System requirements

Check these before you install HF Panel. The installer checks the most important ones itself and stops, before it changes anything, when one is not met.

Operating system

HF Panel installs on a freshly installed, 64-bit server running one of these releases:

Important:

• Interim Ubuntu releases (for example 26.10) are not supported: they lose security updates after nine months.
• Rocky Linux 8 and AlmaLinux 8 reach their end of life in May 2029 (security updates stop then). For a new server, choose 9 or 10, which are supported for longer. CentOS Stream 8 is not supported.
• Install on a clean server. Do not install HF Panel on a server that already runs another control panel, websites, a mail server or a database you want to keep. The download script refuses to run when it finds another control panel.

Rocky Linux, AlmaLinux, CentOS Stream and CloudLinux

• 64-bit Intel/AMD (x86_64) only on these systems.
• The installer adds EPEL (with the CRB repository it needs, called PowerTools on version 8) and the extra PHP versions repository, whose release package is installed only when its signature checks out. On 9 and 10, when that repository can't be reached, websites get the system's own PHP 8.3 and no other PHP versions are offered. On 8 the system's own PHP stops at 8.2, so the installer stops and says so when the repository can't be reached.
• SELinux stays on (enforcing). The installer sets the labels, switches and ports HF Panel needs; it never turns SELinux off. A server where SELinux is permissive or disabled works too.
• The firewall is firewalld instead of ufw. The panel's Firewall screen works the same way.
• Not available yet on these systems: MongoDB databases (DB Studio), Docker, the web application firewall and newer versions from other sources under Software versions (it offers the system's own packages). Everything else works as on Ubuntu and Debian.

Version 8 (Rocky Linux 8, AlmaLinux 8, CloudLinux 8)

• Resource limits need cgroups v2, and version 8 starts with cgroups v1. The installer does not change how the server boots. Until you switch, the limits of packages and accounts are saved but not enforced, and the usage charts stay empty. To switch, run hf-agent cgroups-v2 as root and restart the server when it suits you. Until that restart, Packages and Top accounts say the limits need a restart. On CloudLinux, the limits stay with LVE instead (see below).
• The installer makes the newer versions of the system's packages the ones it installs: Nginx 1.24, MariaDB 10.11, Redis 6, PostgreSQL 16 and Ruby 3.3. The defaults on 8 are older: Nginx 1.14, MariaDB 10.3, Redis 5, PostgreSQL 10 and Ruby 2.5.
• Python 3.11 is installed and becomes python3, because the system's own Python 3.6 is too old for HF Panel. The system's tools keep their own Python.
• Apache is 2.4.37 and OpenSSL is 1.1.1 (with security fixes from the system). HF Panel's download and update signatures are checked with the system's Python, because OpenSSL 1.1.1 can't check them itself.
• Version 8 has systemd 239, so two hardening settings of newer systemd versions are skipped: hiding other processes from the accounts' sandboxed services, and stopping the accounts' apps from creating set-user-ID files. Account isolation works otherwise.

CloudLinux

CloudLinux 8, 9 and 10 install like the AlmaLinux of the same version, with the same packages. CloudLinux limits each account itself with LVE and gives each account its own view of the file system with CageFS. HF Panel does not add its own on top, so accounts are never limited twice:

• Resource limits stay off. The limits of packages and accounts are saved, but HF Panel doesn't enforce them, and Enforce limits under Packages is refused. Packages and Top accounts say Resource limits are managed by CloudLinux LVE on this server. Set the limits with CloudLinux's own tools.
• Account isolation: when CageFS is on, the private filesystem view and the jailed SSH shell are not offered. Check first says why.
• LVE's default limits are shown read-only in the isolation check and in hf-agent smoke-test.
• CloudLinux's own alt-php versions are listed by hf-agent php-versions and the smoke test, but HF Panel doesn't use or manage them. Websites use the PHP versions from Server Admin › System › PHP & Node.js.

What works on which system

Step by step for Rocky Linux, AlmaLinux and CloudLinux: Install on Rocky Linux or AlmaLinux.

Newer versions of Nginx, Apache, MariaDB, PostgreSQL, Redis and Node.js can be installed later under Server Admin › System › Software › Software versions, and extra PHP versions under Server Admin › System › PHP & Node.js.

Websites run behind Nginx on Apache by default. OpenLiteSpeed with LiteSpeed's lsphp can take Apache's place, from LiteSpeed's own package repository; the PHP versions it offers depend on the system. See Web server.

Hardware

The installer stops when the server has less than 1 GB of memory or less than 5 GB of free disk on /. Its summary also warns when there is less than 2 GB of memory or 10 GB of free disk. On servers with less than 4 GB of memory, HF Panel adds a swap file.

Virtualisation

A VPS must be a full virtual machine that runs systemd: KVM, VMware, Hyper-V, Xen, or a dedicated server. Containers (OpenVZ, LXC, Docker) are not supported, because the panel manages services, the firewall and disk quotas itself. The installer detects a container and stops.

Network

• A public IPv4 address on the server. IPv6 is used too when the server has it.
• A domain name you control for the server's addresses, for example yourdomain.com, which gives srv.yourdomain.com, cp.yourdomain.com and the others. See DNS setup.
• Access to your server provider's settings, to set the reverse DNS (PTR) of the IP. Without it, email from the server is likely to go to spam.
• Outgoing internet access during the installation, for packages, Let's Encrypt, the licence check and the HF Panel download.
• Outgoing port 25 for email. Many providers block it on new accounts; ask them to open it, or the server cannot deliver email to other mail servers.

Ports

The installer opens these in the server's firewall (ufw; firewalld on Rocky Linux, AlmaLinux, CentOS Stream and CloudLinux). If your provider also has a cloud firewall or security group, open the same ports there.

The full list, including ports that stay closed to the outside: Ports.

Access

• Root access: log in as root, or run sudo -i first.
• Run the command in a normal SSH session; it prints a setup link, and the questions are answered in your browser (port 8443 must be reachable). For an automated install, give every answer as an option: see Customise the installation.

Licence

A licence key (HFL-XXXXX-XXXXX-XXXXX-XXXXX) is tied to the server's public IPv4 address. You add it, or start the free 30-day trial, on the browser installer's Licence step. See Licensing.

What the installer checks

Related

• DNS setup
• Install
• Troubleshoot the installation