{"id":"account/api-tokens.md#intro","url":"https://docs.turbostack.app/account/api-tokens/","path":"account/api-tokens.md","title":"API tokens","heading":"","keywords":"","text":"# API tokens\n\nPersonal Access Tokens let you authenticate with the TurboStack API. You create and manage them from your Profile Settings."} {"id":"account/api-tokens.md#create-a-token","url":"https://docs.turbostack.app/account/api-tokens/#create-a-token","path":"account/api-tokens.md","title":"API tokens","heading":"Create a token","keywords":"","text":"1. Open **Profile Settings**.\n2. Select **Create token** to open the new token modal.\n3. Enter a descriptive **name** and choose an **expiration**.\n4. Confirm to create the token.\n5. **Copy the token value** when it is shown.\n\n> [!IMPORTANT]\n> The token is a secret. Copy it when it is created - it will not be shown again. Store it securely, and delete any tokens you no longer use."} {"id":"account/api-tokens.md#manage-tokens","url":"https://docs.turbostack.app/account/api-tokens/#manage-tokens","path":"account/api-tokens.md","title":"API tokens","heading":"Manage tokens","keywords":"","text":"The token list shows each token's name, creation date, and expiration. Use the delete option to remove a token you no longer need."} {"id":"account/api-tokens.md#use-a-token","url":"https://docs.turbostack.app/account/api-tokens/#use-a-token","path":"account/api-tokens.md","title":"API tokens","heading":"Use a token","keywords":"","text":"Send the token as a Bearer token in the `Authorization` header of your API requests:\n\n```\nAuthorization: Bearer \n```\n\nFor available endpoints and request details, see the API reference.\n\n> [!WARNING]\n> Anyone with your token can act as you via the API. Treat it like a password."} {"id":"account/api-tokens.md#related","url":"https://docs.turbostack.app/account/api-tokens/#related","path":"account/api-tokens.md","title":"API tokens","heading":"Related","keywords":"","text":"- Profile and preferences\n- API reference\n- Two-factor authentication"} {"id":"account/profile-and-preferences.md#intro","url":"https://docs.turbostack.app/account/profile-and-preferences/","path":"account/profile-and-preferences.md","title":"Profile and preferences","heading":"","keywords":"","text":"# Profile and preferences\n\nProfile Settings is where you manage your personal account preferences on the TurboStack Platform. You can reach it at `/profile-setting`."} {"id":"account/profile-and-preferences.md#editing-mode","url":"https://docs.turbostack.app/account/profile-and-preferences/#editing-mode","path":"account/profile-and-preferences.md","title":"Profile and preferences","heading":"Editing mode","keywords":"","text":"You can choose your preferred default editing mode used when configuring hosts:\n\n- **GUI** - a guided, visual experience.\n- **Source/YAML** - direct editing of the underlying configuration.\n\nThis preference sets the default view, which you can still switch per host. For details on how this applies, see Configuring a host."} {"id":"account/profile-and-preferences.md#description","url":"https://docs.turbostack.app/account/profile-and-preferences/#description","path":"account/profile-and-preferences.md","title":"Profile and preferences","heading":"Description","keywords":"","text":"**Description** is a free-text note stored with your account. Type your note in the box and click\n**Save** in the top right, the same button that saves your editing mode. TurboStack keeps the text\nwith your account and does not act on it, so use it for whatever helps you or your colleagues\nidentify this account."} {"id":"account/profile-and-preferences.md#api-tokens","url":"https://docs.turbostack.app/account/profile-and-preferences/#api-tokens","path":"account/profile-and-preferences.md","title":"Profile and preferences","heading":"API tokens","keywords":"","text":"From Profile Settings you can also create and manage Personal Access Tokens for the TurboStack API. See API tokens to learn how to create and use them."} {"id":"account/profile-and-preferences.md#related","url":"https://docs.turbostack.app/account/profile-and-preferences/#related","path":"account/profile-and-preferences.md","title":"Profile and preferences","heading":"Related","keywords":"","text":"- Configuring a host\n- API tokens\n- Two-factor authentication"} {"id":"account/two-factor-authentication.md#intro","url":"https://docs.turbostack.app/account/two-factor-authentication/","path":"account/two-factor-authentication.md","title":"Two-factor authentication","heading":"","keywords":"","text":"# Two-factor authentication\n\nTwo-factor authentication (2FA) adds an extra layer of security to your account by requiring a one-time code from an authenticator app in addition to your password.\n\n> [!TIP]\n> Enable 2FA to significantly improve the security of your account."} {"id":"account/two-factor-authentication.md#enable-2fa","url":"https://docs.turbostack.app/account/two-factor-authentication/#enable-2fa","path":"account/two-factor-authentication.md","title":"Two-factor authentication","heading":"Enable 2FA","keywords":"","text":"You set up and manage 2FA in the Hosted Power Customer Center, not on the TurboStack Platform\nprofile page. Once it is enabled there, the Platform asks for your one-time code when you sign in.\n\n1. Sign in to the Customer Center.\n2. Open its security settings and start the 2FA setup.\n3. Scan the displayed **QR code** (Quick Response code) with an authenticator app on your device.\n4. Enter the current code from the app to confirm setup.\n\n> [!TIP]\n> Use any standard Time-based One-Time Password (TOTP) authenticator app, for example Google\n> Authenticator, Microsoft Authenticator, Authy, or 1Password.\n\n> [!IMPORTANT]\n> Keep your authenticator app safe. If you lose access to it, you may be locked out of your account."} {"id":"account/two-factor-authentication.md#signing-in-with-2fa","url":"https://docs.turbostack.app/account/two-factor-authentication/#signing-in-with-2fa","path":"account/two-factor-authentication.md","title":"Two-factor authentication","heading":"Signing in with 2FA","keywords":"","text":"After 2FA is enabled, the Platform prompts you for a one-time code each time you sign in. You can\nchoose **remember this device** to skip the prompt for 30 days on that device. After that period, or\nwhen you sign in from a different device, you are prompted for a code again.\n\nFor the full sign-in process, see Logging In."} {"id":"account/two-factor-authentication.md#if-you-lose-access","url":"https://docs.turbostack.app/account/two-factor-authentication/#if-you-lose-access","path":"account/two-factor-authentication.md","title":"Two-factor authentication","heading":"If you lose access","keywords":"","text":"If you lose your authenticator device, contact Support to regain access to\nyour account."} {"id":"account/two-factor-authentication.md#related","url":"https://docs.turbostack.app/account/two-factor-authentication/#related","path":"account/two-factor-authentication.md","title":"Two-factor authentication","heading":"Related","keywords":"","text":"- Logging In\n- Profile and preferences\n- API tokens"} {"id":"api/cli.md#intro","url":"https://docs.turbostack.app/api/cli/","path":"api/cli.md","title":"TurboStack CLI","heading":"","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"# TurboStack CLI\n\n`tscli` is the **TurboStack command-line tool** that ships on every TurboStack server. It gives you\nsafe, audited control over day-to-day operations: checking and restarting services, clearing\ncaches, managing the firewall, validating email Domain Name System (DNS), searching logs, and more, without needing to\nknow the underlying system commands.\n\nWhere the API manages your configuration from the outside (the desired state that\nTurboStack deploys), `tscli` acts on the running server itself: it operates on live services and\ncaches right now.\n\n> [!NOTE]\n> `tscli` runs on the server, over SSH. Connect first (see your host's\n> SSH tab for connection details), then run the commands below from\n> that shell."} {"id":"api/cli.md#how-it-works","url":"https://docs.turbostack.app/api/cli/#how-it-works","path":"api/cli.md","title":"TurboStack CLI","heading":"How it works","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Run commands in the form:\n\n```bash\ntscli [arguments] [options]\n```\n\nFor example:\n\n```bash\ntscli nginx reload\ntscli service status\ntscli firewall block 203.0.113.10 --comment \"abuse\"\n```\n\nUseful global flags:\n\n| Flag | What it does |\n|---|---|\n| `tscli --help` / `-h` | Show help for the tool, a group, or a command (for example `tscli firewall --help`). |\n| `tscli --version` / `-v` | Show the installed `tscli` version. |\n\nTab-completion is enabled, so you can press Tab to complete groups, commands, log\nsources and options."} {"id":"api/cli.md#permissions-and-auditing","url":"https://docs.turbostack.app/api/cli/#permissions-and-auditing","path":"api/cli.md","title":"TurboStack CLI","heading":"Permissions and auditing","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Most `tscli` commands act on system services and therefore need **root privileges**. This is\nconfigured for you: when you run `tscli`, it elevates automatically. You do not need to type `sudo`\nand you are not prompted for a password.\n\nEvery invocation is **logged**, including the connecting SSH IP address, to:\n\n```\n/var/log/tscli.log\n```\n\nThis gives you (and Hosted Power) a clear audit trail of who ran what, and when."} {"id":"api/cli.md#checking-status","url":"https://docs.turbostack.app/api/cli/#checking-status","path":"api/cli.md","title":"TurboStack CLI","heading":"Checking status","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Almost every service group has a `status` command that shows whether the service is active and\nenabled, its uptime, and a liveness check. To see everything on the host at once, use\n`tscli service status`.\n\n> [!WARNING]\n> Some commands are **destructive**: they flush caches, kill processes, remove firewall rules, or\n> overwrite files. They take effect immediately and cannot be undone. Each one is flagged below and\n> listed under Destructive commands."} {"id":"api/cli.md#web-servers","url":"https://docs.turbostack.app/api/cli/#web-servers","path":"api/cli.md","title":"TurboStack CLI","heading":"Web servers","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Manage Nginx and Apache.\nBoth validate the configuration first and abort safely if it is invalid, so a bad config can never\ntake a site offline.\n\n| Command | What it does |\n|---|---|\n| `tscli nginx reload` | Validate the config and gracefully reload Nginx. |\n| `tscli nginx restart` | Validate the config and restart Nginx. |\n| `tscli nginx status` | Show Nginx service status and a config check. |\n| `tscli apache reload` | Validate the config and reload Apache. |\n| `tscli apache restart` | Validate the config and restart Apache. |\n| `tscli apache status` | Show Apache service status and a config check. |\n\n```bash\n# Apply a config change without interrupting live traffic\ntscli nginx reload\n```\n\n> [!TIP]\n> Prefer `reload` over `restart`: it applies changes without dropping active connections. Use\n> `restart` only when a full restart is genuinely needed."} {"id":"api/cli.md#caching","url":"https://docs.turbostack.app/api/cli/#caching","path":"api/cli.md","title":"TurboStack CLI","heading":"Caching","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Manage the Varnish full-page cache, the\nRedis object cache, and the PHP\nOPcache.\n\n| Command | What it does |\n|---|---|\n| `tscli varnish clear` | Clear the entire Varnish full-page cache. |\n| `tscli varnish reload` | Validate and reload the Varnish configuration. |\n| `tscli varnish status` | Show Varnish service status. |\n| `tscli redis clear` | Flush the Redis **cache** instance (6379). The persistent instance (6378) is left untouched. |\n| `tscli redis status` | Show Redis service status and a liveness check. |\n| `tscli opcache clear` | Clear the PHP OPcache. |\n\n```bash\n# Purge the full-page cache after a deploy or content change\ntscli varnish clear\n```\n\n> [!NOTE]\n> `tscli redis clear` runs `redis-cli flushall` on the **cache instance (6379)**, clearing all of its\n> databases. The **persistent instance (6378)** - sessions and queues - is not affected. Expect a\n> short performance dip while the cache warms up again. See\n> Clear the Redis cache to target a single database.\n\n> [!NOTE]\n> Clearing OPcache makes PHP recompile scripts on the next request, so the first hit after clearing\n> is slightly slower. This is normal."} {"id":"api/cli.md#php","url":"https://docs.turbostack.app/api/cli/#php","path":"api/cli.md","title":"TurboStack CLI","heading":"PHP","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"| Command | What it does |\n|---|---|\n| `tscli php status` | Show PHP-FPM status for each installed PHP version. |\n| `tscli php kill` | Terminate all PHP-FPM worker processes. |\n\n> [!WARNING]\n> `tscli php kill` immediately stops all PHP processing on the server (graceful stop first, then a\n> forced kill if needed). Requests in flight are aborted, which can interrupt transactions. Use it\n> only as a last resort when PHP is stuck; for normal config changes, reload the web server instead."} {"id":"api/cli.md#blackfire-profiler","url":"https://docs.turbostack.app/api/cli/#blackfire-profiler","path":"api/cli.md","title":"TurboStack CLI","heading":"Blackfire profiler","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Manage the Blackfire PHP profiler.\n\n| Command | What it does |\n|---|---|\n| `tscli blackfire enable` | Install and enable the Blackfire profiler. |\n| `tscli blackfire disable` | Remove and disable the Blackfire profiler. |\n| `tscli blackfire configure` | Set the Blackfire server ID and token interactively. |\n| `tscli blackfire reload` | Restart the Blackfire agent. |\n| `tscli blackfire status` | Show Blackfire agent status. |\n\n```bash\n# Enable profiling temporarily to investigate a performance problem\ntscli blackfire enable\n# ... profile your application ...\ntscli blackfire disable\n```\n\n> [!NOTE]\n> `enable` and `disable` restart the PHP-FPM services so the change takes effect, which briefly\n> interrupts PHP processing."} {"id":"api/cli.md#databases","url":"https://docs.turbostack.app/api/cli/#databases","path":"api/cli.md","title":"TurboStack CLI","heading":"Databases","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Restart and check MySQL/MariaDB,\nPostgreSQL and MongoDB.\n`postgresql restart` covers every detected cluster.\n\n| Command | What it does |\n|---|---|\n| `tscli mysql restart` | Restart the MySQL/MariaDB service. |\n| `tscli mysql status` | Show MySQL/MariaDB status and a liveness check. |\n| `tscli postgresql restart` | Restart all PostgreSQL clusters. |\n| `tscli postgresql status` | Show PostgreSQL status and a per-cluster liveness check. |\n| `tscli mongo restart` | Restart the MongoDB service. |\n| `tscli mongo status` | Show MongoDB status and a liveness check. |\n\n> [!TIP]\n> Restart a database sparingly. A restart briefly interrupts every site that uses it. Check\n> Database problems before restarting."} {"id":"api/cli.md#search-and-queues","url":"https://docs.turbostack.app/api/cli/#search-and-queues","path":"api/cli.md","title":"TurboStack CLI","heading":"Search and queues","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"| Command | What it does |\n|---|---|\n| `tscli solr restart` | Restart the Solr search service. |\n| `tscli solr status` | Show Solr status. |\n| `tscli rabbitmq status` | Show RabbitMQ status and a liveness check. |\n| `tscli rabbitmq queue list ` | List the queues in a RabbitMQ virtual host (JSON output). |\n\n```bash\n# List queues in the default virtual host\ntscli rabbitmq queue list /\n```"} {"id":"api/cli.md#containers","url":"https://docs.turbostack.app/api/cli/#containers","path":"api/cli.md","title":"TurboStack CLI","heading":"Containers","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"| Command | What it does |\n|---|---|\n| `tscli docker restart` | Restart the Docker service. |\n| `tscli docker status` | Show Docker status and the number of running containers. |"} {"id":"api/cli.md#firewall","url":"https://docs.turbostack.app/api/cli/#firewall","path":"api/cli.md","title":"TurboStack CLI","heading":"Firewall","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Manage the host Firewall, which works together with\nTurboShield threat detection. Blocks apply at both the\nnetwork and web layers, take effect immediately, and repeating a block for the same address does not\ncreate a duplicate rule. Every command accepts an IPv4 or IPv6 address, or a Classless Inter-Domain Routing (CIDR) range.\n\n| Command | What it does |\n|---|---|\n| `tscli firewall check ` | Look up whether an IP (or range) is currently blocked. |\n| `tscli firewall block ` | Block an IP. See the options below. |\n| `tscli firewall unblock ` | Remove a block for an IP. |\n| `tscli firewall whitelist ` | Add an IP to the allow and ignore lists. |\n| `tscli firewall unlist ` | Remove an IP from the allow and ignore lists. |\n| `tscli firewall flush` | Remove all automatic blocks (permanent manual blocks remain). |\n| `tscli firewall display-blocks` | List the active manual blocks. Add `--full` to include automatic blocks. |\n| `tscli firewall display-whitelists` | List the active allow and ignore entries. |\n| `tscli firewall status` | Show firewall status, protection mode and block counts. |\n\nOptions for `tscli firewall block`:\n\n| Option | Default | What it does |\n|---|---|---|\n| `--time ` | `2592000` (30 days) | How long the block lasts. Use `-1` for a permanent block. |\n| `--comment ` | empty | A short reason for the block (for the audit trail). |\n\n```bash\n# Is this address blocked?\ntscli firewall check 203.0.113.10\n\n# Block an abusive IP for a week, with a reason\ntscli firewall block 203.0.113.10 --time 604800 --comment \"spam\"\n\n# Block a whole range permanently\ntscli firewall block 203.0.113.0/24 --time -1\n\n# Permanently trust a known-good IP (office, monitoring)\ntscli firewall whitelist 198.51.100.7\n```\n\n> [!WARNING]\n> `tscli firewall flush` removes all automatic blocks at once, including blocks that were protecting\n> you from active abuse. Use it only when you are sure a block is a false positive and you need a\n> clean slate. Permanent manual blocks are kept.\n\n> [!TIP]\n> If you (or a customer) are locked out by the firewall, `tscli firewall check ` confirms\n> whether that IP is the cause, and `tscli firewall whitelist ` restores access for a trusted\n> address."} {"id":"api/cli.md#email-dkim","url":"https://docs.turbostack.app/api/cli/#email-dkim","path":"api/cli.md","title":"TurboStack CLI","heading":"Email (DKIM)","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Check the DomainKeys Identified Mail (DKIM) DNS records for the domains on the host. See Email for\nthe wider mail setup.\n\n| Command | What it does |\n|---|---|\n| `tscli dkim records` | Show the DNS TXT records that DKIM requires for each domain. |\n| `tscli dkim validate` | Look up the records in DNS and report whether they match. |\n\n```bash\n# Show the records to add at your DNS provider\ntscli dkim records\n\n# Confirm they are live and correct\ntscli dkim validate\n```"} {"id":"api/cli.md#service-overviews","url":"https://docs.turbostack.app/api/cli/#service-overviews","path":"api/cli.md","title":"TurboStack CLI","heading":"Service overviews","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"| Command | What it does |\n|---|---|\n| `tscli service status` | Show the status of every installed service on the host at a glance. |\n| `tscli app status` | Overview of your application background services (per user). |\n| `tscli app list` | A flat, scriptable list of app services (user, backend, service, active/total). |\n| `tscli app backends` | Show which process manager each app user uses. |\n\n```bash\n# Quick health snapshot of every service on the host\ntscli service status\n```"} {"id":"api/cli.md#logs","url":"https://docs.turbostack.app/api/cli/#logs","path":"api/cli.md","title":"TurboStack CLI","heading":"Logs","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Search the server logs in plain language, without remembering file paths.\n\n```bash\ntscli logs [query...] [--explain]\n```\n\n- `source` is a log source such as `nginx`, `apache`, `mysql`, `postgresql`, `php`, `redis`, or\n `web` (Nginx and Apache together). For web sources, add `error` or `access` to narrow the scope.\n- The query understands phrases like `find `, `show last lines`, and time ranges such as\n `from last hour` or `from 2 hours ago`.\n- When you give **more than one search term, they are combined with AND by default**: a line must\n contain every term to match. To match any term instead, put `or` between them.\n- `--explain` shows how your query was interpreted, including whether the terms were combined with\n \"and\" or \"or\".\n\n```bash\ntscli logs nginx error # recent Nginx error log\ntscli logs nginx find timeout from last hour # search both Nginx logs for \"timeout\"\ntscli logs web find 203.0.113.10 timeout # lines that contain BOTH terms (AND)\ntscli logs web find 203.0.113.10 or 203.0.113.11 # lines that contain EITHER term (OR)\ntscli logs mysql find error from 2 hours ago # MySQL log, scoped by time\n```\n\nSee Troubleshooting for how to use logs while diagnosing an issue."} {"id":"api/cli.md#health-snapshot","url":"https://docs.turbostack.app/api/cli/#health-snapshot","path":"api/cli.md","title":"TurboStack CLI","heading":"Health snapshot","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"```bash\ntscli healthcheck [brief]\n```\n\nShows a one-screen snapshot of the server: uptime and load, memory and swap, disk usage per mount,\nthe top memory-using processes, and active connections. Add `brief` for a shorter report. For the\nfull picture over time, use the host's Health tab."} {"id":"api/cli.md#bot-traffic-analysis","url":"https://docs.turbostack.app/api/cli/#bot-traffic-analysis","path":"api/cli.md","title":"TurboStack CLI","heading":"Bot traffic analysis","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Analyze how much of your traffic comes from bots and crawlers, which feeds into\nTurboShield tuning.\n\n| Command | What it does |\n|---|---|\n| `tscli tools botload list [--time ]` | List log files and analyze one (optionally within a time window, `HH:MM:SS`). |\n| `tscli tools botload shared [-n ]` | Analyze all web logs and rank them by bot percentage (default top 10). |\n| `tscli tools botload ip [--cidr ]` | Analyze all entries for an IP or range (default `--cidr 32`). |\n| `tscli tools botload live` | Watch incoming traffic and update bot statistics in real time. |\n\n```bash\n# Which logs have the highest bot share?\ntscli tools botload shared -n 20\n```"} {"id":"api/cli.md#image-optimizer","url":"https://docs.turbostack.app/api/cli/#image-optimizer","path":"api/cli.md","title":"TurboStack CLI","heading":"Image optimizer","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"Reduce the size of JPG and PNG assets under a path.\n\n```bash\ntscli tools image-optimizer [options]\n```\n\n| Option | Default | What it does |\n|---|---|---|\n| `-a`, `--apply` | off (dry-run) | Replace originals when the optimized file is smaller. |\n| `-q`, `--quality <1-100>` | `90` | JPEG quality target. |\n| `-s`, `--size ` | `2000` | Maximum width/height before resizing. |\n| `-n`, `--new` | off | Only scan files added since the last run. |\n| `--exclude ` | none | Skip a directory tree (repeatable). |\n\n```bash\n# Preview savings (no changes made)\ntscli tools image-optimizer /var/www/site/media\n\n# Apply, at quality 85 and max 1500px\ntscli tools image-optimizer /var/www/site/media -q 85 -s 1500 -a\n```\n\n> [!WARNING]\n> `tscli tools image-optimizer` with `-a`/`--apply` overwrites the original image files. Run it\n> first without `-a` to preview the savings."} {"id":"api/cli.md#destructive-commands","url":"https://docs.turbostack.app/api/cli/#destructive-commands","path":"api/cli.md","title":"TurboStack CLI","heading":"Destructive commands","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"These change state immediately and cannot be undone. Use them with care:\n\n- `tscli redis clear`, `tscli varnish clear`, `tscli opcache clear` - clear caches (temporary performance dip).\n- `tscli php kill` - stops all PHP processing; in-flight requests are dropped.\n- `tscli firewall flush` - removes all automatic blocks.\n- `tscli blackfire disable` / `configure` - removes the profiler / overwrites its credentials.\n- `tscli tools image-optimizer ... -a` - overwrites original image files.\n- `tscli ... restart` / `reload` - can cause a brief interruption if a service fails to come back."} {"id":"api/cli.md#exit-codes","url":"https://docs.turbostack.app/api/cli/#exit-codes","path":"api/cli.md","title":"TurboStack CLI","heading":"Exit codes","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"`tscli` returns `0` on success and a non-zero code on failure, so you can use it safely in scripts:\n\n| Code | Meaning |\n|---|---|\n| `0` | Success |\n| `1` | Command failed, or could not elevate to root |\n| `6000` | Generic error |\n| `6001` | Invalid user input |\n| `6002` | Service is not installed |\n| `6101` | Invalid Nginx configuration |\n| `6201` | Invalid IP address |\n| `6301` | Could not install Blackfire |\n| `6302` | Could not remove Blackfire |\n| `130` | Interrupted (Ctrl-C) |"} {"id":"api/cli.md#when-to-use-the-cli","url":"https://docs.turbostack.app/api/cli/#when-to-use-the-cli","path":"api/cli.md","title":"TurboStack CLI","heading":"When to use the CLI","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"| You want to... | Use |\n|---|---|\n| Change configuration (versions, services, domains) | In the TurboStack Platform or API, then publish |\n| See whether a service is healthy | `tscli service status` or `tscli status` |\n| Apply a config change to the running web server | `tscli nginx reload` |\n| Clear caches after a deploy or content change | `tscli varnish clear`, `tscli redis clear`, `tscli opcache clear` |\n| Block or trust an IP address | `tscli firewall block` / `whitelist` |\n| Check or validate email DNS | `tscli dkim records` / `validate` |\n| Search logs while troubleshooting | `tscli logs find ` |\n\n> [!IMPORTANT]\n> `tscli` operates on the running server. It does not change your saved TurboStack configuration: a\n> future publish re-applies the desired state. To make a change\n> permanent, set it in the TurboStack Platform or API and publish."} {"id":"api/cli.md#related","url":"https://docs.turbostack.app/api/cli/#related","path":"api/cli.md","title":"TurboStack CLI","heading":"Related","keywords":"tscli turbostack cli service status clear cache flush Redis reload nginx firewall block dkim log search healthcheck image optimizer","text":"- API reference\n- SSH access\n- Publishing changes\n- Performance tuning\n- Troubleshooting\n- Firewall"} {"id":"api/mcp.md#intro","url":"https://docs.turbostack.app/api/mcp/","path":"api/mcp.md","title":"MCP server","heading":"","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"# MCP server\n\n**TurboStack MCP** connects your artificial intelligence (AI) assistant to this\ndocumentation. Instead of answering from\nwhatever it happens to remember about hosting in general, the assistant looks up the real\nTurboStack documentation - the configuration parameters, the example configurations, the technology\nand application pages and the REST API - and cites the page it used.\n\nIt speaks the **Model Context Protocol (MCP)**, the open standard that AI clients use to reach\nexternal tools and data. Any client that supports it can connect.\n\nEndpoint:\n\n```\nhttps://docs.turbostack.app/mcp\n```\n\nNo account, no token, no sign-up.\n\n> [!IMPORTANT]\n> **Connected without a token, this is documentation and nothing else.** It explains and looks\n> things up. It cannot change anything on the TurboStack platform or on your server, and it cannot\n> see your hosts, your configuration or your data - it has no access to your account. Applying a\n> change stays your own step, in the TurboStack Platform, the REST API or the\n> CLI."} {"id":"api/mcp.md#why-connect-it","url":"https://docs.turbostack.app/api/mcp/#why-connect-it","path":"api/mcp.md","title":"MCP server","heading":"Why connect it","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"A general-purpose assistant knows Ansible, Docker and Nginx in general. It does not know how\nTurboStack names things, and it will confidently invent a configuration key that looks plausible and\ndoes not exist. Connected to this server, it can check.\n\n- **It stops guessing parameters.** Ask for a configuration and the assistant looks up each key: its\n scope (host, system user or application), its type, its default and its valid values.\n- **It starts from a working example.** Complete configurations for WordPress, Magento 2, Shopware,\n Odoo, Laravel, Node.js, several applications on one host, and an application server with a\n separate database server.\n- **It knows the rules between keys.** The mistakes that pass a syntax check and still do nothing -\n Varnish needing two keys, a runtime enabled by setting its version, Elasticsearch and OpenSearch\n being mutually exclusive.\n- **It can help you build against the API.** Endpoints, parameters, request bodies and responses,\n including what may go inside a host's configuration body.\n- **Every answer links to the page it came from**, so you can check it."} {"id":"api/mcp.md#claude-code","url":"https://docs.turbostack.app/api/mcp/#claude-code","path":"api/mcp.md","title":"MCP server","heading":"Claude Code","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"```bash\nclaude mcp add --transport http TurboStack https://docs.turbostack.app/mcp\n```"} {"id":"api/mcp.md#claude-desktop-cursor-windsurf-zed","url":"https://docs.turbostack.app/api/mcp/#claude-desktop-cursor-windsurf-zed","path":"api/mcp.md","title":"MCP server","heading":"Claude Desktop, Cursor, Windsurf, Zed","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"Add the server to the client's configuration file:\n\n```json\n{\n \"mcpServers\": {\n \"TurboStack\": {\n \"type\": \"http\",\n \"url\": \"https://docs.turbostack.app/mcp\"\n }\n }\n}\n```"} {"id":"api/mcp.md#openai","url":"https://docs.turbostack.app/api/mcp/#openai","path":"api/mcp.md","title":"MCP server","heading":"OpenAI","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"Pass the server in the `tools` array of a Responses API call:\n\n```json\n{\n \"type\": \"mcp\",\n \"server_label\": \"TurboStack\",\n \"server_url\": \"https://docs.turbostack.app/mcp\",\n \"require_approval\": \"never\"\n}\n```"} {"id":"api/mcp.md#assistants-that-start-a-local-command","url":"https://docs.turbostack.app/api/mcp/#assistants-that-start-a-local-command","path":"api/mcp.md","title":"MCP server","heading":"Assistants that start a local command","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"Some clients, including Google Gemini's command-line tool, expect to launch a program and talk to it\nover its input and output rather than over the network. Use the bridge shipped with the server: it\npasses everything through to the same endpoint.\n\n```json\n{\n \"mcpServers\": {\n \"TurboStack\": {\n \"command\": \"node\",\n \"args\": [\"/path/to/stdio-bridge.mjs\"]\n }\n }\n}\n```\n\nThe bridge is a single file with no dependencies. Ask Support for it, or\nopen the endpoint in a browser: it returns a description of the server and these connection\nsnippets."