Xtream UI panel explained: servers, streams, lines and resellers

The Xtream UI panel is the free successor of Xtream Codes, and in 2026 it is still the mental model most IPTV operators carry around: a main server, some load balancers, streams grouped into bouquets, lines handed out to customers, resellers who sell those lines. This guide explains each of those pieces, how they fit together, how to size the servers behind them, and where the panel shows its age. It replaces a 2023 forum post that was half feature list and half hosting advertisement.

Where Xtream UI comes from

Xtream Codes was a commercial panel that dominated the market until law enforcement shut it down in September 2019. Within weeks a team released Xtream UI, built on the same code base and the same database layout. Operators could restore an Xtream Codes backup into it and continue. Players did not need to change because the client API stayed identical. That API compatibility is the reason the panel still matters: almost every IPTV app on the market implements “the Xtream Codes API”, and Xtream UI is its reference implementation.

Official development ended with R21 (stable) and R22F (early access) in the 2020–2021 period. The project site went offline and the developers advised users to keep mirrors of the files. Everything you find today is a mirror or a community modification. The panel is unmaintained, and you run it at your own risk. For the practical consequences of that, see Installing Xtream UI in 2026.

Architecture: main server and load balancers

An Xtream UI deployment has two kinds of servers.

The main server

The main server runs the panel itself: the admin web interface, the reseller interface, the client API, the MariaDB database, the EPG grabber and the scheduler. Every login, every playlist request and every line check hits the main server first. It also tells the load balancers what to do. If the main server is down, customers cannot authenticate even if the streams on the load balancers are still running.

The main server needs a fast disk for the database, enough RAM for MariaDB and PHP-FPM, and a stable public IP. It does not need huge bandwidth unless it also streams.

Load balancers

A load balancer is a server that is attached to the panel solely to ingest and redistribute streams. It runs the same bundled nginx and the Python tooling, registers with the main server using a key, and pulls its stream assignments from there. Customers connect to the main server’s domain, and the panel redirects each playback request to the load balancer that currently holds the stream and has capacity.

You can run streams on the main server as well; the panel treats it as a server like any other. Most operators stop doing that once the viewer count grows, because a streaming process that consumes all CPU will also take down the admin panel and the database.

Load balancers are stateless from the operator’s point of view. If one fails, you move its streams to another one in the panel. If you add one, you select it in the stream’s server list. The main server is the single point of failure; back it up accordingly.

Streams

A stream is anything the panel ingests and redistributes. Xtream UI distinguishes several types:

• Live streams – a source URL (HTTP, HLS, RTMP, UDP and others supported by the bundled FFmpeg). The panel pulls it continuously or on demand and serves it to viewers in MPEG-TS or HLS.
• Movies (VOD) – files on local or remote storage, or remote URLs, with metadata pulled from a movie database.
• Series – episodes grouped under a series title with season and episode numbers.
• Radio stations – audio-only live streams.
• Created channels (24/7) – a playlist of VOD files looped as a live channel.

Each stream has a category, which is what the customer sees as a folder in the player, and belongs to one or more servers. The panel also keeps a stream’s status (running, stopped, error) and its current viewers.

On-demand mode

The old guide called this a way to “save money”, and that is accurate. A stream in on-demand mode is not pulled from the source until a viewer requests it, and it stops a short time after the last viewer leaves. Hundreds of rarely watched channels cost nothing while idle. The trade-off is a start-up delay of a few seconds on first request, and that the panel cannot show “online” status for streams nobody is watching. Streams you expect to be watched constantly stay in always-on mode.

Transcoding profiles

The panel can pass streams through FFmpeg with a profile that changes codec, resolution, bitrate or buffer. Transcoding is CPU-heavy; one full-HD transcode occupies roughly one strong core. Most operators restream as-is and only transcode to fix a problematic source. If you transcode at scale, your load balancer sizing changes completely.

Bouquets

A bouquet is a named collection of streams, movies, series and radio stations. Bouquets are the link between content and customers: a line is assigned one or more bouquets, and the customer sees exactly the union of those bouquets. Typical bouquets are “Basic”, “Sports add-on”, “Country X”, “Adult” and so on. Changing a bouquet changes what every line holding it can see, immediately, without touching the lines.

Design your bouquets before you add customers. Renaming or splitting bouquets later is possible but every reseller who has been handed a package definition will have to be told.

Lines

A line is a customer account. The panel supports:

• Username and password lines – used by apps that implement the Xtream Codes API and by M3U playlists. The same line can produce an M3U, an M3U with options, an Enigma 2 list and other formats.
• MAG devices – identified by MAC address, served through the Stalker-style portal.
• Enigma 2 devices – also identified by MAC address.

