Instance

Admin → Instance shows the server at a glance:

• Hostname, public IP, operating system, kernel, architecture, CPU (cores, model, clock speed), memory, disk size and uptime.
• Live CPU, memory, disk and load (refreshed every 10 seconds) with absolute values — for example 3.3 GB / 8.0 GB and load for 5 and 15 minutes. Hover or focus a card for more: free memory and disk, the CPU model and load per core.
• Status of nginx, the database server, Redis, cron and each PHP-FPM version — with a Restart button.

Metrics history

A scheduled task records CPU, memory, disk and load every minute. The dashboard charts the last hour, 24 hours, 7 days, 30 days or 90 days; hover the chart (or focus it and use the arrow keys) to read the time and value of each sample. Minute samples are kept for 7 days; every finished hour is also stored as an average for 90 days, which the 30- and 90-day ranges use to show trends such as a disk that fills up a little every week.

Settings

• Panel domain — point an A record (e.g. panel.example.com) to the server, enter it and save. XAXA issues a Let's Encrypt certificate and the panel opens at https://panel.example.com (port 443) without a browser warning; the IP address keeps working on port 8443. The certificate renews automatically. Leave the field empty to go back to the self-signed certificate. Behind Cloudflare's proxy, tick Skip DNS check. The panel domain cannot be the domain or alias of a site, and no site can take it afterwards.
• Timezone — pick the zone from the list (each shows its current UTC offset); sets the server's timezone (timedatectl). Cron jobs, logs, the backup time and the times shown in the panel follow it; the panel keeps storing times in UTC. The change applies at once: cron restarts, PHP-FPM pools reload and queue workers pick it up after their current job. No server restart is needed.

Runtimes

The Runtimes card lists PHP (8.2–8.5), Node.js (20, 22, 24, 26) and Python (3.10–3.14) versions. Installed versions are green; click a version to install it in the background. A PHP version is installed the same way as xaxa php-install (from the signed release package); sites can switch to it under Settings → PHP once it is ready, and its patch releases come with the system package updates. Node.js comes from nodejs.org and is verified against the official SHASUMS256.txt; Python is installed with uv. Node.js 20, 22 and 24 (the default for new sites) and Python 3.12 are installed by default.

Node.js shows the exact release (for example 24.11.0); Python shows the major.minor version the sites select (3.12) and the panel installs its latest patch. Every Sunday at 04:30 the panel installs the latest patch release of each installed version through the same verified path; click the refresh icon next to a version to update it now. Running apps keep the old binary until their next restart or deploy.

PHP extensions

Every PHP version comes with bcmath, curl, gd, imagick, intl, mbstring, mysql, opcache, redis, soap, sqlite3, xml and zip. More can be added per version: amqp, apcu, bz2, ds, gmp, gnupg, grpc, igbinary, imap, ldap, mailparse, maxminddb, memcached, mongodb, msgpack, pgsql, protobuf, snmp, ssh2, tidy, uuid, vips and yaml.

• Click a PHP version in the Runtimes card. The dialog lists every extension: the installed and included ones are ticked and locked, the others can be ticked.
• Install selected installs the ticked ones together, from the same package repository as PHP, in the background. The version shows extensions… meanwhile and you get one notice when they are ready.
• PHP-FPM of that version is tested with the new extensions before it reloads. If it does not start, the extensions are removed again and the error is shown, so a broken extension never takes the sites down.
• × next to an added extension (at the bottom of the dialog) removes it after a second click. Sites on that version that use it stop working until it is installed again. An extension that an included one needs (redis needs igbinary) is not removed.
• Adding or removing an extension reloads PHP-FPM of that version: requests in progress finish first.

Panel health

The Panel card shows both queue workers — xaxa-queue for quick jobs and xaxa-queue-long for backups, restores, clones, app installs, certificates and runtime installs, so a long backup never delays a deploy — and the scheduler, when the scheduler last ran and how many background jobs failed (with a Retry button). If the scheduler stops, backups, monitoring and cleanup stop too — the dashboard shows a warning.

Redis

Every site can get its own Redis user (Site → Databases → Redis). Require a password turns off password-less access, so sites without their own user can no longer read or delete each other's keys. New servers start with a password required; a server updated from an older version stays open (sites may already use Redis) until you switch it here.

Mail

The Mail card configures one SMTP relay (host, port, username, password, from address) for two things:

• Panel alerts — with Email admins about problems on, every admin is emailed when a site goes down (two failed checks in a row, so a single slow response sends nothing) or comes back, a certificate expires within 14 days (30 days for imported certificates), a backup fails or is overdue (no successful backup for twice the site's backup interval, at least 6 hours past it: the backup worker or scheduler may have stopped) or the root disk passes 90% (each alert is rate-limited). A failed deploy alerts the admins and whoever started it. Every alert ends with the server name, the time in the panel time zone and the panel address, so with several servers you know which one to open.
• Site email — msmtp-mta replaces /usr/sbin/sendmail, so PHP's mail(), WordPress and cron output go through the same relay.

Site users can read /etc/msmtprc, so a hacked site would hold the login the sites send with. Fill in Site login to give the sites a login of their own: the panel keeps sending its alerts with the main login, which then never leaves the panel. Without a site login the sites use the main one, so it should be a credential that can only send mail. Port 465 uses implicit TLS, any other port STARTTLS. Send test email sends to your own address and shows the SMTP error if it fails. Clear the host and save to turn mail off.

Alerts also cover sites that return server errors, sites over their disk alert and new XAXA versions.

Alert webhook

The Alert webhook card posts alerts as JSON to an HTTPS URL, with or without SMTP. The body has event (site, certificate, backup, deploy, disk, signin, token or test), text (Slack, Mattermost, Telegram), content (Discord), subject and body, so most chat webhooks work as they are. For Telegram use https://api.telegram.org/bot<token>/sendMessage?chat_id=<chat id>.

• The URL holds a token, so it is stored encrypted and the card shows only its host. Leave the field empty to keep it; Remove turns the webhook off.
• Alerts to send picks the kinds of alerts the webhook gets. Email is not affected.
• Sign requests adds X-Xaxa-Signature: sha256=<hex>, the HMAC-SHA256 of the raw body. The secret is shown once when you turn it on; turn it off and on again for a new one.
• The card shows the last delivery and its result. Send test alert shows the error, with the usual cause, if the endpoint does not accept it.
• An endpoint has 5 seconds to answer, so a slow one cannot hold up site monitoring.

Cloudflare

With an API token in the Cloudflare card, the panel creates a site's DNS record and switches its proxy for you (see SSL → Cloudflare DNS). Create the token in Cloudflare under My Profile → API Tokens → Create Token with Zone → Zone: Read and Zone → DNS: Edit, limited to your zones. On save the panel checks it with Cloudflare and lists the zones it sees; it is stored encrypted and never shown again. Only admins use it. Remove leaves the records in Cloudflare as they are.

Update notice

The panel does not look for new versions by itself: Check for updates in the Updates card asks the website, and when a newer one is out the card shows Update now, which runs the update in the background and shows its log; over SSH, xaxa update does the same.

Add a PHP version

xaxa php-install 8.2

The new version appears in site settings immediately.