Your machine
Single-host control plane — not a multi-tenant reseller panel. State stays in your data directory.
YSK product · MIT open source · single-host control plane · v1.1.26
YSK Server
A free, open, single-host Linux control plane — web panel + CLI + API to manage hosting, files, mail, databases, DNS/SSL, and security on your VPS or bare metal.
CLI: ysk-server, default panel port 9287.
Free & openMIT · public use
Panel ≡ CLI ≡ APIOne core · scriptable
:9287HTTPS panel (self-signed first)
Honest opsroot + YSK_EXECUTE=1
One server you own
Not multi-tenant SaaS lock-in — panel, CLI, and API share one core. Host changes stay dry-run until you say so.
- OperatorBrowser / terminal / AI agent
- Panel · CLI · APISame commands and RBAC
- CoreSites · mail · files · defense
- Host executorDry-run by default · EXECUTE to apply
- Linux hostNginx / DB / mail / files
Operator (browser / terminal / AI agent)
│ Panel HTTPS :9287 · CLI ysk-server · API ysk_*
▼
Control plane (one core)
· projects / files / mail / databases / DNS·SSL / defense
· written to dataDir ≠ applied on the host
· 2FA · RBAC · audit
│
▼
Host executor (dry-run by default)
· real mutations: root + YSK_EXECUTE=1
│
▼
Your VPS / bare metal (Ubuntu 22.04 / 24.04 / 26.04)
Panel ≡ CLI ≡ API
One core, one capability set. Humans use the panel; scripts and agents use --json.
Honest ops
No fake success. Dangerous host operations stay dry-run until root + YSK_EXECUTE=1.
Full hosting stack
Projects, Nginx/Apache, SSL, databases, email, FTPS, Docker, validators (Beta), and a Defense center — one box.
| Area | Highlights |
|---|---|
| Sites | Projects, deploy, isolation, multi-runtime (Node / PHP / static…) |
| Files | Sandboxed manager, public shares, WebDAV, FTPS, BT Tracker / WebTorrent |
| Domains, mailboxes, DNS bundles, deliverability checks (no inbox guarantee) | |
| Data | MySQL / MariaDB / PostgreSQL / Redis |
| Edge | DNS, SSL, Nginx, Apache, CDN agents |
| Security | Defense center, SSH / 2FA, VPN, VNC, API keys |
| Containers | Docker engine; full-width inspect / logs; Compose YAML editor |
| Ops | Metrics, shared LogViewer, terminal, cron, backups, updates |
| Validators | L1 nodes (Beta); official GitHub version picker; no staking-yield promise |
| License | MIT · free for public use · CLI ysk-server v1.1.26 |
Hosting stack
Sites through defense on one machine — every domain has a matching CLI, and host changes can stay planned-only.
Sites & projects
- Create, deploy, stop, health, git deploy, OS isolation, and templates
- Multi-runtime: Node, PHP, static sites, and more
- Without
YSK_EXECUTE=1, deploy is plan-only — never a fake go-live - Deployed ≠ publicly published until Nginx / SSL apply
Files, shares & BitTorrent
- Sandboxed file manager (public or project root) — not unrestricted remote SSH browse
- Public shares: direct HTTP, BitTorrent / WebTorrent, or both
- WebDAV tokens; FTPS accounts (host apply needs EXECUTE)
- Built-in BT Tracker; browser WebTorrent uses a same-origin proxy, not a public CDN
- Mail domains, mailboxes, aliases, queue, optional SMTP relay
- DNS bundles and deliverability probes — honest scores, no global inbox claim
- PTR, port 25, and blacklists stay external (host / ISP)
- Install is not a one-click inbox-reputation guarantee
Databases
- MySQL / MariaDB, PostgreSQL, Redis
- Same create / list / apply flow in panel and CLI
- System-package apply is gated by EXECUTE
DNS, SSL, Nginx, Apache
- DNS and Let's Encrypt / panel TLS; first login uses a self-signed cert
- Nginx site console; Apache on its own page
- CDN agents bring edge nodes onto the same control plane
- Replace the self-signed panel cert with Let's Encrypt once you have a domain
Defense, VPN, VNC
- Defense center: firewall, fail2ban, ban / unban, presets
