Self-hosted infrastructure stack
TulioCP is an open-source Linux server control panel for hosting, DNS, mail, and databases. TulioBilling is its native billing and client-management companion. No per-account license fees, no vendor lock-in — the code is GPL-3.0 and Apache-2.0, and it runs on infrastructure you already control.
Two products, one lifecycle
The control panel underneath the infrastructure you already run.
A GPL-3.0 fork of HestiaCP, itself descended from VestaCP. It runs Apache and nginx, five PHP branches side by side, Bind for DNS, Exim and Dovecot for mail, and MariaDB or PostgreSQL — administered from a web panel or a 500-command CLI.
Explore the panel →Commerce and provisioning, wired directly into the panel.
An Apache-2.0 fork of FOSSBilling, descended from BoxBilling. It handles invoicing, orders, and client management, and ships a native TulioCP server-manager module so a paid order provisions a real hosting account without a middle integration layer.
Explore billing →Verified integration
TulioBilling's server-manager module talks to the panel's access-key–authenticated API. These seven actions are implemented and were verified against a live instance — not aspirational roadmap items.
Access-key authenticated connection test against the panel API
Provisions the system user and primary domain in one pass
Locks the account without deleting data
Restores access to a suspended account
Reassigns hosting plan limits on the panel side
Rotates panel credentials from the billing order
Tears down the account when a service is terminated
What operators actually do
Apache and nginx with PHP-FPM across five major versions on one box. DNS clustering, mail with anti-spam and anti-virus, MariaDB and PostgreSQL, and one-click installers for WordPress, Laravel, Nextcloud, and eight more stacks.
See what's under host →iptables and fail2ban brute-force detection out of the box, SSH/SFTP chroot jails, two-factor auth on the admin panel, and wildcard Let's Encrypt across web and mail domains.
See what's under secure →Every admin action has a v-* CLI and API equivalent — over 500 commands. Cron jobs, access keys, and a REST API mean the panel is scriptable, not just clickable.
See what's under automate →Automated backups to SFTP, FTP, or 50+ cloud providers via Rclone, plus Restic-based backup and restore for full-user, database, and file-level recovery.
See what's under recover →Debian 13 packages
Debian 13 packages resolve with a public apt update today — no access request needed. A complete public install path isn't available yet, since the installer and both product source repositories are still private preview.