Ubuntu 22.04 & 24.04 · x86-64 and ARM64
Bezalel Forge
A server panel that does the work — and shows it
Run websites, databases and certificates on your own Ubuntu server, with backups, a web application firewall and deploys from git — one server or many, from one panel. Every job runs as a task you can watch, and an AI only ever proposes.
CPU
24%
Memory
61%
Disk
38%
Claude proposes
Serve staging.example.com over HTTPS
Runs
LaravelStatamicWordPressNext.jsNuxtNode.jsStatic sitesMySQLPostgreSQLDockerForge
Everything a server needs
Each part does one job and tells you what it did.
Websites, each in its own account
PHP, Laravel, Statamic, WordPress, Next, Nuxt and static sites behind nginx — each site runs as its own Linux account, so one can never read another.
$ git push
→ deploying release 0193 to shop.example.com
→ composer install, npm run build
✓ live — the old release served until now
HTTPS that renews itself
Let’s Encrypt for every site, wildcards too through your DNS provider, and a warning long before anything expires.
A firewall in front of every site
The OWASP Core Rule Set per site: watch what it would catch, then switch to block.
/wp-login.phpblocked
?id=1' OR 1=1blocked
/checkoutallowed
Databases
MySQL and PostgreSQL databases and users, owned per account, with phpMyAdmin and phpPgAdmin a click away.
Backups
On a schedule, to S3-compatible storage, Google Drive or this server — and restores that keep what they replace.
One panel, many servers
Add your other servers and manage them from here; when it’s time, move a whole server to a new one with a short pause.
Every job, live
Installs, deploys, certificates and backups run as tasks you watch line by line, and stay in the history.
Deploys
Deploys that don't keep you up
Connect GitHub, GitLab or Bitbucket once and push: every deploy builds in its own release and switches in only when every command has passed.
- Its deploy key and webhook added for you
- Each command and how long it took, on the site’s page
- One click back to the release before
- Queue workers and the scheduler restarted gracefully
- Private Composer packages and Node apps under pm2
shop.example.com
Live- Clone main @ 4f2a9c12s
- composer install --no-dev14s
- npm ci && npm run build41s
- php artisan migrate --force3s
- Switch to release 01930s
Deployed in 1m 0s
The old release served until the switch.
Firewall
Attacks stopped at the door
Each site gets the OWASP Core Rule Set in front of it. Watch what it would catch in Detect, then switch to Block when you’re sure.
- Every blocked request with its rule and address
- Exclusions for the rule that trips up your app
- fail2ban for whoever keeps trying their luck
Web application firewall
DetectBlockOWASP Core Rule Set · shop.example.com
Blocked today
1,284
Top rule
Scanner
Sites protected
4
Security
Secure from the first minute
- A firewall you can't lock yourself out with
- Turning it on opens SSH, HTTP and HTTPS first, then undoes itself after two minutes unless you confirm it still works.
- Banned before they get far
- fail2ban bans addresses that keep trying their luck; you see every ban and can lift any of them.
- Two-factor and passkeys
- Every panel account can sign in with an authenticator app or a passkey, and an administrator can require it.
- Hardening checks
- Root logins over SSH, automatic security updates and other settings that matter, checked and fixed from one page.
Backups
Backups you’ll actually restore from
Schedules per site or per database, to S3-compatible storage, Google Drive or this server — and a history that shows the one run that didn’t make it.
- Restores keep what they replace, beside it
- An alert when a backup fails, where you’ll see it
- Databases hourly, everything nightly — your call
Backups
New scheduleLast runs
Restore shop_db from 02:00?
The current database is kept beside it first.
Servers
One panel, many servers
Add your other servers and manage them from here. When it’s time for new hardware, Forge moves a whole server across — sites, databases, certificates and settings — and switches over with a short pause.
- Each server’s health at a glance
- x86-64 and ARM64, Ubuntu 22.04 and 24.04
- A move you watch step by step
Servers
Add a serverweb-1
Ubuntu 24.04 · ARM64
CPU 31%
web-2
Ubuntu 24.04 · x86-64
CPU 54%
db-1
Ubuntu 22.04 · x86-64
CPU 22%
Moving web-1 to web-1-newstep 4 of 6
Sites, databases, certificates and settings copied · switching over next
Or install it yourself
One command, checked at every step
Install from your account in one click, or run the installer yourself: it asks for your licence, downloads the newest release and checks every file against it before anything runs.
$ curl -fsSLO https://packages.bezalel.rocks/forge/install.sh$ sudo bash install.shYour Bezalel Forge licence (it is not shown as you paste):==> asking packages.bezalel.rocks for the newest release==> release 1.0.0, for amd64panel: matches the releaseagent: matches the release==> installing==> Bezalel Forge 1.0.0 is running$
Approvals
It suggests. You decide.
Connect Claude over MCP: it reads your servers, the firewall’s events and the logs, and proposes what to change. Each change waits on the AI access page until a person approves it.
Bots keep hammering /wp-login.php on shop.example.com.
Proposed change
Block attacks on shop.example.com
Switch its web application firewall from Detect to Block, so these requests are refused rather than logged.
Firewall on Block — the requests are refused.
And more
Everything else, in the box
- Files and a terminal in the browser
- Browse, edit and upload a site’s files, or open a shell as its account — without leaving the panel.
- Docker
- Run containers and compose stacks next to your sites, with their logs and ports in view.
- Cron and supervisor
- Scheduled jobs and long-running programs per account, kept running and restarted if they die.
- Alerts where you are
- Expiring certificates, failing backups and full disks — by email, Telegram, Slack, Discord or a webhook.
- Move off your old panel
- Pull sites and their databases off cPanel, Plesk or ISPmanager over SSH.
- Signed updates
- The panel updates itself from its own page, and installs only releases signed with Bezalel’s release key.
Questions
What does Forge run on?
A fresh Ubuntu 22.04 or 24.04 server you have root access to, on x86-64 or ARM64 — at any host.
How do I install it?
With a Forge licence, from your account: the portal installs Forge on your server over SSH, then removes its key. Or run the installer yourself.
Can I bring an existing server?
Install Forge on a new server and move to it: Forge copies sites, databases, certificates and settings across and switches over with a short pause. Sites on cPanel, Plesk or ISPmanager can be pulled across too.
Can several people use it?
Yes. Each person has their own account and sees their own sites and databases; administrators see everything.
What does the AI see?
Only what the account that connected it may see. It can read and propose; every change waits for a person to approve it.
How do updates arrive?
Your panel sees new releases on its Panel updates page and installs only ones signed with Bezalel’s release key; one that doesn’t come up is rolled back.