gopanel

README

The self-hosted AI development and delivery cockpit for solo founders and small teams.

Delegate development from your phone, run rootless containers, automate HTTPS, manage data and backups, and operate everything required to ship your product.

Website · Releases · Issues

---

Running a software business alone means being the product manager, developer, reviewer, release engineer, and operator at the same time. AI coding agents can write code, but the founder still has to connect them to Git, tests, previews, production, monitoring, and safe decision points.

GoPanel brings those responsibilities into one self-hosted control plane.

It is not just a server panel with a chat box. GoPanel organizes AI development sessions, isolated workspaces, Git delivery, quality checks, pipelines, releases, websites, containers, databases, runtime diagnostics, approvals, and mobile actions around one goal:

Let one person safely develop, deliver, and operate multiple products without staying in front of a terminal all day.

From Intent to Production

GoPanel is converging the existing Code, Pipeline, Release, Website, Container, Flow, and Mobile capabilities into one continuous path:

Describe the change from web or mobile
  → AI works in an isolated project workspace
  → review progress, files, diff, and quality checks
  → open a preview and verify the result
  → approve high-risk or production actions
  → build and publish a traceable release
  → monitor runtime health, diagnose failures, and recover

The control plane keeps structured state while detailed terminal output and logs remain available when needed. You see what is happening, why it stopped, what needs attention, and what can safely happen next.

Why GoPanel

AI development that produces deliverable code

• Run development tasks with Codex, Claude Code, Grok Build, OpenCode, Antigravity, Aider, or a built-in terminal.
• Keep long-running sessions, native CLI interaction, execution history, and resumable context inside each project.
• Isolate changes with managed Git worktrees, including multi-repository project delivery.
• Inspect files, Git status, diffs, history, branches, token usage, and audit events without leaving the workspace.
• Define project quality checks and run them before delivery.
• Save, merge, push, revert, and recover conflicts through a structured delivery job instead of an opaque shell script.
• Preserve reusable project memories and executor configuration while keeping the AI provider replaceable.

A mobile command center, not a miniature IDE

GoPanel's mobile experience is designed for decisions rather than desktop emulation:

• pair and revoke trusted devices;
• view projects, sessions, tasks, resources, and security risks;
• send new instructions and follow structured execution state;
• review Git changes and delivery status;
• open previews and inspect results;
• approve or reject risky actions;
• stop, retry, or recover work that needs attention;
• use a lightweight terminal only when it is genuinely useful.

The mobile client reuses the same server-side project, session, approval, and delivery contracts as the web console. Business state stays on the server instead of being guessed by the client.

Rootless containers and least privilege from a fresh server

Security is part of the default deployment model, not an enterprise add-on.

• On a fresh Linux server, the installer recommends running GoPanel as a regular service user with rootless Podman.
• The installation flow prepares the runtime user's home directory, subuid / subgid mappings, user-level podman.socket, linger, and the rootless socket path.
• Runtime validation reports whether Docker or Podman is installed, whether the API socket is reachable, and whether the runtime is rootless.
• Built-in repair actions cover Podman socket, user session, short-name registry, Compose, and subordinate ID problems.
• Docker remains supported for existing environments, while rootless Podman is the preferred path for a new least-privilege installation.
• The panel stays unprivileged for normal work; the separate gpc helper exposes bounded, auditable host actions when elevated access is genuinely required.

This separation matters when AI agents, build scripts, applications, and production infrastructure share the same machine: each layer gets only the authority it needs.

Governed automation instead of blind automation

• Choose manual, safe automatic, or fully automatic approval policy per development session.
• Route dangerous AI operations into explicit approval records.
• Keep operation logs, session audit events, execution history, and token usage for traceability.
• Use role and directory boundaries to keep non-super administrators inside managed project paths.
• Store Git and AI provider credentials as controlled resources rather than embedding them in tasks.
• Redact common secrets, authorization headers, cookies, tokens, private keys, and sensitive query parameters from diagnostic data.
• Require approval for high-risk security recommendations instead of applying them silently.

