Installation Reference
System Requirements
What a server needs before you install TiiPanel — and the exact checks the installer runs before it touches anything.
1. Supported Operating Systems
64-bit only. These are the versions the installer accepts — anything else fails loudly with a clear message rather than attempting a partial install.
| Distribution | Versions | Status |
|---|---|---|
| Ubuntu Server | 22.04 LTS, 24.04 LTS | Recommended |
| Debian | 12 (Bookworm), 13 (Trixie) | Supported |
| AlmaLinux | 9.x | Supported |
| Rocky Linux | 9.x | Supported |
| RHEL | 9.x | Supported |
| CentOS Stream | 9 | Best effort |
× Not supported
- × Any 32-bit system
- × Ubuntu non-LTS releases (23.10, 24.10 and similar) — lifecycle too short for a hosting box
- × CentOS 7, CentOS 8, Debian 11 and older — end of life
- × Desktop editions of any distribution
- × Windows, macOS, FreeBSD
2. Virtualisation
| Platform | Supported |
|---|---|
| Bare metal | Yes |
| KVM | Yes |
| Xen (HVM) | Yes |
| VMware ESXi | Yes |
| Hyper-V | Yes |
| Proxmox (KVM guests) | Yes |
| AWS EC2, Google Compute, Azure, Hetzner, Contabo, DigitalOcean, Vultr, Linode | Yes |
| OpenVZ / Virtuozzo | No |
| LXC / LXD containers | No |
| Docker containers | No |
Container-based virtualisation is excluded deliberately, not as an oversight. TiiPanel needs filesystem quotas, per-user cgroup limits, its own kernel modules for the firewall, and control over systemd services. Container platforms share the host kernel and restrict all four. A panel that appears to install on OpenVZ and then silently fails to enforce quotas is worse than one that refuses.
The installer detects and refuses these platforms, naming the detected platform in the error.
3. Hardware
TiiPanel installs in two roles. A single-server install runs both on one machine.
3.1 Control plane only (master, no hosting accounts)
The control plane is light — it holds a database and dispatches jobs. Customer traffic never passes through it.
| Minimum | Recommended | |
|---|---|---|
| CPU | 1 core | 2 cores |
| RAM | 1 GB | 2 GB |
| Disk | 10 GB | 20 GB |
3.2 Hosting node
Sizing is driven by RAM, not CPU. PHP-FPM pools dominate.
| Minimum | Small | Medium | Large | |
|---|---|---|---|---|
| CPU | 2 cores | 4 cores | 8 cores | 16 cores |
| RAM | 4 GB | 8 GB | 16 GB | 32 GB |
| Disk | 40 GB SSD | 100 GB SSD | 250 GB NVMe | 500 GB+ NVMe |
| Swap | 2 GB | 4 GB | 4 GB | 8 GB |
| Typical accounts | up to 25 | up to 80 | up to 250 | 400–800 |
Account figures assume typical shared-hosting sites. A node hosting busy WooCommerce stores will hold a fraction of that. A node hosting parked domains and small brochure sites will hold more. Treat these as planning figures, not guarantees.
Do not plan for more than roughly 800 accounts on a single node regardless of hardware. Beyond that, memory pressure, backup windows, inode counts and blast radius all become the binding constraint. Add a node instead — TiiPanel manages the fleet from one dashboard, which is the point.
3.3 Single-server install (control plane + node together)
Take the node requirement and add 1 GB RAM and 10 GB disk. Minimum realistic: 2 cores, 4 GB RAM, 40 GB SSD.
3.4 Storage notes
- SSD or NVMe strongly recommended. Spinning disks are workable for backups and archival, not for a live hosting node.
- Filesystem: ext4 or XFS. Both must have quota support available — ext4 with
usrquota,grpquota, XFS withprjquota. The installer enables these and may require a remount. - Btrfs and ZFS are untested. They may work; quota enforcement will behave differently.
- A separate
/homepartition is recommended so a customer filling their disk cannot take down the system. - Inode count matters as much as capacity. A node full of WordPress installs runs out of inodes before it runs out of gigabytes. Check
df -i.
4. Network
4.1 Requirements
- A static public IPv4 address. Not behind NAT for the hosting node — customers' sites need to be reachable, and Let's Encrypt validation requires inbound access on port 80.
- A fully qualified hostname that resolves to the server, set as the system hostname (
panel.yourhost.com, notlocalhostorserver1). - Outbound HTTPS (443) to reach package repositories, Let's Encrypt, and the TiiPanel licence API.
- IPv6 optional but supported. If present, it must be configured correctly — a broken IPv6 stack causes intermittent, hard-to-diagnose failures.
