Kursor by Intech
A server control panel written from scratch in Go
What it is
Kursor is our own server control panel, built by Intech from scratch in Go — an aaPanel/1Panel alternative, but built for the company's actual needs rather than as a one-size-fits-all product.
A single binary, SQLite, a native systemd service — no Docker, no extra layers of abstraction. The idea: instead of paying for a dozen separate SaaS subscriptions (hosting panel, mail, ticketing, VPN service), keep everything under our own control, on our own hardware.
Modules
Server
- Sites
- Create/remove sites, auto-generates and validates nginx configs before applying (test config → symlink → reload, with rollback on failure).
- SSL
- Issues and auto-renews Let's Encrypt certificates right from the interface.
- File manager
- Browse, edit, upload/download files within a sandboxed root (protected against path traversal).
- Database manager
- Manage databases and their users.
- Cron
- Scheduled jobs through the interface — no manual crontab -e.
- Backups
- Create and download backups.
- Terminal
- A full web console right in the browser.
- Monitoring
- Live CPU/RAM/disk/network metrics.
Network
- Domains & DNS
- Manage DNS records, including our own NS server (you can be your own DNS-zone registrar, not just rely on the domain registrar).
- Ports / Firewall
- Fine-grained port open/close, port forwarding.
- VPN
- WireGuard, issuing configs to employees straight from the panel (not a separate service).
- SSH
- Manage keys and the server's system users.
Company
- Employee accounts
- Full name, department, role, granular per-module access rights (not "all or nothing"), photo, termination with a recorded date, password reset.
- Departments & positions
- A real org structure with hierarchy.
- Corporate email
- Our own mail server (WildDuck + Haraka + ZoneMTA), not a rented service. Real SPF/DKIM/DMARC/PTR — mail doesn't land in spam. An employee's account and mailbox are created together, with one login and password — not two separate credentials.
- Shared mailboxes
- info@, sales@ — access is granted to specific people without a shared password floating around; every sent email is tagged with who on the team actually wrote it, so it's easy to see who answered a client.
- Ticket System
- Ticket categories, approvals, escalation between support groups, a separate client portal on its own subdomain.
- Single sign-on (SSO)
- One login and password for the panel, mail and the company site's cabinet. Log into one service and you're automatically signed into the others, no re-entering a password. Access to each service is toggled per employee.
System
- Audit log
- Who changed what in the panel, and when.
- Notifications
- A bell with events (new tickets, access granted, etc.).
- OAuth2/OIDC
- Our own projects can be plugged in as clients, authenticating through Kursor.
- API keys
- For outside integrations, scoped to a specific project.
- Panel hardening
- A custom domain for the panel, port change, IP allowlist, brute-force protection (lockout after failed attempts).
What's coming
An extra code at login — not implemented yet.
A technical request from the site's form drops straight into the internal support desk as a ticket, with a "route to developer" button.
Closing direct IP:port access from the outside (leave only its own domain over HTTPS), mandatory session cookie encryption.
Automatically to every new internal service, on the same principle.
A future ambition — the same single login/password for logging into employees' work computers too (not just web services), via a separate, more rigorous auth protocol.
The same engine, the same infrastructure discipline — I can set it up for your project too.
Discuss a project