Delivery and operations in the same control plane

GoPanel also provides the infrastructure needed to turn code into a running product:

• Pipelines and releases: fetch source, run scripts, build files or container images, retain logs and records, and publish versioned artifacts.
• Delivery Flow: coordinate a selected code baseline with a pipeline and environment-oriented run state as the end-to-end workflow is consolidated.
• Multiple nodes: observe registered servers and route controlled HTTP and WebSocket operations through the main control plane.
• Built-in access and updates: serve the panel without an extra web server, manage its secure access entry, and update the installed binary through the release channel.

Practical Production Features

AI delivery is the differentiator, but GoPanel is also a practical server panel for the work that keeps a product online every day.

Websites, domains, and automatic HTTPS

• Host static sites, reverse proxies, and containerized web applications from one website workspace.
• Manage domains, upstreams, access logs, deployment history, version switching, and application snapshots.
• Create ACME accounts and obtain certificates without assembling a separate certificate toolchain.
• Seed a daily certificate-renewal job automatically and renew every certificate that has automatic renewal enabled and is approaching expiry.
• Upload or manage existing certificates when automatic issuance is not appropriate.
• Define certificate push rules so newly issued or renewed certificates are automatically deployed to configured CDN providers and domains.
• Follow issuance, renewal, and CDN deployment through detailed logs instead of treating HTTPS as a black box.

A real database management workspace

• Connect local, remote, or container-discovered MySQL, MariaDB, and PostgreSQL servers.
• Create and delete databases; manage database users, passwords, hosts, and privileges.
• Browse tables and data with pagination, search records, and insert, edit, or delete rows directly.
• Inspect and modify table structures, columns, indexes, views, routines, triggers, sequences, and database metadata where supported by the engine.
• Run SQL in the built-in console and keep common administration work inside GoPanel.
• Import SQL or CSV from pasted content or uploaded files, including chunked import for larger datasets.
• Export CSV or SQL with column, filter, and schema options; copy tables and perform engine-appropriate maintenance operations.
• Back up, restore, and transfer database data without switching to a separate database administration product.

Backups, recovery, and scheduled maintenance

• Create and restore backups for databases, websites, and installed applications, with progress logs and downloadable backup records.
• Recover from an existing record or an uploaded backup file.
• Store backups locally or use configured S3, OSS, SFTP, OneDrive, MinIO, COS, KODO, and WebDAV targets.
• Schedule database backups, certificate renewal, log cleanup, and shell tasks from the same job center.
• Enable, disable, run immediately, and inspect execution records for every scheduled task.

Containers, applications, files, and host operations

• Manage rootless Podman or Docker containers, Compose projects, images, registries, networks, volumes, logs, ports, and resource state.
• Install common databases, middleware, developer tools, and self-hosted applications; inspect connection details and manage installed versions and parameters.
• Detect and repair common runtime problems including Compose availability, Podman socket/session setup, subordinate IDs, image short names, and port conflicts.
• Upload, download, edit, move, compress, extract, search, and permission files from the built-in file manager.
• Inspect processes and ports, operate long-running services, view host resources, and use the terminal when direct intervention is required.

Host visibility, firewall, audit, and alerts

• Monitor CPU, memory, disks, network traffic, I/O, processes, and key host conditions from one dashboard.
• Manage firewall port, IP, and forwarding rules without losing visibility into the effective policy.
• Scan for large disk usage and perform protected cleanup with explicit targets instead of relying on opaque cleanup scripts.
• Review login, SSH, operation, terminal, and system logs so important changes remain traceable.
• Receive notifications for disk, container, node, certificate, Code, and security events, with debouncing, silence windows, and recovery messages to reduce alert noise.

Production problems can return to Code

Website diagnostics are designed as a closed loop rather than a log viewer:

• receive application events and collect web-server failures;
• group related events into structured issues;
• run active health probes with thresholds;
• redact sensitive data before it becomes diagnostic context;
• hand an issue, its evidence, route, release context, and verification requirements to a new Code session;
• verify the issue again after remediation.

Security monitoring similarly turns website, authentication, SSH, and system signals into structured risks that can be reviewed from web or mobile.