- Reverse DNS (PTR) matching the hostname. Not needed for web hosting; essential once mail is enabled, and easier to arrange at provisioning time than later.
4.2 Ports
Must be open inbound
| Port | Protocol | Purpose |
|---|---|---|
| 80 | TCP | HTTP for customer sites, Let's Encrypt HTTP-01 validation |
| 443 | TCP | HTTPS for customer sites |
| 2087 | TCP | TiiPanel control plane interface (admin, reseller and client panels) |
| 22 | TCP | SSH — restrict by source IP where possible |
Open as needed
| Port | Protocol | Purpose |
|---|---|---|
| 21 | TCP | FTP control |
| 40000–50000 | TCP | FTP passive range |
| 53 | TCP + UDP | DNS, if the node serves DNS |
| 25, 465, 587 | TCP | SMTP, submission — phase 2 |
| 110, 995, 143, 993 | TCP | POP3, IMAP and their TLS variants — phase 2 |
× Must not be publicly reachable
- × 3306 (MySQL/MariaDB) — local socket only, or restricted to known hosts
- × 5432 (PostgreSQL) — same
- × 6379 (Redis) — same
- × The agent's local control socket
repo.tiipanel.com, and Let's Encrypt. A locked-down egress policy must allow these or the install will fail partway.5. Pre-Install State
TiiPanel installs and manages its own stack — Apache, PHP-FPM, MariaDB, and later Postfix, Dovecot and PowerDNS. It expects to own them. The server must be a clean OS installation.
× None of the following may be present
- × Another control panel: cPanel/WHM, Plesk, CyberPanel, CWP, DirectAdmin, HestiaCP, ISPConfig, Froxlor, aaPanel, Webmin/Virtualmin
- × A pre-installed web server: Apache, Nginx, LiteSpeed, Caddy
- × A pre-installed database server: MySQL, MariaDB, PostgreSQL
- × A pre-installed mail stack: Postfix, Exim, Sendmail, Dovecot
- × Docker with published ports on 80 or 443
The installer detects these and refuses, naming what it found. Installing over an existing stack produces a system where neither the previous software nor TiiPanel works correctly, and unpicking it usually means rebuilding the server.
Other pre-install conditions
- Root access, or a user with full sudo
- SELinux may be enforcing — the installer configures the required policies. It must not silently disable SELinux.
- AppArmor supported on Debian and Ubuntu
- No conflicting custom repositories that would override distribution packages
- System clock accurate and NTP running — certificate validation and licence checks both depend on it
- At least 2 GB free in
/tmpfor the install process
6. Browser Support
For the panel interface:
Chrome / Edge
Last 2 versions
Firefox
Last 2 versions
Safari
Last 2 versions
Mobile Safari & Android Chrome
Last 2 versions
JavaScript required. No Internet Explorer support.
7. Licence and Connectivity
- A valid TiiPanel licence key, entered during installation or immediately after
- Outbound HTTPS to the licence API for activation and periodic verification
- The panel continues to operate during a network outage — a configurable grace period covers loss of connectivity to the licence server, and customer websites are never affected by licence state in any case
8. Recommendations
Beyond the minimum requirements, these materially affect how well a TiiPanel server runs.
Use a fresh server.
Installing onto a machine with a history is the single most common cause of failed installs. If a server has had another panel on it, rebuild rather than clean up.
Separate roles once you have more than one node.
Mail on its own server, DNS on two small servers in different networks. Mail on a web node means one compromised WordPress site can get your entire IP range blacklisted.
Size for headroom, not for today.
A node at 90% memory has no capacity to absorb a traffic spike, and adding RAM usually means a reboot and downtime for every account on it.
Set up backups before you host anything.
Offsite object storage — Backblaze B2, Wasabi, S3. Backups stored on the same node are not backups. Test a restore before you need one.
Keep the OS updated.
Enable unattended security updates. A hosting server is a permanent target.
Restrict SSH.
Key-based authentication only, root login disabled, source IP restrictions where practical. TiiPanel configures a firewall, but SSH policy is yours.
Monitor from outside.
The panel tells you a node's status; an external monitor tells you when the panel itself is unreachable.
Plan the second node before you need it.
Migrating accounts under pressure is worse than migrating them on a quiet afternoon.
9. Installer Preflight Checks
The installer verifies every item below before making any change to the system, and aborts with a specific, actionable message on failure. A half-installed panel is worse than a refused install.
Rules
- Every check reports pass, warn or fail with a one-line explanation
- Warnings are listed and require confirmation to continue; failures abort
- A
--check-onlyflag runs the preflight and exits, so an operator can validate a server before committing to it - The full preflight result is written to the install log
- No system modification occurs until every check has passed
Server meets the requirements?
Start free, upgrade any time — no credit card required for the free tier.