Glossary

Abbreviations and acronyms

A quick expansion of the abbreviations used across the documentation.

| Abbreviation | Stands for |
|---|---|
| **AAAA** | Quad-A record (the DNS record that points a name at an IPv6 address; the A record does the same for IPv4). |
| **ACME** | Automatic Certificate Management Environment (the protocol Let's Encrypt uses to issue certificates). |
| **AI** | Artificial Intelligence (software that answers questions or generates content; AI crawlers collect pages to train such software). |
| **AJAX** | Asynchronous JavaScript and XML (a browser technique that loads data in the background without reloading the page). |
| **AMQP** | Advanced Message Queuing Protocol (the messaging protocol RabbitMQ uses). |
| **API** | Application Programming Interface (how software talks to the platform). See API reference. |
| **APM** | Application Performance Monitoring. See Monitoring. |
| **CC** | Carbon Copy (extra recipients who also receive an email or the replies on a ticket). |
| **CDN** | Content Delivery Network. |
| **CI / CD** | Continuous Integration / Continuous Delivery (an automated pipeline that builds, tests and deploys your code). |
| **CIDR** | Classless Inter-Domain Routing (an IP-range notation such as `203.0.113.0/24`). |
| **CISA** | Cybersecurity and Infrastructure Security Agency (the United States agency that publishes the KEV list of exploited weaknesses). |
| **CLI** | Command-Line Interface (text commands run over SSH; see the TurboStack CLI). |
| **CMS** | Content Management System (such as WordPress or Drupal). |
| **CNAME** | Canonical Name (a DNS record that points one name at another name, shown as "Alias" in some interfaces). |
| **CPU** | Central Processing Unit (the server's processor). |
| **CRM** | Customer Relationship Management (software for tracking customers, leads and sales, such as Odoo). |
| **CSR** | Certificate Signing Request (submitted to a certificate authority to buy a certificate). |
| **CSS** | Cascading Style Sheets (the files that control how a web page looks). |
| **CSV** | Comma-Separated Values (a simple spreadsheet/export file format). |
| **DAL** | Data Abstraction Layer (Shopware's layer between the application and the database). |
| **DAV** | Distributed Authoring and Versioning (the WebDAV protocol for working with files over HTTP; CalDAV and CardDAV are its calendar and contacts versions). |
| **DB** | Database (the short form used in command names, log output and configuration keys). |
| **DDoS** | Distributed Denial of Service (an attack that floods a site to take it offline). |
| **DI** | Dependency Injection (how a framework wires classes together; Magento compiles its DI container in production mode). |
| **DKIM** | DomainKeys Identified Mail (an email-authentication signature). See Email. |
| **DMARC** | Domain-based Message Authentication, Reporting and Conformance (an email-authentication policy). |
| **DNS** | Domain Name System (translates domain names to IP addresses). See Connecting your domain. |
| **DNSSEC** | Domain Name System Security Extensions (signed DNS answers, so a resolver can detect a forged reply). See DNS management. |
| **EAV** | Entity-Attribute-Value (the flexible database model Magento uses to store product attributes). |
| **EdDSA** | Edwards-curve Digital Signature Algorithm (the modern SSH key type, used by Ed25519 keys). See Add an SSH key. |
| **EOL** | End Of Life (a version that no longer receives updates or security fixes). |
| **EPP** | Extensible Provisioning Protocol (the protocol behind domain registrations; the EPP code is the authorization code you need to transfer a domain). |
| **ERP** | Enterprise Resource Planning (business-management software such as Odoo). |
| **ESI** | Edge Side Includes (a Varnish feature that builds one page from separately cached fragments). |
| **FPM** | FastCGI Process Manager (the part of PHP that runs your code behind the web server; always written PHP-FPM). |
| **FQDN** | Fully Qualified Domain Name (a complete hostname such as `www.example.com`). |
| **FTP / SFTP** | File Transfer Protocol / SSH File Transfer Protocol (file upload methods; SFTP is the secure one). |
| **FTPS** | File Transfer Protocol Secure (classic FTP wrapped in TLS encryption; not the same as SFTP). |
| **GB** | Gigabyte (a unit of storage or memory; 1 GB is 1024 megabytes). |
| **GC** | Garbage Collection (a runtime freeing memory it no longer needs; heavy GC pressure slows an application down). |
| **GD** | The GD Graphics Library (the PHP extension that resizes and converts images; ImageMagick is the alternative). |
| **GeoIP** | Geographic IP (locating a visitor's country from their IP address). |
| **GUI** | Graphical User Interface (the web interface of the TurboStack Platform, as opposed to YAML or the API). |
| **HSTS** | HTTP Strict Transport Security (a header that forces browsers to use HTTPS). |
| **HTML** | HyperText Markup Language (the code a web page is built from). |
| **HTTP / HTTPS** | HyperText Transfer Protocol (Secure) - the web protocol; HTTPS is the encrypted version. |
| **IIS** | Internet Information Services (Microsoft's web server). |
| **IMAP** | Internet Message Access Protocol (for reading email). |
| **IoC** | Indicator of Compromise (see the security table above). |
| **IP / IPv4 / IPv6** | Internet Protocol address (a server or visitor's network address). |
| **JS** | JavaScript (the programming language that runs in the visitor's browser). |
| **JSON** | JavaScript Object Notation (the data format the API uses). |
| **JVM** | Java Virtual Machine (the Java runtime that Elasticsearch and OpenSearch run on; the memory it reserves is called the heap). |
| **JWT** | JSON Web Token (a signed token an application uses to recognize a signed-in user or service). |
| **LTS** | Long-Term Support (a release that keeps receiving fixes for an extended period, so it is the safe choice for production). |
| **MB** | Megabyte (a unit of storage or memory; 1024 MB is 1 GB). |
| **MX** | Mail Exchanger (the DNS record that says which mail server receives a domain's email). |
| **NoSQL** | A non-relational database model (such as MongoDB). |
| **OCSP** | Online Certificate Status Protocol (how a browser checks that a TLS certificate has not been revoked). |
| **OOM** | Out Of Memory (when a server runs out of usable memory). See Out of memory. |
| **OPcache** | PHP's compiled-code cache, which speeds up PHP by reusing compiled scripts. |
| **ORM** | Object-Relational Mapping (a library that maps database tables to objects in your code, such as Laravel's Eloquent). |
| **OS** | Operating System (the software a server runs on, such as Debian or Ubuntu). |
| **OSI** | Open Systems Interconnection (the seven-layer network model; layer 3 is the network layer and layer 7 the application layer). |
| **OWASP** | Open Worldwide Application Security Project (the non-profit that publishes the OWASP Top 10 list of the most common web application risks). |
| **PDF** | Portable Document Format (the document format used for invoices, labels and exports). |
| **PEM** | Privacy Enhanced Mail (the plain-text file format for certificates and keys, starting with a `-----BEGIN` line). |
| **PFX** | Personal Information Exchange (a `.pfx` file bundling a certificate and private key). |
| **PHP** | PHP: Hypertext Preprocessor (the programming language most web applications on the platform run on). |
| **PIM** | Product Information Management (product-catalog software such as Akeneo). |
| **PM2** | A process manager for Node.js applications that keeps them running and restarts them after a crash. |
| **POP3** | Post Office Protocol version 3 (an older protocol that downloads email to one device; IMAP is the modern choice). |
| **PTR** | Pointer record (a reverse-DNS record mapping an IP address back to a hostname). |
| **QR** | Quick Response code (the square barcode you scan with a phone camera). See Two-factor authentication. |
| **RAM** | Random Access Memory (the server's working memory). |
| **RBL** | Realtime Block List (a public blocklist of IP addresses and domains known for spam). See Email deliverability. |
| **REST** | Representational State Transfer (the style of the TurboStack API: ordinary HTTP requests returning JSON). See API reference. |
| **RSA** | Rivest-Shamir-Adleman (an older public-key algorithm, still supported for SSH keys and certificates). |
| **SEO** | Search Engine Optimization (the work of making a site rank well in search results). |
| **SES** | Simple Email Service (Amazon's service for sending bulk email). |
| **SLA** | Service Level Agreement. |
| **SMTP** | Simple Mail Transfer Protocol (for sending email). |
| **SNI** | Server Name Indication (lets one IP address serve certificates for multiple domains). |
| **SPF** | Sender Policy Framework (an email-authentication record). See Email. |
| **SQL** | Structured Query Language (the query language for relational databases). |
| **SSH** | Secure Shell (encrypted remote access to a server). See SSH access. |
| **SSO** | Single Sign-On (signing in with one identity, such as GitHub or Google). |
| **STARTTLS** | The mail-protocol command that upgrades a plain connection to an encrypted TLS one. |
| **TCP** | Transmission Control Protocol (the connection-based transport protocol behind HTTP, SSH and database traffic). |
| **TLS / SSL** | Transport Layer Security, formerly Secure Sockets Layer (SSL) - the encryption behind HTTPS. See TLS certificates. |
| **TOTP** | Time-based One-Time Password (the six-digit code an authenticator app generates, valid for about 30 seconds). See Two-factor authentication. |
| **TTL** | Time To Live (how long a DNS record or cache entry stays valid). |
| **TXT** | Text record (a DNS record holding free text, used for SPF, DKIM, DMARC and domain-ownership checks). |
| **UDP** | User Datagram Protocol (a lightweight transport protocol without connections, used by DNS and VPN traffic). |
| **UI** | User Interface (the screens you click in, as opposed to a command line or the API). |
| **URL** | Uniform Resource Locator (a web address such as `https://example.com/page`). |
| **VAT** | Value Added Tax (the European sales tax; your VAT number appears on your invoices). |
| **VCL** | Varnish Configuration Language (the rules that control Varnish caching). |
| **VIP** | Virtual IP address (an IP address that can move between servers, so a standby server can take over). |
| **VPN** | Virtual Private Network (a private, encrypted network). See Networking. |
| **WAF** | Web Application Firewall (filters web requests to block attacks). See Security. |
| **WHM** | WebHost Manager (the server-wide administration interface that comes with cPanel). See System types. |
| **XSS** | Cross-Site Scripting (a web attack that injects malicious scripts into a page). |
| **YAML** | YAML Ain't Markup Language - the text format used for a host's configuration. See The Source (YAML) view. |


Glossary

Related

- Core concepts
- Threat Center


Monitoring

# Monitoring

TurboStack monitors your infrastructure and applications so problems are caught early. This page explains the monitoring and observability you get and how to use it well.