- SSH identities; panel and SSH 2FA
- VPN server / client; VNC accounts and share
- Missing host tools fail closed — never a silent success
Docker containers
- Docker engine on the host, on the same control plane
- Inspect and logs in full-width modals
- Compose YAML editor; ops stream can maximize
- Host apply still gated by
YSK_EXECUTE=1
Metrics, backups & updates
- Metrics, log center, terminal, cron, backups, updates
- Log tails share one LogViewer (validators, Docker, Logs, projects, PM2, Agents stderr, install stream)
- JSON displays use a collapsible viewer
- Readiness probe:
ysk-server readiness --json - Host Browse is panel UI; dangerous work still goes through EXECUTE
- Allowlisted AI tools /
asknever bypass dry-run
Validators · L1 nodes (Beta)
- Run L1 nodes on a host you own; this surface is marked Beta
- Live ↓ / ↑ traffic in the list; official GitHub version picker
- Staking credential cards; logs use the shared LogViewer
- No staking-yield promise; production install and hardening can be custom-build scope
Security & honesty
Writing a config is not applying it. Conservative by default; host mutations need an explicit gate.
Login, 2FA & API
- Bootstrap credentials print at install and live in
$dataDir/BOOTSTRAP-CREDENTIALS.txt - Change the password and enable 2FA after first login
- API keys use prefix
ysk_*; mutating routes default fail-closed RBAC - High-risk tools need an allowlist / approval — not an open root shell
written ≠ applied
- Managed configs usually land in
dataDirfirst (written) - Copy / reload onto system services needs
YSK_EXECUTE=1(applied) - Most host mutations also need root (useradd, apt, system Nginx…)
- CLI stays dry-run until
--execute/--apply
Three honest limits
- Install ≠ mail / DNS reputation. Inbox delivery depends on PTR, port 25, lists, and ops.
- Dangerous work is dry-run by default. Until
YSK_EXECUTE=1, we will not pretend the host changed. - The self-signed panel cert is for first login. Replace it with Let's Encrypt once you have a domain.
YSK Server is not multi-tenant reseller SaaS and does not guarantee global inbox delivery.
CLI & AI agents
What the panel can do, the CLI does on the same core. Agents should prefer --json.
CLI ysk-server
- Requires Node.js 22+; npm package
ysk-serverv1.1.26 (ships withysk-server-sharedandysk-server-core) ysk-server readiness --json— readiness probeysk-server help --locale en— help (13 UI locales; default zh-HK)export YSK_EXECUTE=1— required for real host mutations- Projects, mail, files, defense, backups, containers, and more stay aligned with the panel
- Full reference: GitHub
docs/cli/reference.md
For AI agents
ysk-server tools --json·ysk-server ask "list projects" --json- Tools stay on the allowlist and protection mode — they do not bypass EXECUTE
- Machine catalog:
docs/agent/commands.json - Project skill:
.grok/skills/ysk-server/SKILL.md
Screenshots & install
Ubuntu 22.04 / 24.04 / 26.04 recommended. Run as root. Other Linux: best-effort.
01
Dashboard
Service health, readiness, security, and apply status.
02
System tools
Identity, panel HTTPS, network, and storage.
Ready to use
- Run install.sh as root (or npm / git). Prefer
install.shon a fresh host - systemd starts
ysk-server - Open
https://<IP>:9287(accept the self-signed warning) - Log in with bootstrap credentials → change password · enable 2FA. Weak password
adminis rejected
curl -fsSL https://raw.githubusercontent.com/yanshekki/ysk-server/main/install.sh \
| bash -s -- --non-interactive
# or npm
npm install -g ysk-server
ysk-server setup
ysk-server serve
# uninstall (keep data)
sudo ./uninstall.sh --all --keep-data --yesNeed install, hardening, or a custom build? See Business — no prices on this page.
Open source to use. YSK can install or custom-build.