Built for Solo Founders

GoPanel is especially useful when one person maintains several SaaS products, client projects, or self-hosted services:

• Delegate without losing control: let agents execute while keeping approval boundaries and a complete delivery record.
• Operate away from the desk: use mobile for instructions, progress, previews, approvals, and recovery decisions.
• Replace tool switching: connect code agents, Git, CI/CD, containers, websites, certificates, databases, and monitoring in one workspace.
• Keep the stack yours: run the control plane, project context, operational data, and credentials on infrastructure you control.
• Lower maintenance cost: use a Go single-binary control plane with embedded web assets and a Docker/Podman-first application model.
• Automate recurring operations: let certificate renewal, CDN deployment, database backups, and maintenance jobs run without becoming another personal checklist.
• Bootstrap products faster: install common databases, middleware, and self-hosted applications without rebuilding the same environment by hand.

GoPanel starts with solo founders because the need is immediate and the workflow is clear. The same foundation can grow with a small team through shared projects, roles, approval boundaries, and multiple managed nodes.

Product Principles

• Structured state before raw logs: summaries and next actions are first-class; terminal streams remain available as evidence.
• Automation with control: routine steps should flow automatically, while risky and irreversible operations stop for a decision.
• Immutable delivery facts: requirements, sessions, commits, releases, deployments, approvals, and incidents should remain traceable.
• Recoverable by design: retries, conflicts, restarts, and failures must have explicit states and safe recovery paths.
• Least privilege by default: rootless containers and bounded elevation reduce the blast radius of both people and agents.
• One chain, not another silo: strengthen the existing Code → Pipeline → Website → Mobile path instead of creating parallel systems.

Quick Start

Linux and macOS:

bash <(curl -fsSL https://gopanel.run)

On a fresh Linux server, follow the installer recommendation to run GoPanel as a regular user and install rootless Podman. The installer prepares the required user namespace mappings and user-level runtime services.

Windows PowerShell:

irm https://raw.githubusercontent.com/hoxiai/gopanel/main/install.ps1 | iex

Preview

The interface is organized as a working control plane rather than a collection of unrelated administration pages: project work, attention items, infrastructure state, delivery records, and operational evidence stay close to the decisions they support.

Compatibility

• Linux: primary production platform; supports regular-user deployment, rootless Podman, Docker, systemd, gpc, and gp-agent.
• macOS: suitable for local development and demonstrations, with Podman machine support.
• Windows 10 1809+: supports local GoPanel development and ConPTY-based AI terminals; gpc and gp-agent host management are not currently supported.

Architecture

• Control plane: Go + Fiber + SQLite/GORM
• Web console: Vue 3 + TypeScript + Naive UI + TailwindCSS
• Mobile client: Flutter + Riverpod + GoRouter + Dio
• Container runtimes: rootless Podman or Docker
• Privileged helper: gpc, a bounded local host-action service
• Host agent: gp-agent, used for host-level capabilities and node control
• Distribution: a single Go binary with bundled web assets

Key directories:

• app/ — API, models, services, repositories, middleware, and routing
• admin/ — web administration and Code workspace
• client/ — Flutter mobile command center
• gpc/ — privileged helper
• gp-agent/ — host agent
• docs/ai/ — product contracts, architecture decisions, and workflow documentation

Development

Requirements:

• Go 1.25.13+
• Node.js 20+

Run the backend locally:

git clone https://github.com/hoxiai/gopanel.git
cd gopanel
go run main.go

Build the web console into the backend assets:

cd admin
npm install
npm run build:public

Telemetry

The install scripts and the panel send an anonymous event to gopanel.cn when an install or upgrade succeeds or fails. The event carries a random install ID (<install dir>/install_id), the event name, where it was sent from (install script or panel), GoPanel version (plus the previous version on upgrades), install channel, OS, CPU architecture, Linux distribution, kernel version and container runtime. The event itself does not include your IP address, host name, users, or any data managed by the panel; the server records the IP address the request comes from and the approximate location derived from it, linked to the install ID for per-server statistics.

To turn it off, do either of the following:

• run the installer with GOPANEL_TELEMETRY=off (or DO_NOT_TRACK=1); this also creates the file below, so later upgrades stay opted out;
• create an empty telemetry_disabled file in the install directory, for example touch /opt/gopanel/telemetry_disabled.

Separately from telemetry, the panel queries gopanel.cn for update information and the app store catalog. Override these with GOPANEL_UPGRADE_URL and GOPANEL_APP_REPO_URL.

License

GoPanel is licensed under the GNU General Public License v3.0.

Parts of the backend are derived from 1Panel by FIT2CLOUD, also GPL-3.0. See NOTICE for attribution and bundled third-party data.