> [!NOTE]
> The in-app **Monitoring** screen is documented at Monitoring, and each host has a **Health** tab documented at Health.

> [!TIP]
> Each host's **Health** tab gives you a live overview of top issues, CPU/memory/disk usage and service checks. The **Monitoring** section in the main navigation collects monitoring across your hosts.


Monitoring

Infrastructure and service monitoring

TurboStack's monitoring provides uptime and health checks for your hosts and services. It watches system-level metrics such as disk, memory, load and open ports, and runs dedicated checks for the services you run, including:

| Category | Examples |
| --- | --- |
| Databases | PostgreSQL, MySQL, MongoDB |
| Caching and search | Redis, Elasticsearch/OpenSearch, Varnish |

You receive email alerts whenever a status changes, and you can review current state on a read-only monitoring dashboard.


Monitoring

Per-application health checks

You can set a `monitoring_url` for each application so that every production site is actively monitored. See Applications for where to configure this.

> [!TIP]
> Set a `monitoring_url` on every production application so each site is checked continuously and you are alerted the moment it goes down.


Monitoring

Application Performance Monitoring (APM)

For deeper insight into how your applications behave, optional APM integrations are available:

| Tool | What it offers |
| --- | --- |
| New Relic | PHP and Python transaction tracing, errors and slow transactions. |
| Tideways | PHP profiler and APM. |
| Blackfire | On-demand profiling. |

These are configured with per-application API keys. See Advanced settings.

> [!TIP]
> With Blackfire you can profile a page directly from the browser: install the Blackfire browser
> extension (Chrome or Firefox), sign in with your blackfire.io account, open the page and click
> **Profile** to see the call graph and timeline. The **Profile all requests** mode (for POST and
> Ajax calls) currently works in Firefox, not Chrome. You can also start a profile over SSH with
> `tscli blackfire enable`.


Monitoring

Database monitoring

Advanced Database Monitoring provides query-performance insight and metrics dashboards for your databases. It uses a central **monitoring master server** that collects metrics from your TurboStack servers.

To send a server's database metrics to a monitoring master, enable it on the host's **Advanced > Advanced Database Monitoring**. Fill in the master server's hostname and, optionally, the sampling rate. You can also configure it in YAML:

```yaml
pmm_master:
  server_hostname: pmm.example.com
```

> [!TIP]
> Keep the default **sampling rate of 50** unless you have a reason to change it. It collects metrics from every Nth query; a lower value gives more detail but adds load to both the monitored server and the master.

Once a monitoring master is running, open its dashboard at `https://pmm.<yourdomain>`. Log in with the `pmmagent` user; its credentials are available from the **Credentials** button in the TurboStack interface.

If you do not have a monitoring master yet, you can run one on TurboStack - see Self-hosted platforms. For where database services are configured, see Services.


Monitoring

Standards-based metrics

An optional OpenTelemetry collector is available for standards-based metrics export, so you can feed monitoring data into your own observability tooling.


Monitoring

Related

- Applications
- Services
- Advanced settings
- Security overview
- Networking


Networking

# Networking

TurboStack gives your servers secure, private ways to talk to each other and to your own network. This page explains the networking capabilities you can rely on and the value each one brings. Private networking keeps internal traffic - database replication, backups and monitoring - off the public internet, and high availability reduces downtime; both matter for keeping critical sites online.


Networking

PrivateNet

PrivateNet is a secure, encrypted private overlay network - a mesh Virtual Private Network (VPN) - that connects your managed servers. It lets your servers exchange traffic safely for tasks such as database replication, backups and monitoring, without exposing anything to the public internet.

PrivateNet uses a private Domain Name System (DNS) suffix, so your servers reach each other by name with no public DNS required. Servers join the network automatically, and you get secure, short-lived certificate-based Secure Shell (SSH) access over the overlay.


Networking

Site-to-site VPN

An optional IPsec site-to-site VPN creates encrypted tunnels between your own network and your servers, so an office network and the servers behave as one private network. Split tunnelling is available so only the traffic you choose travels through the tunnel.


Networking

Remote-access VPN

An optional Secure Sockets Layer (SSL) VPN (OpenConnect, compatible with Cisco AnyConnect) gives your team secure remote access to your environment. It supports per-user accounts and split-tunnel routes so users reach your servers without routing all of their traffic through the VPN.


Networking

High availability and load balancing

For resilient setups, a virtual IP (Internet Protocol) address can fail over between a pair of servers in an active/passive configuration. This means one server handles traffic while a second stands by. Health checks continuously monitor the active server, and if it fails the virtual IP moves to its partner so your service keeps running.


Networking

How these are set up

Most networking features are provisioned by Hosted Power as part of your setup rather than being self-served toggles, so they are tailored to your environment.

> [!NOTE]
> To enable a VPN or high-availability configuration, contact support.


Networking

Related

- Security overview
- Monitoring
- SSH access
- Support


Performance tuning

turbostack performance caching Redis Varnish opcache database tuning

# Performance tuning

TurboStack ships with sensible, server-aware defaults so most sites are fast by default. This
page explains the caching layers available to you and how to override the defaults safely.

Faster pages improve conversion and search ranking, and they keep your site responsive during
traffic peaks such as sales campaigns. For online stores, caching is the main tool for staying fast
under load.

> [!IMPORTANT]
> TurboStack auto-tunes memory sizing to the size of your server. Only override these values with
> **measured evidence**, such as memory pressure, a low cache hit ratio, or garbage-collection
> (GC) pressure. Guessing at larger values usually makes performance worse, not better.


Performance tuning

Caching layers

Caching is the highest-impact lever for most sites. TurboStack provides several layers, each suited
to a different workload.

| Layer | What it caches | Notes |
| --- | --- | --- |
| Redis (port `6379`) | Transient application cache | Safe to clear at any time |
| Redis (port `6378`) | Durable sessions and queues | Persistent - do not clear casually |
| Varnish | Full-page HyperText Markup Language (HTML) responses | For PHP storefronts (Magento, Shopware, WordPress) |
| OPcache | Compiled PHP bytecode | Per-application; see PHP advanced options |


Performance tuning

Redis

The cache instance on port `6379` holds transient data and is safe to clear. The persistent
instance on port `6378` stores durable data such as sessions and queues, so clearing it can log
users out or drop queued jobs. Configure Redis from the host's
Services tab.


Performance tuning

Varnish

Varnish is a full-page cache that sits in front of PHP storefronts. It is most effective for
read-heavy catalog and content pages on Magento, Shopware, and WordPress.


Performance tuning

OPcache

OPcache stores compiled PHP bytecode so scripts do not have to be recompiled on every request. You
can tune it per application under
Applications > Technologies > PHP advanced options, where you
can enhance OPcache and set a preload script.


Performance tuning

Sizing keys you can override

These values are auto-tuned to your server by default. Change them only with evidence.

| Key | What it controls |
| --- | --- |
| `mysql_innodb_size` | InnoDB buffer pool size for MySQL/MariaDB |
| `postgresql_shared_buffers` | Shared memory PostgreSQL uses for caching data |
| `redis_memory` | Maximum memory Redis may use before eviction |
| `elasticsearch_heap_size` | Java Virtual Machine (JVM) heap allocated to Elasticsearch |
| `varnish_cache_size` | Memory reserved for the Varnish full-page cache |


Performance tuning

PHP-FPM and OPcache

PHP performance is tuned per application. Under
Applications > Technologies, the PHP advanced settings let you
adjust the PHP-FPM process manager (`pm` start, min spare, and max spare servers) and enable OPcache
preloading. Raise the PHP-FPM worker counts only when you see requests queuing and have the memory
headroom to support them. Each worker is one PHP process handling one request at a time.


Performance tuning

Measure first

Always find the real bottleneck before changing anything. A slow page is often caused by a single
layer (database, cache, or PHP) and tuning the wrong one wastes effort.

1. Check the host's Health tab for resource pressure.
2. Use Monitoring to inspect trends over time.
3. See Monitoring concepts to understand what the metrics mean.

Once you have identified the constrained resource, apply the smallest override that relieves it and
re-measure.


Performance tuning

Related

- Services
- Applications
- Health
- Monitoring concepts
- TurboStack CLI - clear Redis, Varnish and OPcache on the server


Accounts and access

# Accounts and access

What you can see and do in TurboStack depends on the account you are signed in to. This page explains
what your account gives you access to, and how multi-account login works for agencies and partners
who manage several customer accounts and switch between them without signing out.


Accounts and access

What your account can access

Your account manages its own resources. You can work with your **Hosts**, **Groups**, **Templates**,
global **Search**, **Monitoring**, **Support** and your account settings. You only ever see the
resources that belong to your own account.


Accounts and access

Multi-account login and account selection

A single login can be linked to more than one account. When it is, TurboStack shows the **Select
account** screen after you sign in so you can choose which account to work in. You can switch to
another linked account later without signing out. This is useful for agencies and partners who
manage several customer accounts. See Logging in.


Accounts and access

Permissions

Access in TurboStack is scoped to your account: you only see the hosts, groups and templates that
belong to the account you are signed in to. Switching to another linked account changes which
resources are visible accordingly.

Permissions themselves are not set in TurboStack. They are part of the contact's profile in the
Customer Center, so that is where you grant or withdraw them - see
Contacts.


Accounts and access

If you see a permission message instead of your hosts

A contact who can sign in but has not been given the right permissions sees a message instead of the
interface. There are two:

| Message | What it means | How to fix it |
|---|---|---|
| "You don't have access to GUI TurboStack. Please login to the portal and configure your permissions for TurboStack." | The contact may sign in, but does not have the TurboStack **Access UI** permission. | In the Customer Center, open the contact and turn on **Access UI** under the TurboStack permissions. |
| "You don't have access to the services of TurboStack. Please login to the portal and configure your services for TurboStack." | The contact has access to the interface, but to none of the services on the account, so there is nothing to show. | In the Customer Center, give the contact access to the service (the server) it should manage, under the per-service permissions. |

Both are corrected in the Customer Center, not in TurboStack. After the change, sign out and sign in
again so the new permissions are loaded.

> [!NOTE]
> Only someone with permission to manage contacts can change this. If that is not you, ask the main
> account holder or another administrator on the account.


Accounts and access

Related

- Logging in
- Navigating the interface
- Contacts - where permissions are granted.
- Glossary


Security hardening checklist

turbostack security harden server ssh keys turboshield waf 2fa best practices

# Security hardening checklist

TurboStack is secure by default, but a few deliberate choices make your servers and applications significantly harder to attack. Work through this checklist and tighten each area to match your risk.