} {"id":"api/mcp.md#with-a-turbostack-api-token","url":"https://docs.turbostack.app/api/mcp/#with-a-turbostack-api-token","path":"api/mcp.md","title":"MCP server","heading":"With a TurboStack API token","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"The endpoint stays the same. A token adds the tools that work on your own hosts - see\nWorking on your own servers for what that covers and what it\nrefuses to do.\n\nCreate the token under API tokens in your Profile Settings, then send it\nas an `Authorization: Bearer ` header. Every client that supports MCP can add one.\n\n**Claude Code**\n\n```bash\nclaude mcp add --transport http TurboStack https://docs.turbostack.app/mcp \\\n --header \"Authorization: Bearer \"\n```\n\n**Claude Desktop, Cursor, Windsurf, Zed**\n\n```json\n{\n \"mcpServers\": {\n \"TurboStack\": {\n \"type\": \"http\",\n \"url\": \"https://docs.turbostack.app/mcp\",\n \"headers\": {\n \"Authorization\": \"Bearer \"\n }\n }\n }\n}\n```\n\n**OpenAI**\n\n```json\n{\n \"type\": \"mcp\",\n \"server_label\": \"TurboStack\",\n \"server_url\": \"https://docs.turbostack.app/mcp\",\n \"headers\": {\n \"Authorization\": \"Bearer \"\n },\n \"require_approval\": \"never\"\n}\n```\n\nTreat the token like a password: it carries whatever access your account has. Keep it out of shared\nconfiguration files and out of anything you commit."} {"id":"api/mcp.md#check-that-it-works","url":"https://docs.turbostack.app/api/mcp/#check-that-it-works","path":"api/mcp.md","title":"MCP server","heading":"Check that it works","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"Ask your assistant something only this documentation can answer:\n\n- \"What does `php_fpm_pm_max_children` do, and where does it belong in the configuration?\"\n- \"Give me a TurboStack configuration for a Magento 2 shop with Redis and Varnish.\"\n- \"Which technologies does TurboStack support?\"\n- \"How do I poll the API until a deployment is finished?\"\n\nA connected assistant answers with the parameter's scope, type and default, or with a complete\nexample configuration, and links to the page it used. An assistant that is not connected will\nanswer in general terms and invent key names."} {"id":"api/mcp.md#what-you-can-ask-it","url":"https://docs.turbostack.app/api/mcp/#what-you-can-ask-it","path":"api/mcp.md","title":"MCP server","heading":"What you can ask it","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"Without a token, the server answers from the documentation. It is exact where an exact answer\nexists, and searches only when the question is genuinely prose.\n\n| Ask about | What comes back |\n| --- | --- |\n| A configuration key | Scope (host, system user or application), type, default, documented values, what it does, what it requires, what to be careful with |\n| \"Which key controls X\" | The matching parameters with their scope and purpose |\n| A complete setup | A full working example configuration for the scenario - WordPress, Magento 2, Shopware, Odoo, Laravel, Node.js, several applications on one host, an application server with a separate database server |\n| How keys interact | The rules that connect keys: which one enables a runtime, which needs a second key elsewhere, which combinations exclude each other |\n| The REST API | Endpoints with their parameters, request body and responses |\n| A term | What it means on this platform |\n| What is supported | Every documented technology and application |\n| Anything else | The matching documentation passages with a link to each, or a whole page |\n\nSome questions that work well:\n\n- \"What does `php_fpm_pm_max_children` do, and where does it belong in the configuration?\"\n- \"Give me a TurboStack configuration for a Magento 2 shop with Redis and Varnish.\"\n- \"Is `redis_maxmemory_mb` a real parameter?\" (it is not, and the answer says what is)\n- \"How do I poll the API until a deployment is finished?\""} {"id":"api/mcp.md#working-on-your-own-servers","url":"https://docs.turbostack.app/api/mcp/#working-on-your-own-servers","path":"api/mcp.md","title":"MCP server","heading":"Working on your own servers","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"Connect with a **TurboStack API token** and the same endpoint can also work on the hosts that token\ncan reach. Create a token under API tokens in your Profile Settings, and\nsend it as an `Authorization: Bearer ` header - see\nWith a TurboStack API token for the snippet per client.\n\n| Then you can | Notes |\n| --- | --- |\n| List your servers | By name, active ones only, however many pages the platform needs |\n| List your groups and accounts | A group carries settings that the hosts in it inherit |\n| Read a host | Its deploy status, and its configuration when you ask about settings or versions. Shown as YAML, the form a configuration is written in |\n| Check a configuration before using it | Parses your YAML and checks every key: does it exist, is it in the right place, is the type right, which rules apply |\n| See exactly what a change would do | A difference against the live host. Writes nothing |\n| Save a change | Reads the host, applies your change to the whole configuration, writes it back. Saving does not deploy |\n| Publish a host | Applies the saved configuration to the server |\n\nThe platform address is `https://my.turbostack.app`.\n\n> [!WARNING]\n> **This part changes live servers, and those changes are yours.** An assistant can be wrong, and a\n> configuration change can take a site offline. Read the difference it shows you before you agree to\n> anything, keep a normal deploy as the default, and contact Support when\n> something is unclear - do not let an assistant try another approach instead.\n\nHow it protects you:\n\n- **A key that does not exist is refused.** Your YAML is checked against the documented parameters\n first. An unknown key stops the whole change and the answer names the parameters that do exist.\n- **Nothing is saved without showing the difference first**, and the save has to quote a code that\n belongs to exactly that difference.\n- **A normal deploy is the default.** A full deploy happens only if you ask for one, and a full\n delete deploy - which removes resources and their data - needs a separate confirmation.\n- **Nothing is removed that you did not ask to remove.** Your change is merged into the\n configuration that is already there.\n\n**Two things have to be true** for any of this. You have to send a token, and the server has to have\nthe platform integration switched on. Hosted Power can switch it off, in which case the endpoint\nserves the documentation only and no token changes that. If the tools do not appear in your client,\nthat is the first thing to check."} {"id":"api/mcp.md#good-to-know","url":"https://docs.turbostack.app/api/mcp/#good-to-know","path":"api/mcp.md","title":"MCP server","heading":"Good to know","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"**It answers from a snapshot.** The server carries the documentation as published, refreshed with\nevery documentation release. Version numbers and the option lists behind the dropdowns are\nmaintained in the TurboStack Platform, so treat an exact version in an answer as \"documented at the\ntime\" and confirm it in the interface before you rely on it. Ask the assistant what its snapshot\ndate is and it will tell you.\n\n**It is rate limited.** A generous limit per address, enough for interactive use. An assistant that\nhammers it in a loop will be slowed down, not banned.\n\n**It only knows what is published here.** Nothing about your hosts, your traffic or your invoices.\nFor those, use the TurboStack Platform, the REST API or\nSupport."} {"id":"api/mcp.md#related","url":"https://docs.turbostack.app/api/mcp/#related","path":"api/mcp.md","title":"MCP server","heading":"Related","keywords":"mcp model context protocol ai assistant claude chatgpt gemini cursor copilot documentation server turbostack mcp","text":"- API reference\n- TurboStack CLI\n- YAML configuration reference\n- Support"} {"id":"api/reference.md#intro","url":"https://docs.turbostack.app/api/reference/","path":"api/reference.md","title":"API reference","heading":"","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"# API reference\n\nThe TurboStack API lets you read and manage Clients, Groups and Hosts\nprogrammatically - the same objects you manage in the TurboStack Platform. Use it to automate\nconfiguration changes and deployments from your own tooling.\n\n- **Base URL (Uniform Resource Locator):** `https://my.turbostack.app`\n- **Version:** `v1` - every path is under `/api/v1`\n- **Format:** JSON request and response bodies\n- **Auth:** an HTTP Bearer token on every request"} {"id":"api/reference.md#interactive-api-explorer-swagger","url":"https://docs.turbostack.app/api/reference/#interactive-api-explorer-swagger","path":"api/reference.md","title":"API reference","heading":"Interactive API explorer (Swagger)","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"The platform ships an interactive **Swagger UI**, a user interface (UI) where you can browse every\nendpoint, see its parameters and response schema, and try calls live. Open it at\n`/swagger`; the full machine-readable spec is at\n`/api-docs/api-docs.json`.\n\n\n\n> [!TIP]\n> The Swagger UI and the OpenAPI spec are the authoritative, always-current reference. This page\n> covers every endpoint with ready-to-use examples; consult the spec for the exact, up-to-date\n> schema of every field.\n\nExpand an endpoint to see its parameters with their defaults and its response codes and example\npayloads; **Try it out** sends a live request from the browser."} {"id":"api/reference.md#authentication","url":"https://docs.turbostack.app/api/reference/#authentication","path":"api/reference.md","title":"API reference","heading":"Authentication","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Every endpoint requires an `Authorization: Bearer ` header:\n\n```\nAuthorization: Bearer \n```\n\nCreate a token under API tokens in your Profile Settings. In Swagger UI,\nclick **Authorize** and enter `Bearer `.\n\n\n\n> [!IMPORTANT]\n> Treat your API token as a secret. Anyone with it can read and modify your clients, groups and\n> hosts. Store it in an environment variable and never commit it to source control."} {"id":"api/reference.md#rate-limit","url":"https://docs.turbostack.app/api/reference/#rate-limit","path":"api/reference.md","title":"API reference","heading":"Rate limit","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"The API accepts **6000 requests per minute**, counted per token owner (or per IP address for an\nunauthenticated request). That is generous enough that normal integrations never reach it.\n\nGo over it and the API answers `429 Too Many Requests` with a `Retry-After` header telling you how\nmany seconds to wait. The response also carries `X-RateLimit-Limit` and `X-RateLimit-Remaining`, so\nyou can back off before you get there.\n\nThe limit is about protecting the platform, not about pacing your work. If you are close to it, the\nusual cause is polling in a tight loop. A deployment takes minutes, so check its status every few\nseconds at most - see\nCommon workflow: update a host and deploy."} {"id":"api/reference.md#setup-for-the-examples","url":"https://docs.turbostack.app/api/reference/#setup-for-the-examples","path":"api/reference.md","title":"API reference","heading":"Setup for the examples","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"The PHP and Python samples below assume this one-time setup. The `cURL` samples read the token from\nthe `TURBOSTACK_API_TOKEN` environment variable.\n\n+++ cURL\n```bash\nexport TURBOSTACK_API_TOKEN=\"\"\n```\n+++ PHP\n```php\n= 400) {\n throw new RuntimeException(\"TurboStack API error: HTTP {$status} - {$res}\");\n }\n return json_decode($res, true) ?? [];\n}\n```\n+++ Python\n```python\nimport os\nimport requests\n\nBASE = \"https://my.turbostack.app\"\nsession = requests.Session()\nsession.headers.update({\n \"Authorization\": f\"Bearer {os.environ['TURBOSTACK_API_TOKEN']}\", # never hard-code your token\n \"Accept\": \"application/json\",\n})\n```\n+++"} {"id":"api/reference.md#the-configuration-model","url":"https://docs.turbostack.app/api/reference/#the-configuration-model","path":"api/reference.md","title":"API reference","heading":"The configuration model","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Host and group configuration uses the same desired-state model as the TurboStack Platform. Where the\nPlatform shows it as YAML (the Source (YAML) view), the API represents it\nas JSON. You read the current state with a `GET` and submit changes by `POST`ing an updated JSON\nbody. Every key of that model is listed in the\nYAML configuration reference, including which level it belongs to and\nwhat it changes on the server.\n\n> [!NOTE]\n> Saving configuration with a `POST` describes the desired state; it does not deploy by itself. You\n> must trigger a deployment to apply it - see the\n> update-and-deploy workflow below and\n> Publishing changes."} {"id":"api/reference.md#pagination","url":"https://docs.turbostack.app/api/reference/#pagination","path":"api/reference.md","title":"API reference","heading":"Pagination","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"List endpoints (clients, hosts and groups) return a paginated response. The items are under the\n`data` array, alongside pagination metadata:\n\n```json\n{\n \"data\": [ ],\n \"current_page\": 1,\n \"per_page\": 15,\n \"total\": 42,\n \"last_page\": 3\n}\n```\n\nControl paging with the `page` and `size` query parameters, and narrow the results with `search`.\nTo walk every page, request `page=1` and keep incrementing `page` until `current_page` equals\n`last_page`. A `page` beyond the last one is not an error: it returns `200` with an empty `data`.\n\n> [!NOTE]\n> **Deduplicate on `id`, and do not read `total` as a count of hosts or groups.** The host and group\n> lists are joined to the accounts that can see them, so an entry comes back once per account that\n> shares its customer id. An account with sub-accounts therefore repeats the same host several\n> times, across page boundaries as well, and `total` counts those repeated rows. Collect the pages,\n> collapse them on `id`, and count what is left.\n\n---"} {"id":"api/reference.md#clients","url":"https://docs.turbostack.app/api/reference/#clients","path":"api/reference.md","title":"API reference","heading":"Clients","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"A client is an account that owns groups and hosts."} {"id":"api/reference.md#badge-variant-success-text-get-api-v1-clients","url":"https://docs.turbostack.app/api/reference/#badge-variant-success-text-get-api-v1-clients","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"success\" text=\"GET\"] `/api/v1/clients`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"List all clients you can access. The result is a paginated list (see\nPagination below).\n\n**Query parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `page` | integer | Page number (default `1`). |\n| `size` | integer | Items per page (default `15`). |\n| `search` | string | Filter by name, email, company or ID (partial match). |\n\n+++ cURL\n```bash\ncurl \"https://my.turbostack.app/api/v1/clients?page=1&size=50&search=acme\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$clients = ts('GET', '/api/v1/clients?page=1&size=50&search=acme');\n```\n+++ Python\n```python\nclients = session.get(\n f\"{BASE}/api/v1/clients\",\n params={\"page\": 1, \"size\": 50, \"search\": \"acme\"},\n).json()\n```\n+++\n\n**Response** `200`\n\n```json\n{\n \"data\": [\n { \"id\": 7, \"firstname\": \"Ada\", \"lastname\": \"Lovelace\", \"email\": \"ada@acme.example\" },\n { \"id\": 8, \"firstname\": \"Alan\", \"lastname\": \"Turing\", \"email\": \"alan@example.test\" }\n ],\n \"current_page\": 1,\n \"per_page\": 50,\n \"total\": 2,\n \"last_page\": 1\n}\n```"} {"id":"api/reference.md#badge-variant-success-text-get-api-v1-clients-id","url":"https://docs.turbostack.app/api/reference/#badge-variant-success-text-get-api-v1-clients-id","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"success\" text=\"GET\"] `/api/v1/clients/{id}`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Fetch one client by its `id`.\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The client ID. |\n\n+++ cURL\n```bash\ncurl \"https://my.turbostack.app/api/v1/clients/7\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$client = ts('GET', '/api/v1/clients/7');\n```\n+++ Python\n```python\nclient = session.get(f\"{BASE}/api/v1/clients/7\").json()\n```\n+++\n\n**Response** `200`\n\n```json\n{ \"id\": 7, \"firstname\": \"Ada\", \"lastname\": \"Lovelace\", \"email\": \"ada@acme.example\" }\n```"} {"id":"api/reference.md#badge-variant-success-text-get-api-v1-clients-id-hosts","url":"https://docs.turbostack.app/api/reference/#badge-variant-success-text-get-api-v1-clients-id-hosts","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"success\" text=\"GET\"] `/api/v1/clients/{id}/hosts`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"List the hosts that belong to a client. The result is a paginated list (see\nPagination below).\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The client ID. |\n\n**Query parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `page` | integer | Page number (default `1`). |\n| `size` | integer | Items per page (default `15`). |\n| `search` | string | Filter by host name (partial match). |\n\n+++ cURL\n```bash\ncurl \"https://my.turbostack.app/api/v1/clients/7/hosts?page=1&size=50&search=shop\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$hosts = ts('GET', '/api/v1/clients/7/hosts?page=1&size=50&search=shop');\n```\n+++ Python\n```python\nhosts = session.get(\n f\"{BASE}/api/v1/clients/7/hosts\",\n params={\"page\": 1, \"size\": 50, \"search\": \"shop\"},\n).json()\n```\n+++\n\n**Response** `200`\n\n```json\n{\n \"data\": [\n { \"id\": 123, \"client_id\": 7, \"active\": 1, \"name\": \"shop-production\" }\n ],\n \"current_page\": 1,\n \"per_page\": 50,\n \"total\": 1,\n \"last_page\": 1\n}\n```"} {"id":"api/reference.md#badge-variant-success-text-get-api-v1-clients-id-groups","url":"https://docs.turbostack.app/api/reference/#badge-variant-success-text-get-api-v1-clients-id-groups","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"success\" text=\"GET\"] `/api/v1/clients/{id}/groups`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"List the groups that belong to a client. The result is a paginated list (see\nPagination below).\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The client ID. |\n\n**Query parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `page` | integer | Page number (default `1`). |\n| `size` | integer | Items per page (default `15`). |\n| `search` | string | Filter by group name (partial match). |\n\n+++ cURL\n```bash\ncurl \"https://my.turbostack.app/api/v1/clients/7/groups?page=1&size=50&search=security\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$groups = ts('GET', '/api/v1/clients/7/groups?page=1&size=50&search=security');\n```\n+++ Python\n```python\ngroups = session.get(\n f\"{BASE}/api/v1/clients/7/groups\",\n params={\"page\": 1, \"size\": 50, \"search\": \"security\"},\n).json()\n```\n+++\n\n**Response** `200`\n\n```json\n{\n \"data\": [\n { \"id\": 42, \"client_id\": 7, \"name\": \"shared-security\" }\n ],\n \"current_page\": 1,\n \"per_page\": 50,\n \"total\": 1,\n \"last_page\": 1\n}\n```\n\n---"} {"id":"api/reference.md#hosts","url":"https://docs.turbostack.app/api/reference/#hosts","path":"api/reference.md","title":"API reference","heading":"Hosts","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"A host is a server you configure and deploy. Its configuration uses the\nconfiguration model described above."} {"id":"api/reference.md#badge-variant-success-text-get-api-v1-hosts","url":"https://docs.turbostack.app/api/reference/#badge-variant-success-text-get-api-v1-hosts","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"success\" text=\"GET\"] `/api/v1/hosts`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"List all hosts. The result is a paginated list (see Pagination below), filterable by\nname with the `search` parameter.\n\n**Query parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `page` | integer | Page number (default `1`). |\n| `size` | integer | Items per page (default `15`). |\n| `search` | string | Filter by name (partial match). |\n\n+++ cURL\n```bash\ncurl \"https://my.turbostack.app/api/v1/hosts?page=1&size=50&search=shop\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$hosts = ts('GET', '/api/v1/hosts?page=1&size=50&search=shop');\n```\n+++ Python\n```python\nhosts = session.get(\n f\"{BASE}/api/v1/hosts\",\n params={\"page\": 1, \"size\": 50, \"search\": \"shop\"},\n).json()\n```\n+++\n\n**Response** `200`\n\nEach host carries its configuration under the `json` key and a live `monitoring` object.\n\n```json\n{\n \"data\": [\n {\n \"id\": 123,\n \"client_id\": 7,\n \"active\": 1,\n \"name\": \"shop-production\",\n \"json\": { \"webserver\": \"nginx\", \"mysql_version\": \"8.4\", \"redis_enabled\": true },\n \"monitoring\": { \"load\": {}, \"disk\": {}, \"memory\": {} }\n }\n ],\n \"current_page\": 1,\n \"per_page\": 50,\n \"total\": 1,\n \"last_page\": 1\n}\n```"} {"id":"api/reference.md#badge-variant-success-text-get-api-v1-hosts-id","url":"https://docs.turbostack.app/api/reference/#badge-variant-success-text-get-api-v1-hosts-id","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"success\" text=\"GET\"] `/api/v1/hosts/{id}`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Fetch one host's full configuration (the desired-state model).\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The host ID. |\n\n+++ cURL\n```bash\ncurl \"https://my.turbostack.app/api/v1/hosts/123\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$host = ts('GET', '/api/v1/hosts/123');\n```\n+++ Python\n```python\nhost = session.get(f\"{BASE}/api/v1/hosts/123\").json()\n```\n+++\n\n**Response** `200`\n\nThe configuration model is returned under the `json` key.\n\n```json\n{\n \"id\": 123,\n \"client_id\": 7,\n \"active\": 1,\n \"name\": \"shop-production\",\n \"json\": {\n \"webserver\": \"nginx\",\n \"mysql_version\": \"8.4\",\n \"redis_enabled\": true\n },\n \"monitoring\": { \"load\": {}, \"disk\": {}, \"memory\": {} }\n}\n```"} {"id":"api/reference.md#badge-variant-info-text-post-api-v1-hosts-id","url":"https://docs.turbostack.app/api/reference/#badge-variant-info-text-post-api-v1-hosts-id","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"info\" text=\"POST\"] `/api/v1/hosts/{id}`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Update a host's configuration. The request body wraps the configuration model in a `json` key (the\nsame model as the Source view). This saves the desired state; it does not deploy on its own.\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The host ID. |\n\n+++ cURL\n```bash\ncurl -X POST \"https://my.turbostack.app/api/v1/hosts/123\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{ \"json\": { \"webserver\": \"nginx\", \"mysql_version\": \"8.4\", \"redis_enabled\": true } }'\n```\n+++ PHP\n```php\n$updated = ts('POST', '/api/v1/hosts/123', [\n 'json' => [\n 'webserver' => 'nginx',\n 'mysql_version' => '8.4',\n 'redis_enabled' => true,\n ],\n]);\n```\n+++ Python\n```python\nupdated = session.post(\n f\"{BASE}/api/v1/hosts/123\",\n json={\"json\": {\"webserver\": \"nginx\", \"mysql_version\": \"8.4\", \"redis_enabled\": True}},\n).json()\n```\n+++\n\n**Response** `200`\n\n```json\n{ \"message\": \"Host saved successfully\" }\n```\n\n> [!NOTE]\n> Saving does not apply the change. Trigger a deployment to apply it - see the next endpoint and\n> Publishing changes."} {"id":"api/reference.md#badge-variant-info-text-post-api-v1-hosts-id-deploy","url":"https://docs.turbostack.app/api/reference/#badge-variant-info-text-post-api-v1-hosts-id-deploy","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"info\" text=\"POST\"] `/api/v1/hosts/{id}/deploy`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Start a deployment of the host, applying its saved configuration. The request body must specify the\ndeployment `type`.\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The host ID. |\n\n**Request body**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `type` | string | Required. One of `deploy`, `fullDeploy` or `fullDeleteDeploy`. |\n\n- `deploy` - a standard deploy of the current configuration.\n- `fullDeploy` - a full deploy that re-applies the complete configuration.\n- `fullDeleteDeploy` - a full deploy that also removes resources no longer in the configuration.\n\n+++ cURL\n```bash\ncurl -X POST \"https://my.turbostack.app/api/v1/hosts/123/deploy\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{ \"type\": \"deploy\" }'\n```\n+++ PHP\n```php\n$deploy = ts('POST', '/api/v1/hosts/123/deploy', ['type' => 'deploy']);\n```\n+++ Python\n```python\ndeploy = session.post(\n f\"{BASE}/api/v1/hosts/123/deploy\",\n json={\"type\": \"deploy\"},\n).json()\n```\n+++\n\n**Response** `200`\n\n```json\n{ \"message\": \"Deploy started\" }\n```\n\n> [!NOTE]\n> If the host is already deploying, the endpoint returns `400` with\n> `{ \"error\": \"Host is currently deploying\" }`."} {"id":"api/reference.md#badge-variant-success-text-get-api-v1-hosts-id-deploy","url":"https://docs.turbostack.app/api/reference/#badge-variant-success-text-get-api-v1-hosts-id-deploy","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"success\" text=\"GET\"] `/api/v1/hosts/{id}/deploy`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Get the status of the host's most recent deployment.\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The host ID. |\n\n+++ cURL\n```bash\ncurl \"https://my.turbostack.app/api/v1/hosts/123/deploy\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$status = ts('GET', '/api/v1/hosts/123/deploy');\n```\n+++ Python\n```python\nstatus = session.get(f\"{BASE}/api/v1/hosts/123/deploy\").json()\n```\n+++\n\n**Response** `200`\n\n```json\n{\n \"publishing\": true,\n \"publishing_status\": \"deploy\",\n \"is_deploying\": true,\n \"job_stdout\": \"\",\n \"deploy_at\": \"2026-07-22T09:30:00Z\",\n \"deploy_type\": \"deploy\"\n}\n```\n\n**Response fields**\n\n| Field | Type | Description |\n| --- | --- | --- |\n| `publishing` | boolean | Whether this deployment is still marked as active. |\n| `publishing_status` | string | Where the deployment stands. See the values below. |\n| `is_deploying` | boolean | Whether the host is deploying right now. Poll this if you only need to know \"busy or not\". |\n| `job_stdout` | string | Output of the deployment job, when there is any. |\n| `deploy_at` | string | When the deployment finished, as a timestamp like `2026-07-22T09:30:00Z`. |\n| `deploy_type` | string | The deployment that was run: `deploy`, `Full Deploy` or `Full Delete Deploy`. |\n\n**Values of `publishing_status`**\n\n| Value | Meaning | Finished? |\n| --- | --- | --- |\n| `deploy` | The deployment is running. | No |\n| `import` | An account import is running on this host, not a configuration deployment. | No |\n| `published` | The deployment finished successfully. | Yes |\n| `error` | The deployment failed. `job_stdout` usually says where. | Yes |\n| `canceled` | The deployment was cancelled before it finished. | Yes |\n| `timeout` | The deployment stopped reporting progress and was released. See below. | Yes |\n\n> [!TIP]\n> To wait for a deployment, poll this endpoint and stop when `publishing_status` is one of the\n> finished values, or when `is_deploying` is `false`. Do not poll faster than once every few\n> seconds; a deployment takes minutes, not milliseconds.\n\nA deployment that stops reporting progress for more than five minutes is set to `timeout`\nautomatically, and `publishing` goes back to `false` so a new deployment can start. That is a\nsafeguard against a host being locked by a deployment that never reports back - it does not\nnecessarily mean the work on the server failed. Check the host's\nPublishing history before you retry.\n\nIf the host has no deploy history, the endpoint returns `404` with\n`{ \"error\": \"No deploy history found\" }`."} {"id":"api/reference.md#badge-variant-danger-text-delete-api-v1-hosts-id-deploy","url":"https://docs.turbostack.app/api/reference/#badge-variant-danger-text-delete-api-v1-hosts-id-deploy","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"danger\" text=\"DELETE\"] `/api/v1/hosts/{id}/deploy`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Reset a stuck deploy state so a new deployment can be triggered.\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The host ID. |\n\n+++ cURL\n```bash\ncurl -X DELETE \"https://my.turbostack.app/api/v1/hosts/123/deploy\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$reset = ts('DELETE', '/api/v1/hosts/123/deploy');\n```\n+++ Python\n```python\nreset = session.delete(f\"{BASE}/api/v1/hosts/123/deploy\").json()\n```\n+++\n\n**Response** `200`\n\n```json\n{ \"message\": \"Deploy reset\" }\n```"} {"id":"api/reference.md#badge-variant-success-text-get-api-v1-hosts-id-credentials","url":"https://docs.turbostack.app/api/reference/#badge-variant-success-text-get-api-v1-hosts-id-credentials","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"success\" text=\"GET\"] `/api/v1/hosts/{id}/credentials`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Get the host's connection credentials. Sensitive - handle the response securely.\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The host ID. |\n\n+++ cURL\n```bash\ncurl \"https://my.turbostack.app/api/v1/hosts/123/credentials\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$credentials = ts('GET', '/api/v1/hosts/123/credentials');\n```\n+++ Python\n```python\ncredentials = session.get(f\"{BASE}/api/v1/hosts/123/credentials\").json()\n```\n+++\n\n**Response** `200`\n\nThe `master_user` and `admin_user` blocks are only returned for admin-access or cms-access tokens.\n\n```json\n{\n \"hostname\": \"shop-production.example.com\",\n \"master_user\": { \"user\": \"prod\", \"password\": \"...\" },\n \"admin_user\": { \"user\": \"admin\", \"password\": \"...\" },\n \"facts\": {},\n \"network\": {},\n \"platform\": {},\n \"system_users\": [],\n \"ftp_users\": []\n}\n```\n\n---"} {"id":"api/reference.md#groups","url":"https://docs.turbostack.app/api/reference/#groups","path":"api/reference.md","title":"API reference","heading":"Groups","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"A group holds shared configuration that its member hosts inherit."} {"id":"api/reference.md#badge-variant-success-text-get-api-v1-groups","url":"https://docs.turbostack.app/api/reference/#badge-variant-success-text-get-api-v1-groups","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"success\" text=\"GET\"] `/api/v1/groups`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"List all groups you can access. The result is a paginated list (see Pagination\nbelow).\n\n**Query parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `page` | integer | Page number (default `1`). |\n| `size` | integer | Items per page (default `15`). |\n| `search` | string | Filter by name (partial match). |\n\n+++ cURL\n```bash\ncurl \"https://my.turbostack.app/api/v1/groups?page=1&size=50&search=security\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$groups = ts('GET', '/api/v1/groups?page=1&size=50&search=security');\n```\n+++ Python\n```python\ngroups = session.get(\n f\"{BASE}/api/v1/groups\",\n params={\"page\": 1, \"size\": 50, \"search\": \"security\"},\n).json()\n```\n+++\n\n**Response** `200`\n\nEach group carries its configuration under the `json` key.