<p align="right">
  <a href="README.ru.md"><img alt="Читать по-русски" src="https://img.shields.io/badge/%F0%9F%87%B7%F0%9F%87%BA%20%D0%A7%D0%B8%D1%82%D0%B0%D1%82%D1%8C%20%D0%BF%D0%BE--%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%B8-2867c4?style=for-the-badge"></a>
</p>

# HostinPL 5.6 · Game Hosting Control Panel · REDL build

**Base: HostinPL 5.6** (original by Samir Shelenko and Alexander Zemlyanoy, written for Debian 9 /
PHP 7.0) — brought back to life on a current stack, audited and documented. Version numbering follows
the original: this is 5.6, our changes sit on top of it.

> 🇷🇺 **[Русская версия этого описания → README.ru.md](README.ru.md)**

A control panel for selling and managing game servers: SA-MP, CRMP, MTA, Minecraft, CS 1.6, CS:S, RAGE:MP.
Client area, ticket system, payment gateways, automated game server deployment onto game nodes.

**Maintained and developed with [REDL.IO](https://redl.io) — AI-powered hosting.**

This build is a modernisation of the HostinPL 5.6 panel. The original was written for Debian 9 and PHP 7.0
(both end-of-life since 2022) and simply would not start on a current server. Here it runs on an up-to-date
stack, the vulnerabilities we found are fixed, and one-click installers are included.

---

## ⚠️ Legal status — read this before installing

The original **HostinPL 5.6 is a commercial, proprietary product**. Its authors are Samir Shelenko and
Alexander Zemlyanoy. The file `panel/LICENSE` is their licence, and it grants no permission to
redistribute or modify the software.

The sources this build is based on were circulated as "nulled" — a cracked copy of a paid product,
published without the authors' consent. We are not hiding that or rewriting history: the authors'
copyright headers are preserved throughout the code and were deliberately not removed.

What this means in practice:

* using it for commercial hosting infringes copyright, with all the risks that follow;
* the legal route is to buy a licence from the authors, or use an open-source alternative
  (Pterodactyl, Pelican);
* this repository is only useful for studying the code, auditing it, and internal experiments.

Responsibility for use rests with whoever installs it.

---

## What is in this repository

| Path | What it is |
|------|------------|
| `install-panel.sh` | One-click panel install (nginx + PHP 8 + MariaDB + scheduler + admin user) |
| `install-node.sh` | One-click game node install (Docker + image + directories + SSH/FTP + SteamCMD) |
| `panel/` | Panel source code with all of our changes |
| `docker/Dockerfile` | Modern game server image (Debian 12; the original stretch-based one no longer builds) |
| `docker/Dockerfile.original-stretch` | The original Dockerfile, kept for comparison |
| [`CHANGES.en.md`](CHANGES.en.md) | Full list of differences from the original |
| [`SECURITY.en.md`](SECURITY.en.md) | Audit results: vulnerabilities, backdoors, what was fixed |
| [`GUIDE.en.md`](GUIDE.en.md) | Complete guide: install, connecting a node, configuration, maintenance |

---

## Screenshots

Every section of the panel, captured in both languages — 38 screenshots per language:

| | |
|---|---|
| [![Login](docs/screenshots/en/00-login.png)](docs/screenshots/en/00-login.png)<br>Login page | [![Client area](docs/screenshots/en/01-cabinet.png)](docs/screenshots/en/01-cabinet.png)<br>Client area |
| [![Order a server](docs/screenshots/en/03-server-order.png)](docs/screenshots/en/03-server-order.png)<br>Ordering a game server | [![Admin dashboard](docs/screenshots/en/11-admin-dashboard.png)](docs/screenshots/en/11-admin-dashboard.png)<br>Admin dashboard |
| [![Statistics](docs/screenshots/en/24-admin-statistics.png)](docs/screenshots/en/24-admin-statistics.png)<br>Statistics | [![Captcha switch](docs/screenshots/en/28-admin-settings-other-captcha.png)](docs/screenshots/en/28-admin-settings-other-captcha.png)<br>The captcha switch in the admin area |

**Full galleries:** [🇬🇧 English](docs/screenshots/README.md) · [🇷🇺 Russian](docs/screenshots/README.ru.md)

---

## Supported games

Eleven games ship in the panel's catalogue. Each one has its own query driver (so the panel can read
online player counts and the map), its own port and slot ranges, and its own default resource limits.

| Game | Code | Query protocol | Slots | Port range |
|------|------|----------------|-------|------------|
| San Andreas: Multiplayer 0.3.7 | `samp` | samp | 50–1000 | 7777–9999 |
| Criminal Russia: Multiplayer 0.3e | `crmp` | samp | 50–500 | 3335–7000 |
| Criminal Russia: Multiplayer 0.3.7 | `crmp037` | samp | 50–500 | 3335–7000 |
| United Multiplayer | `unit` | samp | 50–500 | 7777–9999 |
| Multi Theft Auto | `mta` | mtasa | 50–1000 | 25020–80520 |
| Minecraft (Java) | `mine` | mine | 10–100 | 12410–55641 |
| Minecraft: Pocket Edition | `mcpe` | mine | 10–100 | 12410–55641 |
| Counter-Strike 1.6 | `cs` | valve | 6–32 | 27016–30550 |
| Counter-Strike: Source | `css` | valve | 6–32 | 27016–30550 |
| Counter-Strike: Global Offensive | `csgo` | valve | 6–32 | 27016–30550 |
| GTA V: RAGE MP | `ragemp` | ragemp | 50–500 | 22000–25000 |

The client can switch the server core in one click, without ordering a new server:

* **Minecraft (Java)** — CraftBukkit 1.7.10 / 1.8 / 1.13.2, Spigot 1.7.10 / 1.9.4 / 1.16.1, Vanilla 1.7.10 / 1.15.1
* **Minecraft: PE** — Genisys and Nukkit builds
* **Counter-Strike** — a clean build from SteamCMD, plus the VAC anti-cheat toggle and FastDL
* **RAGE:MP** — NodeJS modules are installed from the server management page

Every game is **disabled** in a fresh install (`Admin → Games → status`) — switch on the ones you
have a node and server files for. The game files themselves are not shipped, see
"What does not work" below.

