When building a self-hosted server control panel, security isn't just a checklist—it is the foundational architecture.
If you are hosting production workloads, databases, and customer sites on your own infrastructure using OrbixPanel (our Go, NestJS, and React web hosting platform), you need total clarity on how your system boundaries are enforced, where your secrets live, and how applications are isolated.
Today, we are diving into our newly published OrbixPanel Security Whitepaper (v1.1). Here is a look at the core security principles powering the platform.
🏗️ 1. The Shared Responsibility Model
Because OrbixPanel is self-hosted directly on your VPS or dedicated server, your data, credentials, and customer workloads never leave infrastructure you control. There is no middle-tier proxy or external SaaS holding your keys.
- What OrbixPanel Secures: Session integrity (JWT/2FA), role-based access control (RBAC), database encryption of sensitive OAuth credentials, agent task scoping, and automated TLS lifecycle management.
-
What You Secure: Host OS kernel patches, SSH access keys, firewall/security group rules, and your root master keys (
ENCRYPTION_KEYandJWT_SECRET).
🔒 2. Secrets Management & Zero-Token Git Sprawl
One of the biggest risks in modern server management is plaintext credential leakage or third-party token relaying.
- AES-256-GCM Vault: All sensitive recovery secrets—including OAuth client secrets, access tokens, and refresh tokens—are encrypted at rest using AES-256-GCM.
- Per-Secret Salts & IVs: A unique random 96-bit IV and a 128-bit salt are generated per secret, ensuring that identical plaintexts never yield identical ciphertexts.
- Direct Provider Exchange: When connecting GitHub, GitLab, or Bitbucket for 1-click deployments, the code-for-token exchange happens server-to-provider directly. OrbixPanel.com is never in the path.
📦 3. Process & Application Isolation
To ensure that a compromised application or rogue script cannot compromise the host server, OrbixPanel enforces strict systemd sandboxing:
-
Non-Root Control Plane: The NestJS API control plane runs under a dedicated, unprivileged service account (
PrivateTmp=true). -
Isolated Systemd Units: Every deployed application runs as its own unprivileged systemd unit (
www-data) with strict fork-bomb guards, task caps, and tamper-evident journald logging. -
Resource Ceilings: Built-in cgroup enforcement (
MemoryHigh/MemoryMaxandCPUQuota) guarantees that a memory-runaway app triggers an OOM kill specifically for that unit rather than crashing the entire host. -
Filesystem & Capability Hardening: App units execute with
NoNewPrivileges=true, an empty capability set, read-only system paths (ProtectSystem=full), and private temporary directories (PrivateTmp=true).
🤖 4. AI Copilot Privacy & Guardrails
OrbixPanel features an optional native AI Copilot to help diagnose server incidents and read system logs.
- 100% Local Inference Support: By pointing the panel to a local model running via Ollama, all prompts, logs, and system metrics stay on your server with zero external API calls or telemetry.
- Diagnostic-First Design: The copilot recommends potential fixes by inspecting local metrics rather than executing autonomous, destructive root shell commands.
📄 Read the Full Whitepaper
Security through obscurity is never a valid strategy. We believe in complete transparency about what our software does—and what is still on our roadmap.
You can read the complete, unedited OrbixPanel Security Whitepaper v1.1 directly on our site:
👉 orbixpanel.com/blog/orbixpanel-security-whitepaper
Have questions, feedback, or security contributions? Reach out to our engineering team at security@orbixpanel.com.
Top comments (0)