Initial Server Setup

corepanel system init is an interactive wizard that brings a freshly installed server online. It detects the server identity, sets the panel domain, validates DNS, creates the administrator account, and hands SSL off to CoreHttpd for automatic, on-demand certificates. It is safe to re-run at any time.

What “panel domain” means

Throughout this guide, the panel domain is the fully qualified domain you use to access CorePanel — for example panel.example.com. It is a DNS name that points at the server, not the machine’s operating-system hostname; the wizard only offers the OS hostname as a convenient default, and setting the panel domain does not change the server’s OS hostname. The older --hostname flag still works as a deprecated alias for --domain.

Prerequisites

Before running the wizard, make sure you have:

• A fresh RHEL 8/9/10, AlmaLinux, or Rocky Linux server with CorePanel installed.
• A DNS A record pointing your chosen panel domain at the server’s public IP.
• Inbound ports 80 and 443 reachable from the internet.

Port requirements

CoreHttpd obtains Let’s Encrypt certificates on demand through the TLS-ALPN-01 challenge on port 443, and serves the panel over standard HTTPS on the same port. Open ports 80 and 443 in your firewall before running the wizard — otherwise certificate issuance cannot complete.

Interactive wizard

Run the wizard as root:

corepanel system init

It walks through six steps and finishes by applying the configuration:

  CorePanel Initial Setup
  =======================

  [1/6] Detecting server identity... done
        Public IP: 203.0.113.45

  [2/6] Panel domain [vps-12345.provider.com]: panel.example.com

  [3/6] Checking DNS for panel.example.com... ok
        panel.example.com resolves to 203.0.113.45

  [4/6] Admin email []: admin@example.com

  [5/6] Admin password: generated

  Summary
  -------
  Domain:      panel.example.com
  Server IP:   203.0.113.45
  Admin name:  Administrator
  Email:       admin@example.com
  Password:    xK9#mP2$vL7@nQ4

  Apply this configuration? [Y/n] [Y]: Y

  [6/6] Applying configuration...

        Setting panel domain... done
        Setting administrator... done
        Setting admin password... done

  ====================================
  CorePanel is ready!
  ====================================

  Access:    https://panel.example.com
  User:      coreadmin
  Password:  xK9#mP2$vL7@nQ4

  Sign in to finish the setup: the panel asks for your company
  details and nameservers the first time you open it.

At step 2 the wizard proposes the server’s OS hostname as the default, but you normally enter the panel domain you want — the address people will use to reach CorePanel. When DNS already resolves, that is all you need: open the panel at the address shown and sign in.

What the CLI does not set

The wizard deliberately stops at the server identity and the administrator: it sets no company details and no nameservers. Those are asked in the panel, by the initial configuration wizard that opens automatically on first login and keeps opening until they are filled in — see In the panel below.

When DNS hasn’t propagated yet

DNS validation is a warning, not a blocker. If the panel domain does not yet resolve to the server, step 3 flags it and the wizard continues:

  [3/6] Checking DNS for panel.example.com... warning
        panel.example.com does not resolve to 203.0.113.45 yet.
        SSL will be available once DNS propagates.

In this case the closing summary adds a reminder to create the A record and shows how to reach the panel in the meantime, by IP:

  Note: DNS is not yet pointing to this server.
  Create an A record for panel.example.com -> 203.0.113.45
  SSL will be provisioned automatically once DNS propagates.

  To reach the panel right now (before DNS), open it in your browser at:
      https://203.0.113.45
  Your browser will warn that the certificate is not trusted — this is
  expected for the temporary self-signed certificate.
  Before accepting the warning, confirm the certificate SHA-256 matches:
      A1:B2:C3:D4:...:F0
  (The IP address only accepts real browsers, not automated clients.)

You can finish setup now and add the DNS record later; CoreHttpd issues the real certificate automatically once the panel domain resolves. See Accessing the panel before DNS resolves for how the temporary IP access works and how to verify it safely. This block appears only while DNS is unresolved — once the panel domain points at the server, the wizard prints the standard summary with no IP hint.

Non-interactive usage

For automated deployments, pass the values as flags and skip the prompts:

corepanel system init \
  --domain panel.example.com \
  --admin-email admin@example.com \
  --no-interactive

Available flags

Flag	Description	Default
--domain	Panel domain — the FQDN used to access CorePanel (e.g. panel.example.com)	Server OS hostname
--admin-name	Administrator display name	Administrator
--admin-email	Administrator email for SSL notices	Current DB value
--admin-password	Administrator password	Auto-generated
--no-interactive	Skip all prompts	false

--hostname is still accepted as a deprecated alias for --domain, so existing provisioning scripts keep working.

