aaPanel Manager

Self-hosted dashboard to manage your aaPanel servers from one place — backed by the most complete verified API documentation for aaPanel (Node.js projects, server monitoring, and more).

🌍 Language: English · Русский

---

Why this project

aaPanel (the international edition of the BT Panel) is a popular web control panel for Linux servers — but its HTTP API is only partly documented, and running several panels means logging into each one separately. This repository solves both problems:

1. The app — a self-hosted Next.js dashboard that manages many aaPanel servers through a secure backend proxy. The browser never talks to a panel directly; your api_sk secrets stay encrypted on your own server.
2. The docs — real, verified request/response examples for the aaPanel API, including the parts the official docs skip (Node.js project management in particular).

Key finding: a single permanent api_sk key, used at the panel root, covers both the official endpoints (/system?action=…) and the internal ones (/v2/project/nodejs/…) — so one stable key manages everything.

App features

• 🖥️ Multi-server — add / edit / remove aaPanel servers; api_sk encrypted at rest (AES-256-GCM)
• 🟢 Node.js projects — list, status, info, logs, start / stop / restart, create / modify / delete
• 📊 Live monitoring — CPU / RAM / disk with auto-refresh (in-process polling + Server-Sent Events)
• 👥 Users & roles — admin / viewer, user management, self password change
• 🔒 Secure by design — backend proxy; secrets never reach the browser; audit log of every change
• 🌐 i18n & themes — English / Russian, light / dark

Status: actively developed. Multi-server, Node.js projects, monitoring and user management work today. Databases, files, FTP, cron and firewall are already covered in the API docs and are on the roadmap for the app.

Screenshots

Servers (dark theme)	Add a server
Users & roles	Versions & updates

Tech stack

Next.js 16 (App Router · React Server Components · Server Actions) · React 19 · TypeScript · Prisma 7 + PostgreSQL · Auth.js v5 · Tailwind v4 · Docker.

Quick start (development)

Requirements: Node 24, pnpm 11 (corepack enable), PostgreSQL.

git clone https://github.com/vsgrade/aapanel-manager.git
cd aapanel-manager/web
pnpm install
cp .env.example .env          # set DATABASE_URL, AUTH_SECRET, APP_ENCRYPTION_KEY
pnpm prisma migrate deploy
pnpm dev                      # http://localhost:3000

For production (Docker images, releasing by tag, self-update) see docs/RELEASING.md.

API documentation

Document	Contents
📖 Overview	What the aaPanel API is; two auth schemes; the discover→execute recipe
🔑 Authentication	api_sk key (recommended) vs session; request signing; SSL; security
🟢 Node.js Projects	list, info, scripts, versions, start/stop — with real responses
🌐 Websites (PHP/WP)	list, create, delete sites
🗄️ Databases	MySQL + PostgreSQL CRUD (each engine has its own API)
📁 Files (File Manager)	list/create/edit/move/copy/permissions/archive/upload/remote-download/delete + recycle bin
📂 FTP	FTP users: list, create, change password, enable/disable, delete
⏱️ Cron (Scheduler)	tasks: list, create, run now, logs, enable/disable, delete
🛡️ Firewall (Security)	read firewall state: status, summary, port rules (writes via recipe)
📊 Server Monitoring	CPU / RAM / disk (GetSystemTotal, GetDiskInfo)

Code example

A ready-to-use TypeScript wrapper (api_sk or session auth): examples/javascript/aapanel-client.ts.

import { AaPanelClient } from "./examples/javascript/aapanel-client";

const client = new AaPanelClient({
  baseUrl: process.env.AAPANEL_BASE_URL!,                  // https://<server>:<port> (root!)
  auth: { mode: "apiKey", apiSk: process.env.AAPANEL_API_SK! },
  insecureTLS: true,                                       // self-signed cert
});

await client.listProjects();        // names, status (running/stopped), CPU/RAM
await client.getSystemTotal();      // server CPU / RAM / cores
await client.startProject("myapp");

⚠️ Server-side only. api_sk grants full server access — never expose it in browser code. See Authentication → Security.

The recipe (aaPanel's official approach)

Undocumented feature? Open the panel → DevTools (Network) → click it → inspect the request → replay the same path and body with api_sk auth. See Authentication.

Roadmap

API documentation

• Node.js project management (create, list, info, scripts, versions, start/stop/restart, modify, delete)
• Websites (PHP/WP): list, create, delete
• Databases (MySQL + PostgreSQL CRUD)
• Files / File Manager (CRUD, permissions, archive, upload, remote download, recycle bin)
• FTP users (CRUD, password, enable/disable)
• Cron / Task Scheduler (CRUD, run now, logs, enable/disable)
• Firewall (read state: status, summary, port rules — writes via recipe)
• Server monitoring (CPU/RAM/disk)
• Verified api_sk covers internal endpoints too
• More modules (SSL, domains, backups)

App

• Multi-server management (encrypted api_sk, test connection, audit log)
• Node.js projects (CRUD + control + logs)
• Live monitoring (in-process polling + SSE)
• Users & roles, authentication
• Version display + update settings
• Databases / Files / FTP / Cron / Firewall sections in the app
• Update / rollback actions

Disclaimer

Unofficial documentation. Verified on aaPanel v8; behavior may change between versions — verify against your own panel. Official docs: aapanel.com/docs.

License

MIT