Panel capabilities
Organized by workflow, not by feature count.
Most of what TulioCP does falls into four jobs an operator repeats every week. Here's what's actually implemented in each, with the real CLI commands behind it.
01
Host
The core serving stack — web, DNS, mail, and databases — configured to work together instead of as four separate installs.
Web
- Apache2 and nginx, with PHP-FPM and per-domain routing
- Five PHP branches side by side, 5.6 through 8.5, switchable per user or per domain
- nginx FastCGI cache, and nginx-as-proxy in front of Apache2
- One-click installers: WordPress, Laravel, Drupal, Joomla, Nextcloud, and eight more
DNS & mail
- Bind-based DNS with clustering and DNSSEC
- Exim and Dovecot with SpamAssassin, ClamAV, and Sieve filtering
- Roundcube webmail, with SnappyMail as an alternative
- Adjustable per-account rate limits to control outbound abuse
Databases
- MariaDB and MySQL 8, or PostgreSQL
- phpMyAdmin and phpPgAdmin bundled and pre-wired
v-add-web-domain admin example.com
OK: Web domain example.com added
v-add-mail-domain admin example.com
OK: Mail domain example.com added
v-add-database admin exampledb exampleuser
OK: Database exampledb created
02
Secure
Security defaults that assume the panel is a target, not just a convenience layer.
Perimeter
- iptables + ipset firewall with fail2ban brute-force detection built in
- SSH and SFTP chroot jails per user
- SSH key-based login for SFTP/SSH accounts
Transport & access
- Let's Encrypt with wildcard certificate support, auto-renewed via cron
- Per-domain TLS for both web and mail (Exim, Dovecot, webmail)
- Two-factor authentication on the admin panel
v-add-user-2fa admin
OK: 2FA enabled for admin
v-add-letsencrypt-domain admin example.com
OK: SSL certificate issued for example.com
v-add-firewall-ban 203.0.113.4 22
OK: Ban added for 203.0.113.4
03
Automate
Every panel action has a scriptable equivalent. The web UI is one client of the same interface the CLI and API use.
CLI
- 500+ v-* commands covering users, domains, DNS, mail, databases, backups, and firewall
- Consistent verb-noun naming: add / list / change / delete / backup / restore
- Per-user PHP CLI version switching
API & scheduling
- REST API authenticated by IP-restricted access keys
- Cron job management, including scheduled Let's Encrypt renewal and reports
- Packages system for defining reusable resource-limit templates per plan
v-list-user-package admin
PACKAGE: default
v-add-cron-job admin 0 2 '*' '*' '*' /scripts/nightly.sh
OK: Cron job added
04
Recover
Backups are a first-class object, not a script someone bolts on after the fact.
Backup destinations
- SFTP and FTP targets
- 50+ cloud storage providers via Rclone
- Restic-based incremental backup and restore
Restore granularity
- Full-user restore
- Per-domain, per-database, and per-file restore via Restic
v-backup-user admin
OK: Backup admin.2026-08-22_02-00.tar created
v-restore-database-restic admin exampledb latest
OK: Database exampledb restored