YSK Server is MIT-licensed and runs on a Linux host you own. YSK Limited can install and harden it, or custom-develop on ysk-server — no charge for using the open-source product; custom work is quoted in writing by scope.
Open source
You run one VPS or bare-metal machine yourself.
- Panel, CLI, and API share one core
install.shor npm, install yourself- No fee to use the open-source product
YSK install / custom build
For production go-live, white-label, or wiring existing systems.
- The host stays yours (or a VPS named in the contract) — not a multi-tenant cloud
- Hong Kong company contract; NDA if needed
- No custom prices on this page — written quote only
Firms with their own host
Skip shared-hosting panels; run sites, mail, and databases on your Ubuntu box.
Agencies
Install and white-label per client project, still one host and one control plane.
Teams that want CLI / agents
Wire Git, DNS, and backups into the same --json commands and permissions.
Harden before go-live
2FA, a trusted panel cert, firewall, and backups — executed in the written scope.
| Custom scope | What we can do |
|---|---|
| Install | Ubuntu 22.04 / 24.04 / 26.04, install.sh / systemd, first certificate, password change and 2FA |
| Harden | SSH, firewall, backups, trusted panel HTTPS |
| White-label | Panel name, mark, port, default locale |
| Workflow | Project / Git deploy templates, site isolation, Docker Compose samples, cron / backup policy |
| Integrations | Existing DNS, Git, backups, internal accounts, CLI / agent scripts |
| Mail / DNS help | PTR, port 25, checklists; still no global inbox guarantee |
| Validator nodes | In-product status is Beta; production install/hardening is contract scope — no staking-yield promise |
| After delivery | Docs, remote training, warranty window. Small changes can use outsourcing monthly tickets |
How an engagement runs
From first contact to warranty, every step has a written scope. Open-source use and install/custom work are billed separately. Host applies still need root + YSK_EXECUTE=1.
- EnquireWhatsApp or email: current host, sites / mail / databases to manage
- DiscoverRemote call: Ubuntu version, DNS, compliance, white-label / agents
- ProposeScope, timeline, deliverables (install vs custom modules); written quote
- ContractHong Kong company agreement; NDA if needed
- Install / buildysk-server as the base; staged demos; EXECUTE before host writes
- AcceptPanel login, 2FA, docs, training
- WarrantyFixes in the agreed window; then maintenance or monthly outsourcing
Deliverables (per contract)
- A working panel on your host or a VPS named in the contract
- Deploy and operations docs; remote training
- Defect fixes in the agreed warranty window
- Upstream core stays MIT; custom-module IP is defined in the contract
Honest limits: YSK Server is not a multi-tenant SaaS or reseller panel. Dangerous operations stay dry-run until root + YSK_EXECUTE=1. Install or paid install does not guarantee mail inbox delivery. We do not apply for domains or CA accounts, and we do not turn your host into a YSK cloud.
Business FAQ
Yes. MIT-licensed; install it yourself. YSK does not charge for using the open-source product. Install, hardening, and custom work are quoted by scope.
A fresh-host install and a white-label plus integrations plus validators job differ widely. Quotes are written. Small changes can use existing outsourcing monthly tickets; large work is a project.
No. It stays a single-host control plane. You own the machine, or the contract names the VPS. YSK does not offer a multi-tenant SaaS YSK Server.
No. We can help with PTR, port 25, and checklists; inbox delivery still depends on DNS reputation, blocklists, and ongoing operations.
FAQ
Yes. It is MIT-licensed and free for public use. Install, hardening, or a custom build: see Business — no prices on this page.
No. It is a single-host Linux control plane: one VPS or bare-metal machine you own. The panel, CLI, and API share the same core.
Ubuntu 22.04 / 24.04 / 26.04 is recommended. Other Linux is best-effort. Default panel port is 9287.
No. Install is not a mail or DNS reputation guarantee. Inbox delivery depends on PTR, port 25, blocklists, and operations.
Get started with YSK Server
MIT open source to install yourself; YSK Limited can install, harden, or custom-build on top.