The panel, page by page

What this page is for. It says what every page in the panel does, what you will use it for most, and when to leave it alone.

You need

• To be logged in to the panel (First login).

Read this once. It is the difference between hunting for a button and knowing where it lives.

Two groups of pages

The menu is split in two.

Panel pages act on the whole server: Home, Projects, Server, Backups, Security, Settings.

Project pages act on one project: Overview, Deploys, Domain & SSL, Database, Logs, App .env, SixPreflight, Advanced.

Most people run one project, so the two groups feel like one menu. If you run more than one on the same server, a switcher in the top bar chooses which one the Project pages act on. See More than one project.

The web address tells you which group you are in. …/#/server is a Panel page. …/#/p/default/logs is a Project page. Bookmarks and the browser's Back button both work, and older addresses still work too — #/health, #/disk, #/firewall and #/cloudflare all land on the tab that absorbed them.

Panel pages

Home

What it is for. The first look every day, and the answer to "does anything need me?"

It opens with Needs your attention — one line per thing that is actually wrong, each with the button that fixes it. A stopped service, a certificate close to expiry, a backup that has not run, an available panel update, a disk past its comfortable level. When there is nothing, it says All clear.

Under it: This server (processor, memory, disk, uptime), then Monitoring, then Your projects (one card each, with its addresses, whether HTTPS is on, whether the app is installed, the last deploy and quick links to the admin and the store), Backups, and Recent activity.

Monitoring is the history behind those three meters: how busy the processor, the memory and the disk have been over the last hour, six hours or 24 hours — your choice, with the buttons in the corner of the card. Each chart carries a red dashed line at 90%: a line that touches it and stays there is the server telling you it needs a cleanup or more capacity. The number beside each label is where it is right now.

Open Per-service usage right now at the foot of that card to see which service is using what — the database, the web server, PHP, the panel itself. It is read only when you open it, so a closed card costs the server nothing.

You will use it for the attention list. If it is empty, close the tab.

Projects

What it is for. Creating and listing 6ammart installs. Each project gets its own domain, database, Linux user, PHP pool and services.

Create a new project is a guided flow, not a form: you type one domain and the panel derives the admin, website, www and websocket addresses from it, then — if Cloudflare manages that domain — creates the runtime, registers the addresses, writes the DNS records (always proxied) and gets both certificates, showing each step as it happens.

Each project card shows what is still missing, a rename… link, and a search box once you have several. Renaming changes the label this panel shows and nothing else — see Rename a project.

Do not create a second project on a small server without adding memory first. See More than one project.

Server

What it is for. The machine itself. It has five tabs.

Info — every fact about this server, in one place, with copy buttons: your public IPv4 and IPv6 addresses (the values a DNS A or AAAA record needs), the processor and how many cores, memory and swap, which Ubuntu or Debian this is, and the exact PHP, MariaDB, nginx, Redis and Node.js versions — which are what a security advisory is written against, so they are the versions to quote. One button copies the lot as plain text for a support ticket.

Two things on this tab are worth reading rather than skimming:

• Swap. If it says your server is using swap, that is memory being kept on disk, which is far slower than real memory. A little is normal. A lot means the box is short of RAM, and it is the commonest reason a server "feels slow" while every page still works.
• A public address that is not on the server. If the tab says so, your provider puts your machine behind network address translation. That is normal on some hosts, and the public address is still the right one for a DNS record — but it explains why the address you see inside the server is different.

Health — a full check-up: DNS, certificate expiry, services, the database, the queue, the scheduler, disk space, memory, backups, Cloudflare and more — over thirty checks in one view. Each failure carries a plain-language fix that names the page to go to.

