Installing Xtream UI in 2026: R22F, community mods and the risks

Installing Xtream UI in 2026 means installing software that nobody maintains. That is not a reason to skip this guide; it is the reason to read it. Thousands of panels still run on it, operators still inherit it, and the old forum posts that explained the installation are badly outdated. This guide replaces them. It explains what the R22F installer does, why the Ubuntu 18.04 requirement is a problem, what the community “mods” changed, and how to harden a panel whose upstream disappeared.

What Xtream UI is, and what it is not

Xtream UI appeared after the original Xtream Codes service was shut down in September 2019. A group of developers took the panel code base, kept the Xtream Codes database layout and API, and released it as a free download. Because the API stayed compatible, players and resellers that had worked with Xtream Codes kept working. The last official releases were R21 (stable) and R22F (early access). After that the project site went offline and no further official release followed. Anything newer that calls itself Xtream UI is a third-party build.

Two points follow from this history:

• There is no upstream. No security patches, no compatibility updates for newer PHP, MariaDB or Ubuntu releases, no official support.
• Every download is a mirror. The original distribution servers are gone. What you fetch today comes from someone’s GitHub account or file host. You cannot verify it against an official checksum, because there is none.

For the architecture of the panel (main server, load balancers, bouquets, lines) read the Xtream UI panel guide. This article is only about getting it onto a server and keeping it from falling over.

The risks, stated plainly

The old articles sold Xtream UI as “the most complete free IPTV panel”. In 2026 the honest description is: a capable panel frozen in 2021. Before you provision a server, weigh these points.

End-of-life operating system

The original installer targets Ubuntu 18.04 LTS. Canonical ended standard support for 18.04 in May 2023. Without an Ubuntu Pro subscription you receive no security updates for the kernel, OpenSSL, the C library or anything else. A streaming server exposed to the internet on an unpatched OS is a liability, and the panel itself does not stay hidden: the client port is probed constantly.

Frozen dependencies

Xtream UI ships its own nginx and PHP-FPM binaries inside /home/xtreamcodes/iptv_xtream_codes/ and uses the MariaDB package of the host OS. The bundled PHP belongs to the 7.x generation, which stopped receiving security fixes at the end of 2022. The MariaDB version that Ubuntu 18.04 provides is equally old. You cannot swap these components for current versions without breaking the panel’s compiled extensions and SQL assumptions. Community installers that claim Ubuntu 20.04 or 22.04 support work around this by shipping their own binaries or by pinning repositories; check the current release notes of whichever build you use, because the details differ.

Known security problems

Xtream UI inherited the Xtream Codes code base, and that code base had publicly discussed weaknesses: predictable admin paths, weak default credentials, SQL injection reports in reseller endpoints, and an API that leaks more than it should. Some of these were fixed in R22F, some only in community builds, some never. Running the panel behind a firewall that allows only the ports you need is not optional.

Cracked and modified builds

The forum post this article replaces promoted “CK MODS 41”, a community-modified build that bundled security fixes and extra features. Such builds exist for every release and they do fix real bugs. They also come from anonymous sources, cannot be audited by you, and have repeatedly been found with added backdoors or phone-home code. We name them as history. We do not link them, and we recommend you do not install one on a server that handles customer data or payments.

Legal exposure

The panel is just software. What you stream through it is your responsibility. This guide does not cover content sourcing, and nothing here changes your obligations under the copyright law of your country and your customers’ countries.

If any of this makes you hesitate, look at the XUI One vs Xtream UI comparison first. If you still want to proceed, continue.

Choosing hardware and OS in 2026

Dedicated or VPS

The 2023 advice was “never on a VPS”. That was partly marketing for a hosting affiliate. The real constraint is bandwidth and CPU: a main server that only runs the panel, the database and the EPG grabber is fine on a well-sized VPS with a few dedicated cores and 8–16 GB RAM. Load balancers that push streams need predictable, unmetered bandwidth and real cores, which usually means a dedicated server. Size them from your bitrate times concurrent viewers, plus a reserve of at least 20 percent.

Operating system options

You have three realistic choices:

1. Ubuntu 18.04 with the original R22F installer. Everything works as documented. The OS is unsupported. Only acceptable for a lab or for a migration box you will decommission.
2. Ubuntu 18.04 with Ubuntu Pro. Canonical’s extended security maintenance covers 18.04 until 2028. This at least patches the OS layer. The panel’s bundled PHP and nginx remain frozen.
3. A newer Ubuntu with a community installer. Ubuntu 20.04 or 22.04 images are still available from every host. Community installers rebuild the dependency set. You trade the OS problem for a trust problem; see above.

Whatever you pick, start from a clean image. Do not install the panel on a server that already runs a web stack, because the installer assumes it owns nginx’s ports and the MariaDB instance.

What the installer actually does

Understanding the installer helps you debug it and helps you notice when a mirror has changed it. The original R22F installer is a Python 2 script run as root. In order, it:

1. Checks the OS release and architecture.
2. Installs packages: MariaDB server, nginx dependencies, Python modules (notably paramiko), unzip, e2fsprogs.
3. Creates the xtreamcodes system user and /home/xtreamcodes/iptv_xtream_codes/.
4. Downloads the panel archive (nginx, PHP-FPM, admin web root, Python tools, the GeoLite2 database) and unpacks it.
5. Creates the database xtream_iptvpro, imports the schema and writes the connection details into an encoded config file.
6. Marks the GeoIP database immutable with chattr +i, runs permissions.sh and starts the services via start_services.sh.
7. Prints the admin URL (default port 25500), the default credentials and the database password.

