Skip to content
HipnoTypePanel

v1.2.0 · open source · single-VPS by design

One VPS. Everything under control.

HipnoType Panel puts websites, apps, bots, DNS, files, a real terminal, firewall and backups in one dark, beautiful panel — behind a rotating secret URL that opens zero inbound ports.

Install on a fresh Ubuntu / Debian / EL9 VPS

curl -fsSL https://hypnotype.mangocloud.cyou/install.sh | sudo bash
Install guide Read the docs Source & releases
  • Outbound-only tunnel
  • Argon2id + TOTP 2FA
  • Audit hash chain
  • AES-256-GCM secrets

The whole toolbox

Every module is real

No simulated states, no 'staged' deploys, no demo data. If a feature is unavailable in your environment, the panel says so — with the action to fix it.

Websites & projects

Guide Static, PHP, Node and reverse-proxy sites with real files on disk, generated vhost configs, SSL and live DNS verification.

Domains & DNS

Guide Connect Cloudflare with a scoped API token, import every existing record and sync both ways with a reviewed diff.

Apps & templates

Guide 22 one-click templates — WordPress, Ghost, n8n, Gitea, PostgreSQL… — or deploy from any Git repository.

Bots & workers

Guide Long-running processes run as first-class apps: env-var secrets, restart policies, live logs and exit codes — no fakery.

IDE-grade files

Guide A real file workspace: tree, Monaco editor, archives, uploads, trash and path-jailed, audited operations.

Terminal in the browser

Guide A genuine shell over xterm.js — PTY when available, single-use tickets, role-limited, never logged.

Firewall with a safety net

Guide nftables rules with a 60-second rollback window — lock yourself out and the panel undoes it for you.

Backups that verify

Guide Checksummed archives you can inspect, restore or download — with an honest reminder to keep a copy off-site.

Monitoring & alerts

Guide Live metrics, rules with severities, a bell that badges the browser tab, and delivery to email or webhooks.

How it works

From zero to panel in three steps

The installer does the work; you keep the keys.

  1. Run one command

    01
    On a fresh Ubuntu, Debian, AlmaLinux or Rocky VPS:
    curl -fsSL https://hypnotype.mangocloud.cyou/install.sh | sudo bash

  2. Open your secret URL

    02
    The installer prints a boxed summary: a 32-character access URL, the admin email and a one-time password. The panel itself opens zero inbound ports — it tunnels out.

  3. Build something

    03
    Unlock, set your real password, turn on 2FA — then ship a website, deploy an app or open a terminal. Everything is real from second one.

Runs where kernels are real

Supported environments

Capability-checked, not guessed — the installer probes the machine and tells the truth.

Virtualization

  • KVM / QEMU — full support (recommended)
  • Bare metal, Xen, VMware, Hyper-V — full support
  • LXC / LXD — with nesting, feature-gated honestly
  • Docker / Podman — restricted mode, reported as such
  • ✗ OpenVZ — refused (no real kernel)

Operating systems

  • Ubuntu 22.04 / 24.04 x86_64 · arm64
  • Debian 12 x86_64 · arm64
  • AlmaLinux 9 x86_64
  • Rocky Linux 9 x86_64
  • 1 GB RAM · 10 GB disk · outbound 443 only · full matrix

An honest comparison

How it stacks up

Only claims we can stand behind. “—” means we have not verified that cell — check the project's own docs.

HipnoTypehPanelaaPanelCyberPanelCloudPanelCoolify
Self-hosted on your VPSno
Free & open sourceno—
Rotating secret access URLnonononono
Cloudflare DNS two-way sync—————
Browser terminal includedno
Single-VPS focus (no cluster tax)—no

Compared against each project's public documentation as of November 2026. Verify before you buy anything.

Security & trust

Built paranoid, on purpose

A panel is the keys to your server. HipnoType treats it that way.

Secret-URL access

The access URL is a 32-character credential. Unknown tokens get a byte-identical 404 — no enumeration.

Zero inbound ports

The panel tunnels out to the relay. Nothing listens publicly on your VPS unless you enable direct mode.

Encrypted secrets

Cloudflare tokens and 2FA secrets are AES-256-GCM encrypted at rest and never leave the box unencrypted.

Tamper-evident audit

Every action lands in a hash-chained audit log. Editing history breaks the chain visibly.

The relay in the default setup terminates TLS — like a CDN, it is in your trust path. Read the trust model before you decide, and switch to direct mode or self-host the relay if that position is not acceptable.

Open source, fully

Get the code

Everything is on GitHub — and the install asset is mirrored right here, so the one-liner works even before you publish a release.

Panel source (installer asset)

The exact archive install.sh builds from — served from this domain at /downloads/panel-source.tar.gz and verified against its checksum.

The full repository

Panel, relay, terminal service, installer, docs and the website source live in one repo: Arsh0712/HypnoPanel. Releases carry the same checksummed archives.

This website (Vercel)

The site you are reading is the website/ folder of the repo — a standalone Next.js app. Import it in Vercel with the deploy guide.

FAQ

Questions people actually ask

Do I need a domain to use it?+

No. Your panel is reachable from day one through its secret URL on the shared domain. Domains are only needed for the websites you host — and you bring your own at the registrar of your choice.

Can the relay see my traffic?+

In the default relay mode, TLS terminates at the relay — the same trust position as a CDN or Cloudflare Tunnel. If that is not acceptable, the panel has a direct mode with its own certificate on a domain you control, and the relay itself is open source so you can run your own.

Which VPS works?+

Any KVM/QEMU VPS (the vast majority) with Ubuntu 22.04/24.04, Debian 12, AlmaLinux 9 or Rocky 9, 1 GB RAM and 10 GB disk. LXC and Docker environments install with honest feature gating; OpenVZ is refused.

What does it cost?+

The panel is free and open source (MIT). You pay only for your VPS — and the domains you choose to buy.

How do I lock things down after a leak?+

hypno rotate issues a brand-new access URL in one command. Every existing session is revoked and the old URL dies instantly.

Is it ready for production?+

v1.0 ships the full ops surface — auth with 2FA, audit hash chain, backups with verification, firewall rollback and honest status everywhere. Test it on a fresh VPS and judge by the doctor output, not by promises.

Your VPS is waiting. Put it under a spell.

One command, one secret URL, one beautiful panel. Free and open source — forever.

Install HipnoType Browse the docs