Your whole server in one panel.
Containers, deploys from Git, domains with automatic HTTPS, backups and system updates for a single Linux machine. One binary, no agent, no external database.
Private beta: sources and installer are sent to testers by email.
Named after Sirius, the brightest star in the night sky.
Sirio is a single Go binary that runs as a systemd service on the machine it administers, and manages it through the Docker socket. The panel, the API and the database are all inside it: nothing to deploy alongside, no agent, no cluster. It’s made for the server that hosts a handful of sites and applications, the one you’d otherwise look after over SSH.
What it does
Sites and deploys
- Domains with automatic HTTPS
Group domains, containers and pipelines into sites and route a domain and path to a container. Certificates arrive on their own, and every change is validated before it’s applied, so a bad domain never takes live sites down. Any route can ask for a password.
Domains and sites- Deploys from Git
Connect a repository, define the steps (shell, Docker build, Compose, restarts, backups) and run them by hand or from a GitHub, GitLab or Gitea webhook verified by its signature. Running an old deploy again is a rollback.
Pipelines- Backups you can restore
Scheduled restic backups of each site: volumes, folders and MySQL, MariaDB or PostgreSQL dumps, encrypted, to a local folder, SFTP, S3, B2 or Google Cloud Storage. Restore from the panel, or with plain restic from any machine.
Backups- SFTP for each site
An optional SFTP server per site, in its own confined container, with accounts limited to that site’s volumes and folders. System paths and other sites’ data are never exposed.
SFTP
Containers and the host
- Docker
Live logs and stats, a terminal, start, stop and recreate; images, volumes and networks. Environment and port overrides survive deploys, and Sirio tells you when a newer image is out and updates the container, after a backup if you like.
Image updates- System packages
Pending updates with security fixes highlighted. Upgrade everything or a few packages and clean up, with apt, dnf, yum or apk, watching the package manager’s output live.
System packages- Ports and fail2ban
Every listening port, with a warning on the risky ones: SSH accepting passwords, a database on a public address, ports Docker opens past the firewall. Sirio installs fail2ban for SSH and shows who it banned.
Listening ports
People and upkeep
- Users and permissions
Permissions per section and per site, down to a single action: run a pipeline but not edit it, restore a backup, never delete a container. An activity log records who did what.
- Updates itself
By hand or automatically, up to patch, minor or major releases. Every release is signed, verified twice, and rolled back on its own if the new version doesn’t stay up.
Updates
Docker access is root access
Whoever controls the Docker socket controls the host, so whoever gets into Sirio does too. That’s why Sirio itself runs unprivileged, on a system it can’t write to, and every action that needs root takes the same narrow path.
The security model- You press Upgrade all, Restart server or Install fail2ban in the panel.
- Sirio writes a request naming only the action and its arguments. It can’t do more: /usr is read-only and sudo is blocked.
- A systemd unit picks the request up and starts a helper as root.
- The helper checks the request again against its own closed list, runs it, and writes back the result, which the panel streams to you.
What it isn’t
- Multi-server. Sirio administers the machine it runs on. For more servers, install one on each.
- Multi-tenant. Sites group domains, containers and pipelines, and permissions can stop at a site, but they share one host.
- For Windows. Linux only, on amd64 or arm64. No plugin marketplace either.
What it needs
- A Linux machine with systemd, amd64 or arm64.
- Docker Engine. If it’s missing, the first-run wizard installs it.
- A domain, when you want HTTPS in front of the panel.
Sirio is in private beta.
Testers get the sources and the installer by email, and a direct line for feedback. Say what you’d run it on and you’ll hear back.