Five checks are worth knowing about in advance:

• The app answers requests. The panel dials your project's own hostname on this machine, with the real name in the request, and reports what /api/v1/config gives back — the first call every 6ammart phone app makes. A green services list and a 404 here means your customers get nothing while everything looks fine.
• Shop timezone. 6ammart keeps the shop's timezone inside its own admin panel and applies it on every request. If that value is a name this server's PHP does not know, PHP quietly falls back to UTC — every order time, report boundary and scheduled task is out by the offset while every page renders normally. This check reads the value and says whether the server really has it.
• Storefront rate-limit exemption. SixPanel limits abusive traffic at the web server automatically, so one bad source cannot use up the whole site. That check confirms your own storefront is never caught by those limits.
• Customer website. See below — it now catches a website address that was published before the website was ever built.
• Modules enabled with no code. See below — it reads which 6ammart modules your shop has switched on and checks that their code is actually here.

Customer website

This check asks your storefront address for a page, on this machine, and reports what a shopper would get. It is the only row that looks at the storefront rather than the admin app, and it exists because a broken storefront can look perfectly healthy from everywhere else: if your site sits behind Cloudflare, visitors may keep seeing a cached copy while nothing is running here at all.

One case it now catches that it used to miss. If this server publishes a website address for a project but the website has never been built, every shopper who follows that address gets an error page — a 503 — and it never recovers on its own, because there is nothing there to start. The check turns orange and offers you the two real repairs, because only you know which one you want:

• install the customer website from the project's Deploys page — see The customer website; or
• remove the website address under Domain & SSL, if this shop sells through the phone apps only, so nothing advertises an address that leads nowhere.

A project that sells through the apps alone and has no website address at all is not a fault and never nags you. That row stays grey and simply says there is no customer website on this project.

Modules enabled with no code

6ammart is built from modules — RideShare, Rental, and so on. Its own settings file records which ones are switched on, and that list can name a module whose code is not on this server. This is how plain CodeCanyon 6amMart arrives: the download switches nine modules on and ships three. You did nothing wrong, and it is worth knowing that before you read the row.

So the check does not count them. It reads how each missing module is actually reached, and grades what it finds:

• red — a page on this server asks for a missing module in a way it cannot skip. On untouched 6amMart v4.1 that is RideShare: the rider sign-up page answers a 500 error to anyone on the internet who opens it, and the tool everything else uses to list the app's pages stops working too. Nothing else on the Health page notices, because the home page, the apps and the admin panel are all fine.
• orange — the missing module is not being reached today, so nothing is erroring. Either the app only loads that code once the module is properly installed, or every place that reaches for it is guarded. Worth tidying up, not an emergency.
• green — every module switched on for this shop has its code here.

Either way the fix is the same and it is 6ammart's own switch: turn the absent modules off, so the list matches what is really installed. SixPreflight has a Fix button that does it for you — see SixPreflight — and the row names it. Nothing is deleted and no module you paid for is lost: if you were sold a module and did not receive its code, 6amtech can supply it, and switching it on again is all that is needed once the code is here.

On some servers the panel will tell you to do it from 6ammart's own Addons page instead, and say why: on a project installed from git, that settings file is one the panel must not write, or the next deploy would refuse to run.

Resources — where the disk went, per project (app code next to customer uploads), and a tick-list of safe things to remove: Laravel caches and logs, old system logs, the package manager's cache, PHP temporary files and the panel's own job leftovers, each with an estimate of what it frees. Customer uploads and the database are never touched by the cleanup. There is also a switch for running the cleanup automatically.

Firewall — the exact rules this server needs, with copy buttons. See Firewall and ports.

Scheduled — everything the panel does by itself on a timer: certificate renewal, backups, the backup restore test, disk cleanup.

You will use it for the Info tab whenever something outside the panel asks what your server is — a support form, a DNS record, a firewall rule; the Health tab every time something feels wrong; and the Resources tab the moment the disk passes about 90 per cent. A full disk stops the database, and a stopped database stops the site.

Backups

What it is for. Choosing where backups go, how often they run, and getting data back when something goes wrong.

Backups are incremental: after the first one, only the changes are stored, so later backups stay small and fast.