Security hardening checklist

Access

- Use Secure Shell (SSH) keys and disable password authentication (SSH). Keys cannot be guessed the way passwords can.
- Restrict access with an Internet Protocol (IP) allow-list (Security).
- Enable two-factor authentication (2FA) on your account, so a stolen password alone is not enough to log in.
- Treat Credentials as secrets. Store and share them carefully.
- Use least-privilege extra database users (readonly where possible) (Applications).


Security hardening checklist

Web protection

- Keep TurboShield enabled, and raise it to `high` while under attack.
- Enable the Web Application Firewall (WAF), which blocks common web attacks such as SQL injection.
- Consider GeoIP filtering (blocking by the visitor's country) for regions you do not serve.
- Understand how the layers fit together (Security overview).


Security hardening checklist

Encryption (TLS)

- Always use Let's Encrypt and redirect all traffic to HTTPS, the encrypted version of HTTP. This keeps data between your visitors and the server private. See Transport Layer Security (TLS) certificates.


Security hardening checklist

Stay current and watch

- Keep your application and runtime versions updated.
- Review the Threat Center for vulnerabilities and malware.
- Act promptly on any findings.

> [!TIP]
> Start with the defaults. TurboStack is secure by default. Tighten settings based on what the Threat Center reports for your hosts.


Security hardening checklist

Related

- Security configuration
- Security overview
- SSH
- Threat Center
- Two-factor authentication
- TurboStack CLI - manage firewall blocks from the server with `tscli firewall`


Security overview

# Security overview

TurboStack defends your servers and applications with layered protection that works automatically. This page explains what each layer does in plain language. For the settings you can adjust yourself, see Security configuration.

> [!NOTE]
> Each host has a **Threat Center** tab that surfaces the security findings detected on that host (see TurboRadar below).


Security overview

TurboShield

TurboShield filters traffic to your applications and is enabled by default at the `medium` level. It protects your applications without blocking the visitors and search engines you want to reach.

TurboShield provides:

- **Rate limiting** - caps how many requests and connections a single visitor can make, so nobody can consume all your capacity.
- **Bot classification** - friendly limits for verified good bots (such as Google and Bing) and stricter limits or blocks for scraping and AI training crawlers.
- **Search-bot verification** - confirms that traffic claiming to be Googlebot or Bingbot is genuine, preventing spoofing.
- **Known-exploit blocking** - blocks requests matching known exploit signatures before they ever reach your application.
- **Attack detection** - recognizes attack behavior in your logs (injection probing, file scanning, brute-force logins) and temporarily bans the source at both the web server and the firewall. Bans always expire on their own.
- **Shared reputation** - blocks sources already known to be malicious on other sites.
- **Bot challenge (optional)** - an automatic browser check for suspicious visitors, for sites under scraping or credential-stuffing pressure.

You can choose a level to match your situation:

| Level | What it does |
| --- | --- |
| `low` | Relaxed limits for sites with heavy legitimate automation. |
| `medium` | Balanced protection for most applications (default). |
| `high` | Tighter limits for sites under sustained bot pressure. |
| `attack` | Aggressive protection during an active attack: adds distributed-attack and disguised-browser detection, and longer bans. |

Trusted addresses on your allow-list skip every check. See Configure TurboShield.

> [!NOTE]
> When a visitor exceeds a limit they receive a soft `429` response and can try again shortly. They are not banned at the firewall.


Security overview

Firewall

TurboStack runs a stateful firewall that protects your server at the network layer. It continuously watches for malicious behavior such as SSH brute-force attempts and web attacks, and automatically blocks offending IP addresses. Bans expire automatically. It applies connection rate limits, honours any IP addresses on your allow-list, and is fully managed by the platform.


Security overview

TurboRadar

TurboRadar adds runtime security detection and scanning that runs after your application is deployed. It:

- detects suspicious process behavior such as web shells, in-memory or fileless malware, and access to credential files;
- finds known vulnerabilities (Common Vulnerabilities and Exposures, or CVEs) in your packages and containers; and
- runs commerce-specific malware scans for Magento, WooCommerce and PrestaShop.

Findings are reported to each host's Threat Center tab, where you review them, see how urgent each one is, and act on it.


Security overview

Encryption and access

- **Transport Layer Security (TLS) certificates** - the encryption behind `https://` - are issued and renewed automatically for each application using Let's Encrypt. This keeps traffic between your visitors and the server private. See Applications.
- **Secure Shell (SSH) access** - encrypted remote access to the server - is key-based rather than password-based, which is far harder to brute-force. See SSH access.


Security overview

What you should do

Most of this protection is automatic, but a few things are yours to act on:

- **Review the Threat Center** on each host now and then, and after any security alert. Fix anything marked **Exploited (Known Exploited Vulnerabilities, KEV)** or **Likely exploited** first.
- **Keep your applications and their dependencies up to date.** Most vulnerabilities are fixed simply by updating to a newer version.
- **Leave the defaults on** (TurboShield, the Firewall, the Web Application Firewall, or WAF) unless you have a specific reason to change them.
- **Raise TurboShield** to `high` or `attack` only while you are under abusive traffic, then return to `medium`.


Security overview

Defaults

> [!IMPORTANT]
> By default: TurboShield runs at `medium`, the Firewall is managed automatically, and TurboRadar is enabled on every host.


Security overview

Related

- Security configuration
- Networking
- Monitoring
- Applications
- SSH access


versioned releases atomic deploy symlink deploy public_html releases current shared ci cd deploy

# Versioned releases with a symlink layout

By default, your website is served from a single `public_html` directory in your home
directory. That works well for a manual upload, but continuous integration and continuous
deployment (CI/CD) pipelines usually expect a different layout: each deploy lands in its own
`releases/` folder, and a `current` symlink points at the release that is live. Switching the
symlink makes a new version go live in one step, and switching it back is an instant rollback.

This page shows you how to replace `public_html` with that layout. Your web root stays at
`~/public_html`, so nothing changes for the web server: you only change what it points to.

> [!NOTE]
> Deploy tools such as Deployer, Envoyer, and most custom CI/CD scripts create this structure
> for you. This page prepares the home directory so those tools can take over the `public_html`
> path.


The target layout

You are aiming for a home directory where `public_html` is a symlink into a versioned release,
rather than a real directory:

```bash
current -> releases/<current-release>
public_html -> current
releases/
shared/
```

- `releases/` holds one directory per deploy (often named by timestamp or commit).
- `current` is a symlink to the release that should be live.
- `shared/` holds files that must survive between releases (uploads, `.env`, caches).
- `public_html` is a symlink to `current`, so the web server always serves the live release.


Step-by-step

Connect to the host over SSH first (see the host SSH tab). Run the
commands from your home directory.

1. Remove the existing `public_html` directory. This command only succeeds if the directory is
   empty, which protects you from deleting a live site by accident:

   ```bash
   rmdir ~/public_html
   ```

   If `rmdir` reports that the directory is not empty, do not force it. Move your current site
   into a first release directory instead, then continue.

2. Create the `releases/` and `shared/` directories, or run a deploy so your pipeline creates
   them. This page assumes your code is already laid out with a `current` symlink pointing at a
   release, for example `current -> releases/2026-07-24-1`.

3. Point `public_html` at the `current` symlink:

   ```bash
   ln -s current public_html
   ```

4. Verify that the symlinks resolve as expected:

   ```bash
   ls -l
   # current      -> releases/<current-release>
   # public_html  -> current
   # releases/
   # shared/
   ```

From now on, your pipeline deploys a new release, repoints `current`, and the change is live
immediately. To roll back, repoint `current` to the previous release.


A different root directory

Some frameworks keep `current` and `releases/` inside a subdirectory, for example
`application/`. In that case, only step 3 changes: point `public_html` at the `current` symlink
under that subdirectory.

```bash
ln -s application/current public_html
```

> [!WARNING]
> `public_html` is your live web root. If the symlink points at a path that does not exist,
> your site returns an error until you fix it. Always confirm with `ls -l` that
> `public_html -> current` and that `current` resolves to a real release.


Related

- Host SSH tab
- What is SSH?
- Deployment history
- Applications
- Finding and reading logs


The Source (YAML) view

# The Source (YAML) view

Every host and group can be edited in two ways: the guided **GUI** editor, and the
**Source** view, which shows the configuration as raw **YAML**. Both edit the same
configuration. Use whichever suits the task.


The Source (YAML) view

Opening the Source view

In a host's header, click the **`</>` Source** button. This opens the YAML editor at
`/hosts/yaml/{id}`. The breadcrumb ends in **Source**. To go back, click the **GUI** button in
the header.

> [!TIP]
> The GUI and Source views stay in sync. Changes you make in one are reflected in the other,
> because they describe the same underlying configuration.


The Source (YAML) view

What you can do

- **Edit the YAML** directly - useful for advanced changes, reviewing the whole configuration at
  a glance, or making many edits quickly.
- **Copy** - the **Copy** menu can pre-fill the configuration **From host** (another of your
  hosts) or **From template**.

The YAML mirrors the structure you see in the GUI, for example:

```yaml
webserver: nginx
mysql_version: "8.4"

system_users:
  - username: prod
    vhosts:
      - server_name: app.example.com
        php_version: "8.4"
        cert_type: letsencrypt
```

See Core concepts for the configuration model, and
Applications and Services
for what these keys control.


The Source (YAML) view

Saving and validating

Saving from the Source view works exactly like the GUI: **Save** stores the configuration, and
**Save & Publish** deploys it (see Publishing changes). Before
saving, the YAML is validated. Invalid YAML is flagged and the publish action is disabled until
it is fixed.

> [!WARNING]
> Because the Source view is free-form, a small mistake (wrong indentation, a typo in a key) can
> change behavior. If you are unsure, make the change in the GUI and switch to Source to review
> the result.


The Source (YAML) view

GUI vs. Source: which to use

| Use the GUI when... | Use Source (YAML) when... |
|---|---|
| Making everyday changes with guidance and validation. | Making advanced or bulk edits. |
| You want dropdowns and field help. | Reviewing or copying the whole configuration. |
| You are new to TurboStack. | You are comfortable with YAML and the configuration keys. |

You can set your preferred default editing mode in
Profile & preferences.


The Source (YAML) view

Related

- YAML configuration reference - every key you can set, and what it does
- Hosts
- Core concepts
- Publishing changes


Edit details

edit details profile address vat number company details update account

# Edit details

The **Edit Details** tab is where you update your profile - the information used for your account and
on invoices. Open **Account details** and select the **Edit Details** tab.


