Download
Download RackHelm
RackHelm is self-hosted. You download one archive, run it on your own server, and your customers’ data never leaves your infrastructure. The installer sets up PHP, the web server, database, queue workers, SSL and the ionCube Loader in a single command.
The download is free. RackHelm needs a key to run — a demo key gives you thirty days of everything, no card and no call.
Current release
Version
2.0.2
Released
10th October 2026
Channel
Stable
Download
RackHelm.tar.gz · 32 MB
Runs on
PHP 8.5 · 8.3 and 8.4 also run
Try before you download
A full RackHelm install is running at demo.rackhelm.com — log in with the shared demo accounts and click around before you set up a server.
Read this before you install.
The full documentation covers every step. These are the six pages worth reading first.
PHP versions, the ionCube Loader, database, Redis and everything the server needs first.
The one-command install: what it asks you, what it builds and what it prints at the end.
For operators who would rather place the files, write .env and wire the web server by hand.
Where the key lives, what the licence check does, and what happens if it cannot phone home.
Moving an existing install onto a newer release without losing your configuration.
The setup checklist: company details, a product, a payment gateway and your first order.
Stuck part-way through? Installation troubleshooting · browse all documentation
Up and running in one command.
On a clean Ubuntu, Debian, AlmaLinux or Rocky server, the whole install is two commands and about ten minutes.
# 1. Extract the release, best place to download the tar file is in he home directory $ sudo tar -xvzf RackHelm.tar.gz $ cd RackHelm $ sudo chmod 700 install.sh # 2. Run the installer as root and answer its prompts $ sudo bash install.sh
What the installer does
- Installs PHP, nginx, Redis, Supervisor and Node
- Fetches and enables the ionCube Loader
- Creates the database, or connects to yours
- Issues a Let’s Encrypt certificate
- Runs migrations and starts Horizon
- Prints your admin login at the end
- Can be ran behind reverse proxy
Requirements at a glance
Operating system
Ubuntu 24.04+ / Debian, or AlmaLinux, Rocky & RHEL
PHP
8.5 — the installer sets it up. 8.3 and 8.4 also run,
with an ionCube Loader built for that exact version
with an ionCube Loader built for that exact version
ionCube Loader
15.0 or newer — required, the build is encoded.
The installer fetches and enables it for you
The installer fetches and enables it for you
Database
MySQL 8 or MariaDB — local or remote
Cache & queues
Redis, with Horizon under Supervisor
Web server
nginx, installed for you — or Apache with PHP-FPM
Network
HTTPS on the site itself — logins fail without it.
Plus outbound HTTPS for the licence check
Plus outbound HTTPS for the licence check
Access
root or sudo on a server you control
What’s in 2.0.2
Released 10 October 2026. 2.0 is the first major release since 1.1.1: inbound webhooks that order and manage services created in another system, Active Orders with whole-order Cancel and Terminate, a rebuilt Product tab on the package page, a reworked support desk (email threading, a knowledge base, a public status page, satisfaction ratings and SLA timers), and staff alerts that say why they were raised. 2.0.1 and 2.0.2 followed with fixes to the Custom API editor, the admin dashboard and the installer. Version numbers now have three parts: 1.0.1.1 is now written 1.1.1.
Added31
- Inbound webhooks, under Admin → Webhooks: when another system creates a service itself, such as a licence server issuing a reseller’s licence, it posts a signed event and RackHelm creates the matching order, billed from the due date the event names.
- Each webhook maps values out of the event’s JSON by path, with a picker built from a pasted sample, a dry run that shows exactly what an event would create, and an event log with Approve and Re-process.
- Webhook orders are limited to the products ticked on the webhook, at the catalogue price, and start with a zero-value activation invoice: nothing is charged until the due date.
- Each ticked product chooses how its service comes to exist: already made by the sender, provisioned at once, provisioned on the next run, or left for staff. cPanel, Plesk, Enhance and domain products take the domain from the event, and domains register for real at the registrar.
- Webhooks can also cancel, uncancel, terminate, suspend and unsuspend the services they created, each action with its own conditions and route, and an event is never acted on twice.
- A suspension made by a webhook is not lifted when the customer pays; only the webhook, or staff setting the service Active, lifts it.
- Webhooks can report back to the sender with a signed callback when a service is provisioned or fails, or when an action is done, retried for about a day, plus a signed status URL for any event.
- Webhooks can order a product’s add-ons and set its configurable options, translating the sender’s own codes through rules on an Add-ons and options tab.
- Two new permissions, View Webhooks and Manage Webhooks, and re-processing an event that would suspend, cancel or terminate a service needs a ticked confirmation and a recent password.
- Active Orders, beside Active Packages: live orders with their packages beneath them, the same filters and search, and a switch between the views.
- A whole order can be cancelled at the end of its paid term or terminated now, add-ons included, with a confirmation that lists what will end and what is left alone.
- Active Packages offers Cancel at end of term and Terminate now in each package’s menu.
- The Product tab on a package’s page shows everything the portal knows about the service: provider status and remote IDs, captured Custom API values, recent API calls, provisioning history and change history.
- A “Needs attention” strip on a package warns staff before they act, for example when the provider’s status or expiry differs from the portal’s.
- Masked values on the package page, such as panel passwords and EPP codes, can be revealed one at a time by staff allowed to view products, and every reveal is logged.