You will use it for three things, and they matter more than everything else in this manual: send backups somewhere that is not this server, keep your own copy of the backup password, and read the Can your backup be restored? card, which loads your newest backup into a throwaway database every week and tells you whether it really works.

Full page: Backups.

Security

What it is for. Everything about who can get into this panel, and a record of what they did.

It holds your login name, your password, two-factor login, the list of browsers signed in right now, the secret panel link and entry code, the panel's own domain and certificate, the panel port, the login address list, the addresses you have blocked, the addresses currently locked out after failed logins, temporary logins, the public demo login, and the activity log.

Blocked addresses is the one to reach for when a single address is bothering your panel. It shuts that address out completely and at once — even a session signed in from it right now — and it covers the panel only, never your shop. The panel will not let you block your own address or 127.0.0.1, and sudo sixpanel block clear always lets an address back in from the server itself.

You will use it for the activity log when something changed and you do not know who changed it, and for handing a developer a login of their own instead of your password.

This cannot be undone — pressing Change entry code kills the old panel link immediately, on every device including the one you are using. Save the new link when it is shown.

Full pages: Security and Let someone else in.

Settings

What it is for. How the panel talks to you, and the few buttons that take something offline. Two tabs.

General holds:

• Language, timezone and alert email — the basics from the first-run wizard, changeable any time.
• Email alerts (SMTP) — give the panel a mailbox so it can write to you when a job fails, health turns red, the disk passes 90 per cent, someone is locked out after wrong passwords, or a certificate renewal fails. At most one email per topic every six hours.
• Automatic repairs — once a minute the panel checks the handful of things that take a site offline, and for a few of them it does the same repair you would do by hand. It is on by default. It never deletes anything, never restarts the database, and never starts a service you stopped yourself; each repair has a daily ceiling and a cooldown, and one it keeps failing at is abandoned rather than retried forever. Everything it does is on the activity log, and it emails you either way.
• Auto-tune — the install sized the database, the cache and the PHP workers for the hardware you had at the time. If you later give the server more memory or more processors, open this card and press Apply tuning. The affected services pick up the new sizes and one page load may feel slow while they do.

The suggested column is the same calculation the installer used, so on a server whose hardware has not changed it will usually say there is nothing to do. Where a suggestion is lower than what you are running now — because you removed a project, or because you raised a number yourself — the job says so in its log before it writes, since a later update will not put it back.

• Panel updates, Server security updates and Restart this server.

Cloudflare is the second tab. See Cloudflare.

You do not have to set up anything to keep the queue worker, the scheduler or the websocket service alive. Each one is a systemd unit with a restart policy, so it comes back after a crash and after a server restart. Do not add your own systemd units or Supervisor for them — two supervisors fighting over one process is a real way to break a working site.

There are three different updates on this server, and mixing them up is the most common misunderstanding in this product:

Restart this server is on the same tab. You have to confirm, and the site is offline for the whole restart.

Full pages: Update SixPanel itself and Server updates and restarts.

Project pages

Overview

What it is for. One project at a glance: its addresses, whether HTTPS is on, whether the app is installed, which services are up, the versions, the last deploy, the last backup, recent activity and the newest error lines from the application log.

You will use it for landing somewhere sensible after switching projects.

Deploys

What it is for. Getting 6ammart code onto the server and keeping it current.

The first screen answers three questions and nothing else: is my project live, which version is running, and what do I press. Depending on the state you see Install 6ammart Admin, Get the latest code, or a note that a domain has to be added first.

You can install from a git repository or by uploading the CodeCanyon zip — both are first-class, and the page offers them side by side. Below the first screen sit the customer website's own install and update, automatic deploys on git push (one webhook per repository, each with its own address and secret), the full deploy history with rollback, and the wizard for moving a project here from another server.

Every long action runs as a job with a live log you can watch.

Full pages: Install your 6ammart code, Deploy and update, Move an existing site here.

Domain & SSL

What it is for. Connecting names to this server and securing them.

There are three groups: Admin site (main domain), Customer website, and Live updates (websockets). Each name moves through three chips: added → pointed → secured.