Edit details

What you can change

- **Account type** - Personal or Organization.
- **Organization name** and **tax (VAT) number** - the Value Added Tax number, for organizations.
- **First name** and **Last name**.
- **Address**, **city**, **state**, **postal code** and **country**.
- **Phone** and **mobile phone**.

Make your changes and **save** the form. To change your sign-in email or password instead, see
Sign-in details.

> [!NOTE]
> Your address and tax number appear on invoices, so keep them correct. The
> billing contact setting decides whose details are used.


Edit details

Related

- Account details overview
- Sign-in details


Account details overview

account details profile account overview customer center account

# Account details overview

**Account details** is where you manage your own profile and account settings. Open it from **Account
details** in the left sidebar. It has five tabs: **Overview**, **Edit details**, **Change email**,
**Change password** and **Settings**.

This section covers:

- Overview - read-only summary of your account information.
- Edit details - change your name, company, address and contact details.
- Sign-in details - change your email address and password on the **Change
  email** and **Change password** tabs.
- Settings - records-per-page, time zone, billing, and which **notifications** you
  receive.


Account details overview

Overview

The **Overview** tab lists your account information in a read-only table: account type, organization
name, tax (VAT) number, name, email address, postal address, country and phone numbers. Each row also
shows what the information is used for (for example **Billing**).

To change any of this, use the other tabs - see Edit details and
Sign-in details.


Account details overview

Related

- Edit details
- Settings
- Contacts and teams


Settings

settings notifications email notifications invoice delivery nameservers time zone

# Settings

The **Settings** tab holds account-wide preferences, billing options, your notification choices, and
default nameservers. Open **Account details** and select the **Settings** tab.


Settings

General

- **Records per page** - how many rows lists show at once.
- **Time zone** - the time zone used for dates across the portal.


Settings

Billing

- **Default payment gateway** - the payment method used by default.
- **Invoice delivery method** - **Email** or **Email + Paper**.


Settings

Notifications

This is where you choose which emails your **main account** receives.

> [!IMPORTANT]
> The main account holder **always receives billing and support emails by default**. If you do not
> want all of them, turn them off here. (This is separate from contacts
> and teams, who only receive an email type if you grant them the
> matching permission.)

Under **Email notifications** you can enable or disable each type:

| Notification | What you receive |
|---|---|
| **Billing** | Invoices, reminders, and administrative and billing emails (and the related tickets). |
| **Support** | Technical notifications about your Hosted Power services. |
| **Services** | Emails about your services (for example renewals or changes). |
| **Domains** | Emails about your domains (for example expiry and transfer notices). |

Select the types you want and **save**.


Settings

Domains

- **Nameservers** - use Hosted Power's default nameservers for new domains, or set your own custom
  nameservers. See Domains and DNS management.


Settings

Related

- Account details overview
- Contacts
- Teams


Sign-in details

change email change password sign-in login details account security

# Sign-in details

Your sign-in details are your email address and password. You change them on two tabs of **Account
details**: **Change email** and **Change password**.


Sign-in details

Change email

The **Change email** tab updates the email address you sign in with and that receives account emails.

Enter the new email address, confirm it, and save. Use an address you can access, because it is also
where notifications are sent.


Sign-in details

Change password

The **Change password** tab sets a new password for your account.

Enter your current password, then the new password twice, and save. Choose a strong, unique password.

> [!NOTE]
> If you sign in with GitHub or Google (single sign-on), you manage your password with
> that provider, not here.


Sign-in details

Related

- Logging in
- Account details overview


Contacts

contacts sub-account add contact permissions access ui billing support account access

# Contacts

A **contact** is an extra person on your account - for example a colleague, your developer, or your
accountant - with their own sign-in and a set of permissions you choose. Contacts let you give people
access without sharing your own password, and let you grant each person only what they need.

> [!IMPORTANT]
> The **primary contact** is always the first point of contact should a critical incident on your
> environment occur. Keep its details up to date so Hosted Power can always reach the right people.


Contacts

Add a contact

1. In the left sidebar, select **Manage contacts**.
2. Open the **Contacts** tab and select **Add new contact**.
3. Enter the person's name and email and set a password.
4. Choose the **permissions** they should have (see below).
5. Save the contact. The person can now sign in with their own details.

On the **invite** tab you can also invite an existing individual contact, for example an external
consultant, instead of creating a new one.


Contacts

Permissions

Permissions decide what a contact (or a team) can see and do, and which emails they
receive. Grant only what each person needs: some permissions are high-impact, and several also **turn on
automatic emails**.

The permissions are grouped:

| Group | What it controls | Why it matters |
|---|---|---|
| **Billing** | View and pay invoices, place orders, see the balance, add funds, edit card details, receive billing notifications. | Decides who handles money and paperwork. **Granting billing permissions sends this person the billing and administrative emails** (invoices, reminders) and the related tickets. |
| **Support** | Open, view and close tickets; receive email notifications; see all of the organization's tickets. | Decides who can raise and follow support requests. **Granting support permissions sends this person the technical notifications** about your Hosted Power services. |
| **Misc** | Account-wide controls: manage SSH keys, edit allowed IP access, add/edit contacts, manage teams, full control over services or domains, modify the main profile. | High-impact. Give "Full control over services/domains", "Modify main profile details", "Add / Edit contacts" and "Manage teams" only to people you fully trust. |
| **TurboStack** | **Access UI**, and which departments the contact may use. | **Access UI is required to sign in to the TurboStack Platform** (`my.turbostack.app`) and see and manage the servers there. Without it, the contact cannot open the server-management interface. |
| **Per service** | For each service (for example a TurboStack server or Domain Name System (DNS) management): view details and billing, request cancellation, upgrade/downgrade, edit information, change owner, and receive that service's emails. | Lets you scope a contact to specific services only - useful when someone should manage one project but not the whole account. |

> [!IMPORTANT]
> The two email-related groups are opt-in **per contact**: a contact only receives billing emails if
> they have the billing permissions, and technical/support notifications if they have the support
> permissions. The **main account holder** is different - it always receives billing and support
> emails by default. You change that under
> Account details > Settings > Notifications.


Contacts

Status: active or closed

Each contact and each team has a **Status** setting. Set it to **active** to allow the
permissions you granted, or to **closed** to suspend access. When a contact or team is closed, all of
its permissions are denied until you set it back to active. This lets you revoke access temporarily
without deleting the contact or team.


Contacts

Billing contact

Under the contact list, the **Billing contact** setting controls which details appear on invoices.
Leave it on **None, use main profile details** to bill the main account holder, or choose a contact.
Select **Save changes** to apply.


Contacts

Related

- Teams
- Notification settings
- TurboStack Platform


Teams

teams shared access invite code invite team partner access project access permissions

# Teams

A **team** gives a group of people shared access to your account with one set of permissions. Teams
are the usual way to give **several people access to a project** at once - for example your own
developers, or an external partner such as a web agency - instead of creating and maintaining a
contact for every individual.


Teams

Why use a team instead of contacts

- **One set of permissions for the whole group.** Set what the team may do once; everyone in the team
  inherits it. You do not repeat the permissions person by person.
- **Built for projects and partners.** Give a team access to the services that make up a project (for
  example a TurboStack server and its Domain Name System (DNS)), so the right people can work on it
  together.
- **Easy to invite and remove.** People join with an invite code, and you can change the team's
  permissions or remove the team in one place.


Teams

Invite a team with an invite code

You add people to a team with a **unique invite code**:

1. Select **Manage contacts > Teams**, then **Invite Team**.
2. Give the team a **Name** and **Description**.
3. Set the **Invite Code** - a unique code you share with the people who should join. Anyone with the
   code can join the team and receive its permissions, so treat it like a password.
4. Optionally enable **Allow notifications to remote team members**.
5. Choose the team's **permissions** (see below), then select **Save changes**.

Share the invite code with the people who should join. To create a team without an invite, use **Add
new team** on the same screen.


Teams

Permissions and pre-made privileges

A team uses the **same permissions as a contact** - see
Contacts > Permissions for the full list and what each group does. Two points are worth repeating:

- **TurboStack > Access UI** is required for team members to sign in to the
  TurboStack Platform and manage the servers there.
- Granting the **Billing** or **Support** permissions sends team members the billing/administrative or
  technical emails for your services.

To set permissions quickly, use the **Pre-made privileges** presets at the top of the list:

| Preset | Use it for |
|---|---|
| **None** | Start from nothing and pick each permission yourself. |
| **Full privileges** | A trusted team that manages the whole account. |
| **Accounting** | People who handle invoices and billing. |
| **Technical staff** | Developers and operators who manage services - typically including Access UI. |

Pick a preset as a starting point, then fine-tune the individual permissions.


Teams

Related

- Contacts
- Notification settings
- TurboStack Platform


Dashboard

dashboard customer center my services navigation account menu

# Dashboard

The **Dashboard** is the first page you see after signing in. It lists your active services and gives
access to every area of the Customer Center.


Dashboard

My services

The **My services** table lists each service on your account with:

| Column | Meaning |
|---|---|
| **Product/Service** | The product name and its hostname. |
| **Status** | For example **Active**. |
| **Total** | The recurring price. |
| **Billing cycle** | How often it renews, for example **Monthly**. |
| **Expiry date** | The next renewal date. |

Select a service (or the arrow at the end of its row) to manage it - see
TurboStack servers.


Dashboard

Navigation

- **Left sidebar** - grouped into **Manage** (Dashboard, Services), **Account** (Account details,
  Manage contacts, Billing, Partner center, Security, History) and **Help** (TurboStack Docs, Support
  Tickets, Downloads). A link to the **TurboStack Platform** is also here.
- **Top bar** - **Search**, the green **Order** menu (browse products to buy), the shopping cart,
  notifications, your account **Balance**, the **language** selector, and your account menu.


Dashboard

Related

- Order and manage TurboStack servers
- Contacts and teams
- Tickets


Customer Center overview

customer center customer portal account services billing support hosted power portal

# Customer Center overview

The **Customer Center** is Hosted Power's customer portal at
portal.hosted-power.com. It is where you manage your account,
order and manage services, register domains, handle billing, and open support tickets. It is
separate from the TurboStack Platform, which is where you configure the
servers themselves.


Customer Center overview

What you can do here

This section covers:

- Registering an account - create your Customer Center account.
- Logging in - sign in, including single sign-on (SSO).
- Dashboard - your landing page and an overview of your services.
- Contacts and teams - give other people access to your account.
- Services - order and manage TurboStack servers, domains and Domain Name System (DNS) records.
- Tickets - get help from support.