- Staff can run any Custom API action, or a refresh, for the customer from the package page, and replay a recorded call.
- Customers’ ticket emails include the reply itself, and a guest gets a link, valid for 30 days, to read the ticket and reply without an account.
- Email replies thread onto the right ticket, with quoted history stripped and the original email kept as an attachment.
- The ticket list gains an Awaiting staff view and sorts by last reply; staff can open tickets for customers, merge tickets and work the queue in a ticket workspace.
- Tickets get CC lists and attachment previews, quarantined mail gets Release to and Change requester, and the spam list takes whole domains.
- Email Routing shows each mailbox’s health and has a Test connection button.
- SLA policies with business hours, automatic assignment per department, ticket snoozing, canned replies as macros and configurable auto-close.
- Tickets the system opens itself, such as overdue suspensions and failed renewals, can be filed for the customer or kept internal.
- The Messages menu in the header is now a ticket inbox showing replies you have not read, for customers and staff.
- Redesigned customer ticket pages, department descriptions, hidden departments and sort order, and ticket access per sub-account.
- Customers can rate a closed ticket, and a Ticket Satisfaction widget reports the ratings.
- A knowledge base at /knowledgebase, with categories and articles, managed under a new Manage Knowledge Base permission.
- A public status page at /status, with components and incidents, managed under a new Manage Status Page permission.
- An invoice History card, for staff and the customer, showing when the invoice was issued, emailed, reminded and paid, and every later change.
- A Termination failed alert names the service and the provider’s reason and says what to do next, and the package page gains a Retry termination button.
- A Free product switch: a product priced at 0.00 is ordered without payment details, its invoice is paid at once, and each renewal is settled at 0.00 without reminders or receipts.
Improved9
- Every staff alert says why it was raised and what to do next, and links to the invoice, client or ticket it concerns, by email, Slack, Discord, Teams and webhook.
- Alerts sent outside email leave out secrets, email addresses and IP addresses, unless a channel is set to include the full details.
- The notification log opens each alert in full, and the Background job failed alert names the queue and links to the job in Horizon.
- Bounces and out-of-office replies no longer open or reopen tickets, and mail that cannot be filed is kept for review instead of being deleted.
- Staff see the tickets of departments linked to their role, and a new View All Departments permission shows every department.
- Request Quote on a quote-only product takes a signed-out visitor to the contact form, with the subject filled in and the Sales department chosen.
- The WHMCS importer follows the auto-close period set in Ticket Settings when it brings in old tickets.
- A service waiting for staff to set it up shows as Setting up in the customer’s Sites list.
- Auth Logs name the staff member behind each impersonation, and a Logout while impersonating is recorded as the staff member’s.
Fixed27
- (2.0.2) The admin dashboard no longer fails with a server error when every active service is priced at 0.00.
- (2.0.2) On servers built from minimal images, the installer now installs and starts the cron service, so scheduled jobs such as provisioning, invoicing and reminders run; the updater warns when none is running.
- (2.0.1) Save Changes on a Custom API integration works on an install with no orders yet.
- (2.0.1) A Custom API integration can be created under the name of one that was deleted.
- (2.0.1) A Custom API integration now requires the key, token or username its authentication method sends.
- Opening an add-on’s package page, or a package whose product was deleted, no longer fails.
- A package’s Invoices tab lists every invoice that bills it, merged invoices included, with the right totals and currency.
- Saving the Package Addons tab no longer erases stored domain, TLD and EPP code answers.
- Test calls from the Custom API editor no longer appear in the customer’s recent activity.
- Reveals, actions and ticket replies made while logged in as a customer are recorded under the staff member’s name.
- The Switch product form explains why a package cannot be switched before you submit.
- Cancelling, terminating or replaying a call for a package now checks the staff member’s rank against the account owner’s.
- An order whose packages are all ending reads Pending cancellation, shown in amber.
- Retry and Force provision refuse a service that was provisioned before, or is suspended or being cancelled, so it cannot be created twice.
- Terminating a service on a manual product closes it, instead of leaving it cancelling for good.
- The contact form’s captcha works again, and the form is rate limited.
- Ticket actions check the same permissions everywhere.
- A bounced ticket email no longer opens a new ticket or sends a receipt to the bounce address.
- Links in ticket alerts no longer open a missing page.
- The Bank transfer awaiting confirmation alert reports accurately what was emailed and shows the due date.
- The Announcements menu in the header is styled on staff pages too.
- The role list under Security → MFA is now a searchable picker.
- Hide System Schedule Changes on the Audit Logs page also hides the changes scheduled jobs make, and names the schedule behind each one.
- A termination that failed at the provider no longer leaves the service cancelling without telling anyone.
- Sign-in locations on the Auth Logs tab are looked up again, and private-network and on-server sign-ins are labelled as such.
- New customers at checkout see the password rules, a strength bar and show/hide buttons, and invalid fields are marked.
- Upgrades, billing-cycle changes and scheduled package changes can no longer move a service onto a 0.00 cycle unless the product is marked free.
Grab a demo key and get going.
The download is free, but RackHelm checks its licence on every request and will not serve a page without a valid key. Take a demo key and you have thirty days of the whole platform — every feature, no card, no call.
Already licensed? Your key goes in RACKHELM_LICENSE_KEY — demo keys go in exactly the same place. See Licensing and activation.