From a hostname to a set of containers

Edge

One reverse proxy terminates HTTPS on port 443 for every site and service. It obtains and renews Let's Encrypt certificates with the HTTP-01 check, so port 80 has to be reachable. It routes by hostname. The admin area is checked on the way in, including two-factor authentication and any IP restriction you set.

Each hosting account

Each hosting account runs in its own set of containers, on its own private network, with CPU and memory limits on each container. A full set is:

• Web: PHP 8.2, 8.3 or 8.4, on NGINX or Apache
• MariaDB 11
• SFTP
• A web file manager at /files/
• Adminer at /adminer/
• A cron runner that calls the site over HTTP

Site files stay on the server disk and the database stays in its own volume, so a restart does not wipe them. Plans that allow custom Docker apps can add further containers, such as WordPress or Ghost, beside that set. Enterprise plans can also edit the account's Compose file. The panel refuses privileged containers, external volumes and secret interpolation.

The panel

The panel is a web application with a PostgreSQL database. It serves three areas: admin, reseller and client. It talks to Docker through a proxy that only allows the calls the panel needs, on an internal network. Building images and patching images through that proxy are turned off. Account stacks are rendered from a template and use images that have already been pulled onto the server.

The admin console covers clients, containers, DNS, plans, an IP pool, business branding, resellers, transfers, VPN, cron, allowlisted tools, processes, cluster pairing, health checks, metrics and an audit log.

DNS

PowerDNS answers on port 53. Creating an account creates a zone and an A record to the server. Admins and clients edit records in the portal. When mail is in use, SPF, DKIM and DMARC can be written into that zone. One node is the DNS authority when several servers are paired.

Mail, optional

Mailcow (mail delivery, mailboxes and SOGo webmail) runs as a separate stack behind the same proxy. The panel drives it through the Mailcow API: domains, mailboxes and domain admins. It needs about 8 GB of RAM. Mail is not part of cluster failover, and an account created through the Reseller API does not get mail automatically.

Host agent

A small service on the server does the work that has to happen on the host: the IP pool, the firewall, Fail2Ban, process listing, and allowlisted scripts. It is reachable only from the server itself. High-risk scripts ask for a typed confirmation, and the run is kept in history.

VPN and operator tools

A VPN gateway can offer WireGuard, OpenVPN, L2TP/IPsec and IKEv2 peers, with a monthly bandwidth cap. Administrators can also open container logs and start, stop or restart containers. An uptime tool is bundled; monitors are added by hand, not created with the account.

More than one server

A single server is the default. Paired servers share a signed API, send a heartbeat, and show one client list. You can provision an account on another node. Failover is manual, or automatic if you turn it on, and it works by changing DNS. There is no shared storage, no single database and no live migration. Mail does not fail over.

Rough size

Expect about 10 to 11 platform containers, about 18 to 22 more when mail is installed, and about 6 containers for each hosting account.

Security details