Beta — tested on Debian 12 & 13, feedback welcome

The panel that keeps your sites safe.

Self-hosted nginx panel for Debian 12 & 13, designed for small VPS, Raspberry Pi 4/5, and Proxmox homelabs. Per-site outbound firewall, Squid SNI filter, a panel never exposed — all from one panel, all with files you can read.

Get arx See the stack

Free for personal and non-commercial use — home labs, learning, self-hosting your own things. Commercial deployments (paying clients, for-profit production) require a NetForge license — see the terms. Anonymous Brave-style telemetry, opt-out documented.

The panel in 45 seconds

Why arx

⛨

Secure by default

Strict site isolation (mode 0750 / 0640 owner:owner), per-site UID firewall, default-deny outbound. No "just enable everything and we'll figure it out". Every layer is opt-in and auditable.

⌨

Not a black box

Every nginx and FPM config arx generates lives in /srv/arx/ and is yours to read. Drift detection warns when you edit by hand and offers "accept your edit as the new baseline" — never silently overwrites. CLI parallels every UI action.

⌬

Pi & homelab first-class

No Docker. RAM-aware: optional features show estimated RAM cost before you flip the toggle. Ships as a self-contained .deb for Debian 12 & 13. Proxmox LXC template on the way.

How a request flows through arx

Every visitor hit and every outbound call from a site go through the same pipeline. Two lanes — inbound (visitor / admin) and outbound (the site reaching the world). Each blue-bordered box is a security checkpoint you control.

arx data flow: visitor traffic enters via nftables INPUT, branches to nginx/panel/ssh; nginx talks to PHP-FPM; PHP-FPM outbound goes through nftables OUTPUT NAT, redirects to Squid (SNI peek+splice), external host reached only if the destination is on the site's allowlist.

The chosen stack

nginxweb server

Sury PHPmulti-version FPM

SquidSNI peek & splice

nftablesper-site outbound filter

Let's Encryptauto SSL

GoAccessper-site stats

Debian 12 & 13only target

Defense in depth, layer by layer

nftables — per-site outbound filter

Each site user gets a dedicated chain that default-rejects unless a destination IP/CIDR is whitelisted, so a hacked site can't call home. Loaded at every boot, reloaded within a minute if something flushes the rules. The inbound side is yours — NetForge ships a template for every arx / nomina / missus combination — and arx shows it read-only.

Squid — transparent SNI filter

When enabled, nftables redirects every site's outbound 80/443 to a per-site Squid port. Squid peeks the TLS ClientHello, splices through if the destination is on the site's allowlist, refuses otherwise. No MitM: certs are never terminated, so even apps that pin certs keep working.