one lifecycle

TulioCP hosts the workload. TulioBilling sells and manages it. Neither needs the other to function — together, they close the loop.

TulioCP

The control panel underneath the infrastructure you already run.

A GPL-3.0 fork of HestiaCP, itself descended from VestaCP. It runs Apache and nginx, five PHP branches side by side, Bind for DNS, Exim and Dovecot for mail, and MariaDB or PostgreSQL — administered from a web panel or a 500-command CLI.

Explore the panel →

TulioBilling

Commerce and provisioning, wired directly into the panel.

An Apache-2.0 fork of FOSSBilling, descended from BoxBilling. It handles invoicing, orders, and client management, and ships a native TulioCP server-manager module so a paid order provisions a real hosting account without a middle integration layer.

Explore billing →

Verified integration

The TulioBilling → TulioCP account lifecycle, tested end to end.

TulioBilling's server-manager module talks to the panel's access-key–authenticated API. These seven actions are implemented and were verified against a live instance — not aspirational roadmap items.

Temporarily inactive against the hosted panel. The panel at panel.tuliocp.com is running in read-only demo mode, which disables its API, so TulioBilling cannot provision through it until demo mode is switched off. Nothing below was removed or changed: on a TulioCP install of your own, the adapter runs today.

  1. 01

    Connect

    Access-key authenticated connection test against the panel API

  2. 02

    Create

    Provisions the system user and primary domain in one pass

  3. 03

    Suspend

    Locks the account without deleting data

  4. 04

    Unsuspend

    Restores access to a suspended account

  5. 05

    Change package

    Reassigns hosting plan limits on the panel side

  6. 06

    Change password

    Rotates panel credentials from the billing order

  7. 07

    Delete

    Tears down the account when a service is terminated

What operators actually do

Four workflows, not forty feature bullets.

  • 01

    Host

    Apache and nginx with PHP-FPM across five major versions on one box. DNS clustering, mail with anti-spam and anti-virus, MariaDB and PostgreSQL, and one-click installers for WordPress, Laravel, Nextcloud, and eight more stacks.

    See what's under host →
  • 02

    Secure

    iptables and fail2ban brute-force detection out of the box, SSH/SFTP chroot jails, two-factor auth on the admin panel, and wildcard Let's Encrypt across web and mail domains.

    See what's under secure →
  • 03

    Automate

    Every admin action has a v-* CLI and API equivalent — over 500 commands. Cron jobs, access keys, and a REST API mean the panel is scriptable, not just clickable.

    See what's under automate →
  • 04

    Recover

    Automated backups to SFTP, FTP, or 50+ cloud providers via Rclone, plus Restic-based backup and restore for full-user, database, and file-level recovery.

    See what's under recover →

Debian 13 · amd64

Public installer, public packages, public source.

Fetch the installer from the panel repository and run it, or add apt.tuliocp.com by hand and pull the packages yourself. Both source repositories are readable without an account — there is no access request anywhere in this path.