Русский · English

Game Hosting Control Panel · REDL build

A control panel for selling and managing game servers: SA-MP, CRMP, MTA, Minecraft, CS 1.6, CS:S, RAGE:MP. Client area, ticket system, payment gateways, automated game server deployment onto game nodes.

Maintained and developed with REDL.IO — AI-powered hosting.

This build is a modernisation of the HostinPL 5.6 panel. The original was written for Debian 9 and PHP 7.0 (both end-of-life since 2022) and simply would not start on a current server. Here it runs on an up-to-date stack, the vulnerabilities we found are fixed, and one-click installers are included.

---

⚠️ Legal status — read this before installing

The original HostinPL 5.6 is a commercial, proprietary product. Its authors are Samir Shelenko and Alexander Zemlyanoy. The file panel/LICENSE is their licence, and it grants no permission to redistribute or modify the software.

The sources this build is based on were circulated as "nulled" — a cracked copy of a paid product, published without the authors' consent. We are not hiding that or rewriting history: the authors' copyright headers are preserved throughout the code and were deliberately not removed.

What this means in practice:

• using it for commercial hosting infringes copyright, with all the risks that follow;
• the legal route is to buy a licence from the authors, or use an open-source alternative (Pterodactyl, Pelican);
• this repository is only useful for studying the code, auditing it, and internal experiments.

Responsibility for use rests with whoever installs it.

---

What is in this repository

Path	What it is
install-panel.sh	One-click panel install (nginx + PHP 8 + MariaDB + scheduler + admin user)
install-node.sh	One-click game node install (Docker + image + directories + SSH/FTP + SteamCMD)
panel/	Panel source code with all of our changes
docker/Dockerfile	Modern game server image (Debian 12; the original stretch-based one no longer builds)
docker/Dockerfile.original-stretch	The original Dockerfile, kept for comparison
CHANGES.en.md	Full list of differences from the original
SECURITY.en.md	Audit results: vulnerabilities, backdoors, what was fixed
GUIDE.en.md	Complete guide: install, connecting a node, configuration, maintenance

---

Requirements

For the panel (the website and database — Docker is not needed):

• Ubuntu 24.04 / 22.04 or Debian 12 / 13
• 1 core, 1 GB RAM, 10 GB disk
• Any VPS will do, including container-based ones (LXC/OpenVZ)

For a game node (this is where the game servers actually run):

• Ubuntu 24.04 / 22.04 or Debian 12 / 13
• 2 cores, 2 GB RAM, 100 GB disk (budget 1–2 GB per game server)
• Full kernel access is mandatory: a dedicated server or KVM. The panel creates a separate Docker container for every game server, and Docker does not start inside a container-based VPS (LXC/OpenVZ) — the kernel forbids nested namespaces. The installer checks for this and tells you plainly if the machine is unsuitable.

The panel and a node can share one machine, but separating them is better: keep the website on a cheap VPS and put the games on real hardware.

---

One-click install

Panel

apt-get update && apt-get install -y git
git clone https://github.com/RedlHosting/redl-gamepanel.git
cd redl-gamepanel
sudo bash install-panel.sh

The script asks only for the panel address, the administrator e-mail and password — everything else is automatic: it installs nginx, PHP 8 and MariaDB, creates a database with a random password, loads the schema, writes the configuration and the scheduler, sets up an autostart watchdog, creates the administrator, and verifies that the login page actually opens.

To run the panel on a non-standard port, set it via an environment variable:

sudo PORT=8095 bash install-panel.sh

Game node

git clone https://github.com/RedlHosting/redl-gamepanel.git
cd redl-gamepanel
sudo bash install-node.sh

At the end the script prints the IP, SSH login and password — enter those in the panel under Admin → Locations → Add location. See GUIDE.en.md for details.

---

What already works

• Login, registration, password recovery — without a captcha (it is enabled from the admin area, see below)
• Client area: balance, invoices, transfers, bonuses, promo codes, referral system
• Ticket system with categories and attachments
• Admin area: users, servers, locations, games, news, statistics, promo codes, settings
• System check (Admin → System check) — every item green
• Payment gateways: Unitpay, Enot, AnyPay, LiteKassa, RoboKassa, FreeKassa, YooKassa, QIWI (credentials are entered in the admin area; we did not test any gateway with a real payment)
• Web hosting (the WEB section) — via ISPmanager on a separate machine
• Scheduler: statistics, tasks, automatic suspension of expired servers
• Two interface languages: Russian and English, with automatic detection from the browser and a switcher in the header (see GUIDE.en.md)

The captcha is off and is enabled with a single switch

By default there is no captcha anywhere — not on login, registration or tickets; the field simply does not exist. When you need it:

1. Get reCAPTCHA v2 ("I'm not a robot") keys at google.com/recaptcha
2. Go to Admin → Settings → Other settings → "Bot protection (reCAPTCHA v2)"
3. Paste the Site key and the Secret key, switch it to "Enabled", save

The order matters: keys first, switch second — otherwise the form shows "ERROR for site owner: Invalid site key" and nobody can log in.

What does not work

• Creating game servers on a container-based VPS. You need a node with real Docker (dedicated or KVM) — see Requirements for why.
• Game server files are not included. The original installer downloaded them from third-party sites over plain HTTP with no signature checking, so we removed that (see SECURITY.en.md). You need to place the files into /home/cp/gameservers/files/<game_code>/ yourself.
• Payments and VK login require your own keys and merchant accounts.

---

Differences from the original, in brief

• Runs on PHP 8.4 instead of PHP 7.0 — a walk through all 21 sections of the panel produces zero errors in the log
• The installer was rewritten from scratch: the original overwrote /etc/apt/sources.list with Debian 9 repositories and broke apt on any current system
• Two pre-authentication SQL injections were fixed, and plaintext password storage was removed
• The captcha became manageable from the admin area
• Russian and English interface with automatic language detection
• The scheduler and autostart work even where systemd is absent

The full list is in CHANGES.en.md and SECURITY.en.md.

---

Maintained and developed with REDL.IO — AI-powered hosting.