What runs where

• Panel/API runtime — loaded by FXServer from nebula-core and serves the browser UI.
• Game bridge runtime — loaded by the same resource and calls FiveM natives and events.
• Web interface — compiled static files served by the panel runtime.

The API and bridge communicate over 127.0.0.1 on the configured panel port. “Local bridge” means loopback traffic inside the same VPS; it does not mean another application must be installed or started.

Why two secrets exist

Use different long random values for the two settings and never expose either one in screenshots, logs, or support messages.

Server

• A current FiveM FXServer artifact.
• A running QBCore server for the current full integration.
• MySQL or MariaDB for NebulaPanel data.
• Shell or file access to the server data directory.
• One unused inbound TCP port for the web panel. Default: 40130.

Purchase

Download the current customer archive from your verified Tebex purchase. The documentation repository intentionally contains no copy of the resource.

1. Back up the server.
   Back up the QBCore database and server data directory before changing resources.
2. Extract the Tebex download.
   Place nebula-core at resources/[local]/nebula-core. Keep its internal structure unchanged.
3. Add the convars.
   Copy the configuration below into the active server.cfg and replace every placeholder.
4. Open the panel port.
   Allow inbound TCP traffic to the chosen panel port in both the OS and provider firewalls.
5. Start and verify.
   Run ensure nebula-core, open the panel, change the bootstrap password, and complete the smoke test.

Minimal server.cfg

set nebula_api_port "40130"
set nebula_bridge_key "GENERATE_A_LONG_RANDOM_VALUE"
set nebula_jwt_secret "GENERATE_A_DIFFERENT_LONG_RANDOM_VALUE"
set nebula_initial_admin_password "TEMPORARY_FIRST_LOGIN_PASSWORD"

set nebula_db_host "127.0.0.1"
set nebula_db_port "3306"
set nebula_db_user "fivem"
set nebula_db_password "YOUR_DATABASE_PASSWORD"
set nebula_db_name "qbcore"

set nebula_server_data_path "/absolute/path/to/server-data"

ensure nebula-core

Open the panel

Browse to http://YOUR_SERVER_IP:40130. For production, expose the panel through an HTTPS reverse proxy instead of using plain HTTP publicly.

Multiple servers

Every live instance needs a unique panel port, bridge key, JWT secret, and server data path. Never reuse production session secrets between unrelated servers.

Reverse proxy

Terminate TLS at a trusted proxy, forward to the local NebulaPanel port, and preserve WebSocket upgrade headers. Keep the direct panel port private when the proxy is the intended entry point.

Enable Files write access

The Files tab can discover and read resources without extra permissions. FiveM blocks writes into another resource by default. Add one permission line for every resource that NebulaPanel is allowed to modify:

# Allow NebulaPanel to edit qb-core files
add_filesystem_permission nebula-core write qb-core

# Allow NebulaPanel to edit one additional resource
add_filesystem_permission nebula-core write my-resource

ensure nebula-core

1. Replace my-resource with the exact resource name shown in the Resources list.
2. Place the permission before ensure nebula-core in the active server.cfg.
3. Restart the server, open Resources → Files, choose the resource, and test on a non-critical file.
4. Add more target resources individually only when staff genuinely need to edit them.

Access modes

Resource mode

With nebula_file_manager_root left empty, NebulaPanel lists and reads every resource registered by FXServer. This includes modern fxmanifest.lua resources and legacy __resource.lua resources. Ordinary folders without a resource manifest are not listed.