\n\n```json\n{\n \"data\": [\n {\n \"id\": 42,\n \"client_id\": 7,\n \"name\": \"shared-security\",\n \"json\": { \"firewall_whitelist\": [\"203.0.113.10\"] }\n }\n ],\n \"current_page\": 1,\n \"per_page\": 50,\n \"total\": 1,\n \"last_page\": 1\n}\n```"} {"id":"api/reference.md#badge-variant-success-text-get-api-v1-groups-id","url":"https://docs.turbostack.app/api/reference/#badge-variant-success-text-get-api-v1-groups-id","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"success\" text=\"GET\"] `/api/v1/groups/{id}`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Fetch one group's configuration.\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The group ID. |\n\n+++ cURL\n```bash\ncurl \"https://my.turbostack.app/api/v1/groups/42\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Accept: application/json\"\n```\n+++ PHP\n```php\n$group = ts('GET', '/api/v1/groups/42');\n```\n+++ Python\n```python\ngroup = session.get(f\"{BASE}/api/v1/groups/42\").json()\n```\n+++\n\n**Response** `200`\n\nThe configuration model is returned under the `json` key.\n\n```json\n{\n \"id\": 42,\n \"client_id\": 7,\n \"name\": \"shared-security\",\n \"json\": { \"firewall_whitelist\": [\"203.0.113.10\"] }\n}\n```"} {"id":"api/reference.md#badge-variant-info-text-post-api-v1-groups-id","url":"https://docs.turbostack.app/api/reference/#badge-variant-info-text-post-api-v1-groups-id","path":"api/reference.md","title":"API reference","heading":"[!badge variant=\"info\" text=\"POST\"] `/api/v1/groups/{id}`","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Save or update a group's configuration. The request body wraps the configuration model in a `json`\nkey.\n\n**Path parameters**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| `id` | integer | The group ID. |\n\n+++ cURL\n```bash\ncurl -X POST \"https://my.turbostack.app/api/v1/groups/42\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{ \"json\": { \"firewall_whitelist\": [\"203.0.113.10\", \"198.51.100.0/24\"] } }'\n```\n+++ PHP\n```php\n$saved = ts('POST', '/api/v1/groups/42', [\n 'json' => [\n 'firewall_whitelist' => ['203.0.113.10', '198.51.100.0/24'],\n ],\n]);\n```\n+++ Python\n```python\nsaved = session.post(\n f\"{BASE}/api/v1/groups/42\",\n json={\"json\": {\"firewall_whitelist\": [\"203.0.113.10\", \"198.51.100.0/24\"]}},\n).json()\n```\n+++\n\n**Response** `200`\n\n```json\n{ \"message\": \"Group saved successfully\" }\n```\n\n---"} {"id":"api/reference.md#common-workflow-update-a-host-and-deploy","url":"https://docs.turbostack.app/api/reference/#common-workflow-update-a-host-and-deploy","path":"api/reference.md","title":"API reference","heading":"Common workflow: update a host and deploy","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"Saving a change and applying it are two steps: `POST` the new configuration, then trigger a\ndeployment, then poll its status.\n\n+++ cURL\n```bash\n# 1. update the host's configuration (saves the desired state)\ncurl -X POST \"https://my.turbostack.app/api/v1/hosts/123\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{ \"json\": { \"webserver\": \"nginx\", \"mysql_version\": \"8.4\" } }'\n\n# 2. deploy the host to apply the change\ncurl -X POST \"https://my.turbostack.app/api/v1/hosts/123/deploy\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{ \"type\": \"deploy\" }'\n\n# 3. check the deployment status\ncurl \"https://my.turbostack.app/api/v1/hosts/123/deploy\" \\\n -H \"Authorization: Bearer $TURBOSTACK_API_TOKEN\"\n```\n+++ PHP\n```php\nts('POST', '/api/v1/hosts/123', ['json' => ['webserver' => 'nginx', 'mysql_version' => '8.4']]);\nts('POST', '/api/v1/hosts/123/deploy', ['type' => 'deploy']);\n$status = ts('GET', '/api/v1/hosts/123/deploy');\n```\n+++ Python\n```python\nsession.post(f\"{BASE}/api/v1/hosts/123\", json={\"json\": {\"webserver\": \"nginx\", \"mysql_version\": \"8.4\"}})\nsession.post(f\"{BASE}/api/v1/hosts/123/deploy\", json={\"type\": \"deploy\"})\nstatus = session.get(f\"{BASE}/api/v1/hosts/123/deploy\").json()\n```\n+++\n\n> [!TIP]\n> Start read-only (`GET`) to explore your data before you make any `POST` change. When you do\n> write, try it on a host that is not business-critical first: `POST /api/v1/hosts/{id}` replaces\n> the whole configuration, so send back the complete document you read, not just the keys you\n> changed."} {"id":"api/reference.md#related","url":"https://docs.turbostack.app/api/reference/#related","path":"api/reference.md","title":"API reference","heading":"Related","keywords":"turbostack api api reference rest api api endpoints curl php python swagger bearer token api authentication","text":"- YAML configuration reference\n- API tokens\n- Deploy your first site\n- Core concepts\n- Publishing changes\n- The Source (YAML) view\n- Groups\n- Glossary - what the terms and abbreviations mean"} {"id":"applications/akeneo/best-practices.md#intro","url":"https://docs.turbostack.app/applications/akeneo/best-practices/","path":"applications/akeneo/best-practices.md","title":"Akeneo best practices","heading":"","keywords":"akeneo performance akeneo optimization akeneo caching akeneo turbostack akeneo Elasticsearch akeneo job queue akeneo opcache pim tuning","text":"# Akeneo best practices\n\nAkeneo PIM combines a Symfony web application, a MySQL catalog, a mandatory search index, and a set of background job queues. Performance and stability depend on keeping those components healthy and right-sized. This page covers what TurboStack already configures for you and the additional optimizations worth applying."} {"id":"applications/akeneo/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/akeneo/best-practices/#what-turbostack-configures-for-you","path":"applications/akeneo/best-practices.md","title":"Akeneo best practices","heading":"What TurboStack configures for you","keywords":"akeneo performance akeneo optimization akeneo caching akeneo turbostack akeneo Elasticsearch akeneo job queue akeneo opcache pim tuning","text":"When you deploy with `app_type: akeneo`, the platform sets up the full runtime so you do not have to wire it together manually:\n\n- **Production build.** The role installs Akeneo with `make prod` and `APP_ENV=prod`, which compiles assets and Symfony's cache for production rather than running in debug mode.\n- **Background job queues.** Three systemd job-queue consumers run continuously per app so imports, exports and maintenance tasks are processed: `pim-job-queue@ui_job`, `pim-job-queue@import_export_job` and `pim-job-queue@data_maintenance_job`. They run as user services with `Restart=always`.\n- **Search index.** The app is wired to Elasticsearch/OpenSearch via `APP_INDEX_HOSTS` (default `localhost:9200`). Akeneo cannot run without it - the product and catalog index lives there.\n- **Database.** A dedicated MySQL database and user are provisioned and injected through `.env.local`.\n- **Nginx vhost.** An Akeneo-tuned vhost serves the `public/` front controller with a long `fastcgi_read_timeout` (1200s) for heavy operations, and blocks direct access to any other PHP file.\n- **PDF/export dependencies.** System packages Akeneo needs for rendering Portable Document Format (PDF) files and exports (`ghostscript`, `aspell`) are installed for you.\n- **Log rotation.** Akeneo's `var/logs/*.log` files are rotated automatically via logrotate."} {"id":"applications/akeneo/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/akeneo/best-practices/#recommended-optimizations","path":"applications/akeneo/best-practices.md","title":"Akeneo best practices","heading":"Recommended optimizations","keywords":"akeneo performance akeneo optimization akeneo caching akeneo turbostack akeneo Elasticsearch akeneo job queue akeneo opcache pim tuning","text":"Apply these on top of the defaults - most are toggled on the host's Services tab.\n\n- **Keep Elasticsearch/OpenSearch healthy.** It is the heart of the PIM. After large catalog changes, reindex with `bin/console pim:product:index` and `pim:product-model:index`.\n- **Enable Redis** for caching and sessions to take load off MySQL and speed up the UI.\n- **OPcache** keeps compiled PHP in memory - confirm it is enabled for your PHP version for a large throughput win.\n- **Stay in production mode.** Never switch the app to `dev`/debug on a live host; rebuild with `make prod` after upgrades.\n- **Scale the job queues** for catalogs with frequent imports/exports by running additional queue consumers so jobs do not back up. See Background job queues for the service unit and how to manage it.\n- **Optimize media.** Use a Content Delivery Network (CDN)/HTTP cache in front of generated product images and assets to reduce origin load.\n- **Schedule maintenance** (index refreshes, cleanup jobs) during off-peak hours through the data maintenance queue."} {"id":"applications/akeneo/best-practices.md#background-job-queues","url":"https://docs.turbostack.app/applications/akeneo/best-practices/#background-job-queues","path":"applications/akeneo/best-practices.md","title":"Akeneo best practices","heading":"Background job queues","keywords":"akeneo performance akeneo optimization akeneo caching akeneo turbostack akeneo Elasticsearch akeneo job queue akeneo opcache pim tuning","text":"Akeneo processes imports, exports and maintenance tasks through background job queues. TurboStack installs three queue consumers as `systemd --user` services per app and keeps them running with `Restart=always`:\n\n- `pim-job-queue@ui_job` - jobs started from the user interface.\n- `pim-job-queue@import_export_job` - imports and exports.\n- `pim-job-queue@data_maintenance_job` - cleanup and maintenance jobs.\n\nEach service is an instance of one template unit at `~/.config/systemd/user/pim-job-queue@.service`. The name after `@` is the queue the consumer reads:\n\n```ini\n[Unit]\nDescription=Akeneo PIM Job Queue Service (#%i)\nAfter=network-online.target\nRequires=dbus.socket\nStartLimitIntervalSec=0\n\n[Service]\nType=simple\nWorkingDirectory=%h/akeneo\nExecStart=%h/akeneo/bin/console messenger:consume --env=prod %I\nRestartSec=10s\nRestart=always\n\n[Install]\nWantedBy=default.target\n```\n\n- `%i` is the queue name, so one template serves every queue; `%h` is your home directory.\n- `--env=prod` runs the consumer against the production environment.\n- Adjust `WorkingDirectory` to match your app path if it differs.\n\nManage a consumer like any other user service:\n\n```bash\nsystemctl --user status pim-job-queue@import_export_job\nsystemctl --user restart pim-job-queue@import_export_job\n```\n\nWhen a busy queue backs up, run more consumer processes for it, but keep the total within the host's processor budget. See Scale throughput with more instances.\n\nFor the `systemd --user` basics - including `loginctl enable-linger` so the services keep running after you log out - see How to manage user system services."} {"id":"applications/akeneo/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/akeneo/best-practices/#sizing-and-scaling","path":"applications/akeneo/best-practices.md","title":"Akeneo best practices","heading":"Sizing and scaling","keywords":"akeneo performance akeneo optimization akeneo caching akeneo turbostack akeneo Elasticsearch akeneo job queue akeneo opcache pim tuning","text":"TurboStack auto-tunes resource allocations to the host. Override the defaults only when measurements justify it:\n\n| Variable | Tune when |\n| --- | --- |\n| `mysql_innodb_size` | The catalog working set does not fit in the buffer pool. |\n| `redis_memory` | Cache eviction is frequent. |\n| `elasticsearch_heap_size` | Akeneo is index-heavy; size this to your catalog, but keep heap at roughly half of available RAM and never above ~31 gigabytes (GB). |\n\nSee Performance tuning before changing any of these, and change one variable at a time."} {"id":"applications/akeneo/best-practices.md#stability","url":"https://docs.turbostack.app/applications/akeneo/best-practices/#stability","path":"applications/akeneo/best-practices.md","title":"Akeneo best practices","heading":"Stability","keywords":"akeneo performance akeneo optimization akeneo caching akeneo turbostack akeneo Elasticsearch akeneo job queue akeneo opcache pim tuning","text":"- **Back up regularly.** Ensure the MySQL catalog and the application files are covered - review Backups. The search index can be rebuilt from the database if needed.\n- **Watch Health** for CPU, memory and disk pressure, and confirm the job-queue services stay running.\n- **Keep versions current.** Track Akeneo, PHP and Elasticsearch/OpenSearch releases and apply security updates.\n- **Test on a staging clone.** Validate Akeneo upgrades and large catalog imports on a copy before applying them to production."} {"id":"applications/akeneo/best-practices.md#related","url":"https://docs.turbostack.app/applications/akeneo/best-practices/#related","path":"applications/akeneo/best-practices.md","title":"Akeneo best practices","heading":"Related","keywords":"akeneo performance akeneo optimization akeneo caching akeneo turbostack akeneo Elasticsearch akeneo job queue akeneo opcache pim tuning","text":"- Deploy Akeneo\n- Troubleshooting Akeneo\n- How to manage user system services\n- Services\n- Performance tuning"} {"id":"applications/akeneo/deploy.md#intro","url":"https://docs.turbostack.app/applications/akeneo/deploy/","path":"applications/akeneo/deploy.md","title":"Deploy Akeneo on TurboStack","heading":"","keywords":"deploy akeneo akeneo hosting akeneo turbostack akeneo pim Elasticsearch product index php 8.4 mysql job queues","text":"# Deploy Akeneo on TurboStack\n\nAkeneo is a Product Information Management (PIM) platform for centralizing and enriching product catalogs. TurboStack provisions the full runtime, the search index Akeneo depends on, and runs its background job queues for you."} {"id":"applications/akeneo/deploy.md#requirements","url":"https://docs.turbostack.app/applications/akeneo/deploy/#requirements","path":"applications/akeneo/deploy.md","title":"Deploy Akeneo on TurboStack","heading":"Requirements","keywords":"deploy akeneo akeneo hosting akeneo turbostack akeneo pim Elasticsearch product index php 8.4 mysql job queues","text":"| Requirement | Recommended |\n| --- | --- |\n| App type | `akeneo` |\n| Runtime | PHP 8.4 |\n| Database | MySQL 8.4 (or PostgreSQL) |\n| Search | Elasticsearch/OpenSearch 8.x (**required** for the product index) |\n| Cache | Redis |\n| Web server | Nginx |\n\n> [!IMPORTANT]\n> Akeneo cannot start without a search engine. The product and catalog index lives in Elasticsearch/OpenSearch, so enable it before publishing."} {"id":"applications/akeneo/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/akeneo/deploy/#configure-it","path":"applications/akeneo/deploy.md","title":"Deploy Akeneo on TurboStack","heading":"Configure it","keywords":"deploy akeneo akeneo hosting akeneo turbostack akeneo pim Elasticsearch product index php 8.4 mysql job queues","text":"1. Open your host and go to the Applications tab.\n2. Select **Add app or database** and set **App Type** to `akeneo`.\n3. Choose PHP 8.4 as the runtime and a server name for the PIM vhost.\n4. Enable the required services: MySQL, Elasticsearch/OpenSearch, and Redis.\n5. Publish the host to apply the configuration."} {"id":"applications/akeneo/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/akeneo/deploy/#example-configuration","path":"applications/akeneo/deploy.md","title":"Deploy Akeneo on TurboStack","heading":"Example configuration","keywords":"deploy akeneo akeneo hosting akeneo turbostack akeneo pim Elasticsearch product index php 8.4 mysql job queues","text":"```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # Akeneo catalog database\nelasticsearch_version: \"8.x\" # REQUIRED: product/index search\nredis_enabled: true\nsystem_users:\n - username: prod\n vhosts:\n - server_name: pim.example.com\n app_type: akeneo\n php_version: \"8.4\"\n cert_type: letsencrypt\n```\n\n> [!TIP]\n> Pin a specific release with the optional `akeneo_version` key if your project targets a particular Akeneo version."} {"id":"applications/akeneo/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/akeneo/deploy/#why-these-choices","path":"applications/akeneo/deploy.md","title":"Deploy Akeneo on TurboStack","heading":"Why these choices","keywords":"deploy akeneo akeneo hosting akeneo turbostack akeneo pim Elasticsearch product index php 8.4 mysql job queues","text":"- `app_type: akeneo` tells TurboStack to apply the Akeneo runtime profile and run its background job queues.\n- Elasticsearch/OpenSearch is mandatory because Akeneo stores its product and catalog index there.\n- MySQL 8.4 holds the catalog data; PostgreSQL is supported as an alternative.\n- Redis provides fast caching and session handling for the PIM.\n- Nginx and PHP 8.4 match Akeneo's recommended web stack.\n- Let's Encrypt issues and renews Transport Layer Security (TLS) for the PIM hostname automatically."} {"id":"applications/akeneo/deploy.md#related","url":"https://docs.turbostack.app/applications/akeneo/deploy/#related","path":"applications/akeneo/deploy.md","title":"Deploy Akeneo on TurboStack","heading":"Related","keywords":"deploy akeneo akeneo hosting akeneo turbostack akeneo pim Elasticsearch product index php 8.4 mysql job queues","text":"- Technologies used: PHP, MySQL, Elasticsearch.\n\n- Best practices - performance & stability.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications (host tab)\n- The Source (YAML) view"} {"id":"applications/akeneo/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/akeneo/troubleshooting/","path":"applications/akeneo/troubleshooting.md","title":"Troubleshooting Akeneo","heading":"","keywords":"akeneo troubleshooting akeneo logs akeneo error akeneo turbostack akeneo job queue stuck akeneo Elasticsearch error akeneo import hangs","text":"# Troubleshooting Akeneo\n\nMost Akeneo problems on TurboStack have one of three causes. The job queues may not be running, the search index may be missing or unreachable, or the Symfony cache or permissions may be stale. This page shows where to look and how to fix the common cases."} {"id":"applications/akeneo/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/akeneo/troubleshooting/#where-to-find-the-logs","path":"applications/akeneo/troubleshooting.md","title":"Troubleshooting Akeneo","heading":"Where to find the logs","keywords":"akeneo troubleshooting akeneo logs akeneo error akeneo turbostack akeneo job queue stuck akeneo Elasticsearch error akeneo import hangs","text":"| Component | Where |\n| --- | --- |\n| Akeneo application | `var/logs/*.log` in the app directory (rotated automatically) |\n| Job queues | `journalctl --user -u 'pim-job-queue@*'` for the queue consumers |\n| Nginx (web) | the host's Nginx access/error logs |\n| PHP-FPM | the PHP-FPM error log for the app's pool |\n| Database | the MySQL error log |\n\nAlso check the host's Health tab for resource pressure and the recent deploys in History to correlate a problem with a change."} {"id":"applications/akeneo/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/akeneo/troubleshooting/#common-issues","path":"applications/akeneo/troubleshooting.md","title":"Troubleshooting Akeneo","heading":"Common issues","keywords":"akeneo troubleshooting akeneo logs akeneo error akeneo turbostack akeneo job queue stuck akeneo Elasticsearch error akeneo import hangs","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| Imports/exports start but never finish | One or more job-queue services not running | Confirm `pim-job-queue@ui_job`, `@import_export_job` and `@data_maintenance_job` are active (`systemctl --user status 'pim-job-queue@*'`) and restart them. See Services. |\n| 500 errors / blank UI, \"no alive nodes\" or index errors | Elasticsearch/OpenSearch down or unreachable | Verify the search service is running and reachable at `APP_INDEX_HOSTS` (default `localhost:9200`); Akeneo cannot run without it. |\n| Products missing from search/grids | Index out of date or not built | Reindex: `bin/console pim:product:index` and `bin/console pim:product-model:index --env=prod`. |\n| Errors after a deploy or upgrade | Stale Symfony cache or assets | Run `bin/console cache:clear --env=prod` and rebuild with `make prod`. |\n| \"Permission denied\" / cannot write cache or logs | `var/cache` or `var/logs` owned wrong or full disk | Check ownership of the `var/` directory and free disk on the Health tab. |\n| PDF generation or spell-check fails on export | Missing system tool | The platform installs `ghostscript` and `aspell`; if a custom export needs another tool (e.g. `wkhtmltopdf`), contact Support. |\n| Slow UI / timeouts under load | OPcache/Redis off or MySQL undersized | Enable OPcache and Redis; review Best practices and Performance tuning. |"} {"id":"applications/akeneo/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/akeneo/troubleshooting/#a-troubleshooting-workflow","path":"applications/akeneo/troubleshooting.md","title":"Troubleshooting Akeneo","heading":"A troubleshooting workflow","keywords":"akeneo troubleshooting akeneo logs akeneo error akeneo turbostack akeneo job queue stuck akeneo Elasticsearch error akeneo import hangs","text":"1. Check the host's Health tab for CPU, memory and disk pressure.\n2. Read the relevant log - start with `var/logs/*.log`, then the job-queue journal for stuck imports/exports.\n3. Review the last deploy in History; if a recent change broke it, revert and re-publish from Publishing.\n4. Verify the services are running: the three `pim-job-queue@*` consumers, Elasticsearch/OpenSearch, MySQL and Redis. Restart any that are down and reindex if needed."} {"id":"applications/akeneo/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/akeneo/troubleshooting/#getting-help","path":"applications/akeneo/troubleshooting.md","title":"Troubleshooting Akeneo","heading":"Getting help","keywords":"akeneo troubleshooting akeneo logs akeneo error akeneo turbostack akeneo job queue stuck akeneo Elasticsearch error akeneo import hangs","text":"If you are still stuck, gather the relevant log excerpt and the time the problem started, then reach out via Support. The general platform troubleshooting guide covers issues that are not specific to Akeneo."} {"id":"applications/akeneo/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/akeneo/troubleshooting/#related","path":"applications/akeneo/troubleshooting.md","title":"Troubleshooting Akeneo","heading":"Related","keywords":"akeneo troubleshooting akeneo logs akeneo error akeneo turbostack akeneo job queue stuck akeneo Elasticsearch error akeneo import hangs","text":"- Deploy Akeneo\n- Akeneo best practices\n- Health\n- Support"} {"id":"applications/craftcms/best-practices.md#intro","url":"https://docs.turbostack.app/applications/craftcms/best-practices/","path":"applications/craftcms/best-practices.md","title":"Craft CMS best practices","heading":"","keywords":"craft cms performance craft cms optimization craft cms caching craftcms turbostack Varnish full-page cache Redis opcache blitz cache warming","text":"# Craft CMS best practices\n\nCraft CMS renders pages from a database and a Twig template layer, so a fast site depends on effective caching and a primed page cache. TurboStack provisions the stack and warms the cache on a schedule. This page covers what is already configured and how to use it effectively."} {"id":"applications/craftcms/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/craftcms/best-practices/#what-turbostack-configures-for-you","path":"applications/craftcms/best-practices.md","title":"Craft CMS best practices","heading":"What TurboStack configures for you","keywords":"craft cms performance craft cms optimization craft cms caching craftcms turbostack Varnish full-page cache Redis opcache blitz cache warming","text":"When you deploy a `craftcms` app, the platform sets up a Craft-aware stack:\n\n- **Document root** - the vhost serves from your app's `public_html` directory (`/var/www//[/]public_html`), with a Craft-specific Nginx configuration (`50main.conf`). Static assets (`js`, `css`, images, `webp`) are served with long `expires` headers, and PHP requests are routed to a per-site PHP-FPM backend with an extended `fastcgi_read_timeout` for long-running admin operations.\n- **Varnish full-page cache** - when Varnish is enabled, the platform installs a Craft-aware VCL. It bypasses the cache for the control panel (`/admin`) and all `/actions` requests. It strips cookies from cacheable responses and supports `xkey` tag-based purging and ESI. The default Time to Live (TTL) is 3 hours, with 6 hours of grace so stale pages can be served if the backend is busy.\n- **Cache warming** - the platform crawls your site with `wget` (two levels deep, images excluded) immediately after a deploy and then every 6 hours via cron. This ensures visitors are served cached pages instead of triggering cold rebuilds.\n- **App directory** - a dedicated `craftcms/` directory is created under your app root for the Craft codebase, with `storage/` for runtime data, caches and logs.\n- **Log handling** - Craft rotates its own logs under `storage/logs/`, so the platform leaves log rotation to the application."} {"id":"applications/craftcms/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/craftcms/best-practices/#recommended-optimizations","path":"applications/craftcms/best-practices.md","title":"Craft CMS best practices","heading":"Recommended optimizations","keywords":"craft cms performance craft cms optimization craft cms caching craftcms turbostack Varnish full-page cache Redis opcache blitz cache warming","text":"Combine Craft's vendor guidance with the TurboStack options below. Most services can be enabled on the host's Services tab.\n\n- **Keep Varnish enabled** - full-page caching is the biggest time-to-first-byte win for content sites; keep it on in production.\n- **Enable Redis** for Craft's data cache and sessions instead of file or database storage, so cache reads and session lookups stay fast under load.\n- **Use a static page cache** - Craft's Blitz plugin pairs well with the Nginx config (the `50main.conf` already includes a commented `cache_path` block ready for Blitz).\n- **Enable OPcache** in the PHP runtime to cut PHP parsing overhead on every request.\n- **Run in production config** - disable `devMode`, enable template caching, and deploy a compiled `config/project/` so the control panel runs read-only in production.\n- **Optimize images** - ensure the GD Graphics Library or ImageMagick is available and serve WebP/optimized transforms; offload `web/` assets to a Content Delivery Network (CDN) where possible.\n- **Add an HTTP cache / CDN in front** for static asset delivery; this complements Varnish rather than replacing it.\n- **Let the queue run** - long tasks (image transforms, search indexing, emails) are processed through Craft's queue. Drive it reliably by running Craft's queue runner as a user system service instead of relying on web-triggered runs."} {"id":"applications/craftcms/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/craftcms/best-practices/#sizing-and-scaling","path":"applications/craftcms/best-practices.md","title":"Craft CMS best practices","heading":"Sizing and scaling","keywords":"craft cms performance craft cms optimization craft cms caching craftcms turbostack Varnish full-page cache Redis opcache blitz cache warming","text":"TurboStack auto-tunes resource limits from the host's size, so start with the defaults. Override the tuning variables only when you have measured evidence (slow queries, cache evictions, a low page-cache hit ratio):\n\n| Variable | Tune when |\n| --- | --- |\n| `mysql_innodb_size` | The InnoDB buffer pool is too small for your content volume |\n| `redis_memory` | Redis is evicting keys under load |\n| `varnish_cache_size` | The page-cache hit ratio is low because the cache is too small |\n\nSee Performance tuning before changing any of these. When a single host can no longer keep up, scale up the host before splitting services."} {"id":"applications/craftcms/best-practices.md#stability","url":"https://docs.turbostack.app/applications/craftcms/best-practices/#stability","path":"applications/craftcms/best-practices.md","title":"Craft CMS best practices","heading":"Stability","keywords":"craft cms performance craft cms optimization craft cms caching craftcms turbostack Varnish full-page cache Redis opcache blitz cache warming","text":"- **Back up regularly** - verify scheduled Backups cover the database, your `config/` (including `project/`), and the `storage/` and asset directories.\n- **Watch Health** - monitor CPU, memory, and disk; Craft's `storage/` (runtime caches and logs) grows over time.\n- **Keep versions current** - track Craft and plugin releases and the PHP and MySQL versions you run.\n- **Test on a staging clone** - always trial upgrades, plugins, and project config changes on a copy before publishing to production."} {"id":"applications/craftcms/best-practices.md#related","url":"https://docs.turbostack.app/applications/craftcms/best-practices/#related","path":"applications/craftcms/best-practices.md","title":"Craft CMS best practices","heading":"Related","keywords":"craft cms performance craft cms optimization craft cms caching craftcms turbostack Varnish full-page cache Redis opcache blitz cache warming","text":"- Deploy Craft CMS\n- Craft CMS reference\n- Troubleshooting Craft CMS\n- How to manage user system services\n- Services\n- Performance tuning"} {"id":"applications/craftcms/deploy.md#intro","url":"https://docs.turbostack.app/applications/craftcms/deploy/","path":"applications/craftcms/deploy.md","title":"Deploy Craft CMS on TurboStack","heading":"","keywords":"deploy craft cms craft cms hosting craftcms turbostack php 8.4 mysql Redis Varnish cache warming","text":"# Deploy Craft CMS on TurboStack\n\nCraft CMS is a flexible content management system for building custom applications. TurboStack provisions the runtime and supporting services and warms the cache periodically to keep pages fast."} {"id":"applications/craftcms/deploy.md#requirements","url":"https://docs.turbostack.app/applications/craftcms/deploy/#requirements","path":"applications/craftcms/deploy.md","title":"Deploy Craft CMS on TurboStack","heading":"Requirements","keywords":"deploy craft cms craft cms hosting craftcms turbostack php 8.4 mysql Redis Varnish cache warming","text":"| Requirement | Recommended |\n| --- | --- |\n| App type | `craftcms` |\n| Runtime | PHP 8.4 |\n| Database | MySQL 8.4 (or PostgreSQL) |\n| Cache | Redis |\n| Web server | Nginx (Varnish optional) |\n\n> [!TIP]\n> TurboStack warms the cache periodically, so visitors hit primed pages instead of triggering cold rebuilds."} {"id":"applications/craftcms/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/craftcms/deploy/#configure-it","path":"applications/craftcms/deploy.md","title":"Deploy Craft CMS on TurboStack","heading":"Configure it","keywords":"deploy craft cms craft cms hosting craftcms turbostack php 8.4 mysql Redis Varnish cache warming","text":"1. Open your host and go to the Applications tab.\n2. Select **Add app or database** and set **App Type** to `craftcms`.\n3. Choose PHP 8.4 as the runtime and list both the apex and `www` server names.\n4. Enable MySQL and Redis for the database and cache.\n5. Publish the host to apply the configuration."