Node apps, static sites, S3-compatible object storage and Cloudflare routes — on a spare server, a home box, or an Android phone in a drawer.
npx bitpanel install
Debian or Ubuntu. Installs Node, pm2, nginx, cloudflared and Garage, builds the panel and registers it with systemd, then hands over to a browser wizard for the credentials only you can supply. Re-running upgrades instead of duplicating.
curl -fsSL https://raw.githubusercontent.com/yashthakur1/bitroot-panel/main/install.sh | bash
Same script. The npm package pins it to a released tag; this one always takes the tip of main. Either way it is a shell script that installs system packages — worth reading first, and it is right there at the URL.
Node apps under pm2 and static sites under nginx, deployed by pushing to a git remote on the box.
S3-compatible buckets with size limits, browser previews, lossless compression on upload and presigned share links.
Cloudflare Tunnel ingress and DNS, with an edge cache rule so published files are served without touching the device.
A push to a branch deploys a service. The panel registers the webhook with GitHub itself and verifies every delivery's signature.
What a removal left behind — DNS records, files, access keys — and a way to finish the job.
Cloudflare, Tailscale, storage and the tunnel are each optional and each independently broken-able — a token missing one permission, an app installed but never signed in. A panel that degrades quietly around those is correct and useless: you find out when a feature silently does nothing. The setup view probes each one by asking the service rather than reading config, leads with what stops working until it is fixed, and takes the credential right there instead of sending you to a terminal to edit a file it owns.
bitpanel@x.y.z installs the panel released as x.y.z — the installer
checks out that tag rather than the tip of a branch. The panel then compares itself against
the latest published release, and can fetch, build and restart into it without a terminal.
Packages are published from CI through npm trusted publishing, so each carries a signed provenance attestation tying it to the commit it was built from.
| Debian / Ubuntu | One command. Guide → |
| Android / Termux | What it was built on. A few steps a Debian installer cannot take. Guide → |
A phone is a real server with real limits. Its upload link is the ceiling on everything
public, which is why storage leans on edge caching and compresses before it sends. Several
upstream projects publish no android-arm64 binary at all. None of that is
hidden in the UI: a service bound to loopback says so instead of offering a link that will
not open, and a bucket with no public address says that rather than printing one that fails.
| Node 22+ | installed for you on Debian/Ubuntu |
| Cloudflare zone | optional — only for public routes |
| Tailscale | optional — only for private access from elsewhere |
Storage, routing and IAM are each optional; the panel degrades to whatever is configured.