Customer Center overview

Customer Center vs the TurboStack Platform

The two portals do different jobs and use different sign-ins:

| Customer Center (`portal.hosted-power.com`) | TurboStack Platform (`my.turbostack.app`) |
|---|---|
| Account, contacts and teams | Server configuration (web server, databases, caching, security) |
| Ordering services, domains and DNS | Publishing changes to your servers |
| Billing and invoices | Health, monitoring and backups |
| Support tickets | The day-to-day work described in this documentation's Platform section |

You order a server in the Customer Center, then configure it in the TurboStack Platform.

> [!TIP]
> Not sure which plan fits, or want to discuss a custom setup? Talk to our
> sales team.


Customer Center overview

Related

- Logging in
- Order and manage TurboStack servers
- Sales - help choosing or scaling a plan.
- TurboStack Platform


Logging in

login sign in single sign-on sso github google customer center

# Logging in

Sign in to the Customer Center at portal.hosted-power.com.


Logging in

Sign in with email and password

1. Open portal.hosted-power.com and select **Login / Register**.
2. Enter your **Email address** and **Password**.
3. Select **Submit**.

> [!NOTE]
> Your Customer Center sign-in is **not** the same as a server or application control-panel login. It is
> the account you created when registering.


Logging in

Single sign-on (SSO) with GitHub or Google

If you registered with single sign-on (SSO), or linked a provider, sign in with one click:

- **Sign in with GitHub**
- **Sign in with Google**

Select the provider and approve access. You are returned to the Customer Center, signed in.


Logging in

Forgot your password

On the login screen select **Forgot your password?** and follow the email instructions to reset it.
If you only ever signed in with GitHub or Google, keep using that provider's button instead.


Logging in

Related

- Registering an account
- Dashboard


Registering an account

register create account sign up customer center account github google

# Registering an account

To use the Customer Center you need an account. You can register with an email address and password,
or sign up with an existing GitHub or Google account.


Registering an account

Create an account

1. Go to portal.hosted-power.com and select **Login / Register**.
2. On the login screen, select **Create Account**.
3. Fill in the sign-up form:

- **Account type** - choose Personal or Organization (an organization adds company and tax fields).
- **First name** and **Last name**.
- **Email address** - used to sign in and to receive notifications.
- **Password** and **Repeat password**.
- **Country**.

4. Select **Create Account** (or the equivalent submit button) to finish.


Registering an account

Sign up with GitHub or Google

Instead of a password, you can use single sign-on (SSO). On the sign-up screen select **Sign up with
GitHub** or **Sign up with Google** and approve access. The Customer Center creates your account from
that provider, and you sign in the same way next time. See Logging in.

> [!TIP]
> After your account is created you can order services right away - see
> TurboStack servers, Domains and
> DNS management.


Registering an account

Related

- Logging in
- Dashboard


DNS management

dns management dns records nameservers a record mx record manage dns

# DNS management

**DNS management** lets you manage the Domain Name System (DNS) records for your domains - the
records that point your domain at your servers and mail. This page covers ordering DNS management;
once active, you manage the records from the service itself.

> [!NOTE]
> If you already run a cPanel or DirectAdmin control panel, we recommend managing DNS with its
> built-in DNS tools instead of Customer Center DNS management. See the control panel's own
> documentation for how to manage DNS there.


DNS management

Order DNS management

1. Open the **Order** menu and select **DNS Management**.
2. Select the **Manage dns records for your domains** product and add it to your cart.

3. Complete the order. The product is **free**, so there is no charge to add it.


DNS management

Add a domain (zone)

Open the DNS management service from **Services > DNS Management**. It lists the domains (zones) it
manages. Select **Add domain** to add a domain, or **Add domains in bulk** for several at once.


DNS management

Nameservers

For Hosted Power to answer Domain Name System (DNS) queries for a domain, the domain must point at
the Hosted Power nameservers. Set these at the domain's registrar:

```
ns1.hosted-power.com
ns2.hosted-power.com
ns3.hosted-power.com
```

> [!IMPORTANT]
> When you transfer a domain, its current nameservers keep answering until you switch. **Add all
> your DNS records here first, then switch the nameservers** - that way there is no moment where
> records are missing and your application or mail briefly stops resolving.


DNS management

Add and edit records

1. Tick the domain you want to change in the **Domain** list.
2. Use the record buttons for the type you need: **Add A record**, **Add MX entry**, **Add new Alias
   Name** (a CNAME), and **More** for the other types. **DNS Templates** apply a set of records at
   once, and **Clone DNS settings** copies records from another zone.
3. Fill in the record and **Submit**.

A record has three parts:

- **Name** - the host the record is for (leave it on the default for the domain itself, or enter a
  subdomain such as `www`).
- **Time to Live (TTL)** - how long resolvers may cache the record (for example 10 minutes).
- **Content** - the value: an IP address for an **A**/**AAAA** record, a hostname for a **CNAME** or
  **MX** record, or text for a **TXT** record.

Common records:

| Type | Use it for |
|---|---|
| **A** / **AAAA** | Point a name at an IPv4 / IPv6 address. The AAAA record ("quad-A") is the IPv6 version of the A record. |
| **CNAME** (Alias) | Point a name at another name. CNAME is short for Canonical Name. |
| **MX** | Direct email for the domain. MX stands for Mail Exchanger: the mail server that receives the domain's email. |
| **TXT** | Verification and mail records, for example Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC). |

> [!TIP]
> For the SPF, DKIM and DMARC records your mail needs, see Email - it
> lists exactly which records to add here. To use this service for a domain, point the domain at it
> from the domain's nameserver settings - see Domains.


DNS management

DNSSEC

Domain Name System Security Extensions (DNSSEC) add a layer of trust to the Domain Name System
(DNS). DNSSEC signs the answers for your zone with a cryptographic key. A resolver that looks up your
domain can then check the signature and detect if an answer was changed on the way. If the signature
does not match, the resolver treats the answer as invalid instead of sending your visitor to the
wrong place.

This protects against a man-in-the-middle attack, where an attacker sits between your visitor and the
DNS and returns forged records to redirect traffic. DNSSEC is optional. You enable it per zone.


DNS management

How it works

DNSSEC uses a public and private key pair:

- The **private key** stays on the server that manages your DNS zone and signs the records.
- The **public key** is published at your domain's registrar, so resolvers can verify the
  signatures.

Both sides must match. This is why enabling DNSSEC always has two parts: sign the zone, then publish
the key at the registrar.


DNS management

Verify your setup

> [!WARNING]
> A wrong DNSSEC key or a mismatch between the zone and the registrar can make your whole zone fail
> to validate. Resolvers then reject every answer, and all services on the domain (website and mail)
> stop resolving. Always verify after any change.

Check your zone with the DNS visualization tool at https://dnsviz.net/. Enter your domain and it
draws the delegation from the root of the internet, to the top-level zone (for example `.com`), down
to your own zone. If DNSSEC validates, the chain is green. If it is misconfigured, the records for
your zone turn red and show the error.


DNS management

Enable DNSSEC when TurboStack manages your DNS

When your zone runs in the DNS management service in the Customer Center, TurboStack sets up DNSSEC
for you. Open a support ticket, tell us which domain you want to enable DNSSEC for, and we handle the
signing and the registrar side. See Support.


DNS management

Enable DNSSEC when DNS is hosted externally

When your zone is hosted outside TurboStack, you enable DNSSEC in two steps:

1. **Sign the zone at the provider.** Turn on DNSSEC where the zone lives - your external DNS
   provider, or the control panel on your server (for example cPanel or DirectAdmin). This generates
   the key pair and signs the zone. Follow the provider's own guide for the exact steps.
2. **Publish the key at the registrar.** Copy the public key details the provider gives you and add
   them at your domain's registrar. If Hosted Power is your registrar, open a support ticket with the
   key details and we add them at the domain level. If another company is your registrar, add the
   details in their control panel or contact their support.

> [!NOTE]
> Some control panels only expose DNSSEC once it is enabled at the server level. If you cannot find
> the option, check the panel's documentation or ask the party that manages the server.


DNS management

Related

- Domains
- Connecting your domain
- Email (SPF, DKIM, DMARC records)
- Mail deliverability


Domains

domains register domain domain search transfer domain tld domain name

# Domains

Search for and register domain names, or transfer an existing domain to Hosted Power, from the
Customer Center.


Domains

Search and register a domain

1. Open the **Order** menu and select **Domain Names**.
2. Type the name you want in the search box and select **Search**.

3. The results show which names are available and the price per year. Common top-level domains (TLDs)
   such as `.be`, `.com`, `.eu` and `.nl` are listed with their pricing, and the full price list is
   shown below the search.
4. Add the domain you want to your cart and complete the order.

Use **Bulk Domain Search** to check several names at once.


Domains

Transfer a domain

To move a domain you already own to Hosted Power, select **Transfer Domain** (or **Bulk Domain
Transfer** for several at once). You will need the domain's authorization code (also called an EPP
code, short for Extensible Provisioning Protocol, or a transfer code) from your current registrar,
and the domain must be unlocked.

Before you start, confirm the domain's administrative contact email is current at your registrar. The
transfer authorization email is sent to that address, and you must approve it to complete the transfer.


Domains

Manage a domain

After a domain is registered or transferred, it appears under your services. Open it to manage its
settings, such as the nameservers and contact details. To manage the domain's records, see
DNS management.


Domains

Cancel a domain

Domains are registered and paid for **one year at a time**. To stop a domain from renewing, turn off
its auto-renewal - it then keeps working until the paid period ends and is not charged again:

1. Open **Services > Domains** in the sidebar and select the domain you no longer need (use the arrow
   to open it).
2. Open the **Auto-renew** setting and set it to **Off**.
3. **Save** the change.

> [!NOTE]
> Disabling auto-renewal does not delete the domain right away. It stays active until the current
> paid period expires, after which it is no longer charged to your account.


Domains

Related

- DNS management
- TurboStack servers


TurboStack servers

turbostack order server manage server reboot reverse dns server details hosting

# TurboStack servers

You order **TurboStack** servers in the Customer Center and configure them in the
TurboStack Platform. This page covers ordering a server and the basic
server management available in the portal.


TurboStack servers

Order a TurboStack server

1. Open the green **Order** menu in the top bar and select **TurboStack**.
2. Choose a plan and select **Order**.

The plans range from a single managed server (**TurboStack Platinum**) to larger and cloud-based
options (**TurboStack** and **TurboStack Cloud**). After ordering and paying, the server is
provisioned and appears under your services.