} {"id":"applications/craftcms/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/craftcms/deploy/#example-configuration","path":"applications/craftcms/deploy.md","title":"Deploy Craft CMS on TurboStack","heading":"Example configuration","keywords":"deploy craft cms craft cms hosting craftcms turbostack php 8.4 mysql Redis Varnish cache warming","text":"```yaml\nwebserver: nginx\nmysql_version: \"8.4\"\nredis_enabled: true\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com www.example.com\n app_type: craftcms\n php_version: \"8.4\"\n cert_type: letsencrypt\n```\n\n> [!TIP]\n> Set the optional `app_install` key if you want TurboStack to run the initial Craft installation for you."} {"id":"applications/craftcms/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/craftcms/deploy/#why-these-choices","path":"applications/craftcms/deploy.md","title":"Deploy Craft CMS on TurboStack","heading":"Why these choices","keywords":"deploy craft cms craft cms hosting craftcms turbostack php 8.4 mysql Redis Varnish cache warming","text":"- `app_type: craftcms` applies the Craft CMS runtime profile and enables periodic cache warming.\n- MySQL 8.4 stores content and structure; PostgreSQL is supported as an alternative.\n- Redis accelerates caching and session handling.\n- Listing both `example.com` and `www.example.com` covers apex and subdomain traffic on one vhost.\n- Add Varnish for full-page caching on content-heavy sites.\n- Let's Encrypt issues and renews Transport Layer Security (TLS) automatically for the listed hostnames."} {"id":"applications/craftcms/deploy.md#related","url":"https://docs.turbostack.app/applications/craftcms/deploy/#related","path":"applications/craftcms/deploy.md","title":"Deploy Craft CMS on TurboStack","heading":"Related","keywords":"deploy craft cms craft cms hosting craftcms turbostack php 8.4 mysql Redis Varnish cache warming","text":"- Technologies used: PHP, MySQL, Redis.\n\n- Reference - Redis cache and session configuration.\n- Best practices - performance & stability.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications (host tab)\n- The Source (YAML) view"} {"id":"applications/craftcms/reference.md#intro","url":"https://docs.turbostack.app/applications/craftcms/reference/","path":"applications/craftcms/reference.md","title":"Craft CMS reference","heading":"","keywords":"craft cms redis craftcms config app.php yii2-redis craft session redis craft queue runQueueAutomatically","text":"# Craft CMS reference\n\nReference for running Craft CMS on TurboStack: how to point Craft's cache and sessions at the platform's Redis, and how to run the background queue. For setup see Deploy Craft CMS; for tuning see Craft CMS best practices."} {"id":"applications/craftcms/reference.md#file-layout","url":"https://docs.turbostack.app/applications/craftcms/reference/#file-layout","path":"applications/craftcms/reference.md","title":"Craft CMS reference","heading":"File layout","keywords":"craft cms redis craftcms config app.php yii2-redis craft session redis craft queue runQueueAutomatically","text":"Your Craft codebase lives under your system user's home directory. `~` is that home directory (for example `/var/www/prod/`).\n\n| Path | What it is |\n| --- | --- |\n| `~/public_html/` | Web document root |\n| `~/craftcms/` | The Craft codebase |\n| `~/craftcms/config/` | Configuration files (`general.php`, `app.php`, `project/`) |\n| `~/craftcms/storage/` | Runtime data, caches and logs |\n\nFor ownership and permissions, see Application file layout and permissions."} {"id":"applications/craftcms/reference.md#redis-cache-and-sessions","url":"https://docs.turbostack.app/applications/craftcms/reference/#redis-cache-and-sessions","path":"applications/craftcms/reference.md","title":"Craft CMS reference","heading":"Redis cache and sessions","keywords":"craft cms redis craftcms config app.php yii2-redis craft session redis craft queue runQueueAutomatically","text":"TurboStack provisions Redis, but Craft only uses it once you point its cache and session components at it in `config/app.php`. Install the Redis driver first:\n\n```bash\ncomposer require yiisoft/yii2-redis\n```\n\nThen configure the components. This uses the cache instance for the data cache and the persistent instance for sessions, each on its own database index:\n\n```php\n [\n // Connection to the Redis cache instance (unix socket)\n 'redis' => [\n 'class' => yii\\redis\\Connection::class,\n 'unixSocket' => '/var/run/redis/redis.sock',\n 'database' => 0,\n ],\n 'cache' => [\n 'class' => yii\\redis\\Cache::class,\n 'defaultDuration' => 86400,\n 'keyPrefix' => 'craft',\n ],\n // Sessions on the persistent instance, with its own database index\n 'session' => function() {\n return Craft::createObject([\n 'class' => yii\\redis\\Session::class,\n 'as session' => craft\\behaviors\\SessionBehavior::class,\n 'redis' => [\n 'class' => yii\\redis\\Connection::class,\n 'unixSocket' => '/var/run/redis-persistent/redis.sock',\n 'database' => 1,\n ],\n ]);\n },\n ],\n];\n```\n\n- `unixSocket` replaces `hostname` and `port`; leave those out, because they are ignored when a socket path is set.\n- Give each component its own `database` index. Craft warns that sharing an index lets one component flush another's data.\n- The `session` component may also live in `config/app.web.php`, which Craft loads only for web requests. Either file works.\n\n> [!NOTE]\n> The two instances are the cache on `/var/run/redis/redis.sock` and the persistent instance on `/var/run/redis-persistent/redis.sock`. See How to inspect Redis with Redis Insight for the instance and database layout."} {"id":"applications/craftcms/reference.md#background-queue","url":"https://docs.turbostack.app/applications/craftcms/reference/#background-queue","path":"applications/craftcms/reference.md","title":"Craft CMS reference","heading":"Background queue","keywords":"craft cms redis craftcms config app.php yii2-redis craft session redis craft queue runQueueAutomatically","text":"Craft processes long tasks (image transforms, search indexing, emails) through a queue. By default it runs the queue on web requests, which adds load to PHP. On a busy site, turn that off and run the queue as a persistent worker instead.\n\nDisable the web-triggered runner in `config/general.php`:\n\n```php\n'runQueueAutomatically' => false,\n```\n\nThen run Craft's queue as a user system service so it restarts on failure and survives logout. Keep the number of workers within the host's processor budget (see Scale throughput with more instances)."} {"id":"applications/craftcms/reference.md#related","url":"https://docs.turbostack.app/applications/craftcms/reference/#related","path":"applications/craftcms/reference.md","title":"Craft CMS reference","heading":"Related","keywords":"craft cms redis craftcms config app.php yii2-redis craft session redis craft queue runQueueAutomatically","text":"- Deploy Craft CMS\n- Craft CMS best practices\n- Troubleshooting Craft CMS\n- Application file layout and permissions\n- How to manage user system services"} {"id":"applications/craftcms/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/craftcms/troubleshooting/","path":"applications/craftcms/troubleshooting.md","title":"Troubleshooting Craft CMS","heading":"","keywords":"craft cms troubleshooting craft cms logs craft cms error craftcms turbostack http 500 storage permissions project config queue","text":"# Troubleshooting Craft CMS\n\nMost Craft CMS problems involve file permissions, database configuration in `.env`, or out-of-sync project config. This page shows where to look and how to fix the issues you are most likely to encounter on TurboStack."} {"id":"applications/craftcms/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/craftcms/troubleshooting/#where-to-find-the-logs","path":"applications/craftcms/troubleshooting.md","title":"Troubleshooting Craft CMS","heading":"Where to find the logs","keywords":"craft cms troubleshooting craft cms logs craft cms error craftcms turbostack http 500 storage permissions project config queue","text":"Start with the application's own logs - Craft records detailed errors there before anything reaches the browser.\n\n| Component | Where |\n| --- | --- |\n| Craft application log | `/var/www//[/]craftcms/storage/logs/*.log` (and per-day subfolders) |\n| Web server (Nginx) | Nginx access and error logs for the site's vhost |\n| PHP-FPM | the PHP-FPM pool log for the site's per-user backend |\n| Varnish | the system journal for the `varnish` service (when full-page caching is enabled) |\n| Database | the MySQL error log on the host |\n\nBeyond the logs, check the host's Health tab for CPU, memory and disk pressure. Review recent deploys in History to see whether a change coincides with when the problem started.\n\n> [!TIP]\n> Craft rotates its own logs under `storage/logs/`, so look there first - the newest file usually contains the stack trace for a 500 error."} {"id":"applications/craftcms/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/craftcms/troubleshooting/#common-issues","path":"applications/craftcms/troubleshooting.md","title":"Troubleshooting Craft CMS","heading":"Common issues","keywords":"craft cms troubleshooting craft cms logs craft cms error craftcms turbostack http 500 storage permissions project config queue","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| HTTP 500 / blank page | A runtime exception; details suppressed in production | Read the newest file in `storage/logs/`; temporarily enable `devMode` on staging to surface the error |\n| \"Unable to write\" / permission errors | `storage/`, `config/license.key` or `web/cpresources` not writable by the system user | Ensure these paths are owned by the system user and writable; clear `storage/runtime/` and let Craft recreate it |\n| Cannot connect to database | Wrong credentials or driver in `.env` | Verify `CRAFT_DB_*` (driver, server, port, database, user, password) match the host's database; PostgreSQL needs `pgsql`, MySQL needs `mysql` |\n| Changes not appearing / config out of sync | Project config differs between environments | Run `php craft project-config/apply`; commit `config/project/` and re-publish |\n| Stale page after content edit | Varnish or static cache still holds the old page | Purge the relevant entry (Varnish supports `xkey` tag purges); `/admin` and `/actions` are never cached |\n| Broken or missing image transforms | GD/ImageMagick missing or asset volume not writable | Confirm GD or ImageMagick is enabled in the PHP runtime and the asset/transform paths are writable; clear caches |\n| Old assets / stale Cascading Style Sheets (CSS) after deploy | `web/cpresources` holds stale hashed assets | Clear `web/cpresources` and run `php craft clear-caches/all` |\n| Queued jobs never finish | The queue is not being driven | Ensure the queue runs (web-triggered or via `php craft queue/run`); check `storage/logs/` for job failures |"} {"id":"applications/craftcms/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/craftcms/troubleshooting/#a-troubleshooting-workflow","path":"applications/craftcms/troubleshooting.md","title":"Troubleshooting Craft CMS","heading":"A troubleshooting workflow","keywords":"craft cms troubleshooting craft cms logs craft cms error craftcms turbostack http 500 storage permissions project config queue","text":"1. Check the host's Health tab for resource exhaustion (full disk, out-of-memory) that can cause 500s.\n2. Read the relevant log - start with `storage/logs/`, then the Nginx and PHP-FPM logs for the vhost.\n3. Check the last deploy in History; if a recent change broke the site, revert or re-publish it from Publishing.\n4. Verify the supporting services are running and reachable - the web server, PHP-FPM, the database, Redis, and Varnish on the Services tab."} {"id":"applications/craftcms/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/craftcms/troubleshooting/#getting-help","path":"applications/craftcms/troubleshooting.md","title":"Troubleshooting Craft CMS","heading":"Getting help","keywords":"craft cms troubleshooting craft cms logs craft cms error craftcms turbostack http 500 storage permissions project config queue","text":"If you are still stuck, gather the error from `storage/logs/`, the URL, and the time it occurred, then reach out via Support. The general platform troubleshooting guide covers host-wide issues that are not specific to Craft."} {"id":"applications/craftcms/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/craftcms/troubleshooting/#related","path":"applications/craftcms/troubleshooting.md","title":"Troubleshooting Craft CMS","heading":"Related","keywords":"craft cms troubleshooting craft cms logs craft cms error craftcms turbostack http 500 storage permissions project config queue","text":"- Deploy Craft CMS\n- Craft CMS best practices\n- Health\n- Support"} {"id":"applications/drupal/best-practices.md#intro","url":"https://docs.turbostack.app/applications/drupal/best-practices/","path":"applications/drupal/best-practices.md","title":"Drupal best practices","heading":"","keywords":"drupal performance drupal optimization drupal caching drupal turbostack Varnish drupal Redis drupal opcache drush cron","text":"# Drupal best practices\n\nThis page collects the settings and habits that keep a Drupal site fast and stable on TurboStack. Drupal is a configuration-only application on the platform: you bring your own codebase and database and deploy with Git deployment, while TurboStack provisions and tunes the surrounding stack.\n\n> [!NOTE]\n> Because the code and database are yours, application-level tuning (caching modules, compiled assets, scheduled tasks) is your responsibility. TurboStack handles the runtime, web server, cache, and database layers."} {"id":"applications/drupal/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/drupal/best-practices/#what-turbostack-configures-for-you","path":"applications/drupal/best-practices.md","title":"Drupal best practices","heading":"What TurboStack configures for you","keywords":"drupal performance drupal optimization drupal caching drupal turbostack Varnish drupal Redis drupal opcache drush cron","text":"When you set an app's type to `drupal`, the platform provisions and pre-tunes several pieces so you do not have to:\n\n- **Nginx vhost tuned for Drupal.** A Drupal-aware server config is written to your app's `nginx/50main.conf`. It sets the document root to `public_html`, routes clean URLs through `index.php`, passes image-style and asset generation back to Drupal, and serves static files with long `expires` headers.\n- **PHP-FPM backend.** Requests for `.php` (and `update.php`) are passed to a dedicated PHP-FPM pool for your user/app, with a generous `fastcgi_read_timeout` for long operations like updates and imports.\n- **Security hardening in the vhost.** Direct access is denied to PHP in `sites/*/files`, scripts under `vendor/`, and private file paths. Dotfiles (except `.well-known`) and source files such as `.module`, `.inc`, `.twig`, `.yml`, `composer.json`, and `*.sql` are also blocked.\n- **Varnish full-page cache (optional).** When you enable Varnish, a Drupal-specific VCL is installed. It is built for the Advanced Varnish module: cache-tag and wildcard `BAN` invalidation, per-role cache bins via the `ADVBIN` cookie, ESI/BigPipe support, gzip compression, and cookie stripping for static assets. Authenticated, `/user`, `/admin`, and cron/install/update paths bypass the cache.\n- **Redis service.** Redis can be enabled as a service for object and session caching (you must point Drupal at it - see below).\n\n> [!TIP]\n> The vhost is written with `force: no`, so it is not overwritten on later runs. If you hand-edit `nginx/50main.conf`, your changes persist - but you then own keeping it current."} {"id":"applications/drupal/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/drupal/best-practices/#recommended-optimizations","path":"applications/drupal/best-practices.md","title":"Drupal best practices","heading":"Recommended optimizations","keywords":"drupal performance drupal optimization drupal caching drupal turbostack Varnish drupal Redis drupal opcache drush cron","text":"Combine Drupal's own production guidance with the platform options. Enable services on the host's Services tab.\n\n- **Use Redis for cache and sessions.** Enable the Redis service, install the Drupal `redis` contrib module, and configure the cache backends in `settings.php`. This removes cache and session load from MySQL. See Redis object and session cache for the config block and TTL tuning.\n- **Enable Varnish for anonymous traffic.** Turn on Varnish and install the Advanced Varnish module so cache-tag invalidation works with the supplied VCL. Anonymous page views are then served without hitting PHP.\n- **Turn on Drupal's own caches.** In production, enable page and dynamic page caching and the internal CSS/JS aggregation; never run with the Twig debug cache disabled.\n- **Aggregate and compress assets.** Enable Cascading Style Sheets (CSS) and JavaScript (JS) aggregation; the Nginx config already serves the compiled files with far-future expiry.\n- **Keep OPcache warm.** PHP OPcache caches compiled code; keep it enabled and sized for your module count to cut per-request overhead.\n- **Optimize images.** Use responsive image styles and modern formats (WebP/AVIF), which the vhost serves with caching.\n- **Run cron via Drush, not the web cron.** Disable Drupal's automated web cron and schedule `drush cron` so cron is decoupled from page requests. Use a Scheduled task / cron service on the host.\n- **Use a Content Delivery Network (CDN)** in front of the site for static assets and global reach where appropriate."} {"id":"applications/drupal/best-practices.md#redis-object-and-session-cache","url":"https://docs.turbostack.app/applications/drupal/best-practices/#redis-object-and-session-cache","path":"applications/drupal/best-practices.md","title":"Drupal best practices","heading":"Redis object and session cache","keywords":"drupal performance drupal optimization drupal caching drupal turbostack Varnish drupal Redis drupal opcache drush cron","text":"Enable the Redis service, install the Drupal `redis` contrib module, then point Drupal at the cache instance over its socket. TurboStack runs the cache instance on port 6379 (socket `/var/run/redis/redis.sock`) with no password. Add this to `settings.php`:\n\n```php\n$settings['redis.connection']['interface'] = 'PhpRedis';\n$settings['redis.connection']['host'] = '/var/run/redis/redis.sock';\n$settings['redis.connection']['port'] = 6379;\n$settings['redis.connection']['password'] = '';\n$settings['redis.connection']['prefix'] = 'example:';\n```\n\nUse a unique `prefix` per site so several sites on one host do not overwrite each other's keys. Clear all caches after the change (`drush cr`)."} {"id":"applications/drupal/best-practices.md#tune-the-cache-time-to-live-ttl","url":"https://docs.turbostack.app/applications/drupal/best-practices/#tune-the-cache-time-to-live-ttl","path":"applications/drupal/best-practices.md","title":"Drupal best practices","heading":"Tune the cache Time to Live (TTL)","keywords":"drupal performance drupal optimization drupal caching drupal turbostack Varnish drupal Redis drupal opcache drush cron","text":"The Drupal Redis module gives permanent cache items a long default lifetime. The constant `LIFETIME_PERM_DEFAULT` in `modules/contrib/redis/src/Cache/CacheBase.php` is `31536000` (one year): any key without an explicit TTL falls back to that. A one-year fallback lets stale bins build up and fill Redis.\n\nYou do not need to edit the module. Set a shorter TTL per cache bin in `settings.php` with the `perm_ttl_` setting:\n\n```php\n$settings['redis.settings']['perm_ttl_cache_menu'] = 21600; // 6 hours\n```\n\nThis gives the `menu` bin a six-hour lifetime while other bins keep the default. Add one line per bin you want to cap. To decide which bins matter, inspect the keys (for example with Redis Insight) and sort by TTL, then purge the old keys:\n\n```bash\ndrush cr\ntscli redis clear\n```\n\n> [!WARNING]\n> `tscli redis clear` empties the cache Redis instance. Run it only when you intend to clear the cache. The persistent instance on port 6378 (sessions) is not touched."} {"id":"applications/drupal/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/drupal/best-practices/#sizing-and-scaling","path":"applications/drupal/best-practices.md","title":"Drupal best practices","heading":"Sizing and scaling","keywords":"drupal performance drupal optimization drupal caching drupal turbostack Varnish drupal Redis drupal opcache drush cron","text":"TurboStack auto-tunes service sizes to the host. Change them only when you have measured evidence (slow queries, cache evictions, memory pressure):\n\n| Variable | Tune when |\n| --- | --- |\n| `mysql_innodb_size` | Working set larger than the buffer pool; frequent disk reads |\n| `redis_memory` | Cache evictions / low hit rate in Redis |\n| `varnish_cache_size` | Anonymous hit rate dropping as content grows |\n\nSee Performance tuning for how to measure before changing defaults, and increase PHP `memory_limit` only for genuinely heavy operations (config import, large migrations)."} {"id":"applications/drupal/best-practices.md#stability","url":"https://docs.turbostack.app/applications/drupal/best-practices/#stability","path":"applications/drupal/best-practices.md","title":"Drupal best practices","heading":"Stability","keywords":"drupal performance drupal optimization drupal caching drupal turbostack Varnish drupal Redis drupal opcache drush cron","text":"- **Back up before changes.** Confirm scheduled Backups cover both the database and `sites/default/files`, and take one before deploys or `drush updb`/config imports.\n- **Watch Health.** Monitor CPU, memory, and service status, especially after a deploy.\n- **Keep versions current.** Track security releases for Drupal core, contrib modules, and the PHP runtime.\n- **Manage config in Git.** Export with `drush cex` and import with `drush cim` so configuration moves predictably between environments.\n- **Test on a staging clone** before applying updates or module changes to production."} {"id":"applications/drupal/best-practices.md#related","url":"https://docs.turbostack.app/applications/drupal/best-practices/#related","path":"applications/drupal/best-practices.md","title":"Drupal best practices","heading":"Related","keywords":"drupal performance drupal optimization drupal caching drupal turbostack Varnish drupal Redis drupal opcache drush cron","text":"- Deploy Drupal\n- Drupal reference\n- Troubleshooting Drupal\n- Services\n- Performance tuning"} {"id":"applications/drupal/deploy.md#intro","url":"https://docs.turbostack.app/applications/drupal/deploy/","path":"applications/drupal/deploy.md","title":"Deploy Drupal on TurboStack","heading":"","keywords":"deploy drupal drupal hosting drupal turbostack php 8.4 mysql Redis cache git deployment","text":"# Deploy Drupal on TurboStack\n\nDrupal is a PHP content management framework. On TurboStack the platform provisions the PHP runtime, MySQL database, and Redis cache from your host configuration, and you deploy by publishing.\n\n> [!NOTE]\n> This is a configuration-only application: you bring your own Drupal codebase and database. Deploy your code with Git deployment."} {"id":"applications/drupal/deploy.md#requirements","url":"https://docs.turbostack.app/applications/drupal/deploy/#requirements","path":"applications/drupal/deploy.md","title":"Deploy Drupal on TurboStack","heading":"Requirements","keywords":"deploy drupal drupal hosting drupal turbostack php 8.4 mysql Redis cache git deployment","text":"| Requirement | Recommended |\n| --- | --- |\n| App type | `drupal` |\n| Runtime | PHP 8.4 (or newer) |\n| Database | MySQL 8.4 |\n| Cache (Redis) | Enabled (configure Drupal to use it) |\n| Page cache (Varnish) | Optional |\n| Web server | Nginx |"} {"id":"applications/drupal/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/drupal/deploy/#configure-it","path":"applications/drupal/deploy.md","title":"Deploy Drupal on TurboStack","heading":"Configure it","keywords":"deploy drupal drupal hosting drupal turbostack php 8.4 mysql Redis cache git deployment","text":"1. Open the host's Applications tab.\n2. Click **Add app or database**.\n3. Set **App Type** to `drupal` and choose the PHP runtime under **Technologies**.\n4. Enable MySQL and Redis as services.\n5. Publish, then deploy your code via Git deployment."} {"id":"applications/drupal/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/drupal/deploy/#example-configuration","path":"applications/drupal/deploy.md","title":"Deploy Drupal on TurboStack","heading":"Example configuration","keywords":"deploy drupal drupal hosting drupal turbostack php 8.4 mysql Redis cache git deployment","text":"```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # Drupal database\nredis_enabled: true # cache backend; configure Drupal to use it\nsystem_users:\n - username: prod\n vhosts:\n - server_name: drupal.example.com www.drupal.example.com\n app_type: drupal\n php_version: \"8.4\"\n cert_type: letsencrypt\n```"} {"id":"applications/drupal/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/drupal/deploy/#why-these-choices","path":"applications/drupal/deploy.md","title":"Deploy Drupal on TurboStack","heading":"Why these choices","keywords":"deploy drupal drupal hosting drupal turbostack php 8.4 mysql Redis cache git deployment","text":"- **MySQL 8.4** is Drupal's relational datastore for content, configuration, and users.\n- **Redis** provides a fast cache backend, but Drupal must be configured to use it (via a contrib module and settings), since it is not automatic.\n- **Varnish is optional**; enable it for full-page caching of anonymous traffic when needed.\n- **Nginx** serves Drupal efficiently and pairs with PHP-FPM.\n- **You bring your own code**, so the application files and database are deployed by you rather than scaffolded by the platform."} {"id":"applications/drupal/deploy.md#related","url":"https://docs.turbostack.app/applications/drupal/deploy/#related","path":"applications/drupal/deploy.md","title":"Deploy Drupal on TurboStack","heading":"Related","keywords":"deploy drupal drupal hosting drupal turbostack php 8.4 mysql Redis cache git deployment","text":"- Technologies used: PHP, MySQL, Redis.\n\n- Best practices - performance & stability.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications (host tab)\n- The Source (YAML) view"} {"id":"applications/drupal/reference.md#intro","url":"https://docs.turbostack.app/applications/drupal/reference/","path":"applications/drupal/reference.md","title":"Drupal reference","heading":"","keywords":"drupal cli drush drupal file layout drupal cron drupal commands drush cron drupal reference","text":"# Drupal reference\n\nReference for running Drupal on TurboStack: where the files live, the command-line tool, and the scheduled job. For setup see Deploy Drupal on TurboStack; for tuning see Drupal best practices."} {"id":"applications/drupal/reference.md#file-layout","url":"https://docs.turbostack.app/applications/drupal/reference/#file-layout","path":"applications/drupal/reference.md","title":"Drupal reference","heading":"File layout","keywords":"drupal cli drush drupal file layout drupal cron drupal commands drush cron drupal reference","text":"Everything lives under your system user's home directory. `~` is that home directory (for example `/var/www/prod/`). Run every Drush command from `~/public_html`.\n\n| Path | What it is |\n| --- | --- |\n| `~/public_html/` | Drupal project root and web document root; run Drush from here |\n| `~/public_html/core/` | Core framework |\n| `~/public_html/modules/` | Contributed and custom modules |\n| `~/public_html/themes/` | Themes |\n| `~/public_html/profiles/` | Installation profiles |\n| `~/public_html/sites/` | Site-specific configuration and files |\n| `~/public_html/sites/default/files/` | Public uploads (must be writable) |\n| `~/public_html/vendor/` | Composer dependencies |\n| `~/nginx/` | Custom Nginx configuration |\n\nFor ownership and permissions, see Application file layout and permissions. The uploads directory `sites/default/files` must be group-writable so uploads succeed, for example `chmod -R 775 ~/public_html/sites/default/files`.\n\n> [!NOTE]\n> In multi-site configurations, additional directories may exist under `~/public_html/sites/`, one per site alongside `default`."} {"id":"applications/drupal/reference.md#command-line-reference","url":"https://docs.turbostack.app/applications/drupal/reference/#command-line-reference","path":"applications/drupal/reference.md","title":"Drupal reference","heading":"Command-line reference","keywords":"drupal cli drush drupal file layout drupal cron drupal commands drush cron drupal reference","text":"Drupal ships the Drush command-line interface (CLI) at `drush`. Run every command from `~/public_html`. The common commands are below.\n\n| Command | What it does |\n| --- | --- |\n| `drush status` | Show the site status and environment details |\n| `drush cr` | Rebuild the cache |\n| `drush cron` | Run cron |\n| `drush updb` | Apply database updates |\n| `drush cex` | Export configuration |\n| `drush cim` | Import configuration |\n| `drush watchdog:show` (alias `drush ws`) | Show recent log messages |\n\nManage dependencies with Composer from the project root:\n\n```bash\ncd ~/public_html && composer install\ncomposer update\n```\n\nMake sure you set a supported PHP version and have installed all the PHP extensions Drupal requires before installing dependencies. On TurboStack the interpreter is `/usr/bin/php` (for example `/usr/bin/php8.3`). If you need extra PHP modules, contact Support.\n\nClear caches at each layer with the TurboStack CLI (tscli):\n\n| Command | What it clears |\n| --- | --- |\n| `drush cr` | Drupal's own cache |\n| `tscli redis clear` | Redis cache (Redis must be configured) |\n| `tscli varnish clear` | Varnish full-page cache (works by default) |\n| `tscli nginx reload` | Reloads Nginx after config changes |"} {"id":"applications/drupal/reference.md#cron","url":"https://docs.turbostack.app/applications/drupal/reference/#cron","path":"applications/drupal/reference.md","title":"Drupal reference","heading":"Cron","keywords":"drupal cli drush drupal file layout drupal cron drupal commands drush cron drupal reference","text":"Drupal relies on cron to run periodic tasks such as indexing content, sending emails, and cleaning up old log entries. Schedule Drupal cron with Drush rather than the web cron. Add a cron entry for your system user - for example every 15 minutes:\n\n```cron\n*/15 * * * * cd ~/public_html && drush cron\n```"} {"id":"applications/drupal/reference.md#varnish-integration","url":"https://docs.turbostack.app/applications/drupal/reference/#varnish-integration","path":"applications/drupal/reference.md","title":"Drupal reference","heading":"Varnish integration","keywords":"drupal cli drush drupal file layout drupal cron drupal commands drush cron drupal reference","text":"To cache pages for logged-in users and invalidate the cache by cache tag, the contributed Advanced Varnish module (`adv_varnish`) integrates Drupal with Varnish. Install it with Composer and use the latest release, which supports Drupal 9, 10 and 11:\n\n```bash\ncomposer require drupal/adv_varnish\n```\n\nThe module ships its own Varnish configuration (VCL). On TurboStack the Varnish layer is managed, so coordinate a custom VCL through Support. See the module's project page."