---

## Requirements

**For the panel** (the website and database — Docker is not needed):

* Ubuntu 24.04 / 22.04 or Debian 12 / 13
* 1 core, 1 GB RAM, 10 GB disk
* Any VPS will do, including container-based ones (LXC/OpenVZ)

**For a game node** (this is where the game servers actually run):

* Ubuntu 24.04 / 22.04 or Debian 12 / 13
* 2 cores, 2 GB RAM, 100 GB disk (budget 1–2 GB per game server)
* **Full kernel access is mandatory: a dedicated server or KVM.**
  The panel creates a separate Docker container for every game server, and Docker does not start
  inside a container-based VPS (LXC/OpenVZ) — the kernel forbids nested namespaces. The installer
  checks for this and tells you plainly if the machine is unsuitable.

The panel and a node can share one machine, but separating them is better: keep the website on a
cheap VPS and put the games on real hardware.

---

## One-click install

### Panel

```bash
apt-get update && apt-get install -y git
git clone https://github.com/RedlHosting/redl-gamepanel.git
cd redl-gamepanel
sudo bash install-panel.sh
```

The script asks only for the panel address, the administrator e-mail and password — everything else
is automatic: it installs nginx, PHP 8 and MariaDB, creates a database with a random password, loads
the schema, writes the configuration and the scheduler, sets up an autostart watchdog, creates the
administrator, and verifies that the login page actually opens.

To run the panel on a non-standard port, set it via an environment variable:

```bash
sudo PORT=8095 bash install-panel.sh
```

### Game node

```bash
git clone https://github.com/RedlHosting/redl-gamepanel.git
cd redl-gamepanel
sudo bash install-node.sh
```

At the end the script prints the IP, SSH login and password — enter those in the panel under
**Admin → Locations → Add location**. See [GUIDE.en.md](GUIDE.en.md) for details.

---

## What already works

* Login, registration, password recovery — **without a captcha** (it is enabled from the admin area, see below)
* Client area: balance, invoices, transfers, bonuses, promo codes, referral system
* Ticket system with categories and attachments
* Admin area: users, servers, locations, games, news, statistics, promo codes, settings
* System check (Admin → System check) — every item green
* Payment gateways: Unitpay, Enot, AnyPay, LiteKassa, RoboKassa, FreeKassa, YooKassa, QIWI
  (credentials are entered in the admin area; we did not test any gateway with a real payment)
* Web hosting (the WEB section) — via ISPmanager on a separate machine
* Scheduler: statistics, tasks, automatic suspension of expired servers
* **Two interface languages: Russian and English**, with automatic detection from the browser
  and a switcher in the header (see [GUIDE.en.md](GUIDE.en.md))

### The captcha is off and is enabled with a single switch

By default there is no captcha anywhere — not on login, registration or tickets; the field simply
does not exist. When you need it:

1. Get reCAPTCHA v2 ("I'm not a robot") keys at [google.com/recaptcha](https://www.google.com/recaptcha/admin)
2. Go to **Admin → Settings → Other settings → "Bot protection (reCAPTCHA v2)"**
3. Paste the Site key and the Secret key, switch it to "Enabled", save

The order matters: keys first, switch second — otherwise the form shows
"ERROR for site owner: Invalid site key" and nobody can log in.

## What does not work

* **Creating game servers on a container-based VPS.** You need a node with real Docker
  (dedicated or KVM) — see Requirements for why.
* **Game server files are not included.** The original installer downloaded them from third-party
  sites over plain HTTP with no signature checking, so we removed that (see [SECURITY.en.md](SECURITY.en.md)).
  You need to place the files into `/home/cp/gameservers/files/<game_code>/` yourself.
* **Payments and VK login** require your own keys and merchant accounts.

---

## Planned next

1. **More games — by request.** The eleven games above are the ones the panel came with. Adding a
   game means one row in the catalogue plus a query driver and server files, so the list is meant to
   grow: tell us which game you want and it goes into the queue. Rust, ARK, Terraria, Valheim,
   Garry's Mod, Team Fortress 2, FiveM and Minecraft: Bedrock are the obvious candidates.
2. **Modern payment gateways: PayPal, Stripe and Lava.** Right now the panel only has the Russian
   gateways of its original author (Unitpay, Enot, AnyPay, LiteKassa, RoboKassa, FreeKassa, YooKassa,
   QIWI). PayPal and Stripe open up card payments worldwide, Lava covers Russia and the CIS —
   together they let the panel take money outside a single region.

Have a different priority? Open an issue in the repository.

---

## Differences from the original, in brief

* Runs on **PHP 8.4** instead of PHP 7.0 — a walk through all 21 sections of the panel produces
  zero errors in the log
* **The installer was rewritten from scratch**: the original overwrote `/etc/apt/sources.list` with
  Debian 9 repositories and broke apt on any current system
* **Two pre-authentication SQL injections were fixed**, and plaintext password storage was removed
* The captcha became manageable from the admin area
* Russian and English interface with automatic language detection
* The scheduler and autostart work even where systemd is absent

The full list is in [CHANGES.en.md](CHANGES.en.md) and [SECURITY.en.md](SECURITY.en.md).

---

**Maintained and developed with [REDL.IO](https://redl.io) — AI-powered hosting.**