> [!TIP]
> Not sure which plan fits? Talk to sales before you order.


TurboStack servers

Find your servers

Select **Services > TurboStack** in the sidebar to list your servers with their hostname, IP address,
status and expiry date. Use the **All / Active / Cancelled** tabs to filter.


TurboStack servers

Manage a server

Open a server (from the dashboard or the services list) to see its **Overview**:

- **Server details** - status (on/off), hostname, IP address, login user and password (select
  **show** to reveal), operating system, location, and the CPU, memory and storage of the plan.
- **Reboot** and **Shutdown** - power actions for the server. **More** holds further actions.
- **Reverse DNS** - set the reverse Domain Name System (DNS) name for the server's IP address.
- **Billing** - the service's billing details and renewal.

> [!NOTE]
> The Customer Center handles ordering, power actions and billing. To configure what runs on the
> server - web server, databases, caching, security and applications - use the
> TurboStack Platform.


TurboStack servers

Upgrade (resize) your server

When your site outgrows its current plan, upgrade it from the Customer Center:

1. Go to **Services > TurboStack** and open the server.
2. On the right of **Server details**, select **Upgrade**.
3. Choose the new plan size, select **Continue** to review the billing, then **Submit** to start the
   automated upgrade.

A **TurboStack Platinum** server is resized without a reboot; other plans reboot once as part of the
upgrade. The whole process is automated.

> [!TIP]
> Not sure which plan fits your growth, or want to discuss a custom setup? Talk to our
> sales team - they will help you pick the right size.


TurboStack servers

Related

- Sales - help choosing or scaling a plan.

- TurboStack Platform
- Domains
- DNS management


Switching accounts

switch account multiple accounts invited account account list contact guest team

# Switching accounts

You can have access to **more than one customer account**. This happens when another account invites
you - as a contact, a guest, or through a team.
For example, a client can invite your agency so you can manage their services from your own sign-in.

When you have access to several accounts, you switch between them without signing out.


Switching accounts

Switch to another account

1. In the top-right corner, open your account menu (it shows **Welcome <your name>**).
2. Select **Switch customer account**.
3. Choose the account you want from the list.

Each entry shows the account name and its customer number. After you pick one, the Customer Center
loads that account, and everything you do applies to it until you switch again. Switch back the same
way.

> [!NOTE]
> What you can see and do in another account depends on the permissions that account granted you when
> it invited you - see Contacts and
> Teams.


Switching accounts

Related

- Logging in
- Contacts
- Teams


Creating a ticket

create ticket new ticket submit ticket support request department priority

# Creating a ticket

When you have a question or a problem, open a support ticket and the support team will reply.


Creating a ticket

Open a new ticket

1. Select **Support Tickets** in the sidebar, then **Create new** (or use **Support > New ticket**).
2. Fill in the ticket:

- **Department** - choose the team that should handle it, for example **Support**.
- **Priority** - how urgent it is (for example Low).
- **Subject** - a short summary of the issue.
- **Message** - the details. Include as much as you can: what you did, what you expected, and what
  happened.
- **Related service** - link the ticket to a specific service so support has the context.
- **Additional email recipients (CC)** - other people who should receive replies.

3. Add any attachments (for example a screenshot) and **submit** the ticket.

> [!TIP]
> One issue per ticket, with a clear subject, gets the fastest answer. You can follow the reply on
> the ticket dashboard.


Creating a ticket

Related

- Ticket dashboard
- Dashboard


Ticket dashboard

support tickets ticket dashboard ticket status open tickets support

# Ticket dashboard

The **Support Tickets** area is where you see and follow every support request on your account. Open
it from **Support Tickets** in the sidebar.


Ticket dashboard

The ticket list

Tickets are shown in a table with:

| Column | Meaning |
|---|---|
| **Ticket #** | The reference number for the ticket. |
| **Subject** | What the ticket is about. |
| **Status** | For example Open or Answered. |
| **Department** | The team handling it, such as Support. |
| **Date** | When it was last updated. |

Use the **All / Open / Answered** tabs to filter the list. Select a ticket to read the conversation
and reply.


Ticket dashboard

Create a ticket

Select **Create new** to open a new support request - see Creating a ticket.


Ticket dashboard

Related

- Creating a ticket
- Dashboard


Connecting your domain

point domain turbostack dns a record aaaa record lets encrypt connect domain

# Connecting your domain

Before you publish a site with automatic HTTPS, your domain must point to your server. This page
shows you how to find your server's addresses, create the DNS records, and request a certificate.

Domain Name System (DNS) is the first step because Let's Encrypt validates ownership over HTTP: it connects to your
domain and expects to reach your server. If the domain does not resolve to the server, certificate
issuance fails and your site cannot serve HTTPS.


Connecting your domain

Find your server's IP addresses

1. Open the host you want to publish to.
2. Go to the Credentials tab.
3. Copy the **Server Public IPv4** value, and the **Server Public IPv6** value if you plan to add an
   AAAA record.


Connecting your domain

Create the DNS records

At your DNS provider, create the records that point your domain to the addresses you just copied. If Hosted Power manages your DNS, create them in the Customer Center DNS management instead.

| Record type | Name | Value | Required |
| --- | --- | --- | --- |
| A | `example.com` and `www` | Server Public IPv4 | Yes |
| AAAA | `example.com` and `www` | Server Public IPv6 | Recommended |

1. Create an **A record** for the apex (`example.com`) pointing to your IPv4 address.
2. Create an **A record** for `www` pointing to the same IPv4 address.
3. (Recommended) Create matching **AAAA records** for both names pointing to your IPv6 address.

> [!NOTE]
> DNS changes are not always instant. Propagation can take anywhere from a few minutes up to a few
> hours, depending on your provider and the previous record's Time to Live (TTL).


Connecting your domain

Point it in TurboStack

1. Open the application's settings.
2. Set `server_name` to your domain(s) - for example `example.com www.example.com`.
3. Set `cert_type: letsencrypt`.
4. Publish the host.

TurboStack requests the certificate from Let's Encrypt automatically during publishing, then renews
it for you before it expires.

> [!TIP]
> For a domain that isn't pointed at the server yet, or for a wildcard certificate, use the **DNS
> challenge** instead of HTTP validation - see TLS certificates.

> [!NOTE]
> If your account has DNS management enabled in the platform, you can create and manage these
> records directly from TurboStack instead of using an external DNS provider.


Connecting your domain

Next steps

- TLS certificates - HTTPS for your domain.
- Publishing changes - deploy your configuration.
- Applications - manage applications and domains.
- Credentials - server and account access details.
- Customer Center DNS management - manage DNS records when Hosted Power runs your DNS.
- Domains - register or transfer a domain.


Core concepts

client host group template publish deploy revision configuration

# Core concepts

Understanding a few core concepts makes the rest of TurboStack easy to follow.


Core concepts

Objects

TurboStack organizes everything into a simple hierarchy.

| Concept | What it is |
|---|---|
| **Client** | A customer account. It owns hosts and groups, and defines who can see what. |
| **Host** | A single server and its configuration - the central object you work with. |
| **Group** | A reusable set of settings (such as SSH keys or security rules) applied to many hosts at once. |
| **Template** | A pre-built host configuration you can apply to new hosts to save setup time. |

A **client** contains **hosts** and **groups**. A **host** can belong to one or more groups and
inherit their settings. **Groups** and **templates** help you manage many hosts efficiently.


Core concepts

Hosts and their configuration

A host's configuration describes the desired state of a server. It is structured around:

- **System users** - the operating-system accounts that own files and run applications.
- **Applications (vhosts)** - the individual applications that run under a system user,
  each with its own domain, application type, PHP version, Transport Layer Security (TLS) certificate and more.

You edit this configuration through the **GUI editor** or directly as **YAML** in
the **Source** editor. Both describe the same configuration - use whichever you prefer. See
Configuring a host.


Core concepts

Publishing and deployments

Saving and publishing are deliberately separate:

- **Save** stores your changes in TurboStack *without* touching the server.
- **Publish** (also called *deploy*) saves your changes **and** applies them to the server.

While a deployment runs, TurboStack shows live progress and logs. See
Publishing changes.


Core concepts

Revisions

Every time you save, TurboStack records a **revision** of the configuration. You can review the
history and restore a previous revision if you need to roll back.


Core concepts

Default behavior worth knowing

TurboStack applies sensible, secure defaults so you don't have to configure everything:

- **TurboShield** protection is enabled at the **medium** level by default.
- **Database and cache sizes** are auto-tuned to the server; only override them with evidence.
- **Monitoring** is enabled and managed by the platform.

> [!TIP]
> Because most settings have good defaults, you can start with a minimal configuration and only
> change what you need.


Core concepts

Next steps

- Logging in - access the platform.
- Deploy your first site - an end-to-end quick start.
- Managing hosts - put these concepts to work.
- Glossary - definitions of every term used across the docs.


Deploy your first site

turbostack quick start deploy first site publish getting started

# Deploy your first site

This quick start walks you through deploying an application end to end: open your host, enable the
services it needs, add the application, point your domain, and publish.

> [!TIP]
> New to the concepts? Skim Core concepts first. For a deeper look at a
> specific application (Magento, WordPress, and others), see Deploying applications.


Deploy your first site

1. Open your host

Sign in and open **Hosts**, then select the host you want to configure. Your servers are
provisioned by Hosted Power when you order them, so a host is ready in your list.

> [!NOTE]
> Don't have a server yet, or not sure which plan? Support can help you
> get a host provisioned.


Deploy your first site

2. Enable the services you need

Services run at host level, so enable them before you add the application. Go to the
Services tab and enable what your application requires:

- **Web server** - Nginx or Apache.
- **Database** - for example MySQL, and pick the version.
- **Caching and queues** - Redis, Varnish or RabbitMQ.
- **Search** - Elasticsearch or OpenSearch, if the application needs it.

> [!TIP]
> Memory sizing is auto-tuned to the server. Enable the service and pick its version; only
> override the sizing with measured evidence.


Deploy your first site

3. Add your application

Go to the Applications tab -> **Add app or database**.
In **Configure application**:

1. **Hostnames** - enter your domain in `server_name` (e.g. `example.com www.example.com`) and set
   **Certificate** to **Let's Encrypt** for automatic HTTPS.
2. **Technologies** - choose the **App Type** (for example WordPress or Magento) and the runtime
   version (such as PHP), then connect the services you enabled in step 2.

See Deploying applications for ready-to-copy settings per application.