A load-balancer install runs the same script with the server type set to load balancer, plus the main server’s IP and the key the panel generates under Servers → Add. The load balancer then pulls its configuration from the main server over the Xtream API.

The old guide also showed an “update to R22F” step: delete the admin and pytools directories, unpack a release zip over the installation, re-apply chattr, fix ownership with chown -R xtreamcodes:xtreamcodes, re-run permissions.sh and restart services. That is the generic Xtream UI upgrade procedure, and restoring from a backup archive follows the same steps.

Step-by-step installation

The commands below are generic. We deliberately leave out download URLs. Fetch the installer from a source you have decided to trust, and read the script before you run it as root.

1. Prepare the OS

apt update && apt full-upgrade -y
adduser ops
usermod -aG sudo ops
mkdir -p /home/ops/.ssh && cp ~/.ssh/authorized_keys /home/ops/.ssh/
chown -R ops:ops /home/ops/.ssh

Then in /etc/ssh/sshd_config set PasswordAuthentication no and PermitRootLogin prohibit-password, restart sshd, and confirm you can log in as the new user before closing the root session.

Install and arm a firewall before the panel opens its ports:

apt install -y ufw
ufw default deny incoming
ufw allow 22/tcp
ufw allow 25461/tcp
ufw enable

Port 25461 is the default client port. Do not open the admin port (25500 by default) to the world; reach it through an SSH tunnel or a VPN, or restrict it to your office IP with ufw allow from <ip> to any port 25500.

2. Install dependencies and run the installer (main server)

On Ubuntu 18.04 the installer expects Python 2 and a handful of libraries:

apt install -y libxslt1-dev libcurl3 libgeoip-dev python unzip e2fsprogs python-paramiko

On 20.04 and later libcurl3 no longer exists and Python 2 is not installed by default; community installers deal with this, which is exactly why they diverge from the original. Check the current release notes of the build you use.

Run the installer as root, choose MAIN, and wait. Copy the credentials it prints into your password manager now; the database password is not shown again.

3. First login and defaults

Open http://<server-ip>:25500 through your tunnel. Log in with the printed credentials and, before anything else:

• Change the admin password and the admin username.
• Change the admin port under Settings and update your firewall rule.
• Create a second admin account with a different name and test it, then consider disabling the original admin.
• Set the server’s public hostname under Servers if you plan to use TLS.

4. Attach load balancers

On each streaming server, prepare the OS exactly as in step 1 (firewall included), run the installer, choose LB, and enter the main server IP and the key from Servers → Add Server. Back in the panel, the new server should appear online within a minute. If it stays offline, check that the load balancer can reach the main server on the client port and that the main server’s firewall allows the load balancer’s IP.

In the old forum thread a reader’s load balancer install hung for hours. The cause was a dead download mirror inside the installer. Expect this failure mode with abandoned software: the script is fine, the URL it fetches is gone.

5. TLS

Xtream UI predates the expectation that everything speaks HTTPS, and the bundled nginx is not managed by your distribution. You have two workable approaches:

• Reverse proxy. Install a current nginx or Caddy on the main server (or a separate box), obtain a certificate with a maintained ACME client, and proxy to the panel’s ports. This keeps the certificate automation outside the frozen stack.
• Edit the bundled nginx. Point /home/xtreamcodes/iptv_xtream_codes/nginx/conf/nginx.conf at your certificate files. You then have to renew and reload by hand or by a cron job you write yourself.

Do not rely on the certbot package from the Ubuntu 18.04 archive. It is unmaintained and older ACME clients have broken before when Let’s Encrypt retired protocol versions and intermediate certificates. Use the snap package or a client on a current OS.

6. Backups

Dump the database nightly and ship it off the server:

mysqldump --single-transaction xtream_iptvpro | gzip > /var/backups/xtream-$(date +%F).sql.gz

Also archive /home/xtreamcodes/iptv_xtream_codes/ once after installation and after every configuration change; it holds the encoded config, the admin web root and your nginx edits. Test a restore on a scratch server at least once. If you later leave the platform, the uninstall guide explains how to remove it cleanly.

Hardening checklist

• Firewall allows only SSH, the client port and, from known IPs, the admin port.
• SSH keys only, no root password login, fail2ban or equivalent on SSH.
• Admin username and port changed from the defaults.
• Reseller API and admin panel not reachable from the internet without a VPN or IP allow-list.
• MariaDB bound to localhost on the main server; load balancers talk to the main server through the Xtream API, not to the database.
• Automatic OS security updates where the OS still provides them.
• Separate monitoring (disk, memory, connection count, certificate expiry) because the panel’s own dashboard dies with the panel.
• A documented plan for what happens when the next PHP or OpenSSL vulnerability lands and you cannot patch the bundled binaries.

When to stop and choose something else

Installing Xtream UI in 2026 is justified for a lab, for keeping a legacy business alive while you migrate, or for studying the API that most players still implement. It is hard to justify for a new service with paying customers. The maintained alternatives are XUI One, a paid panel from the same lineage that still targets current Ubuntu releases (see the XUI One installation guide), or a hosted panel where the operator does not own the servers at all. Our IPTVOS review covers that third model, including its limits. Whichever you choose, the time you spend hardening an abandoned stack is time you could spend on the business.