pre-v1 · active development · open source

Hestia R* Edition

Rethink. Rebuild. Reboot. Pick your R.
A leaner, decoupled rebuild of HestiaCP for small professional server fleets, and a foundation meant to be forked again by anyone who wants their own.

philosophy

It didn't stay a fork.

HestiaRE started as a fork of HestiaCP. What it's becoming is something else: a stripped-down, dependency-light base that isn't trying to be a drop-in HestiaCP replacement. It's trying to be easy to fork again.

Most self-hosted panel projects accumulate dependent users, people running someone else's release pipeline, someone else's apt repository, someone else's opinions about what belongs in the stack. HestiaRE inverts that. It doesn't want dependent users, it wants to make it cheap for someone else to run their own variant, with their own opinions, without inheriting a build toolchain or a package infrastructure they never signed up for.

No compiled binaries, no custom apt repository, no build step required on the target host. Just source, a git tag, and a single tarball a bootstrap script extracts and hands off to. Forking HestiaRE costs a git clone, not a release infrastructure.

structural changes

What changed, at a glance.

The honest way to describe a fork is a diff. Here's the shape of it.

hestiacp → hestiare
-bind9 (bundled DNS server)delegated to external / managed DNS
-REST APIdeliberate omission
-Web Terminaldeliberate omission
-vsftpd, SpamAssassin, Software Installerreplaced or dropped
-custom apt repo + compiled .deb packagesno private package pipeline
-Make / just build toolchainpure bash now
+Caddy as the panel frontendOS repo, not a bundled nginx build
+Sury PHP, isolated per-site FPM poolsinstead of a custom compiled PHP
+rspamd as the mail filterOS repo, replaces SpamAssassin
+per-customer file managerdedicated FPM pool, not a shared SFTP loopback
+CrowdSec, HTTP ban layer, firewall-level bans, fleet peer-meshL7 + L3 + multi-server
+native bot rate-limiting / WAF-lite layerworks even without CrowdSec installed
+iptables to nftables migrationin progress
+IPv6-ready firewall foundationprepared, never presupposed
+Docker integrationin progress
+component-gated, idempotent bash installerprofiles + individually add/removable addons
dependencies

Two external repos. That's it.

HestiaCP bundles and compiles a lot of its own stack. HestiaRE inverts that: OS repositories are the default, and every external source has to justify itself. In practice that leaves exactly two, Sury (multi-version PHP) and MariaDB, with everything else, web, mail, database, firewall tooling, coming straight from the distribution.

status

Four targets, equal priority.

Every feature is expected to work identically across all four. None is a second-class target.

Debian 12 (Bookworm)first-class
Debian 13 (Trixie)first-class
Ubuntu 24.04 LTS (Noble)first-class
Ubuntu 26.04 LTSfirst-class
not yet usable

HestiaRE is in active, early-stage development. Releases exist for development and testing purposes only. Core components are still being migrated, replaced, or audited. No install on a production system should be attempted at this stage.

development

Human-reviewed, agent-assisted.

HestiaRE is developed through agentic AI-assisted development. An AI agent writes and iterates on code, scripts, and documentation, while every change is reviewed, tested, and merged exclusively by a human maintainer. No commit reaches main without human review. The agent proposes, the human decides.