} {"id":"applications/drupal/reference.md#related","url":"https://docs.turbostack.app/applications/drupal/reference/#related","path":"applications/drupal/reference.md","title":"Drupal reference","heading":"Related","keywords":"drupal cli drush drupal file layout drupal cron drupal commands drush cron drupal reference","text":"- Deploy Drupal on TurboStack\n- Drupal best practices\n- Troubleshooting Drupal\n- Application file layout and permissions\n- How to manage user system services"} {"id":"applications/drupal/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/drupal/troubleshooting/","path":"applications/drupal/troubleshooting.md","title":"Troubleshooting Drupal","heading":"","keywords":"drupal troubleshooting drupal logs drupal error drupal turbostack white screen of death drush cr watchdog drupal cron","text":"# Troubleshooting Drupal\n\nWhen a Drupal site is not working correctly on TurboStack, the cause is usually visible in a log or resolved by clearing a cache. This page shows where to look and how to fix the most common problems. Because Drupal is configuration-only on the platform, most application errors come from your code, modules, or database rather than the platform itself."} {"id":"applications/drupal/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/drupal/troubleshooting/#where-to-find-the-logs","path":"applications/drupal/troubleshooting.md","title":"Troubleshooting Drupal","heading":"Where to find the logs","keywords":"drupal troubleshooting drupal logs drupal error drupal turbostack white screen of death drush cr watchdog drupal cron","text":"Work from the front of the request to the back: web server, PHP, then Drupal itself.\n\n| Component | Where |\n| --- | --- |\n| Nginx access/error | The host's web server logs, surfaced on the Health tab; per-app config lives in `nginx/50main.conf` under the app directory |\n| PHP-FPM | The PHP-FPM pool log for your user/app - start here for fatal PHP errors and timeouts |\n| Varnish | `journalctl -u varnish` (and `varnishlog`) when full-page caching is enabled |\n| Drupal log (dblog) | `drush watchdog:show` / `drush ws`, or **Reports > Recent log messages** in the admin UI |\n| PHP error log | Drupal's configured error log / the PHP-FPM error log - the place to find a white-screen stack trace |\n| Database | MySQL service status and slow query log via Health and Services |\n\n> [!TIP]\n> Connect over SSH and run Drush from your site root. `drush status` confirms the database connection, bootstrap level, and active config; it is the fastest first check."} {"id":"applications/drupal/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/drupal/troubleshooting/#common-issues","path":"applications/drupal/troubleshooting.md","title":"Troubleshooting Drupal","heading":"Common issues","keywords":"drupal troubleshooting drupal logs drupal error drupal turbostack white screen of death drush cr watchdog drupal cron","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| White screen of death (blank page) | Uncaught PHP error or fatal | Read the PHP/PHP-FPM error log or `drush watchdog:show`; temporarily set `$config['system.logging']['error_level'] = 'verbose';` in `settings.php` to reveal the trace |\n| Stale content or \"page not found\" after a deploy | Drupal caches not rebuilt | Run `drush cr` to rebuild caches; for Varnish, invalidate via the Advanced Varnish module or restart Varnish |\n| \"Database connection failed\" / install screen appears | Wrong credentials or DB not reachable | Verify the `$databases` settings in `settings.php` against the host Credentials; confirm MySQL is running in Services |\n| \"Unable to write\" / file upload errors | Permissions on `sites/default/files` | Ensure the files directory is owned by your system user and writable; private files must sit outside the web root |\n| Changes not appearing for anonymous visitors | Varnish serving cached pages | Confirm the Advanced Varnish module is installed so cache-tag `BAN` works; clear the relevant tags or flush Varnish |\n| Scheduled jobs not running | Cron not firing | Schedule `drush cron` as a host cron task instead of relying on web cron; check its log |\n| Slow pages or 502/504 errors | PHP timeouts, no object cache, or DB pressure | Enable Redis + Varnish, profile slow queries, and raise sizing only with evidence (see Best practices) |\n\n> [!WARNING]\n> A failed `drush updb` or config import can leave the site in a broken state. Always back up the database first via Backups."} {"id":"applications/drupal/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/drupal/troubleshooting/#a-troubleshooting-workflow","path":"applications/drupal/troubleshooting.md","title":"Troubleshooting Drupal","heading":"A troubleshooting workflow","keywords":"drupal troubleshooting drupal logs drupal error drupal turbostack white screen of death drush cr watchdog drupal cron","text":"1. **Check Health.** Confirm CPU, memory, and disk are not exhausted and that Nginx, PHP-FPM, MySQL, and (if used) Varnish/Redis are running.\n2. **Read the relevant log.** Use the table above - PHP-FPM/error log for white screens, dblog for application errors, Varnish for stale-cache symptoms.\n3. **Review the last deploy.** Open History. If a recent change broke the site, revert or re-publish the previous working configuration from Publishing.\n4. **Verify services and clear caches.** Confirm services are enabled in Services, then run `drush cr`. If only anonymous users see stale pages, flush Varnish."} {"id":"applications/drupal/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/drupal/troubleshooting/#getting-help","path":"applications/drupal/troubleshooting.md","title":"Troubleshooting Drupal","heading":"Getting help","keywords":"drupal troubleshooting drupal logs drupal error drupal turbostack white screen of death drush cr watchdog drupal cron","text":"If the site is still down after these steps, gather the error message, the relevant log excerpt, and what changed (deploy, module update, config import). Then reach out via Support. The general platform troubleshooting guide covers host-level issues that are not specific to Drupal."} {"id":"applications/drupal/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/drupal/troubleshooting/#related","path":"applications/drupal/troubleshooting.md","title":"Troubleshooting Drupal","heading":"Related","keywords":"drupal troubleshooting drupal logs drupal error drupal turbostack white screen of death drush cr watchdog drupal cron","text":"- Deploy Drupal\n- Drupal best practices\n- Health\n- Support"} {"id":"applications/index.md#intro","url":"https://docs.turbostack.app/applications/","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"# Deploying applications on TurboStack\n\nTurboStack runs your applications on a **host** (a server). You describe what the application\nneeds - a runtime (PHP, Node.js, Python or .NET), a database, and optional services like Redis,\nElasticsearch or Varnish - and TurboStack provisions and configures everything for you when\nyou publish. This page explains how that works and gives a configuration pattern you can reuse\nfor any application.\n\nEverything runs on a standard open-source stack (Nginx, PHP, MySQL, Redis, Elasticsearch and\nsimilar), so your application stays portable and is not tied to a proprietary platform.\n\n> [!TIP]\n> Pick your application from the catalog below for a ready-to-adapt example. Each page lists the\n> requirements and an annotated YAML configuration."} {"id":"applications/index.md#how-deployment-works-3-steps","url":"https://docs.turbostack.app/applications/#how-deployment-works-3-steps","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"How deployment works (3 steps)","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"1. Open a host and go to its Applications tab. Click **Add app or database**.\n2. Choose the application under **Technologies** (the **App Type**) and enable what it needs -\n PHP/Node/Python version, database, caching, search. TurboStack wires the services together.\n3. Publish the host. TurboStack installs and configures the\n stack so the running server matches your configuration.\n\nYou can do all of this in the GUI editor or directly as YAML in the\nSource view - both describe the same configuration."} {"id":"applications/index.md#what-every-application-needs","url":"https://docs.turbostack.app/applications/#what-every-application-needs","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"What every application needs","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"| Building block | Where it is set | Notes |\n|---|---|---|\n| **Web server** | `webserver` (host) | `nginx` (default) or `apache2`. |\n| **Runtime** | per application: `php_version` / `nodejs_version` / `python_version` / `dotnet_version` | Match the application's supported version. |\n| **Database** | `mysql_version` or `postgresql_version` (host) | The database the app stores its data in. |\n| **Application type** | per application: `app_type` | Tells TurboStack which application to provision. |\n| **Domain + TLS** | per application: `server_name`, `cert_type` | `letsencrypt` gives automatic HTTPS. |\n| **Caching / search** | `redis_enabled`, `varnish_enabled`, `elasticsearch_version` | Enable what the app benefits from (see rules below). |"} {"id":"applications/index.md#the-base-configuration-pattern","url":"https://docs.turbostack.app/applications/#the-base-configuration-pattern","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"The base configuration pattern","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"Almost every application follows the same skeleton - **global services** on the host, and one or\nmore **applications** (vhosts) under a **system user**:\n\n```yaml\n# ── Host-level services ───────────────────────────────\nwebserver: nginx # web server for all sites on this host\nmysql_version: \"8.4\" # a database engine (or postgresql_version)\nredis_enabled: true # in-memory cache (sessions/objects) - on by default\n\n# ── Accounts and their applications ───────────────────\nsystem_users:\n - username: prod # the OS account that owns the files\n vhosts:\n - server_name: example.com www.example.com # the domain(s)\n app_type: wordpress # which application TurboStack provisions\n php_version: \"8.4\" # the runtime version for this site\n cert_type: letsencrypt # automatic HTTPS certificate\n```\n\n> [!NOTE]\n> Defaults are auto-tuned (memory sizing for databases, cache and search). Only override sizing\n> keys (`mysql_innodb_size`, `redis_memory`, `elasticsearch_heap_size`, `varnish_cache_size`)\n> when you have measured a real performance need.\n\n> [!TIP]\n> Name the first application of each system user `default`. This is the convention TurboStack\n> expects for the primary application under a user.\n\n> [!WARNING]\n> Run staging and production on entirely different servers. A staging site on the same host\n> silently takes resources away from production - even when it is rarely used, it still consumes\n> memory (for example for its database), causing avoidable overhead on your production site."} {"id":"applications/index.md#how-to-choose-services","url":"https://docs.turbostack.app/applications/#how-to-choose-services","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"How to choose services","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"These rules let you (or an AI assistant) build a correct configuration for any application:\n\n- **The database follows the application.** PHP CMS/shop apps (WordPress, Drupal, Magento,\n Shopware, Craft CMS) use **MySQL** (`mysql_version`). **Odoo** and **Medusa** use\n **PostgreSQL** (`postgresql_version`). Akeneo, Craft CMS and Nextcloud support either.\n- **The runtime follows the application.** PHP apps set `php_version`; **Medusa** (Node) sets\n `nodejs_version`; **Odoo** (Python) needs no version key; **nopCommerce** (.NET) sets\n `dotnet_version`.\n- **Redis** (`redis_enabled: true`) is recommended for almost everything - sessions and object\n cache - and is on by default.\n- **Elasticsearch/OpenSearch** (`elasticsearch_version`) is **required by Magento 2** and used\n by **Akeneo**; most other apps don't need it.\n- **Varnish** (`varnish_enabled: true`, per application) is full-page caching for **PHP storefronts**\n (Magento, Shopware, optionally WordPress). Don't use it for Node apps or Odoo.\n- **Node and Odoo run as their own process** behind nginx. For **Medusa** (and other Node apps)\n set `proxy_enabled: true` and `proxy_upstream_port`. **Odoo** uses `app_type: odoo` (proxying\n is handled for you).\n- **Transport Layer Security (TLS)** is almost always `cert_type: letsencrypt` (automatic HTTPS)."} {"id":"applications/index.md#application-performance-monitoring","url":"https://docs.turbostack.app/applications/#application-performance-monitoring","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"Application performance monitoring","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"New Relic and Tideways are set **per application**, not per host. Open the application's\n**Configure application > Monitoring** tab, turn on **New Relic APM** or **Tideways**, and paste the\nkey from your own account. TurboStack installs and configures the agent for that application only;\nthe subscription and the data stay with your monitoring account. Turning the toggle off again\nremoves the keys.\n\n```yaml\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com\n app_type: magento2\n php_version: \"8.4\"\n # New Relic: reports this application under its own name\n newrelic_appname: \"Example production\"\n newrelic_license: \"nr_xxxxxxxxxxxx\"\n # Tideways: instead of, or next to, New Relic\n tideways_apikey: \"tw_xxxxxxxxxxxx\"\n tideways_service: web\n tideways_sample_rate: 25\n```\n\n| Key | What it sets |\n|---|---|\n| `newrelic_appname` | The name this application reports under in New Relic. |\n| `newrelic_license` | The license key of your New Relic account. Setting it enables the agent for this application. |\n| `tideways_apikey` | The key that sends profiling data to your Tideways account. |\n| `tideways_service` | The service name this application reports under, so several applications stay apart. |\n| `tideways_sample_rate` | The percentage of requests that is profiled. Lower it on a busy site to reduce overhead. |\n\n> [!NOTE]\n> Set a different `newrelic_appname` and `tideways_service` per application, and per environment.\n> Otherwise staging and production data end up in the same graph.\n\n**Blackfire** works differently: it is available on the host and you start a profiling session\nyourself, from the browser extension or with `tscli blackfire enable`. The server-level agent that\nreports the machine's own metrics to your New Relic account is set on the host's\nAdvanced tab. See\nMonitoring for what each product is good at."} {"id":"applications/index.md#application-catalog","url":"https://docs.turbostack.app/applications/#application-catalog","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"Application catalog","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"> [!NOTE]\n> Each application has three pages: **Deploy** (this catalog links to it), **Best practices** (performance & stability) and **Troubleshooting** (logs & common fixes).\n\n| Application | Type | Runtime | Database | Notable services |\n|---|---|---|---|---|\n| WordPress | `wordpress` | PHP | MySQL | Redis; Varnish (optional) |\n| Magento 2 / Adobe Commerce | `magento2` | PHP | MySQL | Elasticsearch, Redis, Varnish |\n| Shopware | `shopware` | PHP | MySQL | Redis, Varnish, OpenSearch (optional) |\n| Drupal | `drupal` | PHP | MySQL | Redis; Varnish (optional) |\n| Laravel | `laravel` | PHP | MySQL | Redis (optional) |\n| Akeneo PIM | `akeneo` | PHP | MySQL/PostgreSQL | Elasticsearch |\n| OroCommerce | `orocommerce` | PHP | MySQL/PostgreSQL | Redis, RabbitMQ; Varnish (optional) |\n| Craft CMS | `craftcms` | PHP | MySQL/PostgreSQL | Redis; Varnish (optional) |\n| Nextcloud | `nextcloud` | PHP | MySQL/PostgreSQL | Redis |\n| Odoo | `odoo` | Python | PostgreSQL | - (runs behind Nginx) |\n| Medusa | Node (proxy) | Node.js | PostgreSQL | reverse proxy |\n| nopCommerce | `nopcommerce` | .NET | SQL Server | - |\n| Self-hosted platforms | `gitlab`, `pmm` | Kubernetes | - | GitLab, Advanced Database Monitoring |\n\n> [!TIP]\n> Don't see your exact framework? Use **Generic** (`app_type` left empty) for a plain PHP site,\n> or the **reverse-proxy** pattern for any Node/containerized app - see\n> Medusa and Applications."} {"id":"applications/index.md#file-layout-and-permissions","url":"https://docs.turbostack.app/applications/#file-layout-and-permissions","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"File layout and permissions","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"Once an application is deployed, its files live under your system user's home directory, and you work with them over Secure Shell (SSH). `~` below is that home directory, for example `/var/www/prod/` for the system user `prod`.\n\n| Path | What it is |\n| --- | --- |\n| `~/` | Your system user's home directory |\n| `~/public_html/` | The application root and web document root for most applications |\n| `~/nginx/` | Your custom Nginx configuration snippets |\n| `~/logs/` | Application and access logs |\n| `~/.config/systemd/user/` | Your systemd user service unit files |\n\n> [!NOTE]\n> Some applications use their own document root inside the application root (for example Magento serves from `~/public_html/pub/`). Each application's **Reference** page lists its exact layout."} {"id":"applications/index.md#ownership-and-permissions","url":"https://docs.turbostack.app/applications/#ownership-and-permissions","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"Ownership and permissions","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"Your system user must own all application files, so updates and package installs do not fail on permission errors. Files should be readable and directories listable, without being world-writable. Run these from your application root, replacing `prod` with your system user:\n\n```bash\nfind ~/public_html -type f -exec chmod 644 {} \\; # files: readable\nfind ~/public_html -type d -exec chmod 755 {} \\; # directories: listable\nchown -R prod:prod ~/public_html # your user owns everything\n```\n\n> [!WARNING]\n> Do not set `777` permissions to fix an access problem. World-writable files are a security risk. Set the ownership to your system user instead."} {"id":"applications/index.md#composer-and-caches","url":"https://docs.turbostack.app/applications/#composer-and-caches","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"Composer and caches","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"Applications that use Composer (the PHP dependency manager) install from the application root; after a change, clear the relevant caches with the TurboStack CLI:\n\n```bash\ncd ~/public_html && composer install # or: composer update (test on staging first)\ntscli redis clear # clear the Redis cache\ntscli varnish clear # clear the Varnish full-page cache\n```\n\n> [!WARNING]\n> `tscli redis clear` and `tscli varnish clear` flush live caches. Expect a short spike in load while the caches refill."} {"id":"applications/index.md#related","url":"https://docs.turbostack.app/applications/#related","path":"applications/index.md","title":"Deploying applications on TurboStack","heading":"Related","keywords":"deploy application turbostack magento shopware wordpress odoo laravel medusa hosting yaml configuration new relic tideways application performance monitoring","text":"- Applications (host tab) - the GUI where you configure this.\n- Services - the databases, caching and search engines.\n- The Source (YAML) view - edit the configuration as YAML.\n- Monitoring - New Relic, Tideways, Blackfire and database monitoring.\n- Publishing changes - deploy it to the server.\n- Glossary - what the terms and abbreviations mean.\n- Sales - help sizing the platform for your application."} {"id":"applications/laravel/best-practices.md#intro","url":"https://docs.turbostack.app/applications/laravel/best-practices/","path":"applications/laravel/best-practices.md","title":"Laravel best practices","heading":"","keywords":"laravel performance laravel optimization laravel caching laravel turbostack Redis queues opcache php-fpm config cache","text":"# Laravel best practices\n\nThis page collects practical advice for running a fast, stable Laravel application on TurboStack. Laravel is a configuration-only application: the platform provisions PHP, the web server, MySQL and (optionally) Redis, while you bring and deploy your own code through Git deployment. Most performance work therefore happens in your repository, while the platform provides the runtime and services to support it.\n\n> [!NOTE]\n> Because you control the code, the platform never runs Artisan commands for you. Compiling caches, running migrations and starting workers are steps you build into your own deploy process."} {"id":"applications/laravel/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/laravel/best-practices/#what-turbostack-configures-for-you","path":"applications/laravel/best-practices.md","title":"Laravel best practices","heading":"What TurboStack configures for you","keywords":"laravel performance laravel optimization laravel caching laravel turbostack Redis queues opcache php-fpm config cache","text":"When you set an app's type to `laravel`, the platform applies an opinionated runtime so the framework works without manual web-server editing:\n\n- **Nginx vhost** with the document root pointing at the application's public directory (`public_html`) and the standard front-controller rewrite (`try_files $uri $uri/ /index.php?$query_string`). This ensures clean URLs and route handling work without additional configuration.\n- **PHP-FPM backend** per application, with a generous FastCGI timeout for longer requests and dotfile protection (everything under `/.` except `/.well-known` is denied).\n- **OPcache** available in the PHP runtime to cache compiled bytecode.\n- **MySQL** as the relational database, and **Redis** when you enable it as a service for cache, sessions and queues.\n- **Supervisor**, available per system user, for keeping long-running processes such as queue workers alive.\n\nManage these building blocks from the host's Services and Applications tabs."} {"id":"applications/laravel/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/laravel/best-practices/#recommended-optimizations","path":"applications/laravel/best-practices.md","title":"Laravel best practices","heading":"Recommended optimizations","keywords":"laravel performance laravel optimization laravel caching laravel turbostack Redis queues opcache php-fpm config cache","text":"Combine Laravel's own production guidance with the platform features above.\n\n- **Cache configuration and routes** - run `php artisan config:cache` and `php artisan route:cache` in your deploy so framework bootstrapping is fast.\n- **Cache views and events** - add `php artisan view:cache` (and `event:cache` if used) to precompile Blade templates and listeners.\n- **Use the optimize shortcut** - `php artisan optimize` bundles the common production caches in one command.\n- **Enable OPcache** - keep OPcache on in your PHP runtime; tune it under Services > PHP advanced options.\n- **Move cache and sessions to Redis** - set `CACHE_STORE=redis` and `SESSION_DRIVER=redis` once Redis is enabled, to offload the database and the local filesystem.\n- **Run queues on Redis** - use `QUEUE_CONNECTION=redis` and process jobs with a worker rather than the `sync` driver for slow tasks (mail, exports, webhooks).\n- **Keep workers alive** - run `php artisan queue:work` under a supervisor so jobs process continuously and restart on failure. Use the per-user Supervisor, or run the worker as a user system service. To clear a backlog faster, run several workers in parallel - but keep the total within the host's processor budget (see Scale throughput with more instances).\n- **Schedule with the scheduler** - point a single cron entry at `php artisan schedule:run` every minute and define tasks in Laravel rather than many crontab lines.\n- **Optimize the autoloader** - deploy with `composer install --no-dev --optimize-autoloader` to drop dev dependencies and speed up class loading.\n- **Optimize assets** - build front-end assets ahead of deploy (e.g. `npm run build` with Vite) and serve them as static files; add a Content Delivery Network (CDN) for heavy media.\n\n> [!TIP]\n> After any code or config change, re-run the cache commands. Stale `config:cache` output is a common cause of \"my `.env` change had no effect\"."} {"id":"applications/laravel/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/laravel/best-practices/#sizing-and-scaling","path":"applications/laravel/best-practices.md","title":"Laravel best practices","heading":"Sizing and scaling","keywords":"laravel performance laravel optimization laravel caching laravel turbostack Redis queues opcache php-fpm config cache","text":"TurboStack auto-tunes service memory from the host's resources, so the defaults suit most Laravel sites. Override the tuning variables only when you have measured evidence (slow queries, Redis evictions, OPcache restarts):\n\n| Variable | Tune when |\n| --- | --- |\n| `mysql_innodb_size` | The InnoDB buffer pool is too small for your working set. |\n| `redis_memory` | Redis is evicting keys you expect to persist (cache/queue churn). |\n\nMake one change at a time and re-measure. See Performance tuning for the full method, and scale PHP-FPM workers there too."} {"id":"applications/laravel/best-practices.md#stability","url":"https://docs.turbostack.app/applications/laravel/best-practices/#stability","path":"applications/laravel/best-practices.md","title":"Laravel best practices","heading":"Stability","keywords":"laravel performance laravel optimization laravel caching laravel turbostack Redis queues opcache php-fpm config cache","text":"- **Back up before changes** - confirm Backups cover the database and any user-uploaded files in `storage/`.\n- **Watch Health** - monitor CPU, memory and service status, especially after a deploy.\n- **Keep versions current** - track Laravel long-term support (LTS) and PHP releases, and bump the PHP runtime under Services on a supported version.\n- **Test on a staging clone** - validate upgrades, migrations and cache changes on a copy before publishing to production.\n- **Run migrations deliberately** - include `php artisan migrate --force` in your deploy step and review it for destructive changes first."} {"id":"applications/laravel/best-practices.md#related","url":"https://docs.turbostack.app/applications/laravel/best-practices/#related","path":"applications/laravel/best-practices.md","title":"Laravel best practices","heading":"Related","keywords":"laravel performance laravel optimization laravel caching laravel turbostack Redis queues opcache php-fpm config cache","text":"- Deploy Laravel on TurboStack\n- Troubleshooting Laravel\n- How to manage user system services\n- Services\n- Performance tuning"} {"id":"applications/laravel/deploy.md#intro","url":"https://docs.turbostack.app/applications/laravel/deploy/","path":"applications/laravel/deploy.md","title":"Deploy Laravel on TurboStack","heading":"","keywords":"deploy laravel laravel hosting laravel turbostack php 8.4 mysql Redis queues git deployment","text":"# Deploy Laravel on TurboStack\n\nLaravel is a PHP framework for building web applications and APIs. On TurboStack the platform provisions the PHP runtime, MySQL database, and Redis from your host configuration, and you deploy by publishing.\n\n> [!NOTE]\n> This is a configuration-only application: you bring your own application code. Deploy it with Git deployment."} {"id":"applications/laravel/deploy.md#requirements","url":"https://docs.turbostack.app/applications/laravel/deploy/#requirements","path":"applications/laravel/deploy.md","title":"Deploy Laravel on TurboStack","heading":"Requirements","keywords":"deploy laravel laravel hosting laravel turbostack php 8.4 mysql Redis queues git deployment","text":"| Requirement | Recommended |\n| --- | --- |\n| App type | `laravel` |\n| Runtime | PHP 8.4 (or newer) |\n| Database | MySQL 8.4 |\n| Cache (Redis) | Enabled (queues, cache, sessions; optional) |\n| Web server | Nginx |"} {"id":"applications/laravel/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/laravel/deploy/#configure-it","path":"applications/laravel/deploy.md","title":"Deploy Laravel on TurboStack","heading":"Configure it","keywords":"deploy laravel laravel hosting laravel turbostack php 8.4 mysql Redis queues git deployment","text":"1. Open the host's Applications tab.\n2. Click **Add app or database**.\n3. Set **App Type** to `laravel` and choose the PHP runtime under **Technologies**.\n4. Enable MySQL, and optionally Redis, as services.\n5. Publish, then deploy your code via Git deployment."} {"id":"applications/laravel/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/laravel/deploy/#example-configuration","path":"applications/laravel/deploy.md","title":"Deploy Laravel on TurboStack","heading":"Example configuration","keywords":"deploy laravel laravel hosting laravel turbostack php 8.4 mysql Redis queues git deployment","text":"```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # application database\nredis_enabled: true # queues, cache, sessions (optional but common)\nsystem_users:\n - username: prod\n vhosts:\n - server_name: app.example.com\n app_type: laravel\n php_version: \"8.4\"\n cert_type: letsencrypt\n```"} {"id":"applications/laravel/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/laravel/deploy/#why-these-choices","path":"applications/laravel/deploy.md","title":"Deploy Laravel on TurboStack","heading":"Why these choices","keywords":"deploy laravel laravel hosting laravel turbostack php 8.4 mysql Redis queues git deployment","text":"- **MySQL 8.4** is a common relational backend for Laravel's Eloquent object-relational mapping (ORM) layer and migrations.\n- **Redis** is optional but widely used in Laravel for queues, cache, and session storage; enable it when your app uses any of those drivers.\n- **Nginx** serves the application's public directory and proxies to PHP-FPM.\n- **Let's Encrypt** provides automatic, renewing HTTPS.\n- **You bring your own code**, so the application is deployed by you rather than scaffolded by the platform."} {"id":"applications/laravel/deploy.md#related","url":"https://docs.turbostack.app/applications/laravel/deploy/#related","path":"applications/laravel/deploy.md","title":"Deploy Laravel on TurboStack","heading":"Related","keywords":"deploy laravel laravel hosting laravel turbostack php 8.4 mysql Redis queues git deployment","text":"- Technologies used: PHP, MySQL, Redis.\n\n- Best practices - performance & stability.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications (host tab)\n- The Source (YAML) view"} {"id":"applications/laravel/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/laravel/troubleshooting/","path":"applications/laravel/troubleshooting.md","title":"Troubleshooting Laravel","heading":"","keywords":"laravel troubleshooting laravel logs laravel error laravel turbostack http 500 app_key php artisan cache queue worker","text":"# Troubleshooting Laravel\n\nWhen a Laravel application is not working correctly on TurboStack, the cause is almost always visible in a log. This page shows where the logs live, the most common problems and their fixes, and a repeatable workflow to follow. Because Laravel is a configuration-only application, most fixes are Artisan commands or `.env` changes you run against your own deployed code."