Downloads
Install TulioCP on Debian 13.
The installer, the apt repository, and both source repositories are public — nothing here needs an access request. Packages are currently built for Debian 13 (trixie) on amd64 and that is the only combination this page claims support for.
Recommended
Download it, read it, then run it
This is the recommended path because it is the one that gets a working panel in one pass: it configures the apt repository below for you, so a full install never needs the manual steps. Those are there for adding the repo to a machine that already runs the panel — or for seeing exactly what gets configured.
It is fetched to a file and read before it is run, rather than piped into a shell, and the three commands below are in that order deliberately. What you are reading is a wrapper: it checks that you are root, detects the distribution, then downloads and executes a second, much larger script that does the actual work. Reading the wrapper is worth doing — and it tells you more than it used to, because of the next paragraph.
What is and isn't verified. The wrapper pins the second stage to an
exact git commit and to that file's SHA-256
hash, both written into the wrapper as constants. It downloads over HTTPS, checks the
hash, and refuses to execute anything that doesn't match — so the bytes you read in the
wrapper determine exactly which second stage runs, rather than "whatever is on a branch
at the moment you run it". What is not verified is the wrapper itself: it is
trusted because it arrived over TLS from GitHub, and nothing checks it against a key
you hold. It is not GPG-signed, and this page won't call it signed.
The packages the installer then pulls from apt.tuliocp.com are a
separate matter: those are GPG-signed and apt verifies them against the key
below. That guarantee covers the packages and does not extend backwards to the script
that configured the repository. Note also that the wrapper needs curl or
wget already installed — a minimal Debian 13 has neither, and it will tell
you so rather than doing something surprising.
Run it on a clean host. The installer takes over nginx/Apache, DNS, mail, and database configuration, and it expects to be the only control panel on the box.
Current packages
apt.tuliocp.com · trixie/main/amd64
These are the versions the repository resolves for Debian 13 (trixie) today. No
other distribution or architecture has a published package set yet. The source tree is
tagged ahead of the packages from time to time — where the two disagree,
apt.tuliocp.com is what you can actually install, and it's what this page
quotes.
Manual repository setup
Add the apt repository by hand
Written for root on a minimal Debian 13 (trixie), which is
the machine this page claims support for, and run end to end in a throwaway container
before being published. There is no sudo in it — every command here needs
root, and a minimal Debian doesn't ship sudo anyway.
The source list is written to /etc/apt/sources.list.d/tulio.list — the same
filename the installer uses, so adding it manually and running the installer later
won't leave two competing entries. Step 2 is safe to re-run: it de-armours into a
temporary file and copies that over the keyring, rather than asking
gpg to overwrite a file it has already written.
- Distribution
- trixie (Debian 13 (trixie))
- Component
- main
- Architecture
- amd64
- Keyring
- /usr/share/keyrings/tulio-keyring.gpg
- Signing key
- TulioCP APT Repository (TulioCP package signing key) <apt@tuliocp.com>
- Key fingerprint
- 7669 5098 4D6D 728A F4EE 6234 51D8 B0CD 5126 BF11
1 A minimal Debian 13 has no
curl and no gpg. Install them first, or the next step fails
with command not found.
2 Fetch the key into a temporary file and read its
fingerprint before anything trusts it. Compare what
gpg prints against the fingerprint listed on the left.
3 Or don't compare by eye. This checks the same fingerprint exactly and only installs the keyring if it matches — a mismatch prints nothing and writes nothing.
4 Now the repository can be added and the packages
installed. apt will refuse anything the key above didn't sign.
Tagged releases
The release page, and what its files are not
The panel is tagged v1.10.6 on
GitHub — TulioCP 1.10.6, published 2026-08-23 — with the two
files on the right attached to it.
Neither attachment is an install path. The .deb is the
tulio package on its own.
tulio-nginx and tulio-php are not attached, and dpkg -i does not
resolve the dependencies the package declares — so installing it by hand gets an
incomplete panel and no upgrade path. The apt repository is still how
you install. These files are here to be read, mirrored, and checked against.
Both are worth checking because they are published twice. The
.deb is the tulio package as it stood when
v1.10.6 shipped, and the release notes print the same hash you see
beside it. It is not what apt.tuliocp.com serves today: a packaging
rebuild has moved the repository on to
1.10.6-2+debian13 without moving the tag, which is what
the two are for — the attachment records the release, the repository records what
installs. Install from the repository. The
documentation archive is the manual as it
stood at v1.10.6 — the hosted copy at
/docs/panel/ is rebuilt from the panel
repository's main branch whenever a docs page changes, so between releases
it runs ahead of the archive. Read the archive for the manual that shipped with the
version you installed, and the hosted copy for the current one.
TulioBilling is at v0.1.0, tagged TulioBilling 0.1.0 Public Preview. It is marked a prerelease on GitHub and has no attached files — it is source and release notes, so there is nothing to download here and nothing on this page installs it. See the TulioBilling page for what the preview covers.
Every tagged release: TulioCP · TulioBilling
The tulio package on its own, as it stood at the tag — for reading or mirroring.
SHA-2566c5cbe5b0edbeccfc8942abca1ec419303a1d5de558accaec136786f73babebe
The built panel manual as it stood at 1.10.6, for reading offline.
SHA-2569938da84324976a0d2722a4bf394a0a3a408a09041303e479c5e6c94eb27ee49
✓ Check the download before you trust it. This
either prints OK or exits non-zero — it does not ask you to compare
64 characters by eye.
Source
Both repositories are public
TulioCP is GPL-3.0 and TulioBilling is Apache-2.0. Clone either, read the install scripts, open an issue, or report a vulnerability through the security policy — there is no separate access process and no contact mailbox behind these.
After the install
Know what the panel does before you point clients at it.
The panel manual covers the user guide, server administration, and the full v-* CLI and API reference. It is built from the panel repository and served from this domain.