Your machine
Single-host control plane — not a multi-tenant reseller panel. State stays in your data directory.
YSK product · MIT open source · single-host control plane
YSK Server
A free, open, single-host Linux control plane — web panel + CLI + API to manage hosting, files, mail, databases, DNS/SSL, and security on your VPS or bare metal.
CLI: ysk-server, default panel port 9287.
Free & openMIT · public use
Panel ≡ CLI ≡ APIOne core · scriptable
:9287HTTPS panel (self-signed first)
Honest opsroot + YSK_EXECUTE=1
One server you own
Not multi-tenant SaaS lock-in — panel, CLI, and API share one core. Host changes stay dry-run until you say so.
- OperatorBrowser / terminal / AI agent
- Panel · CLI · APISame commands and RBAC
- CoreSites · mail · files · defense
- Host executorDry-run by default · EXECUTE to apply
- Linux hostNginx / DB / mail / files
Operator (browser / terminal / AI agent)
│ Panel HTTPS :9287 · CLI ysk-server · API ysk_*
▼
Control plane (one core)
· projects / files / mail / databases / DNS·SSL / defense
· written to dataDir ≠ applied on the host
· 2FA · RBAC · audit
│
▼
Host executor (dry-run by default)
· real mutations: root + YSK_EXECUTE=1
│
▼
Your VPS / bare metal (Ubuntu 22.04 / 24.04)
Panel ≡ CLI ≡ API
One core, one capability set. Humans use the panel; scripts and agents use --json.
Honest ops
No fake success. Dangerous host operations stay dry-run until root + YSK_EXECUTE=1.
Full hosting stack
Projects, Nginx/Apache, SSL, databases, email, FTP, BT shares, and a Defense center — one box.
| Area | Highlights |
|---|---|
| Sites | Projects, deploy, isolation, multi-runtime (Node / PHP / static…) |
| Files | Sandboxed manager, public shares, WebDAV, FTP, BT Tracker / WebTorrent |
| Domains, mailboxes, DNS bundles, deliverability checks (no inbox guarantee) | |
| Data | MySQL / MariaDB / PostgreSQL / Redis |
| Edge | DNS, SSL, Nginx, Apache, CDN agents |
| Security | Defense center, SSH / 2FA, VPN, VNC, API keys |
| Ops | Metrics, logs, terminal, cron, backups, updates |
| License | MIT · free for public use · CLI ysk-server |
Hosting stack
Sites through defense on one machine — every domain has a matching CLI, and host changes can stay planned-only.
Sites & projects
- Create, deploy, stop, health, git deploy, OS isolation, and templates
- Multi-runtime: Node, PHP, static sites, and more
- Without
YSK_EXECUTE=1, deploy is plan-only — never a fake go-live - Deployed ≠ publicly published until Nginx / SSL apply
Files, shares & BitTorrent
- Sandboxed file manager (public or project root) — not unrestricted remote SSH browse
- Public shares: direct HTTP, BitTorrent / WebTorrent, or both
- WebDAV tokens; FTPS accounts (host apply needs EXECUTE)
- Built-in BT Tracker; browser WebTorrent uses a same-origin proxy, not a public CDN
- Mail domains, mailboxes, aliases, queue, optional SMTP relay
- DNS bundles and deliverability probes — honest scores, no global inbox claim
- PTR, port 25, and blacklists stay external (host / ISP)
- Install is not a one-click inbox-reputation guarantee
Databases
- MySQL / MariaDB, PostgreSQL, Redis
- Same create / list / apply flow in panel and CLI
- System-package apply is gated by EXECUTE
DNS, SSL, Nginx, Apache
- DNS and Let's Encrypt / panel TLS; first login uses a self-signed cert
- Nginx site console; Apache on its own page
- CDN agents bring edge nodes onto the same control plane
- Replace the self-signed panel cert with Let's Encrypt once you have a domain
Defense, VPN, VNC
- Defense center: firewall, fail2ban, ban / unban, presets
- SSH identities; panel and SSH 2FA
- VPN server / client; VNC accounts and share
- Missing host tools fail closed — never a silent success
Metrics, backups & updates
- Metrics, log center, terminal, cron, backups, updates
- Readiness probe:
ysk-server readiness --json - Host Browse is panel UI; dangerous work still goes through EXECUTE
- Allowlisted AI tools /
asknever bypass dry-run
Security & honesty
Writing a config is not applying it. Conservative by default; host mutations need an explicit gate.
Login, 2FA & API
- Bootstrap credentials print at install and live in
$dataDir/BOOTSTRAP-CREDENTIALS.txt - Change the password and enable 2FA after first login
- API keys use prefix
ysk_*; mutating routes default fail-closed RBAC - High-risk tools need an allowlist / approval — not an open root shell
written ≠ applied
- Managed configs usually land in
dataDirfirst (written) - Copy / reload onto system services needs
YSK_EXECUTE=1(applied) - Most host mutations also need root (useradd, apt, system Nginx…)
- CLI stays dry-run until
--execute/--apply
Three honest limits
- Install ≠ mail / DNS reputation. Inbox delivery depends on PTR, port 25, lists, and ops.
- Dangerous work is dry-run by default. Until
YSK_EXECUTE=1, we will not pretend the host changed. - The self-signed panel cert is for first login. Replace it with Let's Encrypt once you have a domain.
YSK Server is not multi-tenant reseller SaaS and does not guarantee global inbox delivery.
CLI & AI agents
What the panel can do, the CLI does on the same core. Agents should prefer --json.
CLI ysk-server
ysk-server readiness --json— readiness probeysk-server help --locale en— help (default UI locale is zh-HK)export YSK_EXECUTE=1— required for real host mutations- Projects, mail, files, defense, backups, and more stay aligned with the panel
- Full reference: GitHub
docs/cli/reference.md
For AI agents
ysk-server tools --json·ysk-server ask "list projects" --json- Tools stay on the allowlist and protection mode — they do not bypass EXECUTE
- Machine catalog:
docs/agent/commands.json - Project skill:
.grok/skills/ysk-server/SKILL.md
Screenshots & install
Ubuntu 22.04 / 24.04 recommended. Run as root. Other Linux: best-effort.
01
Dashboard
Service health, readiness, security, and apply status.
02
System tools
Identity, panel HTTPS, network, and storage.
Ready to use
- Run install.sh as root (or npm / git)
- systemd starts
ysk-server - Open
https://<IP>:9287(accept the self-signed warning) - Log in with bootstrap credentials → change password · enable 2FA
curl -fsSL https://raw.githubusercontent.com/yanshekki/ysk-server/main/install.sh \
| bash -s -- --non-interactive
# or npm
npm install -g ysk-server
ysk-server setup
ysk-server serve
# uninstall (keep data)
sudo ./uninstall.sh --all --keep-data --yesNeed hands-on hosting, hardening, or custom work? Contact YSK Limited — no prices on this page.
FAQ
Yes. It is MIT-licensed and free for public use. Hands-on hosting, hardening, or custom work is available from YSK Limited — no prices on this page.
No. It is a single-host Linux control plane: one VPS or bare-metal machine you own. The panel, CLI, and API share the same core.
Ubuntu 22.04 / 24.04 is recommended. Other Linux is best-effort. Default panel port is 9287.
No. Install is not a mail or DNS reputation guarantee. Inbox delivery depends on PTR, port 25, blocklists, and operations.
Get started with YSK Server
MIT open source · YSK Limited. Turn your Linux host into a scriptable control plane.