Serving the HestiaCP Control Panel from a Domain Name

By default, HestiaCP serves its control panel on port 8083, giving you an address such as https://server.example.com:8083. There is nothing particularly wrong with this, but I wanted to access the control panel through a regular HTTPS address without having to include the port number.

Hestia already includes the functionality needed to do this through its Nginx proxy template system. Rather than changing the port Hestia itself listens on or manually maintaining a separate Nginx configuration, a web domain can be configured to proxy requests to the existing control panel. The browser connects to https://cp.example.com, while Nginx forwards the request internally to https://127.0.0.1:8083.

This also makes it easier to use Let’s Encrypt for the control panel’s public-facing SSL certificate. The certificate can be configured through Hestia’s normal web-domain SSL settings, just as it would be for any other website.

The proxy templates used in this article are available in the ryanbrownell/Hestia-Domain-Control-Panel repository on GitHub.

Prerequisites

Before continuing, make sure:

• HestiaCP is configured with Nginx acting as the proxy server.
• The web domain settings include a Proxy Template option.
• The domain or hostname you plan to use points to the Hestia server.
• You have SSH access with permission to write to /usr/local/hestia/data/templates/web/nginx/.

Download the Proxy Templates

Hestia stores Nginx proxy templates in:

/usr/local/hestia/data/templates/web/nginx/

Connect to the server over SSH and download both templates directly from the repository:

sudo wget \
  -O /usr/local/hestia/data/templates/web/nginx/cp.tpl \
  https://raw.githubusercontent.com/ryanbrownell/Hestia-Domain-Control-Panel/main/cp.tpl
​
sudo wget \
  -O /usr/local/hestia/data/templates/web/nginx/cp.stpl \
  https://raw.githubusercontent.com/ryanbrownell/Hestia-Domain-Control-Panel/main/cp.stpl

If files named cp.tpl or cp.stpl already exist in that directory, back them up before running these commands.

The two templates perform slightly different jobs:

• cp.tpl handles non-SSL requests and redirects them to HTTPS.
• cp.stpl handles HTTPS requests and proxies them to Hestia at https://127.0.0.1:8083.

Using a proxy template also avoids manually editing the generated Nginx configuration for a domain, which Hestia may overwrite when the domain configuration is rebuilt.

Create the Control Panel Domain

Replace cp.example.com in the following examples with the hostname you want to use.

Configure a DNS record for the hostname and point it to the Hestia server.

A dedicated hostname such as cp.example.com works well, but it is not required. Hestia already creates a web domain for the server hostname during installation, so the existing hostname domain can also be reconfigured to serve the control panel instead of creating a separate one.

For example, if the server hostname is server.example.com, the control panel can be made available directly at https://server.example.com instead of https://server.example.com:8083.

There is also nothing preventing the cp proxy template from being used on multiple web domains, allowing several domain names to point to the same Hestia control panel. I am not really sure why anyone would want to do that, but it is possible.

If creating a new control-panel hostname, open the Web section in Hestia and add the new domain.

If using the existing server hostname, edit its existing web domain instead.

Leave the default proxy template selected for now.

Enable SSL with Let’s Encrypt

Edit the web domain that will be used for the control panel.

1. Enable Enable SSL for this domain.
2. Enable Use Let’s Encrypt to obtain SSL certificate.
3. Save the domain and allow Hestia to obtain the certificate.
4. Confirm that HTTPS is working before continuing.

The non-SSL template redirects all requests to HTTPS, so HTTPS needs to be ready before applying the control-panel proxy template.

One of the nice side effects of accessing the control panel this way is that its public-facing certificate can now be managed through Hestia just like the certificate for any other web domain.

Apply the Control Panel Proxy Template

Once SSL is working:

1. Edit the web domain again.
2. Find the Proxy Template setting.
3. Select cp.
4. Save the domain.
5. Open another browser tab and visit https://cp.example.com.

The Hestia login page should appear without requiring :8083 in the address.

Visiting http://cp.example.com should also redirect automatically to https://cp.example.com.

Hestia itself is still listening on port 8083. Nginx is simply accepting the normal HTTPS request and forwarding it internally to the control panel.

Sign in and make sure the control panel is working normally before continuing.

Block Direct Access to Port 8083

Once the domain-based address is working, there is little reason to continue exposing port 8083 directly to the Internet.

⚠️ IMPORTANT
Do this last. Make sure the new control-panel address is working before changing the firewall rule.

1. While signed into Hestia through the new domain, open the server settings using the gear icon.
2. Select Firewall.
3. Locate the existing HESTIA rule for TCP port 8083.
4. Edit the rule.
5. Change its action from ACCEPT to DROP.
6. Save the firewall rule.

The resulting rule should look similar to this:

Do not add a second DROP rule while leaving the existing unrestricted ACCEPT rule in place. Modify the existing HESTIA rule instead.

Finally:

1. Open a new browser tab and confirm that https://cp.example.com still works.
2. Then try accessing the old address https://server.example.com:8083.

A new connection to port 8083 should now fail, while the domain-based control panel continues to work normally.

The end result is a much cleaner control-panel address, easier certificate management through Let’s Encrypt, and no need to expose Hestia’s 8083 port directly to the Internet.