Add one line for each resource that Owner should be able to modify:

add_filesystem_permission nebula-core write qb-core
add_filesystem_permission nebula-core write my-resource
ensure nebula-core

Full VPS mode

Full VPS mode replaces the resource-only browser. It displays everything inside the configured root and allows Owner to modify it. The helper is bundled in nebula-core and starts and stops automatically with the resource. Add the following before ensure nebula-core:

# Linux: expose the complete VPS filesystem
set nebula_file_manager_root "/"
set nebula_file_manager_node "/usr/bin/node"
add_unsafe_child_process_permission "nebula-core"

# Windows example
# set nebula_file_manager_root "C:/"
# set nebula_file_manager_node "C:/Program Files/nodejs/node.exe"

ensure nebula-core

Confirm the Node path with command -v node on Linux or where node on Windows, then restart FXServer. The helper inherits the operating-system account used by FXServer.

Default roles

• Owner — full access, administrator and role management, sensitive configuration.
• Admin — player, resource, database, jobs, bans, and log access with restricted console/settings/admin management.
• Moderator — limited player actions and read-only access to selected operational data.

These are the only roles created automatically. You can create custom roles such as Senior Admin or Support from Settings → Roles, but they are not built-in defaults.

Sessions

Review active logins and revoke access remotely from the Sessions page. After a suspected credential leak, revoke the affected sessions and rotate the password.

Auditability

Use individual accounts instead of shared credentials. This keeps administrative actions attributable and makes offboarding reliable.

Production baseline

• Use HTTPS through a reverse proxy.
• Use unique random bridge and JWT secrets.
• Change the bootstrap password immediately.
• Create individual staff accounts with least-privilege roles.
• Restrict the panel through a firewall, VPN, or trusted IP ranges where practical.
• Keep the database private and use a restricted account.
• Keep FXServer, QBCore, the OS, and NebulaPanel current.

Filesystem access

Resource mode stays inside FiveM resources. VPS mode also enables the embedded CFG editor and arbitrary server paths, so it should be enabled only for installations that require that level of control.

1. Read the release notes and confirm compatibility.
2. Back up the database and server data directory.
3. Stop nebula-core.
4. Replace the whole resource with the new Tebex download. Do not merge old compiled files into it.
5. Keep deployment values in server.cfg, start the resource, and inspect startup output.
6. Smoke-test login, players, resources, operations, scheduler, sessions, logs, and the HTTPS endpoint.

“Read Failed: Access to this API has been restricted”

This means the FiveM runtime sandbox blocked NebulaPanel's Node process from reading a path outside its permitted resource area. It is normally not a Linux ownership problem and does not mean the game server is broken.

server.cfg usually sits in the server-data directory, outside nebula-core, which is why the CFG editor can fail even when the configured path is correct.

1. Confirm nebula_server_data_path points to the active server-data directory.
2. For resource-only access, use the target-specific permission shown below.
3. For the CFG editor and paths outside resources, follow the Full VPS mode setup and restart FXServer.

Resources → Files does not load

In resource mode NebulaPanel uses FiveM's registry. In VPS mode it lists the absolute path configured by nebula_file_manager_root.

To save, create, rename, upload, or delete files in another resource, add a target-specific permission before NebulaPanel starts:

add_filesystem_permission nebula-core write exact-resource-name
ensure nebula-core

Restart the server after editing server.cfg. Repeat the permission line for other exact resources, or follow the Full VPS mode setup.

Panel does not open

• Confirm nebula-core started without errors.
• Confirm the chosen TCP port is free and listening.
• Check both operating-system and provider firewalls.
• Use the panel port, not the FiveM game port.
• Verify reverse-proxy upstream and WebSocket settings.

Panel shows Disconnected

• Check the FXServer console for bridge authentication errors.
• Confirm the bridge key is configured consistently.
• Restart nebula-core after changing convars.

Login fails after restart

The initial password only bootstraps an empty administrator table. Changing the convar does not reset an existing Owner. Also verify database connectivity in the startup logs.

Database connection error

Verify the database host, port, name, user, and password; confirm connections from the FiveM host are accepted; and use a restricted database account.

Include with a support request

• NebulaPanel purchase reference and installed version.
• FXServer artifact version and operating system.
• QBCore version or relevant framework changes.
• Exact reproduction steps.
• Relevant, redacted log lines.