Questions people ask

What this page is for: short, honest answers to the questions that come up most, and how to reach support.

You need nothing. Every answer here either stands on its own or points at the page that has the steps.

Where is everything on disk?

SixPanel puts its own files in one place and leaves the rest of the machine looking like an ordinary Ubuntu server.

Where are the containers?

There are none, and that is the point: nginx, PHP-FPM, MariaDB and Redis are ordinary Ubuntu packages, started and stopped by systemd, with their configuration in the usual places. systemctl status nginx works. journalctl -u php8.3-fpm works. If you know Linux, nothing here is hidden behind another layer.

Redis is the one that is not a single service: each project runs its own redis-server@six-<project> instance, which is Ubuntu's own template unit doing exactly what its own documentation describes. systemctl status redis-server@six-shop works the same way.

The per-project background workers are systemd units too, named after the project: sixpanel-queue@<short id>.service, sixpanel-schedule@<short id>.timer, sixpanel-reverb@<short id>.service and sixpanel-react@<short id>.service. The panel's short names (queue, scheduler, reverb, react) are just friendlier labels for those.

Which operating systems are supported?

Ubuntu 26.04 LTS, Ubuntu 24.04 LTS and Debian 13 (trixie) — nothing else. The installer checks and refuses anything else by name before it downloads a thing. For a new server, pick Ubuntu 26.04 LTS.

That is a real design decision, not caution. The whole serving stack comes from your release's own package archive at the versions it ships and supports — no third-party package sources for the web server, the database, PHP or the certificate tool. Security fixes then arrive from the distribution, on its own schedule, and nothing on your server depends on somebody else keeping a repository alive. Security support runs to April 2031 (Ubuntu 26.04), May 2029 (Ubuntu 24.04) and August 2028 (Debian 13).

Debian 12 was supported and no longer is (removed August 2026). Its own security support ended in July 2026, and the only PHP its archive carries is 8.2, which goes out of upstream security support in December 2026. Debian 13 replaces it — same family, PHP 8.4 from the archive.

Can I reach the panel without a domain?

Yes. That is the normal state right after the install: https://SERVER-IP:PORT/SECRET-CODE. The port is a random high number picked at install, and the address always ends in the secret code.

sudo sixpanel info

The panel is always https. On an IP address the certificate cannot match the name, so the browser warns once — click through it. That is expected.

I lost the panel link

sudo sixpanel info      # the whole link, and what is running
sudo sixpanel open      # the link, large, with a QR code for your phone

If the link ever leaked, issue a new one with sudo sixpanel entry-code reset. The old link stops working straight away.

I lost the panel username

sudo sixpanel username

The login name is not plain admin — it was generated at install so that a robot which finds your login page has nothing to aim at. You can change it on the Security page.

I lost the panel password

sudo sixpanel password reset

It confirms first, then prints a new password. The old one is stored as a one-way hash and cannot be recovered.

Do I have to use two-factor login?

You should. This panel controls your whole server, so a 6-digit code from your phone is the difference between a stolen password and a stolen server. You set it up at your first login — and that screen also offers Not now — continue without two-factor login if you have no phone to hand, which is recorded in your activity log and leaves your password as the only lock. You can turn it on later from the Security page in about a minute.

If you lose the phone, sudo sixpanel 2fa off on the server forgets it, and your next login shows a fresh QR code to scan with the new one. See Security.

Do I need a git repository, or can I just upload my zip?

Either. The Deploys page offers both side by side, and both are supported paths for installing and for updating. Git additionally gives you a preview of what will change, rollback to any version, and deploys on git push. See Install your 6ammart code.

Can I give my developer access without giving them my password?

Yes — create a temporary login. It has its own name and password, ends by itself after the time you choose, can run the site, and can never see your secrets or change who gets in. There is also a read-only demo login for showing the panel to somebody. See Let someone else in.

Can I change my shop's name after it is installed?

Yes — in 6ammart's own admin panel, under its business settings. That is the name your customers read, and changing it there is safe at any time.

Projects → rename… in SixPanel is a different thing: it changes only the label this panel shows you, so you can tell your projects apart. It signs nobody out and does not touch the site. See Rename a project.

How do I know my backups actually work?