Scripted provisioning

When --admin-password is omitted, the wizard generates a strong password and stores it in /root/.corepanel_password.

Provisioning script example

#!/bin/bash
PANEL_DOMAIN="panel.example.com"
ADMIN_EMAIL="ops@example.com"

corepanel system init \
  --domain "$PANEL_DOMAIN" \
  --admin-email "$ADMIN_EMAIL" \
  --no-interactive

echo "Panel ready at https://$PANEL_DOMAIN"
echo "Password: $(cat /root/.corepanel_password)"

After setup

Accessing the panel

• URL — https://<panel-domain> (standard HTTPS, port 443).
• Username — coreadmin.
• Password — shown at the end of the wizard and stored in /root/.corepanel_password.

In the panel

The first time you sign in, CorePanel opens its initial configuration wizard over the dashboard. It collects what the CLI leaves out:

1. Company — the name shown to your customers.
2. Identity — administrator name and email, plus the panel hostname and main server IP (already filled in from the CLI run).
3. Nameservers — the hostnames your customers will delegate their domains to, with the IP each one answers on.
4. Review — confirm and apply.

It is not a one-time banner: the wizard opens whenever the configuration is incomplete — no admin email, no server hostname or IP, or no nameservers — so it keeps coming back until the nameservers are set. You can also reach it any time from System in the sidebar (/initial-configuration).

Your name and email become your administrator profile

The name and email you enter in the Identity step are not only the server’s contact details for SSL notices: they are also written to your administrator account, so the panel knows who you are. That is what the support form uses to prefill the reply-to address and name, instead of the placeholder the installer starts with.

Your login username does not change — it stays coreadmin. Updating the identity later, from the wizard or with corepanel system init, updates the account again. Upgrading an existing server adopts the name and email you had already configured, so there is nothing to redo.

How SSL works

CoreHttpd manages certificates for you, with nothing to configure:

• Certificates are obtained from Let’s Encrypt on demand via the TLS-ALPN-01 challenge the first time the panel is served over HTTPS.
• They renew automatically before expiry.
• Issuance requires the panel domain to resolve publicly to the server and port 443 to be reachable.

Accessing the panel by IP

Let’s Encrypt cannot issue a certificate until the panel domain resolves publicly to the server, so immediately after a fresh install the trusted https://<panel-domain> URL is not available yet. Reach the panel directly by IP instead:

https://<server-ip>

This endpoint stays available for good — it is also how you get back in when DNS breaks, an A record is moved, or the hostname’s certificate expires. A few things to know about it:

• The certificate warning is expected. The connection is encrypted, but no certificate authority issues for a bare IP, so the certificate is a self-signed one and the browser flags it as untrusted. Accept the warning to continue.
• Verify the fingerprint. The wizard prints the certificate’s SHA-256 fingerprint when it finishes. Because you ran the wizard over SSH — a trusted channel — you can confirm the fingerprint your browser shows matches it before trusting the connection.
• Browsers only. The IP endpoint deliberately rejects automated clients, so internet scanners that probe the address cannot reach the panel.
• Use the hostname day to day. Once the A record resolves and the real Let’s Encrypt certificate is issued, https://<panel-domain> is the URL to use — no warning, and it is what the panel links to. To close the IP endpoint entirely, set EnableIPAccess = false in /etc/corehttpd.ini and reload corehttpd.

If you want a trusted certificate from the very first visit, add a temporary entry to your local machine’s hosts file pointing the panel domain at the server IP, then create the public DNS record when convenient.

Troubleshooting

DNS not resolving

Check what the panel domain currently resolves to:

dig panel.example.com +short
# Should return your server's public IP

If it returns nothing or the wrong address, verify the A record at your DNS provider and allow up to 15 minutes for propagation. You do not need to re-run the wizard — CoreHttpd picks up the certificate automatically once DNS is correct.

SSL certificate not working

Confirm the web ports are open and CoreHttpd is healthy:

# CoreHttpd service status
systemctl status corehttpd

# Recent CoreHttpd logs, including certificate errors
journalctl -u corehttpd --no-pager -n 50

# Open the web ports if blocked
#   443 — TLS-ALPN-01 validation and HTTPS
#   80  — HTTP→HTTPS redirect
firewall-cmd --add-service=http --permanent
firewall-cmd --add-service=https --permanent
firewall-cmd --reload

Re-running the wizard

The wizard is idempotent — each run reconfigures every setting, so it is safe to run again to change the panel domain, email, or password:

corepanel system init

Password recovery

The administrator password is stored in /root/.corepanel_password:

cat /root/.corepanel_password

To set a new one, run the wizard again or pass it explicitly:

corepanel system init --admin-password "NewSecurePassword!" --no-interactive

See also

• Mail System Configuration — setting up the email stack.