} {"id":"applications/laravel/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/laravel/troubleshooting/#where-to-find-the-logs","path":"applications/laravel/troubleshooting.md","title":"Troubleshooting Laravel","heading":"Where to find the logs","keywords":"laravel troubleshooting laravel logs laravel error laravel turbostack http 500 app_key php artisan cache queue worker","text":"Replace `` with the host's system user and `` with the application name (omit the `_` suffix if the app has no name set).\n\n| Component | Where |\n| --- | --- |\n| Nginx access log | `/var/log/nginx/_.log` |\n| Nginx error log | `/var/log/nginx/error.log` |\n| PHP / PHP-FPM errors | `/var/log/php/_.log` |\n| Laravel application log | `/var/www///storage/logs/laravel.log` |\n| Queue workers (supervisor) | `/var/www//.config/supervisor/log/` |\n| Database | Managed MySQL service - see Services |\n\nAlso use the host's Health tab for service status and resource graphs, and check recent deploys in History - a broken page often coincides with the last publish.\n\n> [!TIP]\n> The Laravel log only fills up if logging works. If `storage/logs/laravel.log` is empty during a 500, the error happened before Laravel booted - look in the PHP-FPM log instead."} {"id":"applications/laravel/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/laravel/troubleshooting/#common-issues","path":"applications/laravel/troubleshooting.md","title":"Troubleshooting Laravel","heading":"Common issues","keywords":"laravel troubleshooting laravel logs laravel error laravel turbostack http 500 app_key php artisan cache queue worker","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| HTTP 500, blank page | Application exception; details suppressed in production | Read `storage/logs/laravel.log`, then the PHP-FPM log; fix the underlying error. |\n| \"No application encryption key\" / 500 on boot | Missing or invalid `APP_KEY` | Set a valid key with `php artisan key:generate`, then `php artisan config:clear`. |\n| `.env` change has no effect | Stale compiled config cache | Run `php artisan config:clear` (and re-run `config:cache` after). |\n| Old routes/views served, \"class not found\" | Stale route/view/autoload caches after deploy | `php artisan route:clear && php artisan view:clear && php artisan cache:clear`; `composer dump-autoload`. |\n| Database / migration errors | Pending migrations or wrong DB credentials | Verify `.env` DB settings against Services; run `php artisan migrate --force`. |\n| Jobs never run, queue backs up | No worker running, or wrong queue connection | Check `QUEUE_CONNECTION`; start `php artisan queue:work` under supervisor and inspect its log. |\n| Scheduled tasks not firing | Scheduler cron not calling Laravel | Ensure a cron entry runs `php artisan schedule:run` every minute. |\n| \"Permission denied\" writing cache/logs | `storage/` or `bootstrap/cache/` not writable | Make those directories writable by the system user; clear and rebuild caches. |\n\n> [!WARNING]\n> Never set `APP_DEBUG=true` to read errors on a live site - it exposes stack traces and secrets. Read the logs instead and keep `APP_DEBUG=false` in production."} {"id":"applications/laravel/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/laravel/troubleshooting/#a-troubleshooting-workflow","path":"applications/laravel/troubleshooting.md","title":"Troubleshooting Laravel","heading":"A troubleshooting workflow","keywords":"laravel troubleshooting laravel logs laravel error laravel turbostack http 500 app_key php artisan cache queue worker","text":"1. **Check Health** - confirm the host is up and PHP, MySQL and Redis services are running before digging into code.\n2. **Read the relevant log** - start with `storage/logs/laravel.log`; if it is silent, read the PHP-FPM log (`/var/log/php/_.log`) and the Nginx error log.\n3. **Check the last deploy** - review recent changes in History. If a publish broke the site, revert or re-publish a known-good revision via Publishing.\n4. **Verify services and caches** - confirm queue workers are alive in supervisor, then clear and rebuild Laravel caches (`php artisan optimize:clear` followed by `php artisan optimize`) once the fix is in place."} {"id":"applications/laravel/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/laravel/troubleshooting/#getting-help","path":"applications/laravel/troubleshooting.md","title":"Troubleshooting Laravel","heading":"Getting help","keywords":"laravel troubleshooting laravel logs laravel error laravel turbostack http 500 app_key php artisan cache queue worker","text":"If you have worked through the steps above and the problem persists, see the platform-wide Troubleshooting guide. Then reach out through Support with the relevant log excerpts and the time the issue occurred."} {"id":"applications/laravel/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/laravel/troubleshooting/#related","path":"applications/laravel/troubleshooting.md","title":"Troubleshooting Laravel","heading":"Related","keywords":"laravel troubleshooting laravel logs laravel error laravel turbostack http 500 app_key php artisan cache queue worker","text":"- Deploy Laravel on TurboStack\n- Laravel best practices\n- Health\n- Support"} {"id":"applications/magento/best-practices.md#intro","url":"https://docs.turbostack.app/applications/magento/best-practices/","path":"applications/magento/best-practices.md","title":"Magento best practices","heading":"","keywords":"magento performance magento optimization magento caching magento turbostack adobe commerce Varnish full-page cache Redis Elasticsearch opcache","text":"# Magento best practices\n\nMagento 2 (Adobe Commerce) is resource-intensive, placing high demands on memory, CPU, and I/O. A fast, stable storefront depends on the right caching layers, a working cron, and production mode. TurboStack provisions most of this for you; this page covers what is already configured and what to optimize on top."} {"id":"applications/magento/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/magento/best-practices/#what-turbostack-configures-for-you","path":"applications/magento/best-practices.md","title":"Magento best practices","heading":"What TurboStack configures for you","keywords":"magento performance magento optimization magento caching magento turbostack adobe commerce Varnish full-page cache Redis Elasticsearch opcache","text":"When you deploy a `magento2` app, the platform sets up a complete, tuned Magento stack:\n\n- **Document root** - the vhost serves from the Magento `pub/` directory inside your app root (`/var/www//public_html`), with a Magento-specific Nginx configuration (`50main.conf`).\n- **Redis caching** - sessions use a dedicated persistent Redis socket, while the default cache and full-page cache use a separate Redis instance. This is configured at install time, so checkout state stays fast and the database is offloaded.\n- **Varnish full-page cache** - when Varnish is enabled, the platform installs a Magento-aware VCL. It configures Magento to use it (`http-cache-hosts`, `caching_application = 2`, backend on port 8080, Varnish on 6081, default Time to Live (TTL) 86400s).\n- **Elasticsearch/OpenSearch** - configured as the catalog search engine with a per-site index prefix. Magento requires this; the storefront will not run without it.\n- **Cron jobs** - three cron entries are installed for the system user: the main `bin/magento cron:run`, `setup:cron:run`, and the updater cron. These drive indexing, emails, and scheduled jobs.\n- **Log rotation** - everything under the app's `var/log/` is rotated weekly via logrotate so disks do not fill up.\n- **Database tuning** - a Magento-specific MySQL setting (`restrict_fk_on_non_standard_key = OFF`) is applied for compatibility, and OPcache is enabled in the PHP runtime."} {"id":"applications/magento/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/magento/best-practices/#recommended-optimizations","path":"applications/magento/best-practices.md","title":"Magento best practices","heading":"Recommended optimizations","keywords":"magento performance magento optimization magento caching magento turbostack adobe commerce Varnish full-page cache Redis Elasticsearch opcache","text":"Combine Magento's vendor guidance with the TurboStack options below. Most are one toggle away on the host's Services tab.\n\n- **Run in production mode** - set the deploy mode to `production` for live stores: `bin/magento deploy:mode:set production`. This compiles dependency injection (DI) and pre-generates static assets. After deploying code or configuration changes, run the standard sequence `setup:upgrade` -> `setup:di:compile` -> `setup:static-content:deploy` -> `cache:flush` (use `setup:upgrade --keep-generated` on production to preserve already-compiled code).\n- **Enable Varnish full-page cache** - this reduces time-to-first-byte significantly for storefront pages; keep it on for production.\n- **Keep Redis on for sessions and cache** - already configured; do not switch back to file sessions on a busy store. See Redis cache tuning for the `env.php` cache block and its lifetime settings.\n- **Keep Elasticsearch/OpenSearch healthy** - it is required; size it for your catalog (see below).\n- **Enable OPcache** (and consider the realpath cache) in the PHP runtime to cut PHP parsing overhead.\n- **Optimize assets and images** - minify/merge JS and CSS, use WebP/optimized images, and serve `pub/static` and `pub/media` via a Content Delivery Network (CDN) when possible.\n- **Use an HTTP cache / CDN in front** - offload static and media delivery. If a CDN fronts the site, TurboStack can disable Varnish caching of static/media to avoid double caching.\n- **Keep cron running** - reindexing, price rules, emails, and message-queue consumers all depend on cron; never disable it on a live store.\n- **Run message-queue consumers as services** - on a busy store, run consumers as persistent `systemd --user` services rather than relying only on cron, so they restart on failure. See Message-queue consumers below."} {"id":"applications/magento/best-practices.md#redis-cache-tuning","url":"https://docs.turbostack.app/applications/magento/best-practices/#redis-cache-tuning","path":"applications/magento/best-practices.md","title":"Magento best practices","heading":"Redis cache tuning","keywords":"magento performance magento optimization magento caching magento turbostack adobe commerce Varnish full-page cache Redis Elasticsearch opcache","text":"TurboStack configures Magento's Redis backends at install time, so you do not set this up by hand. Sessions use the persistent Redis instance; the default cache and full-page cache use the cache instance. The reference below shows the cache block in `app/etc/env.php` and the values worth tuning (`Cm_Cache_Backend_Redis`, port 6379, no password):\n\n```php\n [\n 'frontend' => [\n 'default' => [\n 'backend' => 'Cm_Cache_Backend_Redis',\n 'backend_options' => [\n 'server' => '127.0.0.1',\n 'port' => '6379',\n 'database' => '0',\n 'id_prefix' => 'magento_prod_',\n 'compress_data' => '1',\n 'default_lifetime' => '600',\n 'min_lifetime' => '60',\n 'max_lifetime' => '86400',\n ],\n ],\n 'page_cache' => [\n 'backend' => 'Cm_Cache_Backend_Redis',\n 'backend_options' => [\n 'server' => '127.0.0.1',\n 'port' => '6379',\n 'database' => '1',\n 'id_prefix' => 'magento_prod_',\n 'compress_data' => '0',\n 'default_lifetime' => '86400',\n ],\n ],\n ],\n ],\n];\n```\n\n- `database` keeps the two caches apart (`0` for the default cache, `1` for the full-page cache); `id_prefix` keeps keys unique when several sites share the instance.\n- `default_lifetime` is the Time to Live (TTL) in seconds for keys with no explicit expiry. `min_lifetime` and `max_lifetime` bound the lifetime for the default cache.\n- `compress_data` set to `1` shrinks the cache at a small processing cost. It is on for the default cache and off for the full-page cache, which is already compact.\n\nAfter changing `env.php`, flush the cache:\n\n```bash\nphp bin/magento cache:flush\n```\n\nIf caching was not enabled before, turn it on so Redis is actually used:\n\n```bash\nphp bin/magento cache:enable\n```"} {"id":"applications/magento/best-practices.md#message-queue-consumers","url":"https://docs.turbostack.app/applications/magento/best-practices/#message-queue-consumers","path":"applications/magento/best-practices.md","title":"Magento best practices","heading":"Message-queue consumers","keywords":"magento performance magento optimization magento caching magento turbostack adobe commerce Varnish full-page cache Redis Elasticsearch opcache","text":"Magento offloads asynchronous work - reindexing, transactional emails, and order or coupon processing - to message queues handled by **consumer** processes. On a busy store, run each consumer as a persistent `systemd --user` service so it restarts on failure, instead of relying on cron alone.\n\nCreate a reusable template unit at `~/.config/systemd/user/magento-consumer@.service`:\n\n```ini\n[Unit]\nDescription=Magento Consumer (%i)\nAfter=network-online.target\nRequires=dbus.socket\nStartLimitIntervalSec=0\n\n[Service]\nType=simple\nWorkingDirectory=%h/public_html\nExecStart=php %h/public_html/bin/magento queue:consumers:start %I --single-thread --max-messages=10000\nRestartSec=10s\nRestart=always\n\n[Install]\nWantedBy=default.target\n```\n\n- `%i` is the consumer name, so one template serves every queue, and `%h` is your home directory.\n- `--single-thread` runs one thread per process; `--max-messages=10000` restarts the consumer periodically to keep memory in check.\n\nList the available consumers with `php bin/magento queue:consumers:list`, then enable and start one service per consumer (the name after `@` is the consumer):\n\n```bash\nsystemctl --user enable --now magento-consumer@sales.rule.update.coupon.usage.service\nsystemctl --user status magento-consumer@product_action_attribute.update.service\n```\n\nTo drain queues faster on a busy store, run several consumers in parallel (more instances, or more of the same consumer). Keep the total number of consumers within the host's processor budget: never more than the core count, and keep a margin. Too many will slow the whole store. See Scale throughput with more instances.\n\nFor the `systemd --user` basics - including `loginctl enable-linger` so the services keep running after you log out - see How to manage user system services."} {"id":"applications/magento/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/magento/best-practices/#sizing-and-scaling","path":"applications/magento/best-practices.md","title":"Magento best practices","heading":"Sizing and scaling","keywords":"magento performance magento optimization magento caching magento turbostack adobe commerce Varnish full-page cache Redis Elasticsearch opcache","text":"TurboStack auto-tunes resource limits from the host's size, so start with the defaults. Override the tuning variables only when you have measured evidence (slow queries, cache evictions, search latency):\n\n| Variable | Tune when |\n| --- | --- |\n| `mysql_innodb_size` | The InnoDB buffer pool is too small for your catalog/order volume |\n| `redis_memory` | Redis is evicting keys under load |\n| `elasticsearch_heap_size` | Search is slow or the catalog is very large |\n| `varnish_cache_size` | The page cache hit ratio is low because the cache is too small |\n\nSee Performance tuning before changing any of these. When a single host can no longer keep up, scale up the host before splitting services."} {"id":"applications/magento/best-practices.md#stability","url":"https://docs.turbostack.app/applications/magento/best-practices/#stability","path":"applications/magento/best-practices.md","title":"Magento best practices","heading":"Stability","keywords":"magento performance magento optimization magento caching magento turbostack adobe commerce Varnish full-page cache Redis Elasticsearch opcache","text":"- **Back up regularly** - verify scheduled Backups cover both the database and the `pub/media`, `app/etc`, and `var` directories.\n- **Watch Health** - monitor CPU, memory, and disk. Magento's `var/` and media directories grow over time.\n- **Keep versions current** - track Magento/Adobe Commerce security patches and the PHP, MySQL, and Elasticsearch versions you run.\n- **Test on a staging clone** - always trial upgrades, extensions, and theme changes on a copy before publishing to production."} {"id":"applications/magento/best-practices.md#related","url":"https://docs.turbostack.app/applications/magento/best-practices/#related","path":"applications/magento/best-practices.md","title":"Magento best practices","heading":"Related","keywords":"magento performance magento optimization magento caching magento turbostack adobe commerce Varnish full-page cache Redis Elasticsearch opcache","text":"- Deploy Magento\n- Magento reference\n- How to run multiple Magento store views\n- Troubleshooting Magento\n- How to manage user system services\n- Services\n- Performance tuning"} {"id":"applications/magento/deploy.md#intro","url":"https://docs.turbostack.app/applications/magento/deploy/","path":"applications/magento/deploy.md","title":"Deploy Magento on TurboStack","heading":"","keywords":"deploy magento magento hosting magento turbostack adobe commerce php 8.4 Elasticsearch Redis Varnish full-page cache","text":"# Deploy Magento on TurboStack\n\nMagento 2 (Adobe Commerce) is an e-commerce platform with high infrastructure requirements. On TurboStack, the platform provisions the PHP runtime, MySQL database, Elasticsearch, and caching services from your host configuration. You deploy by publishing."} {"id":"applications/magento/deploy.md#requirements","url":"https://docs.turbostack.app/applications/magento/deploy/#requirements","path":"applications/magento/deploy.md","title":"Deploy Magento on TurboStack","heading":"Requirements","keywords":"deploy magento magento hosting magento turbostack adobe commerce php 8.4 Elasticsearch Redis Varnish full-page cache","text":"| Requirement | Recommended |\n| --- | --- |\n| App type | `magento2` |\n| Runtime | PHP 8.4 (or newer) |\n| Database | MySQL 8.4 |\n| Search | Elasticsearch 8.x (REQUIRED) |\n| Cache (Redis) | Enabled (sessions + object cache) |\n| Page cache (Varnish) | Enabled (recommended) |\n| Web server | Nginx |\n\n> [!NOTE]\n> TurboStack can run an automated Magento install. Set `magento2_version_to_install` and provide your Magento Marketplace composer credentials with `magento2_auth_public_key` and `magento2_auth_private_key`."} {"id":"applications/magento/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/magento/deploy/#configure-it","path":"applications/magento/deploy.md","title":"Deploy Magento on TurboStack","heading":"Configure it","keywords":"deploy magento magento hosting magento turbostack adobe commerce php 8.4 Elasticsearch Redis Varnish full-page cache","text":"1. Open the host's Applications tab.\n2. Click **Add app or database**.\n3. Set **App Type** to `magento2` and choose the PHP runtime under **Technologies**.\n4. Enable MySQL, Elasticsearch, Redis, and Varnish as services.\n5. Publish to apply the configuration."} {"id":"applications/magento/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/magento/deploy/#example-configuration","path":"applications/magento/deploy.md","title":"Deploy Magento on TurboStack","heading":"Example configuration","keywords":"deploy magento magento hosting magento turbostack adobe commerce php 8.4 Elasticsearch Redis Varnish full-page cache","text":"```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # Magento core database\nelasticsearch_version: \"8.x\" # REQUIRED by Magento for catalog search\nredis_enabled: true # sessions + object cache\nsystem_users:\n - username: prod\n vhosts:\n - server_name: shop.example.com www.shop.example.com\n app_type: magento2\n php_version: \"8.4\"\n cert_type: letsencrypt\n varnish_enabled: true # full-page cache - big TTFB improvement for storefronts\n```"} {"id":"applications/magento/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/magento/deploy/#why-these-choices","path":"applications/magento/deploy.md","title":"Deploy Magento on TurboStack","heading":"Why these choices","keywords":"deploy magento magento hosting magento turbostack adobe commerce php 8.4 Elasticsearch Redis Varnish full-page cache","text":"- **MySQL 8.4** holds the Magento core database: catalog, orders, customers, and configuration.\n- **Elasticsearch 8.x is required**; Magento uses it for catalog and layered-navigation search, and the storefront will not function without it.\n- **Redis** is used for both sessions and the object cache, keeping checkout state fast and offloading the database.\n- **Varnish full-page cache** is recommended because it serves cached storefront pages directly, producing a large time-to-first-byte improvement.\n- **Nginx** is the supported web server for Magento and integrates with its built-in caching layers."} {"id":"applications/magento/deploy.md#related","url":"https://docs.turbostack.app/applications/magento/deploy/#related","path":"applications/magento/deploy.md","title":"Deploy Magento on TurboStack","heading":"Related","keywords":"deploy magento magento hosting magento turbostack adobe commerce php 8.4 Elasticsearch Redis Varnish full-page cache","text":"- Technologies used: PHP, MySQL, Redis, Varnish, Elasticsearch.\n\n- Best practices - performance & stability.\n- Magento command-line reference - `php bin/magento` over SSH.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications (host tab)\n- The Source (YAML) view"} {"id":"applications/magento/magento-cli.md#intro","url":"https://docs.turbostack.app/applications/magento/magento-cli/","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"# Magento command-line reference\n\nMagento 2 (Adobe Commerce) ships a command-line interface (CLI) at `bin/magento`. You run it over SSH to install modules, clear caches, rebuild indexes and switch deployment modes. This page groups the common commands by task. For where the files live and the scheduled jobs, see Magento reference."} {"id":"applications/magento/magento-cli.md#how-to-run-it","url":"https://docs.turbostack.app/applications/magento/magento-cli/#how-to-run-it","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"How to run it","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"Connect over SSH, change into the project root, then call the tool with PHP:\n\n```bash\ncd ~/public_html\nphp bin/magento \n```\n\nHere `~` is your system user's home directory (for example `/var/www/prod/`). Run every `bin/magento` command from `~/public_html`.\n\n> [!NOTE]\n> To run a command with a specific Portable Hypertext Preprocessor (PHP) version, call that version's binary directly. Each installed version has its own binary at `/usr/bin/php`, for example:\n> ```bash\n> /usr/bin/php8.4 bin/magento setup:upgrade\n> ```\n> See How to switch PHP version.\n\nRun `php bin/magento list` for the full command list, and `php bin/magento help ` for the options of a single command."} {"id":"applications/magento/magento-cli.md#setup-and-maintenance","url":"https://docs.turbostack.app/applications/magento/magento-cli/#setup-and-maintenance","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Setup and maintenance","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `setup:install` | Installs Magento with DB and admin configuration. |\n| `setup:uninstall` | Uninstalls Magento and removes configuration. |\n| `setup:upgrade` | Applies DB schema/data changes from modules. |\n| `setup:upgrade --keep-generated` | Keeps generated code during upgrade (for production). |\n| `setup:di:compile` | Compiles dependency injection code. |\n| `setup:static-content:deploy` | Deploys static view files for frontend. |\n| `setup:static-content:deploy -f` | Forces deployment even in developer mode. |\n| `setup:config:set` | Sets configuration values like DB or admin URL. |\n| `setup:db:status` | Shows database upgrade status. |\n| `setup:db:status --show-config` | Shows current DB connection settings. |\n| `maintenance:enable` / `maintenance:disable` / `maintenance:status` | Enables, disables maintenance mode, or shows its status. |"} {"id":"applications/magento/magento-cli.md#cache-management","url":"https://docs.turbostack.app/applications/magento/magento-cli/#cache-management","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Cache management","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `cache:clean` | Clears enabled cache types. |\n| `cache:flush` | Clears all cache backends (e.g., Redis). |\n| `cache:enable` / `cache:disable` | Enables or disables specified cache types. |\n| `cache:status` | Displays cache types and their status. |"} {"id":"applications/magento/magento-cli.md#index-management","url":"https://docs.turbostack.app/applications/magento/magento-cli/#index-management","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Index management","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `indexer:reindex` | Rebuilds indexers (e.g. product/category data). |\n| `indexer:reindex catalogsearch_fulltext` | Reindexes product search data. |\n| `indexer:status` | Shows indexer status. |\n| `indexer:reset` | Resets indexers that failed. |\n| `indexer:info` | Lists all indexers. |\n| `indexer:show-mode` | Displays indexer mode (schedule/realtime). |\n| `indexer:set-mode {schedule\\|realtime} [indexer]` | Sets mode for a specific indexer. |"} {"id":"applications/magento/magento-cli.md#module-management","url":"https://docs.turbostack.app/applications/magento/magento-cli/#module-management","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Module management","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `module:status` | Lists all modules and their status. |\n| `module:enable ` | Enables a module. |\n| `module:disable ` | Disables a module. |\n| `module:uninstall ` | Uninstalls a module and optionally removes its data. |"} {"id":"applications/magento/magento-cli.md#admin-users","url":"https://docs.turbostack.app/applications/magento/magento-cli/#admin-users","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Admin users","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `admin:user:create` | Creates a new admin user. |\n| `admin:user:unlock ` | Unlocks a locked admin account. |\n| `admin:user:delete ` | Deletes an admin user. |"} {"id":"applications/magento/magento-cli.md#security","url":"https://docs.turbostack.app/applications/magento/magento-cli/#security","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Security","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `security:passwords:upgrade` | Upgrades customer password hash format. |\n| `security:hash:upgrade` | Upgrades internal hash algorithms for better security. |"} {"id":"applications/magento/magento-cli.md#deployment-mode-and-developer-tools","url":"https://docs.turbostack.app/applications/magento/magento-cli/#deployment-mode-and-developer-tools","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Deployment mode and developer tools","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `deploy:mode:show` | Shows current deployment mode. |\n| `deploy:mode:set {developer\\|production\\|default}` | Changes deployment mode. |\n| `deploy:mode:set production --skip-compilation` | Skips DI compilation during mode switch. |\n| `dev:profiler:enable` / `dev:profiler:disable` | Enables or disables the performance profiler. |\n| `dev:template-hints:enable` / `dev:template-hints:disable` | Displays or hides template hints in frontend. |\n| `dev:source-theme:deploy` | Deploys source files (e.g. LESS) for custom themes. |"} {"id":"applications/magento/magento-cli.md#store-configuration","url":"https://docs.turbostack.app/applications/magento/magento-cli/#store-configuration","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Store configuration","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `config:set ` | Sets a configuration value. |\n| `config:set catalog/search/engine elasticsearch7` | Sets Elasticsearch as the search engine. |\n| `config:show ` | Shows a configuration value. |\n| `config:sensitive:set ` | Marks config value as sensitive (e.g., passwords). |\n| `config:sensitive:remove ` | Removes sensitive flag from a config. |"} {"id":"applications/magento/magento-cli.md#eav-attributes","url":"https://docs.turbostack.app/applications/magento/magento-cli/#eav-attributes","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"EAV attributes","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"Magento stores product attributes in an Entity-Attribute-Value (EAV) model.\n\n| Command | What it does |\n| --- | --- |\n| `eav:attribute:remove ` | Removes a custom attribute from the EAV model. |"} {"id":"applications/magento/magento-cli.md#inventory-reservations","url":"https://docs.turbostack.app/applications/magento/magento-cli/#inventory-reservations","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Inventory reservations","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `inventory:reservation:list-inconsistencies` | Lists mismatches in stock reservations. |\n| `inventory:reservation:create-compensations` | Fixes reservation issues by creating compensation records. |"} {"id":"applications/magento/magento-cli.md#logs","url":"https://docs.turbostack.app/applications/magento/magento-cli/#logs","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Logs","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `dev:log:clean` | Clears system and exception logs. |"} {"id":"applications/magento/magento-cli.md#testing","url":"https://docs.turbostack.app/applications/magento/magento-cli/#testing","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Testing","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `dev:tests:run {unit\\|integration\\|functional}` | Runs specified test suite. |"} {"id":"applications/magento/magento-cli.md#backup-and-restore","url":"https://docs.turbostack.app/applications/magento/magento-cli/#backup-and-restore","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Backup and restore","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `setup:backup --code --media --db` | Creates backup of codebase, media, and DB. |\n| `setup:rollback --code-file= --db-file=` | Restores from specified backup files. |\n\n> [!WARNING]\n> The `setup:backup` and `setup:rollback` commands are deprecated in current Magento releases. For a reliable, off-host copy of your store, use the platform backups instead."} {"id":"applications/magento/magento-cli.md#cron-and-message-queue-consumers","url":"https://docs.turbostack.app/applications/magento/magento-cli/#cron-and-message-queue-consumers","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Cron and message-queue consumers","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"| Command | What it does |\n| --- | --- |\n| `cron:run` | Executes scheduled cron jobs immediately. |\n| `cron:install` | Installs Magento cron jobs into system crontab. |\n| `queue:consumers:list` | List the message-queue consumers |\n| `queue:consumers:start ` | Start a single consumer |\n\nTurboStack installs the Magento cron entries for your system user automatically. On a busy store, run each message-queue consumer as a persistent user service instead of relying on cron alone - see Magento best practices.\n\n> [!TIP]\n> After deploying code on a production store, run the commands in this order: `setup:upgrade --keep-generated` -> `setup:di:compile` -> `setup:static-content:deploy` -> `cache:flush`.