Maran One root process
The panel runs unprivileged. A small Rust daemon holds root, and its contract has no operation that runs a program you hand it.
Source-available hosting panel
A hosting control panel that keeps root to itself
Websites, PHP versions, SSL, databases, file transfer, backups and the firewall — managed from a browser, with a cabinet for every customer and an API your billing system can drive.
curl -sSL https://get.maran.innovayse.com | bashOne command on a fresh server. Every check runs before anything changes.
No shell strings
A domain is validated as a domain, not escaped into a command line. There is no newline to end one directive and begin another.
Real Linux users
Every account is a system user with its own home, its own php-fpm pool under its own uid, and its own quota.
Built for billing
A provisioning API creates, suspends and deletes accounts, so a billing system can run hosting without a person in the loop.
What it manages
Websites and PHP
Static, PHP and reverse-proxy sites with aliases. The agent validates every rendered vhost with the web server itself and rolls it back if the reload refuses.
SSL that renews itself
ACME with an HTTP-01 challenge, uploads for custom material, renewal thirty days before expiry, and keys in a root-only store outside every home.
Databases and transfer
A database and a scoped user per account, chrooted SFTP carrying the account's own uid, per-plan limits on both.
Backups and firewall
Backups of files and databases, restorable one at a time, a managed firewall, and monitoring of the server's own state.
An audit journal
Append-only, covering every sign-in and every change, with a screen only administrators can open.
Signed, reversible updates
Updates are signed, take a database dump before they swap anything, and roll back with one command.
From a bare server to a hosting account
Install
Run one command on a fresh server. Preflight checks the distribution, memory, disk and ports, and reports every problem at once rather than one per run.
Open the one-time link
The installer prints a link that creates the first administrator. Nothing else can create it, and it is consumed the moment it is used.
Create an account
An account is provisioned on the host as a real Linux user with its home, its pool and its quota — then hand its cabinet to the customer.
Three processes, and root belongs to one of them
The split below is the product's main design decision. Everything else on this page follows from it.
maran-apiThe panel
- Runs as
- an unprivileged system user
- Holds
- every piece of business logic, and the only database connection
maran-agentThe only root process
- Runs as
- root
- Holds
- nothing — stateless, no database, no configuration of its own
has root
thenPostgreSQLThe panel's data
- Runs as
- its own user
- Holds
- accounts, sites, the audit journal — on a unix socket with no TCP port at all
The panel asks the agent for named operations with typed, validated arguments. There is no operation that runs a caller-supplied program, and no shell string anywhere between them — so the set of things the root process can be made to do is finite, written down and reviewable.
Runs where your servers already run
One command on a fresh server of any of these, on x86_64 or aarch64.
Ubuntu
22.04 · 24.04 LTS
Debian
12 · 13
AlmaLinux
9 · 10
Rocky Linux
9 · 10
A distribution outside this list is refused rather than guessed at — the installer knows each supported family's package layout and service names. Production installs are native; Docker is used in development only.
Where it is today
In active development toward the first feature release. What follows is what exists, and what does not.
Built and running
- Accounts as real Linux users, with quotas, suspend and delete that reach the host
- Websites — static, PHP and reverse-proxy — with validated, rollback-on-failure configuration
- Several PHP versions side by side, one pool per account per version
- SSL over ACME, renewed thirty days before expiry, keys outside every home directory
- Databases and SFTP logins with per-plan limits and one-time passwords
- Backups, a managed firewall, monitoring, and an append-only audit journal
Not in it yet
- No web database manager and no browser file manager yet
- Certificates are HTTP-01 only — wildcards arrive with DNS management
- Mail, DNS, reseller accounts and multi-server management come after the first release
Source-available, and yours to run
Maran is published under the Business Source License 1.1 by Innovayse LLC, and converts to Apache 2.0 on 29 August 2030. The date is written into the licence rather than promised.
- Install it and host your own customers on it, in production, at no cost
- Read, modify and contribute — the source is available and contributions keep their copyright
- You may not offer Maran itself as a managed control panel service to third parties
- You may not resell or relicense it as your own commercial product
Safe because of how it is built, not because of a promise
Four properties of the code, each of them either true or not, and each checkable by reading it.
No shell strings
A domain is validated as a domain — letters, digits, hyphens, dots — not escaped into a command line. There is no newline in it to end one directive and begin another.
The server validates its own configuration
Every write is rendered, renamed into place atomically, then checked by the service itself. If validation or the reload refuses, the file is rolled back.
The agent checks who is asking
Peer credentials are read from the socket before an operation is considered, so the daemon knows which process is on the other end rather than trusting what it is told.
A missing row answers 404
Asking for another account's resource is answered as not found, never as forbidden — an error that never confirms a row exists.
Who it is built for
Multi-tenancy is in the product from the first release rather than added later, and it shows in who can use it.
Hosting businesses
A cabinet per customer, plans that cap what an account may use, and a provisioning API a billing system drives to create accounts without a person in the loop.
Agencies and studios
Client sites on one server, each its own Linux user with its own quota and PHP version — and an audit journal that answers who changed what.
One server, one owner
Everything a single machine needs, installed in one command, updated with signed artefacts and rolled back with another.
What is new
The newest release and the most recent thing written about how this is built.
beta23 September 2026
Maran 1.0.0-beta.1 — the first installable release
The first release you can install on a server: accounts as real Linux users, websites, PHP versions, SSL, databases, file transfer and backups — published as a beta, with the boundary stated.
19 September 2026Why the agent takes no shell commands
The one design decision that shaped everything else in Maran — a root daemon that takes typed operations and no shell strings — and what it costs.
Questions people ask first
The short answers. The rest are on the questions page.
- What is Maran?
- A web hosting control panel for Linux servers. You install it on a server and manage websites, PHP versions, SSL certificates, databases, files, backups and the firewall from a browser, with a separate cabinet for every hosting customer and an API a billing system can drive.
- Is it free?
- The panel is source-available under the Business Source License 1.1 and free to self-host, including hosting your own paying customers on it. What the licence forbids is offering Maran itself as a hosted control panel service, or reselling it as your own product. Commercial modules are distributed separately and need a licence key; no prices are published yet.
- Can I use it in my hosting business?
- Yes. Running it to host your own customers is explicitly allowed by the licence, and multi-tenancy is in the product from the first release rather than added later.
- Which distributions does it support?
- Ubuntu 22.04 and 24.04 LTS, Debian 12 and 13, AlmaLinux 9 and 10, and Rocky Linux 9 and 10, on x86_64 and aarch64. The installer refuses a system outside that list rather than guessing at its package layout.
Read how it is built before you trust it with root
The architecture, the contract between the panel and the agent, and what the installer does to a server — written down rather than summarised.