Each line has an expiry date, a maximum number of simultaneous connections, assigned bouquets, and optional restrictions: allowed countries, allowed ISPs, forced output format, and a “trial” flag. The panel logs every connection with IP, user agent and the stream watched, which is what you use to spot shared accounts.

Mass tools let you change passwords, extend expiry dates, delete expired lines or change the DNS in bulk. They work, but they operate directly on the database, so take a dump first.

Resellers

Resellers are the sales layer. A reseller logs into the reseller interface, has a credit balance, and spends credits to create or extend lines. Xtream UI supports reseller groups with distinct permissions: can the reseller delete lines, see connection logs, create sub-resellers, choose any bouquet or only approved packages, and so on. Packages define what a reseller can sell: which bouquets, how many connections, how long, for how many credits.

The reseller API lets reseller-facing billing systems create and extend lines automatically. It is also one of the panel’s historically weak points; restrict access to it by IP wherever you can. A built-in ticket system exists for reseller support, though most operators use external tools.

EPG

The panel fetches XMLTV sources on a schedule and matches programmes to channels by EPG channel ID. You configure the sources under EPG, assign an EPG ID to each live stream, and the panel exposes the guide through the client API and through XMLTV for players. The matching is manual: a stream with a missing or wrong EPG ID simply has no guide. Operators with thousands of channels spend real time on this, and the panel offers little help beyond bulk editing.

Sizing the servers

The 2023 recommendations were inflated by a hosting partner. Here is a more useful framing.

Main server

The main server is bounded by the database and PHP workload: logins, playlist generation, API calls, connection logging. A few dedicated cores, 8–16 GB RAM and an SSD handle tens of thousands of lines. Add RAM if you keep long connection logs. Bandwidth matters little unless it also streams.

Load balancers

Bandwidth is the first constraint. The maths is simple:

Bitrate per stream	Concurrent viewers	Required egress
3 Mbit/s (SD)	500	1.5 Gbit/s
5 Mbit/s (HD)	500	2.5 Gbit/s
8 Mbit/s (Full HD)	500	4.0 Gbit/s
13 Mbit/s (4K)	500	6.5 Gbit/s

Keep a 20–30 percent reserve above the calculated figure. Ingress matters too: every always-on stream pulls its source bitrate continuously, so a server with 1,000 always-on HD streams downloads 5 Gbit/s before a single viewer connects. If you have more streams than viewers, size for ingress; if you have more viewers than streams, size for egress.

CPU matters when you transcode, when you use HLS (segmenting costs more than pass-through TS), and when a single server handles thousands of concurrent connections. RAM mostly serves the pre-buffer per viewer and the page cache for VOD. Disk space is about VOD and logs.

Ubuntu 18.04 was the only supported OS for the original installer, and it is end-of-life. Which OS you can realistically use depends on the installer you choose; see the installation guide.

Where Xtream UI is weak in 2026

The old article did not have this section. It should have.

• No maintenance. No security fixes since 2021, no compatibility work. Each new PHP, OpenSSL or MariaDB vulnerability stays open in the bundled binaries.
• End-of-life platform. The reference OS lost standard support in 2023; the bundled PHP 7.x lost security support in 2022.
• Security record. Default admin paths and credentials, a reseller API with historic injection reports, and widely circulated modified builds with unknown additions. Hardening is on you.
• Operational blind spots. No built-in alerting, no health checks beyond the server list, EPG matching by hand, logs that grow until the disk fills.
• No modern delivery features. No native DASH, no low-latency HLS, limited DRM options, no built-in CDN or edge integration, no per-region routing beyond basic server assignment.
• Billing is external. The panel has resellers and credits but no customer-facing shop, payment processing or invoicing. Every operator bolts on a separate billing system through the reseller API.
• Single point of failure. The main server has no clustering story; if it dies, authentication dies.

None of this makes the panel useless. It explains why most of its vocabulary lives on in newer products while the software itself is retired. XUI One is the paid continuation with current OS support; the XUI One vs Xtream UI comparison weighs the two. Hosted panels remove the server layer altogether; the IPTVOS review looks at one such product, strengths and gaps included.

Summary

Xtream UI gave the industry its shared vocabulary: main and load balancer, stream, bouquet, line, reseller, credit. Understanding those terms is still worth your time because every panel since has reused them. Running the software itself in 2026 is a different decision: it is free, familiar and unmaintained. If you take it on, read the installation guide for the hardening work, keep off-server backups of the database, and know how you will leave when the time comes.