Deploy your first site

4. Connect your domain

For Let's Encrypt to issue a certificate, your domain must point to the server. Copy the server's
**Public IPv4/IPv6** from the host's Credentials tab and create
the matching Domain Name System (DNS) records at your provider. Full steps:
Connecting your domain.


Deploy your first site

5. Publish

Click **Save & Publish**. TurboStack provisions the stack, installs the application, and requests
the Transport Layer Security (TLS) certificate so the running server matches your configuration.

Follow the live progress in the publish dialog. When it finishes, your site is live over HTTPS.
See Publishing changes for the deployment types and how to
review logs.


Deploy your first site

6. Verify

- Open your domain in a browser - it should load over **HTTPS**.
- Check the host's Health tab for status and resource usage.
- Retrieve any app/database logins from the Credentials tab.


Deploy your first site

Next steps

- Connecting your domain - DNS records in detail.
- Deploying applications - per-application configuration and YAML.
- Publishing changes - deploy types, revisions and rollback.
- Security hardening - lock things down after launch.


Introduction

turbostack hosting infrastructure self-service host management

# Introduction

**TurboStack** is Hosted Power's self-service platform for managing your hosting
infrastructure. Instead of configuring servers by hand, you describe how each server should
look - its web server, databases, caching, security, backups and applications - and TurboStack
applies that configuration to your servers for you.

TurboStack is a European managed platform built for teams that run business-critical applications and
applications. Its main users are **web developers** and **DevOps** who want full control and
transparency over their stack, **e-commerce and marketing teams** who need their sites to stay fast
and online during busy campaigns, and **agencies** that manage many client sites from one place. It
focuses on e-commerce and other critical applications - such as Magento, Shopware, WooCommerce and
Laravel - and runs them on a standard, open-source stack, so you are not locked into a proprietary
platform.


Introduction

How TurboStack works

TurboStack is built around a **desired-state** model:

1. **You describe the desired state.** In the TurboStack Platform you define the configuration for each
   server (a *host*). You can use the GUI editor or edit the configuration directly as
   YAML.
2. **You publish.** When you are happy with the configuration, you publish it.
3. **TurboStack applies it.** The platform automatically deploys your configuration to the
   server so that the running server matches what you described.

> [!IMPORTANT]
> TurboStack is the single source of truth for your servers. Manual changes made directly on a
> server are not tracked and may be overwritten the next time the host is published. Make your
> changes in TurboStack so they are recorded and consistently applied.


Introduction

What you can manage

From a single interface you can configure, for each server:

- **Web & applications** - Nginx or Apache, PHP and other runtimes, and application types such
  as WordPress, Magento, Shopware, Drupal and more.
- **Databases & search** - MySQL, PostgreSQL, MongoDB and search engines such as
  Elasticsearch/OpenSearch.
- **Caching & queues** - Redis, Varnish and RabbitMQ.
- **Security** - TurboShield protection, firewall rules, IP allow-lists and a web application
  firewall.
- **Access** - SSH keys and authentication.
- **Backups** - restore files and databases from backups.

You also organize servers with **groups** and **templates**, monitor their health,
and work faster with **search** and a full **API** for automation.


Introduction

Your account

Your account manages its own hosts, groups and templates - you only ever see the resources that
belong to it. A single login can be linked to more than one account, which is useful for agencies
and partners; TurboStack then shows a **Select account** screen after you sign in. See
Accounts and access.


Introduction

Next steps

- Core concepts - the building blocks: clients, groups, hosts and publishing.
- Logging in - sign in to the platform.
- Managing hosts - start working with your servers.
- Glossary - every term and acronym used across the docs.


Logging in

# Logging in

You access TurboStack through your web browser. This page covers signing in, two-factor
authentication, and choosing an account when you have more than one.


Logging in

Signing in

1. Open the TurboStack Platform in your browser.
2. Enter your **email address** and **password**.
3. Press **Enter** or click the sign-in button.

> [!TIP]
> Forgot your password? Use the password-reset link on the sign-in screen to receive reset
> instructions.


Logging in

Two-factor authentication

If two-factor authentication (2FA) is enabled on your account, you are asked for a one-time
code after entering your password.

1. Open your authenticator app and read the current code.
2. Enter the code to continue.
3. Optionally choose to be remembered on this device so you are not asked again for a while.

See Two-factor authentication to enable or manage 2FA.


Logging in

Selecting an account

If your login is linked to more than one account, TurboStack asks you to choose which one to
work in. Select the account to continue to its dashboard. You can switch accounts again later
in the GUI.


Logging in

After signing in

You land on the **Hosts** dashboard, your starting point for managing servers. From here,
continue to Navigating the interface or jump straight to
Managing hosts.


Logging in

Next steps

- Selecting an account - choose an account if your login has more than one.
- Navigating the interface - find your way around.
- Two-factor authentication - secure your account.


Navigating the interface

navigation interface sidebar hosts groups templates gui editor yaml source editor

# Navigating the interface

Once you are signed in, TurboStack presents a consistent layout so you always know where you
are.


Navigating the interface

Main navigation

The sidebar gives you access to the platform's areas:

- **Hosts** - your servers and their configuration (the default view).
- **Groups** - shared settings applied across multiple hosts.
- **Templates** - reusable host configurations.
- **Search** - find hosts, groups and templates.
- **Monitoring** - infrastructure and application monitoring.
- **Support** - help and contact details.

Your **Profile Settings** and **Logout** are also available from the navigation, and
a **Platform updates** link in the page footer opens the release-notes feed.


Navigating the interface

Breadcrumbs

A breadcrumb trail at the top of each page (for example *Dashboard / Hosts / your-host*) shows
where you are and lets you step back up at any time.


Navigating the interface

GUI editor vs. Source (YAML)

When configuring a host, group or template, you can switch between two editing modes using the
**GUI / Source** toggle:

- **GUI** - a guided editor with dropdowns and fields.
- **Source** - the raw YAML configuration, for advanced users.

Both edit the same configuration. You can set your preferred default mode in
Profile & preferences.


Navigating the interface

Lists, search and pagination

List pages (Hosts, Groups, Templates) share the same conveniences:

- A **search box** filters the list as you type.
- A **Number of Items** control sets how many entries appear per page.
- **Copy** icons appear next to values such as host names and IP addresses.


Navigating the interface

Real-time feedback

Long-running operations - such as publishing a configuration or restoring a backup - open a
dialog that updates automatically and shows live progress and logs, so you can follow along
without refreshing the page.


Navigating the interface

Next steps

- Deploy your first site - an end-to-end quick start.
- Managing hosts - browse and configure your servers.


Selecting an account

select account account list switch account multiple accounts turbostack login

# Selecting an account

Some logins have access to more than one account. After you sign in, TurboStack then shows the
**Account list** so you can choose which account to work in. If your login has access to a single
account, you skip this step and go straight to the Hosts list.


Selecting an account

How it works

Each row is an account you can open, listed by its name.

1. Read the list under **Please click at the account you want to login for**.
2. Click the account you want to open.
3. TurboStack opens that account and takes you to its Hosts list.

Everything you do next, browsing hosts, editing configuration and publishing, applies to the
account you selected.


Selecting an account

Switching to another account

To work in a different account, use the account selector in the top bar. You can switch at any
time without signing out.

> [!NOTE]
> The hosts, groups and templates you see always belong to the account you are currently in. If a
> host you expect is missing, check that you selected the right account.


Selecting an account

Next steps

- Navigating the interface - find your way around.
- Deploy your first site - an end-to-end quick start.
- Logging in - back to signing in.


TurboStack Documentation

# TurboStack Documentation

**TurboStack** is Hosted Power's self-service platform for managing your hosting
infrastructure. You define how each server should be configured - web server, databases,
caching, security, backups and more - and TurboStack applies that configuration to your servers
for you. This documentation explains how to use the platform, step by step.

TurboStack is built for **web developers**, **DevOps** and **e-commerce teams** - and the
**agencies** that serve them - who run business-critical sites and want them fast, stable and on a
standard, open-source stack (no vendor lock-in).

> [!TIP]
> New to TurboStack? Start with Introduction and
> Core concepts.


TurboStack Documentation

Getting started

- Introduction - what TurboStack is and how it works.
- Core concepts - clients, groups, hosts, templates and publishing.
- Deploy your first site - an end-to-end quick start.
- Connecting your domain - Domain Name System (DNS) records for your site.
- Logging in - signing in, two-factor authentication, account selection.
- Selecting an account - choose an account when your login has more than one.
- Navigating the interface - finding your way around.


TurboStack Documentation

TurboStack Platform

- Platform overview - the main areas of the platform.


TurboStack Documentation

Hosts

- Hosts - browse and manage your servers.
- Publishing changes - save and deploy configuration.
- History (revisions, deploys and cloning) - change and deployment history.
- Credentials - server and per-account access details.
- Health - live host monitoring.
- Threat Center - security findings.
- Services - web server, databases, caching, search.
- SSH - SSH keys and authentication.
- Security - TurboShield, firewall, allow-lists, Web Application Firewall (WAF).
- Backups - create backups and restore files and databases.

**Applications (host tab):** Applications | TLS certificates | Git deployment | Migration Hero

**Advanced (host tab):** Advanced settings | Email | Installing extra OS packages | FTP and SFTP access


TurboStack Documentation

Groups and templates

- Groups - shared settings across hosts.
- Templates - reusable host configurations.


TurboStack Documentation

Tools

- Search - find hosts, groups and templates.
- Monitoring - fleet-wide alerts.
- Platform updates - release notes.
- Support - how to get help.
- Troubleshooting - common questions and fixes.


TurboStack Documentation

Customer Center

- Customer Center overview - the customer portal for account, services, billing and support.
- Registering an account | Logging in | Switching accounts | Dashboard
- Contacts | Teams
- Account details - profile, sign-in details and notification settings.
- TurboStack servers | Domains | DNS management
- Ticket dashboard | Creating a ticket


TurboStack Documentation

Applications

- Deploying applications - how it works, requirements, example YAML, and file layout/permissions.
- WordPress | Magento 2 | Shopware | Drupal | Laravel
- Akeneo PIM | OroCommerce | Craft CMS | Nextcloud
- Odoo | Medusa | nopCommerce | Self-hosted platforms (GitLab, Advanced Database Monitoring)


TurboStack Documentation

Technologies

- Technologies overview - what each building block is and how to configure it.
- **Web and runtimes:** Nginx | Apache | PHP | Node.js | Python | Ruby | .NET
- **Databases and search:** MySQL | PostgreSQL | MongoDB | SQL Server | Redis | RabbitMQ | Elasticsearch | OpenSearch
- **Caching, proxy and containers:** Varnish | Reverse proxy | Docker | Kubernetes
- **Security and access:** TurboShield | Firewall | SSH
- **Server operations:** System services - run background workers and app processes as systemd user services.