Full page: Domains and HTTPS.

Database

What it is for. Size, table counts, the biggest tables, slow queries, a speed check, quick safety copies, and phpMyAdmin when you really need to look inside.

Make a backup now is the button to press before anything risky, and there is a download for a copy you keep yourself.

The Speed card is worth knowing about. Your project keeps shortcuts that let it find orders and products without reading through every row, and depending on where your 6ammart code came from some of them may never have been created. The card names the missing ones and builds them on one press. Safe to run while the site is busy; nothing is deleted.

Start phpMyAdmin runs the familiar database browser only while you need it. It is reachable only while you are logged in to the panel. Stop it when you are done.

This cannot be undone — the danger zone's import replaces everything. Orders and users that are not in the file you upload are gone.

Logs

What it is for. Every log this project writes, in one place, live: the application's own log, the web server, PHP, the queue worker, the scheduler, the websocket service and the customer website.

App errors is the first thing on it — the newest error lines from the 6ammart log, grouped, with how many times each has happened and when it was last seen. Empty is exactly how it should look.

You will use it for the moment something fails: the error usually explains itself here in one line.

App .env

What it is for. The 6ammart app's own settings file, made safe to edit.

Settings that only accept certain values get drop-down lists and switches, so a wrong value cannot be typed. Secrets stay hidden until you press Reveal (each reveal is written to the activity log). Settings this server manages — database, domain, websockets — are shown but locked.

Press save and the panel writes the file, rebuilds the settings cache and reloads PHP without dropping visitors.

The Health tab checks this file against the reference file your 6ammart code ships with, and names every setting that is missing or empty along with what it breaks. Payment keys and Firebase push keys are not in this file at all — 6ammart keeps those in its own admin panel.

Do not change APP_KEY. It locks every user out and makes encrypted data unreadable. The page marks that one, and a few others, as careful.

Some mail settings can also be changed inside 6ammart's own admin panel, and those win over this file. The page says so at the top.

SixPreflight

What it is for. SixPanel looks after the server. SixPreflight looks at your project's own settings — a missing payment key, a mailbox that cannot send, debug mode left on. This page shows what it found, worst first.

Full page: SixPreflight.

Advanced

What it is for. The tools you rarely need, on three tabs.

Files — a file manager for this project's code: the app and, if you run it, the customer website. Upload, edit, rename, move, compress, extract, change permissions, download, delete. Rows marked protected hold things the site cannot live without — uploads, settings files, anything under version control — and the server refuses to delete or rename those. The manager cannot see outside your project's folders: SixPanel's own settings, the database files and the panel's code are not reachable from here. That is a safety boundary, not a missing feature. Changes take effect immediately, and there is no undo.

If your project came from a git repository, the code files git looks after are read-only here: the panel refuses to save, rename, delete or re-permission them, and the refusal explains why and gives you the command that does the job properly. Editing one used to stop every later deploy of that project. Your .env, your customer uploads and the settings files 6ammart writes itself stay editable, and a project installed from a zip is unaffected — every file is editable there. See Deploy and update your code.

Cron — this project's timed tasks: 6ammart's own schedule, plus any job you add yourself. 6ammart needs its scheduler running every minute for subscriptions, reports and cleanups; this tab shows whether that is alive.

Services — the background programs that run this project, each one separately: PHP, the queue worker, the scheduler, the websocket service and the customer website. Start, stop or restart each one, and open its log. This tab also holds Live order updates — one button that sets up real-time order pings — and the websocket domain wizard. See Live order updates.

Do not stop the database or the cache on a live project. Those are shared by every project on the machine, and the page warns you.

How to check it worked

You have finished this page when you can answer, without looking: which page do I open to restart the web server, and which page tells me what is wrong?

(Advanced → Services. Server → Health.)

If it went wrong

• A page says not available on this panel yet — SixPanel is older than that feature. See Update SixPanel itself.
• A page will not load at all — check Server → Health, then When something is broken.