The panel proves it. Every week it loads your newest backup into a throwaway database, counts what is inside, and deletes that copy again — your live data is never touched. The result is on the Backups page and on Server → Health. See Backups.

Can I see the backup password?

Yes, whenever you like — it is your key, on your server. Press Show the backup password on the Backups page. Every time it is displayed, a line goes into the activity log, so a look is never silent. You can also change it: the panel re-keys every backup storage in place, and every backup you already have stays readable with the new password. See Backups.

Can I run this on one small server?

Yes — that is the design target. 2 CPU cores and 4 GB of RAM run everything, and the install sizes the database, the cache and the PHP workers to fit your hardware. The installer refuses a server with less than about 1.2 GB and warns below 2 GB. On a small machine it also adds a swap file, because building the customer website is the one job that briefly wants more memory than the site ever does.

For a second or third project on the same server, plan roughly 2 GB more RAM and 1–2 more cores each. See More than one project on this server.

Can I run my other websites on this server too?

No — and the installer will tell you so. It refuses a server that already has aaPanel, CloudPanel, cPanel or Plesk, or that has something else listening on ports 80 and 443. SixPanel manages the machine's web server, PHP, database and certificates, and two systems doing that on one box break each other.

Use a separate server for other sites. To run more 6ammart projects here, that is supported: see More than one project on this server.

Can I install my own software on the server?

Small things, yes — it is your machine. Two rules:

• Do not change the Node.js version. The panel ships as bytecode that only the exact recorded version can load. See Update SixPanel itself.
• Do not add another web server or another PHP version on ports 80 or 443, and do not add a second supervisor for the queue worker or the scheduler. Those are systemd units with restart policies; two supervisors fighting over one process is a real way to break a working site.

Does an update touch my data or my code?

No. Updating SixPanel replaces SixPanel's own code and configuration. Your settings file, your database, your uploads, your certificates, your local backups and your application code are left exactly as they are. See Update SixPanel itself.

Is SixPanel's own code readable on my server?

Mostly not. The panel's whole backend — its server, its libraries and its route modules — ships as compiled bytecode, and the readable sources are removed from the build. The files that run in your browser are minified and obfuscated. That is deterrence, not protection — anyone determined can still work out what the code does. We say this plainly rather than calling it security.

The sixpanel command line and the installer ship as ordinary readable shell scripts, so the parts that run as root on your machine can be read before you run them.

Your 6ammart code and your data are yours, and nothing here obscures them.

Can I resell this, or use it for a client?

Your 6ammart licence comes from CodeCanyon and is between you and the script's author. SixPanel's own licence terms came with your purchase. If you plan to install it for clients, ask us first — the answer is friendly, but it should come from us and not from a guess.

What does a backup contain?

Every project's database, plus uploaded files and each project's settings file. Not your code — code comes back from your git repository or your CodeCanyon zip. See Backups.

Do I need Cloudflare?

No, but it helps a great deal here. It hides your server's address, absorbs junk traffic before it reaches you, and — once its token is connected — lets the panel create your DNS records and get real certificates without you touching a DNS dashboard or opening port 80 for them. Every record the panel creates is proxied. See Cloudflare and Firewall and ports.

Can I change the panel's port?

Yes:

sudo sixpanel port 30000

Open the new port at your hosting provider first, or the panel becomes unreachable. sudo sixpanel port random picks a new random port; it does not restore an old one.

Can I edit server configuration in the Files tab?

No, on purpose. The file manager is fenced to one project's code. SixPanel's own folders and the machine's configuration are out of reach so a wrong click cannot take the server down. Server-level files are edited over SSH.

How do I get support, and what should I send?

Run this and send us the one file it writes:

sudo sixpanel support-bundle

Add one sentence about what you were doing and what you saw. That single file carries versions, the health report, service states, disk usage and the last 500 lines of every log.

What is taken out before it is written: the SixPanel settings file is reduced to key names only, the panel's own state file — the one holding the password hash and the backup password — is not collected at all, and the secret code from your panel link plus common password-looking values are masked in the collected logs. Read the log files yourself before you send them if any of them worries you.

Write to us at hi@allsweb.com.

Before you write, two places often hold the answer already:

• the project's Logs page, where the first red line of a failed job is usually the real reason;
• Security → Activity log, which shows what changed recently and from where.

And the page that answers most things on its own: When something is broken.