\n\n> [!NOTE]\n> The `n98-magerun2` tool is also installed on your host as `magerun2`. It adds convenience commands (for example `magerun2 sys:info`) on top of `bin/magento`. Run `magerun2 list` to see them.\n\n> [!WARNING]\n> `cache:flush`, `maintenance:enable` and `deploy:mode:set` change how the live storefront behaves. Run them during a quiet window and confirm the store still serves pages afterwards."} {"id":"applications/magento/magento-cli.md#related","url":"https://docs.turbostack.app/applications/magento/magento-cli/#related","path":"applications/magento/magento-cli.md","title":"Magento command-line reference","heading":"Related","keywords":"magento cli bin/magento php bin/magento magento commands cache clean indexer reindex setup upgrade deploy mode","text":"- Magento reference\n- Deploy Magento on TurboStack\n- Magento best practices\n- How to run multiple Magento store views\n- Troubleshooting Magento\n- How to switch PHP version\n- Connect over SSH"} {"id":"applications/magento/multiple-store-views.md#intro","url":"https://docs.turbostack.app/applications/magento/multiple-store-views/","path":"applications/magento/multiple-store-views.md","title":"How to run multiple Magento store views","heading":"","keywords":"magento multiple store views magento multi-website MAGE_RUN_CODE MAGE_RUN_TYPE mage.runmaps multi-domain magento","text":"# How to run multiple Magento store views\n\nOne Magento installation can serve several store views or websites, each on its own domain. Magento selects which one to load from two variables, `MAGE_RUN_CODE` (the store-view or website code) and `MAGE_RUN_TYPE` (`store` or `website`). On TurboStack you set them per domain in your Nginx configuration."} {"id":"applications/magento/multiple-store-views.md#before-you-start","url":"https://docs.turbostack.app/applications/magento/multiple-store-views/#before-you-start","path":"applications/magento/multiple-store-views.md","title":"How to run multiple Magento store views","heading":"Before you start","keywords":"magento multiple store views magento multi-website MAGE_RUN_CODE MAGE_RUN_TYPE mage.runmaps multi-domain magento","text":"- **Your store views or websites already created** in Magento (**Stores > All Stores**), each with its code.\n- **Secure Shell (SSH) access to the host** - see SSH access. You edit files under your system user's `~/nginx/` directory."} {"id":"applications/magento/multiple-store-views.md#map-each-domain-to-a-store-code","url":"https://docs.turbostack.app/applications/magento/multiple-store-views/#map-each-domain-to-a-store-code","path":"applications/magento/multiple-store-views.md","title":"How to run multiple Magento store views","heading":"Map each domain to a store code","keywords":"magento multiple store views magento multi-website MAGE_RUN_CODE MAGE_RUN_TYPE mage.runmaps multi-domain magento","text":"Create `~/nginx/mage.runmaps` and map each host name to its code and type. `MAGE_RUN_TYPE` is either `store` (a store view) or `website`:\n\n```nginx\nmap $http_host $MAGE_RUN_CODE {\n hostnames;\n .domain.nl domainnl;\n .domain.fr domainfr;\n}\n\nmap $http_host $MAGE_RUN_TYPE {\n hostnames;\n .domain.nl store;\n .domain.fr store;\n default website;\n}\n```\n\nReplace `domainnl` and `domainfr` with your store-view or website codes from **Stores > All Stores**."} {"id":"applications/magento/multiple-store-views.md#pass-the-variables-to-magento","url":"https://docs.turbostack.app/applications/magento/multiple-store-views/#pass-the-variables-to-magento","path":"applications/magento/multiple-store-views.md","title":"How to run multiple Magento store views","heading":"Pass the variables to Magento","keywords":"magento multiple store views magento multi-website MAGE_RUN_CODE MAGE_RUN_TYPE mage.runmaps multi-domain magento","text":"In `~/nginx/50main.conf`, find the two commented `fastcgi_param` lines in the PHP location block and remove the leading `#` so they are active:\n\n```nginx\nfastcgi_param MAGE_RUN_CODE $MAGE_RUN_CODE if_not_empty;\nfastcgi_param MAGE_RUN_TYPE $MAGE_RUN_TYPE if_not_empty;\n```\n\nPublish the host (or reload Nginx with `tscli nginx reload`) to apply the change, then load each domain and confirm it shows the right store view.\n\n> [!NOTE]\n> If the host already has store-code mappings for another system user, keep them separate by appending your user name to the variables: use `$MAGE_RUN_CODE_` and `$MAGE_RUN_TYPE_` in both `mage.runmaps` and `50main.conf`."} {"id":"applications/magento/multiple-store-views.md#verify","url":"https://docs.turbostack.app/applications/magento/multiple-store-views/#verify","path":"applications/magento/multiple-store-views.md","title":"How to run multiple Magento store views","heading":"Verify","keywords":"magento multiple store views magento multi-website MAGE_RUN_CODE MAGE_RUN_TYPE mage.runmaps multi-domain magento","text":"List the configured base URLs per store to confirm each code resolves to the right domain:\n\n```bash\nmagerun2 sys:store:config:base-url:list\n```\n\n> [!NOTE]\n> `magerun2` (n98-magerun2) is a third-party command-line tool, not part of core Magento."} {"id":"applications/magento/multiple-store-views.md#related","url":"https://docs.turbostack.app/applications/magento/multiple-store-views/#related","path":"applications/magento/multiple-store-views.md","title":"How to run multiple Magento store views","heading":"Related","keywords":"magento multiple store views magento multi-website MAGE_RUN_CODE MAGE_RUN_TYPE mage.runmaps multi-domain magento","text":"- Deploy Magento\n- Magento reference\n- Magento best practices\n- SSH access"} {"id":"applications/magento/reference.md#intro","url":"https://docs.turbostack.app/applications/magento/reference/","path":"applications/magento/reference.md","title":"Magento reference","heading":"","keywords":"magento cli bin/magento magento file layout magento cron magento commands queue consumers magento reference","text":"# Magento reference\n\nReference for running Magento 2 (Adobe Commerce) on TurboStack: where the files live, the command-line tool, and the scheduled jobs. For setup see Deploy Magento; for tuning see Magento best practices."} {"id":"applications/magento/reference.md#file-layout","url":"https://docs.turbostack.app/applications/magento/reference/#file-layout","path":"applications/magento/reference.md","title":"Magento reference","heading":"File layout","keywords":"magento cli bin/magento magento file layout magento cron magento commands queue consumers magento reference","text":"Everything lives under your system user's home directory. `~` is that home directory (for example `/var/www/prod/`). Run every `bin/magento` command from `~/public_html`.\n\n| Path | What it is |\n| --- | --- |\n| `~/public_html/` | Magento project root; run the command-line tool from here |\n| `~/public_html/pub/` | Web document root (the served files) |\n| `~/public_html/bin/magento` | The Magento command-line tool |\n| `~/public_html/app/` | Core modules, configuration (`app/etc`) and custom themes |\n| `~/public_html/vendor/` | Composer dependencies |\n| `~/public_html/var/` | Cache, generated code, sessions and logs |\n| `~/nginx/` | Custom Nginx configuration |\n| `~/.config/systemd/user/magento-consumer@.service` | Message-queue consumer service |\n\nFor ownership and permissions, see Application file layout and permissions."} {"id":"applications/magento/reference.md#command-line-reference","url":"https://docs.turbostack.app/applications/magento/reference/#command-line-reference","path":"applications/magento/reference.md","title":"Magento reference","heading":"Command-line reference","keywords":"magento cli bin/magento magento file layout magento cron magento commands queue consumers magento reference","text":"Magento ships a command-line interface (CLI) at `bin/magento`. Run `php bin/magento list` for the full list; the common commands are below.\n\n| Command | What it does |\n| --- | --- |\n| `setup:upgrade` | Apply database schema and data changes from modules |\n| `setup:di:compile` | Compile dependency injection code |\n| `setup:static-content:deploy` | Generate static view files for the storefront |\n| `deploy:mode:set {developer\\|production}` | Set the deployment mode (`deploy:mode:show` reads it) |\n| `cache:clean` / `cache:flush` | Clear enabled cache types / flush all cache backends |\n| `cache:status` / `cache:enable` / `cache:disable` | Show or change which cache types are active |\n| `indexer:reindex` | Rebuild indexers (for example catalog and search data) |\n| `indexer:status` / `indexer:reset` / `indexer:set-mode` | Inspect, reset or switch schedule/realtime indexer mode |\n| `config:set ` / `config:show ` | Set or read a store configuration value |\n| `maintenance:enable` / `maintenance:disable` / `maintenance:status` | Control maintenance mode |\n| `module:status` / `module:enable` / `module:disable` | List, enable or disable a module |\n| `admin:user:create` / `admin:user:unlock ` | Create an admin user or unlock a locked one |\n| `cron:run` / `cron:install` | Run due cron jobs now / install the cron entries |\n| `queue:consumers:list` / `queue:consumers:start ` | List message-queue consumers or start one |\n\n> [!TIP]\n> After deploying code on a production store, run `setup:upgrade --keep-generated` -> `setup:di:compile` -> `setup:static-content:deploy` -> `cache:flush`. See Magento best practices."} {"id":"applications/magento/reference.md#full-page-cache-debugging","url":"https://docs.turbostack.app/applications/magento/reference/#full-page-cache-debugging","path":"applications/magento/reference.md","title":"Magento reference","heading":"Full-page cache debugging","keywords":"magento cli bin/magento magento file layout magento cron magento commands queue consumers magento reference","text":"Magento's built-in full-page cache adds an `X-Magento-Cache-Debug` response header: `HIT` means the page was served from cache, `MISS` means it was rendered fresh. The header appears only in developer mode (`bin/magento deploy:mode:set developer`) and is suppressed in production. Check it over SSH:\n\n```bash\ncurl -sI https://example.com/ | grep -i x-magento-cache\n```\n\nWith Varnish in front, use the Varnish cache headers instead.\n\n> [!NOTE]\n> In production, static files are pre-generated with `setup:static-content:deploy`. You can allow on-demand generation by adding `'static_content_on_demand_in_production' => 1` to `app/etc/env.php`, but Adobe recommends against this on live stores because it adds latency on the first request for each uncached asset."} {"id":"applications/magento/reference.md#cron-and-message-queue-consumers","url":"https://docs.turbostack.app/applications/magento/reference/#cron-and-message-queue-consumers","path":"applications/magento/reference.md","title":"Magento reference","heading":"Cron and message-queue consumers","keywords":"magento cli bin/magento magento file layout magento cron magento commands queue consumers magento reference","text":"TurboStack installs the Magento cron entries for your system user automatically (`bin/magento cron:run`, `setup:cron:run` and the updater). These drive indexing, emails and scheduled jobs. Do not disable cron on a live store.\n\nOn a busy store, run each message-queue consumer as a persistent user system service so it restarts on failure, rather than relying on cron alone. The Magento consumer template unit and the exact `systemctl --user` commands are in Magento best practices."} {"id":"applications/magento/reference.md#related","url":"https://docs.turbostack.app/applications/magento/reference/#related","path":"applications/magento/reference.md","title":"Magento reference","heading":"Related","keywords":"magento cli bin/magento magento file layout magento cron magento commands queue consumers magento reference","text":"- Deploy Magento\n- Magento best practices\n- How to run multiple Magento store views\n- Troubleshooting Magento\n- Application file layout and permissions\n- How to manage user system services"} {"id":"applications/magento/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/magento/troubleshooting/","path":"applications/magento/troubleshooting.md","title":"Troubleshooting Magento","heading":"","keywords":"magento troubleshooting magento logs magento error magento turbostack magento maintenance mode indexer reindex Elasticsearch connection Varnish 503","text":"# Troubleshooting Magento\n\nMost Magento problems have a few common causes: stale caches, invalid indexers, a stopped cron, a search-engine connection, or the site stuck in maintenance mode. This page shows where to look and how to fix the common cases. Many fixes use Magento's CLI (`bin/magento`) or the diagnostic tool `n98-magerun2`, both available from your app root."} {"id":"applications/magento/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/magento/troubleshooting/#where-to-find-the-logs","path":"applications/magento/troubleshooting.md","title":"Troubleshooting Magento","heading":"Where to find the logs","keywords":"magento troubleshooting magento logs magento error magento turbostack magento maintenance mode indexer reindex Elasticsearch connection Varnish 503","text":"Your Magento app lives at `/var/www//public_html` (the vhost serves its `pub/` subdirectory). The most useful logs are:\n\n| Component | Where |\n| --- | --- |\n| Magento application | `/var/www//public_html/var/log/` (`system.log`, `exception.log`, `debug.log`) |\n| Magento cron | `var/log/magento.cron.log` and `var/log/setup.cron.log` |\n| Reports / fatal errors | `/var/www//public_html/var/report/` |\n| Nginx access/error | the host's web server logs (under the system user's home / `/var/log/`) |\n| PHP-FPM | the PHP-FPM pool log for the app's runtime |\n| Database (MySQL) | the MySQL error/slow-query log |\n| Varnish | the Varnish service log |\n\nAll files under `var/log/` are rotated weekly. You can also use the host's Health tab for resource graphs and check recent deploys under History."} {"id":"applications/magento/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/magento/troubleshooting/#common-issues","path":"applications/magento/troubleshooting.md","title":"Troubleshooting Magento","heading":"Common issues","keywords":"magento troubleshooting magento logs magento error magento turbostack magento maintenance mode indexer reindex Elasticsearch connection Varnish 503","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| Site shows \"service unavailable\" / maintenance page | Maintenance mode left enabled (often after a failed deploy) | `bin/magento maintenance:status`, then `bin/magento maintenance:disable` |\n| Old content, changed config or prices not showing | Stale cache | `bin/magento cache:flush` (and `cache:clean`) |\n| Catalog/prices wrong, \"indexer invalid\" warning | Indexers out of date | `bin/magento indexer:status`, then `bin/magento indexer:reindex` |\n| Storefront errors, empty search results | Elasticsearch/OpenSearch down or misconfigured | Verify the service is running on Services; re-check the search engine host and index prefix in admin |\n| Emails, reindex, or scheduled jobs never run | Cron not running | Confirm the cron jobs exist for the system user and read `var/log/magento.cron.log`; run `bin/magento cron:run` manually to test |\n| 503 errors from the storefront | Varnish backend (PHP/nginx) down, or wrong Varnish hosts | Check PHP-FPM/nginx are up; verify Magento's `http-cache-hosts` and Varnish backend port (8080) settings |\n| White screen / blank pages, permission errors | Wrong file permissions or stale generated code | Fix ownership of `var/`, `generated/`, `pub/static`; clear with `rm -rf generated/* var/cache/*` then `setup:di:compile` |\n| Admin/storefront very slow | Running in developer mode in production | `bin/magento deploy:mode:set production` |\n| Indexer stuck or failing repeatedly | Corrupted indexer state | `bin/magento indexer:reset`, then `indexer:reindex`; in production set indexers to cron-driven with `indexer:set-mode schedule` |\n| Missing or stale CSS/JS in the storefront | Static content not deployed | `bin/magento setup:static-content:deploy -f` (`-f` forces the deploy even in developer mode) |\n| Stock quantities wrong after orders or returns | Inventory reservations inconsistent | `bin/magento inventory:reservation:list-inconsistencies`, then `inventory:reservation:create-compensations` |\n| Locked out of the admin | Too many failed admin logins | `bin/magento admin:user:unlock ` |"} {"id":"applications/magento/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/magento/troubleshooting/#a-troubleshooting-workflow","path":"applications/magento/troubleshooting.md","title":"Troubleshooting Magento","heading":"A troubleshooting workflow","keywords":"magento troubleshooting magento logs magento error magento turbostack magento maintenance mode indexer reindex Elasticsearch connection Varnish 503","text":"1. **Check Health** - rule out resource exhaustion (CPU, memory, disk) and confirm the host is up.\n2. **Read the relevant log** - start with `var/log/exception.log` and `var/log/system.log`, plus the nginx/PHP-FPM logs for HTTP-level errors.\n3. **Check the last deploy in History** - if a recent change broke the site, revert or re-publish a known-good revision via Publishing.\n4. **Verify services are running** - on Services confirm MySQL, Elasticsearch/OpenSearch, Redis, and Varnish are all up; then re-run `cache:flush` and `indexer:reindex` and re-test."} {"id":"applications/magento/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/magento/troubleshooting/#getting-help","path":"applications/magento/troubleshooting.md","title":"Troubleshooting Magento","heading":"Getting help","keywords":"magento troubleshooting magento logs magento error magento turbostack magento maintenance mode indexer reindex Elasticsearch connection Varnish 503","text":"If you are still stuck, reach out via Support, or work through the platform-wide Troubleshooting guide for issues that are not Magento-specific."} {"id":"applications/magento/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/magento/troubleshooting/#related","path":"applications/magento/troubleshooting.md","title":"Troubleshooting Magento","heading":"Related","keywords":"magento troubleshooting magento logs magento error magento turbostack magento maintenance mode indexer reindex Elasticsearch connection Varnish 503","text":"- Deploy Magento\n- Magento best practices\n- Health\n- Support"} {"id":"applications/medusa/best-practices.md#intro","url":"https://docs.turbostack.app/applications/medusa/best-practices/","path":"applications/medusa/best-practices.md","title":"Medusa best practices","heading":"","keywords":"medusa performance medusa optimization medusa caching medusa turbostack node.js reverse proxy postgresql Redis headless commerce","text":"# Medusa best practices\n\nMedusa is a Node.js headless commerce platform that runs as one or more long-lived Node processes, with Nginx reverse-proxying public traffic to each one. Because there is no dedicated `app_type`, performance and stability come from how you build, run, and keep those processes running - TurboStack provides the surrounding infrastructure. This page covers what the platform configures for you and how to get the most out of it."} {"id":"applications/medusa/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/medusa/best-practices/#what-turbostack-configures-for-you","path":"applications/medusa/best-practices.md","title":"Medusa best practices","heading":"What TurboStack configures for you","keywords":"medusa performance medusa optimization medusa caching medusa turbostack node.js reverse proxy postgresql Redis headless commerce","text":"When you deploy Medusa with the reverse-proxy pattern, the platform provides the infrastructure around your Node processes:\n\n- **Nginx reverse proxy** - for every vhost with `proxy_enabled: true`, Nginx creates an upstream pointing at `proxy_upstream_host` (default `127.0.0.1`) on your `proxy_upstream_port`, and proxies all traffic to it. The proxy is tuned with keepalive (up to 2048 pooled connections), `proxy_http_version 1.1`, and WebSocket pass-through (`Upgrade`/`Connection` headers), so server-sent events and live admin updates work by default.\n- **Transport Layer Security (TLS) termination** - `cert_type: letsencrypt` issues and auto-renews certificates per domain. Nginx terminates TLS and forwards `X-Forwarded-Proto`, `X-Forwarded-Host`, and `Ssl-Offloaded` headers so Medusa generates correct absolute URLs.\n- **PostgreSQL** - the database Medusa persists all of its data in, provisioned from your `postgresql_version`.\n- **Node.js runtime** - the `nodejs_version` you pin per vhost installs the Node runtime each service runs on.\n- **Per-vhost separation** - each `app_name` (storefront, backend/admin) gets its own document root, Nginx vhost, access log, and upstream. Services run as independent processes on their own ports and domains.\n\n> [!NOTE]\n> TurboStack configures Nginx reverse proxy, TLS, PostgreSQL, and the Node runtime. The Medusa processes themselves - building, migrating, and keeping them running on the upstream port - are yours to manage."} {"id":"applications/medusa/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/medusa/best-practices/#recommended-optimizations","path":"applications/medusa/best-practices.md","title":"Medusa best practices","heading":"Recommended optimizations","keywords":"medusa performance medusa optimization medusa caching medusa turbostack node.js reverse proxy postgresql Redis headless commerce","text":"Combine Medusa's vendor guidance with the TurboStack options below. Most caching and runtime services are one toggle away on the host's Services tab.\n\n- **Build before you serve** - always run `medusa build` (and build the storefront/admin) and start from the compiled output for production. Never run a dev server behind the proxy.\n- **Run in production mode** - start each process with `NODE_ENV=production` so Medusa disables dev-only behavior and the admin is served pre-built.\n- **Keep processes running with a process manager** - run each Node service under a supervisor (pm2, or a systemd unit). It must restart on crash and on reboot and keep listening on the configured `proxy_upstream_port`; if it stops, Nginx returns 502. For example, run the backend and storefront under pm2: `pm2 start \"npx medusa start\" --name medusa-backend` and `pm2 start \"npm start\" --name storefront`, then `pm2 save`. See Keep a Node.js app running for the full pm2 workflow.\n- **Add Redis for events and cache** - point Medusa's modules at a Redis instance for the event bus, workflow engine, and cache. This ensures jobs and pub/sub survive restarts and scale beyond a single process. Enable Redis from Services, then set up the cache module - see Redis cache configuration.\n- **Split server and worker modes** - for busy stores, run a dedicated worker process (`workerMode: \"worker\"`) alongside the request-serving process (`workerMode: \"server\"`) so background jobs do not block API responses.\n- **Tune PostgreSQL connection pooling** - size the Medusa database pool to your CPU count; avoid exhausting PostgreSQL connections across server and worker processes.\n- **Serve and cache static assets via a Content Delivery Network (CDN)** - place an HTTP cache/CDN in front of the storefront. This prevents the Node process from serving cacheable pages and assets on every request.\n- **Optimize images and assets** - pre-build and compress storefront assets; let Next.js (or your storefront framework) emit optimized, cacheable output."} {"id":"applications/medusa/best-practices.md#redis-cache-configuration","url":"https://docs.turbostack.app/applications/medusa/best-practices/#redis-cache-configuration","path":"applications/medusa/best-practices.md","title":"Medusa best practices","heading":"Redis cache configuration","keywords":"medusa performance medusa optimization medusa caching medusa turbostack node.js reverse proxy postgresql Redis headless commerce","text":"Medusa's caching module is off by default. Enable it with a feature flag, then point the cache module at the TurboStack cache Redis instance (port 6379, no password). Give each shop its own prefix and a Time to Live (TTL) so cache data stays separate and Redis does not fill up.\n\nAdd the variables to the `.env` file in your project (`~///`):\n\n```bash\n# Enable the caching system\nMEDUSA_FF_CACHING=true\n\n# Cache Redis instance\nCACHE_REDIS_URL=redis://127.0.0.1:6379\n\n# Optional\nCACHE_TTL=28800 # 8 hours in seconds\nCACHE_PREFIX=example-cache:\n```\n\nThen enable the feature flag and register the Redis cache provider in `medusa-config.ts`:\n\n```javascript\nimport { defineConfig } from \"@medusajs/framework/utils\"\n\nexport default defineConfig({\n featureFlags: {\n caching: true,\n },\n\n modules: [\n {\n resolve: \"@medusajs/medusa/caching\",\n options: {\n providers: [\n {\n id: \"caching-redis\",\n resolve: \"@medusajs/caching-redis\",\n is_default: true,\n options: {\n redisUrl: process.env.CACHE_REDIS_URL,\n ttl: process.env.CACHE_TTL\n ? parseInt(process.env.CACHE_TTL, 10)\n : undefined,\n prefix: process.env.CACHE_PREFIX,\n },\n },\n ],\n },\n },\n ],\n})\n```\n\nMedusa does not cache responses until a query opts in, so enabling the module alone does not populate Redis. A query enables caching through its `cache` option. Wire up a workflow that runs a cached query, then an API route that calls it.\n\nCreate a workflow at `~///src/workflows/cache-products.ts`:\n\n```javascript\nimport {\n createWorkflow,\n WorkflowResponse,\n} from \"@medusajs/framework/workflows-sdk\"\nimport { useQueryGraphStep } from \"@medusajs/medusa/core-flows\"\n\nexport const cacheProductsWorkflow = createWorkflow(\n \"cache-products\",\n () => {\n const { data: products } = useQueryGraphStep({\n entity: \"product\",\n fields: [\"id\", \"title\"],\n options: {\n cache: {\n enable: true,\n providers: [\"caching-redis\"],\n },\n },\n })\n\n return new WorkflowResponse(products)\n }\n)\n```\n\nThis queries the product entity and caches the response in Redis through the query's `cache` option.\n\nThen expose it with an API route at `~///src/api/cache-product/route.ts`:\n\n```javascript\nimport { MedusaRequest, MedusaResponse } from \"@medusajs/framework/http\"\nimport { cacheProductsWorkflow } from \"../../workflows/cache-products\"\n\nexport const GET = async (req: MedusaRequest, res: MedusaResponse) => {\n const { result } = await cacheProductsWorkflow(req.scope)\n .run({})\n\n res.status(200).json(result)\n}\n```\n\nThis adds a `/cache-product` endpoint that runs the workflow and returns the cached product data.\n\nRebuild and restart after the change. Stop the process first, rebuild, and copy the environment file into the compiled server directory (the build produces a fresh `.medusa/server` that does not carry your `.env`):\n\n```bash\npm2 stop \nnpx medusa build\ncp .env .medusa/server/.env\npm2 restart \n```\n\nClick around the storefront or hit the `/cache-product` endpoint, then confirm keys appear under your `CACHE_PREFIX` in Redis."} {"id":"applications/medusa/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/medusa/best-practices/#sizing-and-scaling","path":"applications/medusa/best-practices.md","title":"Medusa best practices","heading":"Sizing and scaling","keywords":"medusa performance medusa optimization medusa caching medusa turbostack node.js reverse proxy postgresql Redis headless commerce","text":"TurboStack auto-tunes resource limits from the host's size, so start with the defaults. Override the tuning variables only when you have measured evidence (slow queries, cache evictions, saturated CPU):\n\n| Variable | Tune when |\n| --- | --- |\n| `postgresql` resources | The database is the bottleneck under order/catalog load |\n| `redis_memory` | Redis is evicting keys used for events or cache |\n\nScale Node throughput by running more processes (server + worker, or multiple server instances on different ports behind Nginx) before scaling the host. See Performance tuning before changing any tuning variable, and scale up the host when a single machine can no longer keep up."} {"id":"applications/medusa/best-practices.md#stability","url":"https://docs.turbostack.app/applications/medusa/best-practices/#stability","path":"applications/medusa/best-practices.md","title":"Medusa best practices","heading":"Stability","keywords":"medusa performance medusa optimization medusa caching medusa turbostack node.js reverse proxy postgresql Redis headless commerce","text":"- **Back up regularly** - verify scheduled Backups cover the PostgreSQL database and any uploaded media/file storage.\n- **Watch Health** - monitor CPU, memory, and disk. A crash-looping Node process or a stuck migration appears here first.\n- **Run migrations on every deploy** - apply `medusa db:migrate` before starting new code so the schema matches the running version.\n- **Keep versions current** - track Medusa releases and keep your pinned `nodejs_version` and `postgresql_version` on supported lines.\n- **Test on a staging clone** - trial upgrades, plugins, and migrations on a copy before publishing to production."} {"id":"applications/medusa/best-practices.md#related","url":"https://docs.turbostack.app/applications/medusa/best-practices/#related","path":"applications/medusa/best-practices.md","title":"Medusa best practices","heading":"Related","keywords":"medusa performance medusa optimization medusa caching medusa turbostack node.js reverse proxy postgresql Redis headless commerce","text":"- Deploy Medusa\n- Troubleshooting Medusa\n- How to manage user system services\n- Services\n- Performance tuning"} {"id":"applications/medusa/deploy.md#intro","url":"https://docs.turbostack.app/applications/medusa/deploy/","path":"applications/medusa/deploy.md","title":"Deploy Medusa on TurboStack","heading":"","keywords":"medusa node.js headless commerce reverse proxy proxy_enabled postgresql nodejs_version turbostack","text":"# Deploy Medusa on TurboStack\n\nMedusa is a Node.js headless commerce platform. Unlike applications that have a dedicated `app_type`, Medusa is deployed with the **reverse-proxy pattern**: each Node.js service runs as its own process and Nginx proxies requests to it. This pattern applies to any Node.js or containerized application, not just Medusa, so you can use the same approach for custom Node apps, separate storefronts, and admin dashboards."} {"id":"applications/medusa/deploy.md#requirements","url":"https://docs.turbostack.app/applications/medusa/deploy/#requirements","path":"applications/medusa/deploy.md","title":"Deploy Medusa on TurboStack","heading":"Requirements","keywords":"medusa node.js headless commerce reverse proxy proxy_enabled postgresql nodejs_version turbostack","text":"| Component | Value |\n| --- | --- |\n| App type | - (reverse proxy) |\n| Runtime | Node.js 20+ (LTS versions only) |\n| Database | PostgreSQL |\n| Web server | Nginx (reverse proxy) |\n\n> [!NOTE]\n> There is no `app_type` for Medusa. You enable the reverse proxy per vhost with `proxy_enabled: true` and point it at the port your Node process listens on."} {"id":"applications/medusa/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/medusa/deploy/#configure-it","path":"applications/medusa/deploy.md","title":"Deploy Medusa on TurboStack","heading":"Configure it","keywords":"medusa node.js headless commerce reverse proxy proxy_enabled postgresql nodejs_version turbostack","text":"1. Set `webserver: nginx` at the host level to provide the reverse proxy.\n2. Set `postgresql_version` to the PostgreSQL release Medusa should use (for example `\"18\"`).