TurboStack Documentation

Troubleshooting

- Troubleshooting overview - a method for diagnosing host problems.
- Why is my site slow? | 502/503/504 errors | 403/413/429 errors
- Out of memory | High CPU and load | Disk full
- Database problems | TLS certificate problems | Mail deliverability


TurboStack Documentation

Platform concepts

- The Source (YAML) view - edit configuration as YAML.
- Accounts and access - account access and multi-account login.
- Security overview - how TurboStack protects your servers.
- Networking - private networking, Virtual Private Network (VPN) and high availability.
- Monitoring - the monitoring and observability stack.
- Performance tuning - caching and when to override defaults.
- Security hardening - a practical security checklist.
- Glossary - key TurboStack terms.


TurboStack Documentation

Your account

- Profile and preferences - account settings.
- API tokens - personal access tokens for the API.
- Two-factor authentication - secure your account.


TurboStack Documentation

Developers

- API reference - manage clients, groups and hosts programmatically.
- TurboStack CLI - manage caches, services and the firewall on the server with `tscli`.
- Documentation MCP server - connect Claude, ChatGPT, Gemini or Cursor to this documentation.


TurboStack Documentation

Trust and security

- Trust and security overview - how TurboStack keeps your hosting secure and managed.
- How we protect your platform | DDoS and abuse protection
- Backups and recovery | Access control and encryption | Reporting a security issue


TurboStack Documentation

Frequently asked questions

- Frequently asked questions - quick answers to common questions, each linking to the full page.

> [!NOTE]
> This documentation is produced and maintained with a Claude Code documentation agent. See
> `AGENTS.md` and `PLAN.md` in the repository root for the workflow and structure.


Changelog

changelog release notes platform updates turbostack releases new features bug fixes

# Changelog

<style>
/* Scoped to this page (Retype loads this <style> only on the changelog). Turns each
   "## <date>" heading + its list into a single card, and tidies the entries. */
.retype-markdown h2[id^="20"] {
  margin: 1.7rem 0 0;
  padding: .5rem .95rem;
  font-size: 1rem;
  font-weight: 700;
  font-style: normal;
  letter-spacing: .02em;
  color: #16181D;
  background: #F4F7FF;
  border: 1px solid #E3F1FF;
  border-bottom: none;
  border-radius: .6rem .6rem 0 0;
}
.retype-markdown h2[id^="20"] + ul {
  margin: 0;
  padding: .7rem 1.1rem .8rem 2.4rem;
  list-style: disc;
  background: #FFFFFF;
  border: 1px solid #E3F1FF;
  border-top: none;
  border-radius: 0 0 .6rem .6rem;
  box-shadow: 0 1px 3px rgba(38, 0, 230, 0.05);
}
.retype-markdown h2[id^="20"] + ul > li { margin: .55rem 0; }
.retype-markdown h2[id^="20"] + ul > li::marker { color: #9CB6E8; }
html.dark .retype-markdown h2[id^="20"] {
  color: #E6ECFF;
  background: #141B3A;
  border-color: #26306A;
}
html.dark .retype-markdown h2[id^="20"] + ul {
  background: #0E1430;
  border-color: #26306A;
  box-shadow: none;
}
/* Monochrome badge icons, to match the black/white icon style of the left navigation.
   The badge background and text keep their category colour; only the icon goes neutral. */
.retype-markdown [class*="bg-badge"] svg { color: #16181D; fill: currentColor; }
html.dark .retype-markdown [class*="bg-badge"] svg { color: #E6ECFF; }
</style>

Notable customer-facing changes to the TurboStack Platform, newest first. Releases go out roughly
every two weeks; each entry is dated by its release. For the live, in-app feed see
Platform Updates.

Each entry is labelled: [!badge variant="success" text=":icon-rocket: New"]
[!badge variant="info" text=":icon-light-bulb: Improved"] [!badge variant="warning" text=":icon-tools: Fixes"]
[!badge variant="danger" text=":icon-shield-lock: Security"].

> [!IMPORTANT]
> Some changes only take effect on your servers after a **full publish** of the host. See
> Publishing changes.


Changelog

2026-07-20

- [!badge variant="info" text=":icon-light-bulb: Improved"] **Faster firewall block and unblock from the command line** - `tscli firewall block` and `unblock` now apply at the firewall immediately, instead of waiting for the background sync. Repeating a block no longer stacks duplicate rules, and an unblock takes effect right away. See Block an IP address and the CLI reference.
- [!badge variant="warning" text=":icon-tools: Fixes"] **PHP preloading now takes effect reliably** - A configured preload script now loads correctly. It is applied once per PHP version, at the runtime level. Only one application per PHP version can use preloading, as before. See `php_opcache_preload_script`.
- [!badge variant="warning" text=":icon-tools: Fixes"] Account names containing an ampersand (`&`) now display correctly in the account switcher.


Changelog

2026-06-22

- [!badge variant="success" text=":icon-rocket: New"] **Monitoring in the main navigation** - Monitoring
  now has its own entry in the left navigation. Each alert opens a detail page with a downloadable
  PDF report, and the host graphs are clearer and more accurate. See Monitoring,
  Monitoring (concepts) and the host Health tab.
- [!badge variant="info" text=":icon-light-bulb: Improved"] **Threat Center: export and manage detections** - You
  can now export Indicators of Compromise, Vulnerabilities and Runtime Detections to CSV, dismiss or
  clear individual detections, and page through long lists more comfortably. See
  Threat Center.
- [!badge variant="success" text=":icon-rocket: New"] **Filter and create hosts over the API** - You can
  now filter the list endpoints by name to find the hosts you need without paging through everything,
  and create a host directly from the API. See the API reference.
- [!badge variant="info" text=":icon-light-bulb: Improved"] **Safer account names** - The Add and Edit Account
  screens now reject reserved or invalid usernames before you save, so a bad name cannot slip
  through. See Applications and accounts.
- [!badge variant="info" text=":icon-light-bulb: Improved"] **Compact responsive sidebar** - The navigation now
  collapses to a compact sidebar on medium-sized screens, so it stays usable on smaller displays.
- [!badge variant="warning" text=":icon-tools: Fixes"] Minor fixes to the host Health
  tab, History tab pagination, and the CPU load graph.


Changelog

2026-06-09

- [!badge variant="danger" text=":icon-shield-lock: Security"] **Security alerts with one-click fix** - Hosts
  now show security alerts directly in the interface, for example when a component is out of date.
  Each alert has an optional button that deploys the recommended fix for you, and alerts are hidden
  while a deployment is running. See Security.


Changelog

2026-06-01

- [!badge variant="warning" text=":icon-tools: Fixes"] **Clearer deployment errors** - When a step in a
  deployment fails, you now see the actual error message instead of a blank result, so it is clear
  what went wrong. See Publishing changes.


Changelog

2026-05-18

- [!badge variant="info" text=":icon-light-bulb: Improved"] **Credentials, database users and FTP** - The
  Credentials area is easier to use. You can create extra database users with a read-only or an admin
  role, and FTP accounts are now grouped under their database. See Credentials
  and Manage database users.


Changelog

2026-05-11

- [!badge variant="success" text=":icon-rocket: New"] **Create Backup on demand** - You can now start a
  backup yourself with **Create Backup**, instead of waiting for the scheduled run. See
  Backups.
- [!badge variant="success" text=":icon-rocket: New"] **Ruby application support** - Ruby applications now
  support a custom start command (`ruby_start_cmd`) and an optional Sidekiq background-worker service
  (`ruby_sidekiq`, `ruby_sidekiq_cmd`). See Ruby and the
  application parameters.
- [!badge variant="warning" text=":icon-tools: Fixes"] A host with no system users defined no longer
  causes an error.


Changelog

2026-04-01

- [!badge variant="warning" text=":icon-tools: Fixes"] **Search fixes** - Fixed enabling Elasticsearch, an
  Elasticsearch plugin problem, and search-result sorting. See
  Elasticsearch.

> [!NOTE]
> This changelog is curated from the platform's release history and focuses on changes you can see
> or use as a customer. Internal, infrastructure and staff-only changes are omitted. For the exact,
> always-current behavior of a feature, follow the linked documentation page.


Changelog

Related

- Platform Updates - the live in-app feed
- Publishing changes
- Support


Groups

groups SSH keys shared settings security rules fleet management publish group group history revert

# Groups

Groups are reusable collections of settings that you apply across multiple hosts at the same time. Instead of repeating the same SSH keys or security rules on every server, you define them once on a group and let every member host inherit them. This keeps security consistent across a fleet of hosts: set the keys and rules once, and every member host stays in sync.

This page covers:

- Creating a group - add a group and open it
- Assigning hosts to a group - manage its membership
- Publishing a group - apply the group's settings to its hosts
- Group history - review past changes and deployments, and revert
- Editing a group and Deleting a group


Groups

What you can do with groups

- Define **SSH** keys once and share them across every host in the group.
- Define firewall and **Security** rules once and apply them everywhere.
- Add or remove hosts from a group at any time without touching each host individually.

Settings defined on a group are inherited by all of its member hosts, so changes you make to a group take effect across the whole membership.


Groups

Normal groups and partner groups

There are two kinds of group. A **partner group** is marked with a blue group icon next to its **Manage** button.

- A **normal group** belongs to a single customer account. It applies only to that customer, and you can only add hosts that belong to it.
- A **partner group** sits one level higher and works across multiple customers. It has the same settings as a normal group, but you can add hosts from any customer account you have TurboStack access to. This lets an agency apply shared SSH keys and security rules across all of its client environments at once, instead of configuring each account separately.


Groups

Viewing groups

To see all groups, open `/groups`. The overview lists every group, with a search box and a `Create` button above it.

Each group has its own page at `/groups/{group}` with the following tabs:

| Tab | Purpose |
| --- | --- |
| `SSH` | Set the SSH keys that member hosts inherit. |
| `Hosts` | Select which hosts belong to the group. |
| `Security` | Define firewall and security rules that member hosts inherit. |

> [!TIP]
> A read-only `Source (YAML)` view of any group is available at `/groups/yaml/{group}` if you want to review the full configuration at a glance. The first icon in the group header opens it.


Groups

Creating a group

1. Go to `/groups`.
2. Select `Create`.
3. In the modal, enter a name for the group.
4. Confirm to create the group and open it.