\n3. For each service, add a vhost with a unique `app_name`, a `nodejs_version`, and `cert_type: letsencrypt`.\n4. Set `proxy_enabled: true` and `proxy_upstream_port` to the port the Node process listens on. Nginx will proxy public traffic to that port.\n5. Repeat for each service - for example a storefront on port 8000 and the Medusa backend/admin on port 9000.\n\nSee Applications for supported deployment patterns and Publish for how to apply your host configuration."} {"id":"applications/medusa/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/medusa/deploy/#example-configuration","path":"applications/medusa/deploy.md","title":"Deploy Medusa on TurboStack","heading":"Example configuration","keywords":"medusa node.js headless commerce reverse proxy proxy_enabled postgresql nodejs_version turbostack","text":"```yaml\nwebserver: nginx\npostgresql_version: \"17\" # Medusa stores its data in PostgreSQL\nsystem_users:\n - username: prod\n vhosts:\n - server_name: shop.example.com www.shop.example.com\n app_name: frontend\n nodejs_version: \"24\" # Node.js runtime for the storefront\n cert_type: letsencrypt\n proxy_enabled: true # nginx proxies to the Node process\n proxy_upstream_port: \"8000\"\n - server_name: dashboard.shop.example.com\n app_name: dashboard\n nodejs_version: \"24\"\n cert_type: letsencrypt\n proxy_enabled: true\n proxy_upstream_port: \"9000\" # Medusa backend/admin\n```"} {"id":"applications/medusa/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/medusa/deploy/#why-these-choices","path":"applications/medusa/deploy.md","title":"Deploy Medusa on TurboStack","heading":"Why these choices","keywords":"medusa node.js headless commerce reverse proxy proxy_enabled postgresql nodejs_version turbostack","text":"- The reverse-proxy pattern (`proxy_enabled` + `proxy_upstream_port`) works for any Node.js or containerized application. You keep full control over the runtime, while Nginx handles Transport Layer Security (TLS) and routing.\n- A separate vhost per `app_name` lets the storefront and the backend/admin run as independent processes on their own ports and domains.\n- `nodejs_version` pins the Node.js runtime each service runs on.\n- `postgresql_version` is required because Medusa persists its data in PostgreSQL.\n- `cert_type: letsencrypt` issues and renews TLS certificates automatically for each domain."} {"id":"applications/medusa/deploy.md#related","url":"https://docs.turbostack.app/applications/medusa/deploy/#related","path":"applications/medusa/deploy.md","title":"Deploy Medusa on TurboStack","heading":"Related","keywords":"medusa node.js headless commerce reverse proxy proxy_enabled postgresql nodejs_version turbostack","text":"- Technologies used: Node.js, PostgreSQL, Redis, Reverse proxy.\n\n- Setup example - end-to-end install over SSH.\n- Hosting reference - file layout, permissions & caching.\n- Best practices - performance & stability.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications\n- The Source (YAML) view"} {"id":"applications/medusa/reference.md#intro","url":"https://docs.turbostack.app/applications/medusa/reference/","path":"applications/medusa/reference.md","title":"Medusa hosting reference","heading":"","keywords":"medusa reference medusa file structure medusa permissions medusa caching redis varnish varnish_enabled","text":"# Medusa hosting reference\n\nTurboStack is equipped to run your optimized Medusa application. TurboStack maintains the server and infrastructure, but the Medusa configuration, themes, plugins and customizations are your responsibility. This guide covers the file structure, permissions, caching and more of your Medusa application. To deploy the application, see Deploy Medusa."} {"id":"applications/medusa/reference.md#file-structure","url":"https://docs.turbostack.app/applications/medusa/reference/#file-structure","path":"applications/medusa/reference.md","title":"Medusa hosting reference","heading":"File structure","keywords":"medusa reference medusa file structure medusa permissions medusa caching redis varnish varnish_enabled","text":"The following table shows the directory structure of a Medusa application:\n\n| Path | Purpose |\n| --- | --- |\n| `src/admin` | Holds your admin dashboard's custom widgets and UI routes. |\n| `src/api` | Holds your custom API routes that are added as endpoints in your Medusa application. |\n| `src/jobs` | Holds your scheduled jobs that run at specified intervals during the application's runtime. |\n| `src/links` | Holds your module links that build associations between data models of different modules. |\n| `src/modules` | Holds your custom modules that implement business logic. |\n| `src/scripts` | Holds your custom scripts to be executed using Medusa's CLI tool. |\n| `src/subscribers` | Holds your event listeners that run asynchronously whenever an event is emitted. |\n| `src/workflows` | Holds your custom flows that can be executed from anywhere in your application. |\n| `medusa-config.ts` | Holds your Medusa configurations, such as PostgreSQL database configuration. |\n| `.medusa` | Holds types and other files generated by Medusa when running `build`; should not be modified or committed. |"} {"id":"applications/medusa/reference.md#permissions","url":"https://docs.turbostack.app/applications/medusa/reference/#permissions","path":"applications/medusa/reference.md","title":"Medusa hosting reference","heading":"Permissions","keywords":"medusa reference medusa file structure medusa permissions medusa caching redis varnish varnish_enabled","text":"Medusa requires correct file permissions to operate securely and reliably. Run these commands as your own system user over SSH - you do not need root:\n\n```bash\nfind ~// -type f -exec chmod 644 {} \\;\nfind ~// -type d -exec chmod 755 {} \\;\nchown -R $USER:$USER ~//\n```\n\n> [!NOTE]\n> Replace `` and `` with your actual project and shop name."} {"id":"applications/medusa/reference.md#configuring-redis","url":"https://docs.turbostack.app/applications/medusa/reference/#configuring-redis","path":"applications/medusa/reference.md","title":"Medusa hosting reference","heading":"Configuring Redis","keywords":"medusa reference medusa file structure medusa permissions medusa caching redis varnish varnish_enabled","text":"Redis is enabled by default. TurboStack runs two instances on the host: port `6379` for transient cache data and port `6378` for persistent data such as sessions and queues. Access is secured by the host, so no Redis password is set. See Redis on TurboStack."} {"id":"applications/medusa/reference.md#varnish","url":"https://docs.turbostack.app/applications/medusa/reference/#varnish","path":"applications/medusa/reference.md","title":"Medusa hosting reference","heading":"Varnish","keywords":"medusa reference medusa file structure medusa permissions medusa caching redis varnish varnish_enabled","text":"The Medusa dashboard does not need any caching. We do recommend adding Varnish to your storefront. You can enable Varnish in the TurboStack GUI by adding the following line to the YAML configuration, for the `vhost` where your frontend resides:\n\n```yaml\nvarnish_enabled: true\n```\n\nSee Configure Varnish."} {"id":"applications/medusa/reference.md#clearing-the-cache","url":"https://docs.turbostack.app/applications/medusa/reference/#clearing-the-cache","path":"applications/medusa/reference.md","title":"Medusa hosting reference","heading":"Clearing the cache","keywords":"medusa reference medusa file structure medusa permissions medusa caching redis varnish varnish_enabled","text":"To clear the caches, run the following commands:\n\n```bash\ntscli varnish clear\ntscli redis clear\n```\n\n`tscli redis clear` flushes the cache instance (`6379`) only; it leaves the persistent instance (`6378`) untouched, so sessions and queues survive. For finer control, see Clear the Redis cache."} {"id":"applications/medusa/reference.md#related","url":"https://docs.turbostack.app/applications/medusa/reference/#related","path":"applications/medusa/reference.md","title":"Medusa hosting reference","heading":"Related","keywords":"medusa reference medusa file structure medusa permissions medusa caching redis varnish varnish_enabled","text":"- Deploy Medusa\n- Medusa best practices"} {"id":"applications/medusa/setup-example.md#intro","url":"https://docs.turbostack.app/applications/medusa/setup-example/","path":"applications/medusa/setup-example.md","title":"Medusa setup example","heading":"","keywords":"medusa setup example create-medusa-app medusa storefront medusa admin medusa production pm2 postgresql","text":"# Medusa setup example\n\nThis page walks through a full Medusa installation on TurboStack, step by\nstep: the Medusa backend (which includes the admin dashboard) and the optional Next.js storefront.\nIt is a worked example that complements Deploy Medusa on TurboStack - read that page\nfirst for the host configuration and the reasoning behind the reverse-proxy pattern.\n\nIf you only want the backend, you can skip the storefront steps. Medusa exposes an Application\nProgramming Interface (API) so you can connect your own storefront later."} {"id":"applications/medusa/setup-example.md#before-you-start","url":"https://docs.turbostack.app/applications/medusa/setup-example/#before-you-start","path":"applications/medusa/setup-example.md","title":"Medusa setup example","heading":"Before you start","keywords":"medusa setup example create-medusa-app medusa storefront medusa admin medusa production pm2 postgresql","text":"Configure the host as described in Deploy Medusa on TurboStack. The example below\nassumes two websites (vhosts) under one system user, each with `proxy_enabled: true` so Nginx\nproxies public traffic to the Node process:\n\n- a storefront on port `8000` (for example `shop.example.com`)\n- the Medusa backend and admin on port `9000` (for example `dashboard.example.com`)\n\n```yaml\nwebserver: nginx\npostgresql_version: \"18\"\nsystem_users:\n - username: prod\n vhosts:\n - server_name: shop.example.com www.shop.example.com\n app_name: frontend\n nodejs_version: \"24\"\n cert_type: letsencrypt\n proxy_enabled: true\n proxy_upstream_port: \"8000\"\n - server_name: dashboard.example.com\n app_name: dashboard\n nodejs_version: \"24\"\n cert_type: letsencrypt\n proxy_enabled: true\n proxy_upstream_port: \"9000\"\n```\n\nPublish the host so the two websites and PostgreSQL exist, then open an SSH\nsession as the system user for the steps below.\n\n> [!NOTE]\n> If you only want the backend, remove the storefront vhost."} {"id":"applications/medusa/setup-example.md#step-1-create-the-medusa-project","url":"https://docs.turbostack.app/applications/medusa/setup-example/#step-1-create-the-medusa-project","path":"applications/medusa/setup-example.md","title":"Medusa setup example","heading":"Step 1: Create the Medusa project","keywords":"medusa setup example create-medusa-app medusa storefront medusa admin medusa production pm2 postgresql","text":"Create a directory for the project in your home directory and change into it:\n\n```bash\nmkdir project\ncd project\n```\n\n> [!WARNING]\n> Do not place the project inside `public_html`. That directory is served publicly and would expose\n> source and configuration files.\n\nRun the Medusa installer:\n\n```bash\nnpx create-medusa-app@latest \n```\n\nFollow the interactive prompts. When asked, provide your PostgreSQL credentials:\n\n```\n? Would you like to install the Next.js Starter Storefront? Yes\n? Enter your Postgres username prod\n? Enter your Postgres password [hidden]\n? Enter your Postgres user's database name prod\n```\n\nYou find the PostgreSQL credentials in the TurboStack interface under the host's **Credentials**, or\non the server in the `~/.pgpass` file:\n\n```bash\ncat ~/.pgpass\n```\n\nThe installer is finished when it prints:\n\n```\nServer is ready on port: 9000\n```\n\nStop the test server with `Ctrl + C`. You will start it as a persistent service later.\n\n> [!NOTE]\n> If you only want the backend, answer `No` to the storefront prompt."} {"id":"applications/medusa/setup-example.md#step-2-create-an-admin-user","url":"https://docs.turbostack.app/applications/medusa/setup-example/#step-2-create-an-admin-user","path":"applications/medusa/setup-example.md","title":"Medusa setup example","heading":"Step 2: Create an admin user","keywords":"medusa setup example create-medusa-app medusa storefront medusa admin medusa production pm2 postgresql","text":"You need an admin account to sign in to the dashboard. Change the values to your own:\n\n```bash\nnpx medusa user -e user@example.com -p \n```"} {"id":"applications/medusa/setup-example.md#step-3-allow-your-dashboard-domain","url":"https://docs.turbostack.app/applications/medusa/setup-example/#step-3-allow-your-dashboard-domain","path":"applications/medusa/setup-example.md","title":"Medusa setup example","heading":"Step 3: Allow your dashboard domain","keywords":"medusa setup example create-medusa-app medusa storefront medusa admin medusa production pm2 postgresql","text":"Medusa's admin runs on a development server that only accepts requests for hosts it knows. Add your\ndashboard domain to the `allowedHosts` list in `medusa-config.ts`, found at\n`~/project//medusa-config.ts`. Add the `admin` block:\n\n```javascript\nimport { loadEnv, defineConfig } from '@medusajs/framework/utils'\n\nloadEnv(process.env.NODE_ENV || 'development', process.cwd())\n\nmodule.exports = defineConfig({\n projectConfig: {\n databaseUrl: process.env.DATABASE_URL,\n http: {\n storeCors: process.env.STORE_CORS,\n adminCors: process.env.ADMIN_CORS,\n authCors: process.env.AUTH_CORS,\n jwtSecret: process.env.JWT_SECRET || \"supersecret\",\n cookieSecret: process.env.COOKIE_SECRET || \"supersecret\",\n },\n },\n admin: {\n // Allow the host (and its subdomains) that serve the admin dashboard\n vite: (config) => {\n return {\n ...config,\n server: {\n allowedHosts: [\".example.com\"],\n },\n }\n },\n },\n})\n```"} {"id":"applications/medusa/setup-example.md#step-4-build-and-run-the-backend-for-production","url":"https://docs.turbostack.app/applications/medusa/setup-example/#step-4-build-and-run-the-backend-for-production","path":"applications/medusa/setup-example.md","title":"Medusa setup example","heading":"Step 4: Build and run the backend for production","keywords":"medusa setup example create-medusa-app medusa storefront medusa admin medusa production pm2 postgresql","text":"The development server is not suitable for production. From the project directory\n`~/project//`, build the backend:\n\n```bash\nnpx medusa build\n```\n\nThe build writes a production bundle to `.medusa/server`. Change into it and install its\ndependencies:\n\n```bash\ncd .medusa/server\nnpm install\n```\n\nCopy the environment file from the project root into the build directory:\n\n```bash\ncp ../../.env .env\n```\n\nStart the server once to confirm it works:\n\n```bash\nnpx medusa start\n```\n\nOpen `https://dashboard.example.com` in your browser and sign in with the admin account you created.\nWhen the backend loads correctly, stop it with `Ctrl + C` and start it as a persistent process so it\nsurvives your logout and restarts on boot. A Node process manager such as PM2 does this:\n\n```bash\npm2 start \"npx medusa start\" --name medusa-backend\n```"} {"id":"applications/medusa/setup-example.md#step-5-build-and-run-the-storefront-optional","url":"https://docs.turbostack.app/applications/medusa/setup-example/#step-5-build-and-run-the-storefront-optional","path":"applications/medusa/setup-example.md","title":"Medusa setup example","heading":"Step 5: Build and run the storefront (optional)","keywords":"medusa setup example create-medusa-app medusa storefront medusa admin medusa production pm2 postgresql","text":"Change into the storefront directory and install its dependencies:\n\n```bash\ncd ~/project/-storefront\nnpm install\n```\n\nBuild and start it once to confirm it listens on port `8000`:\n\n```bash\nnpm run build\nnpm start\n```\n\nWhen it works, stop it with `Ctrl + C` and start it as a persistent process:\n\n```bash\npm2 start \"npm start\" --name storefront\n```\n\nThe storefront is now reachable at `https://shop.example.com`, proxied by Nginx to port `8000`."} {"id":"applications/medusa/setup-example.md#tip-non-interactive-install","url":"https://docs.turbostack.app/applications/medusa/setup-example/#tip-non-interactive-install","path":"applications/medusa/setup-example.md","title":"Medusa setup example","heading":"Tip: Non-interactive install","keywords":"medusa setup example create-medusa-app medusa storefront medusa admin medusa production pm2 postgresql","text":"To script the installation, pass the database connection string and the storefront flag directly, so\n`create-medusa-app` does not prompt:\n\n```bash\nnpx create-medusa-app@latest \\\n --db-url \"postgres://:@localhost:5432/\" \\\n --with-nextjs-starter\n```\n\nRead the credentials from `~/.pgpass` rather than copying them from the interface. If you only need\nthe backend, delete the generated storefront directory afterward."} {"id":"applications/medusa/setup-example.md#related","url":"https://docs.turbostack.app/applications/medusa/setup-example/#related","path":"applications/medusa/setup-example.md","title":"Medusa setup example","heading":"Related","keywords":"medusa setup example create-medusa-app medusa storefront medusa admin medusa production pm2 postgresql","text":"- Deploy Medusa on TurboStack - the host YAML and the reverse-proxy pattern.\n- Medusa best practices - performance and stability.\n- Troubleshooting Medusa - logs and common fixes.\n- What is SSH?\n- Applications overview"} {"id":"applications/medusa/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/medusa/troubleshooting/","path":"applications/medusa/troubleshooting.md","title":"Troubleshooting Medusa","heading":"","keywords":"medusa troubleshooting medusa logs medusa error medusa turbostack 502 bad gateway node.js postgresql reverse proxy","text":"# Troubleshooting Medusa\n\nMost Medusa problems on TurboStack have one root cause: the Node process is not running and listening on the port Nginx proxies to. Because the platform only provides the reverse proxy, Transport Layer Security (TLS), PostgreSQL, and the Node runtime, the application process is yours to keep healthy. This page shows where to look and how to fix the common cases."} {"id":"applications/medusa/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/medusa/troubleshooting/#where-to-find-the-logs","path":"applications/medusa/troubleshooting.md","title":"Troubleshooting Medusa","heading":"Where to find the logs","keywords":"medusa troubleshooting medusa logs medusa error medusa turbostack 502 bad gateway node.js postgresql reverse proxy","text":"Medusa runs as your own Node process, so its application output goes wherever your process manager writes it. The platform components have fixed locations:\n\n| Component | Where |\n| --- | --- |\n| Nginx access log (per vhost) | `/var/log/nginx/_.log` |\n| Nginx error log | `/var/log/nginx/error.log` (proxy/502 errors land here) |\n| Medusa application log | wherever your process manager directs stdout/stderr (for example the systemd journal via `journalctl -u `, or PM2 logs) |\n| PostgreSQL | the PostgreSQL service log on the host |\n| Host metrics & service status | the host's Health tab |\n| Recent deploys | History |\n\n> [!TIP]\n> A 502 is almost always logged in `/var/log/nginx/error.log` with a \"connect() failed\" or \"upstream prematurely closed\" message naming the upstream port. That tells you immediately whether Nginx reached your Node process."} {"id":"applications/medusa/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/medusa/troubleshooting/#common-issues","path":"applications/medusa/troubleshooting.md","title":"Troubleshooting Medusa","heading":"Common issues","keywords":"medusa troubleshooting medusa logs medusa error medusa turbostack 502 bad gateway node.js postgresql reverse proxy","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| **502 Bad Gateway** | The Node process is not running, or not listening on `proxy_upstream_port` | Start the process; confirm it listens on the configured port (`ss -ltnp | grep `); ensure `proxy_upstream_port` matches the port the app binds to |\n| **502 only after a deploy / under load** | Process crashed on startup or is crash-looping | Read the application log for the stack trace; verify the build succeeded and env vars are set; run the process under a supervisor so it restarts |\n| **App starts then exits immediately** | Missing or wrong environment variables (database URL, JWT/cookie secrets, Redis URL) | Set the required env vars for the process; restart after correcting them |\n| **Database errors / \"connection refused\"** | Wrong PostgreSQL connection string, or pool exhausted | Verify the database URL, credentials, and that PostgreSQL is running; reduce pool size if connections are exhausted across server and worker |\n| **\"relation does not exist\" / schema errors** | Migrations not run for the deployed version | Run `medusa db:migrate` before starting the new code |\n| **Admin dashboard blank or 404** | The app was not built, or the wrong vhost/port serves the admin | Run `medusa build`; confirm the storefront and backend/admin use the correct separate ports and vhosts |\n| **Events/jobs not firing** | Redis not configured, or no worker process running | Point Medusa at Redis and run a worker-mode process for background jobs |"} {"id":"applications/medusa/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/medusa/troubleshooting/#a-troubleshooting-workflow","path":"applications/medusa/troubleshooting.md","title":"Troubleshooting Medusa","heading":"A troubleshooting workflow","keywords":"medusa troubleshooting medusa logs medusa error medusa turbostack 502 bad gateway node.js postgresql reverse proxy","text":"1. **Check Health** - confirm the host has CPU, memory, and disk headroom, and that core services are up.\n2. **Read the relevant log** - for a 502, start with `/var/log/nginx/error.log`. For app crashes, read the Medusa application log (your process manager's output). For database errors, check the PostgreSQL log.\n3. **Check the last deploy in History** - if a recent change broke the app, revert or re-publish the previous configuration (Publishing).\n4. **Verify services are running** - confirm the Node process is alive and listening on `proxy_upstream_port`, and that PostgreSQL (and Redis, if used) are running. Restart whatever is down via your process manager or the host's Services tab."} {"id":"applications/medusa/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/medusa/troubleshooting/#getting-help","path":"applications/medusa/troubleshooting.md","title":"Troubleshooting Medusa","heading":"Getting help","keywords":"medusa troubleshooting medusa logs medusa error medusa turbostack 502 bad gateway node.js postgresql reverse proxy","text":"If you are stuck after working through the steps above, see the general Troubleshooting guide and reach out via Support. Include the failing domain, the Nginx and application log excerpts, and what changed in the last deploy."} {"id":"applications/medusa/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/medusa/troubleshooting/#related","path":"applications/medusa/troubleshooting.md","title":"Troubleshooting Medusa","heading":"Related","keywords":"medusa troubleshooting medusa logs medusa error medusa turbostack 502 bad gateway node.js postgresql reverse proxy","text":"- Deploy Medusa\n- Medusa best practices\n- Health\n- Support"} {"id":"applications/nextcloud/best-practices.md#intro","url":"https://docs.turbostack.app/applications/nextcloud/best-practices/","path":"applications/nextcloud/best-practices.md","title":"Nextcloud best practices","heading":"","keywords":"nextcloud performance nextcloud optimization nextcloud caching nextcloud turbostack Redis file locking nextcloud cron occ large file uploads","text":"# Nextcloud best practices\n\nReliable Nextcloud performance depends on the right cache layers, a tuned PHP runtime, and healthy background jobs. On TurboStack, most of this is configured when you deploy a `nextcloud` app, so your main effort is keeping caching healthy and following Nextcloud's own production guidance. This page covers what the platform configures and the optimizations to layer on top."} {"id":"applications/nextcloud/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/nextcloud/best-practices/#what-turbostack-configures-for-you","path":"applications/nextcloud/best-practices.md","title":"Nextcloud best practices","heading":"What TurboStack configures for you","keywords":"nextcloud performance nextcloud optimization nextcloud caching nextcloud turbostack Redis file locking nextcloud cron occ large file uploads","text":"When you deploy Nextcloud, TurboStack provisions a working, production-shaped stack:\n\n- **Nginx vhost tuned for Nextcloud** - the document root is set to `public_html`. Standard Nextcloud rewrites and `location` blocks are in place: front-controller routing through `index.php`, `.well-known` redirects for CalDAV/CardDAV (calendar and contacts), and `deny` rules for `data`, `config`, `lib`, `3rdparty`, `occ`, and similar paths. Security headers are added, `X-Powered-By` is hidden, and static assets are served with long-lived `Cache-Control`.\n- **PHP-FPM backend per site** - PHP requests are passed to a dedicated FastCGI pool, with `fastcgi_request_buffering off` and `HTTPS on` set so large uploads and DAV requests behave correctly. DAV is short for Distributed Authoring and Versioning, the WebDAV protocol behind CalDAV and CardDAV.\n- **Redis (required)** - installed and configured in `config.php` over a unix socket (`/var/run/redis/redis.sock`). It is configured for transactional file locking (`memcache.locking = \\OC\\Memcache\\Redis`), with APCu (`memcache.local = \\OC\\Memcache\\APCu`) as the local memory cache.\n- **config.php essentials** - `trusted_domains` is populated with your server name, FQDN, and host IP. `overwrite.cli.url`, `mysql.utf8mb4`, and the `production` updater channel are set via `occ config:system:set`.\n- **Database** - a dedicated MySQL/MariaDB (or PostgreSQL) database and user are created and Nextcloud is installed against it with `occ maintenance:install`.\n- **Transport Layer Security (TLS) and large uploads** - TLS is provisioned (Let's Encrypt or your own certificate). The upload ceiling is driven by `nextcloud_max_upload_size` (default `512m`), which also sets the PHP and web-server limits.\n- **Hardened data permissions** - the data directory is created outside the web root, owned by the system user, with directories at `0750` and files at `0640`."} {"id":"applications/nextcloud/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/nextcloud/best-practices/#recommended-optimizations","path":"applications/nextcloud/best-practices.md","title":"Nextcloud best practices","heading":"Recommended optimizations","keywords":"nextcloud performance nextcloud optimization nextcloud caching nextcloud turbostack Redis file locking nextcloud cron occ large file uploads","text":"- **Keep Redis healthy** - Redis is mandatory for transactional file locking and the memory cache. Confirm it is running as a service and monitor its memory so locks do not revert to the database.\n- **Use system cron for background jobs** - set the background job mode to **Cron** (`occ background:job:mode cron`). A system scheduler then runs `cron.php` every 5 minutes, which is faster and more reliable than the AJAX (Asynchronous JavaScript and XML) or webcron modes (`nextcloud_background_cron`).\n- **OPcache** - the PHP runtime ships with OPcache; keep it enabled (with a generous `interned_strings_buffer` and `memory_consumption`) so compiled PHP is reused across requests.\n- **Add full-text search (optional)** - for large libraries, install the Full Text Search apps backed by Elasticsearch/OpenSearch so document search stays fast.\n- **Raise upload limits deliberately** - increase `nextcloud_max_upload_size` (and the matching PHP `upload_max_filesize`/`post_max_size`) when users sync large files; avoid setting it far higher than needed.\n- **Run \"Add missing indices\"** - after upgrades, run `occ db:add-missing-indices` and clear the admin overview warnings to keep queries efficient.\n- **Front media with a Content Delivery Network (CDN)** - serve static assets through an HTTP cache/CDN to cut origin load and improve global latency."} {"id":"applications/nextcloud/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/nextcloud/best-practices/#sizing-and-scaling","path":"applications/nextcloud/best-practices.md","title":"Nextcloud best practices","heading":"Sizing and scaling","keywords":"nextcloud performance nextcloud optimization nextcloud caching nextcloud turbostack Redis file locking nextcloud cron occ large file uploads","text":"Defaults are auto-tuned to the host, so do not pre-emptively raise them. Override sizing variables only with measured evidence (slow queries, cache evictions, swap):\n\n| Variable | Tune when |\n| --- | --- |\n| `mysql_innodb_size` | The MySQL working set no longer fits in the buffer pool |\n| `redis_memory` | Redis evicts keys or locking contention appears under load |\n| `elasticsearch_heap_size` | Full-text search is enabled and indexing pressures memory |\n\nSee Performance tuning for the full method: measure, change one variable, re-measure."} {"id":"applications/nextcloud/best-practices.md#stability","url":"https://docs.turbostack.app/applications/nextcloud/best-practices/#stability","path":"applications/nextcloud/best-practices.md","title":"Nextcloud best practices","heading":"Stability","keywords":"nextcloud performance nextcloud optimization nextcloud caching nextcloud turbostack Redis file locking nextcloud cron occ large file uploads","text":"- **Back up regularly** - keep automated Backups of the database and the data directory; test a restore before you need one.\n- **Watch the host** - monitor the Health tab for CPU, memory, disk, and service alerts. A full data disk takes Nextcloud offline.\n- **Stay current** - keep Nextcloud, its apps and the PHP runtime on supported versions; apply upgrades through the built-in updater (pinned to the `production` channel) during quiet windows.\n- **Test on a staging clone** - validate major upgrades and app changes on a copy of the host before touching production."} {"id":"applications/nextcloud/best-practices.md#related","url":"https://docs.turbostack.app/applications/nextcloud/best-practices/#related","path":"applications/nextcloud/best-practices.md","title":"Nextcloud best practices","heading":"Related","keywords":"nextcloud performance nextcloud optimization nextcloud caching nextcloud turbostack Redis file locking nextcloud cron occ large file uploads","text":"- Deploy Nextcloud\n- Troubleshooting Nextcloud\n- Services\n- Performance tuning"} {"id":"applications/nextcloud/deploy.md#intro","url":"https://docs.turbostack.app/applications/nextcloud/deploy/","path":"applications/nextcloud/deploy.md","title":"Deploy Nextcloud on TurboStack","heading":"","keywords":"deploy nextcloud nextcloud hosting nextcloud turbostack self-hosted file sync Redis file locking php 8.4 postgresql large uploads","text":"# Deploy Nextcloud on TurboStack\n\nNextcloud is a self-hosted platform for file sync, sharing, and collaboration. TurboStack provisions the runtime and services, can auto-install Nextcloud, and handles large upload limits without extra configuration."} {"id":"applications/nextcloud/deploy.md#requirements","url":"https://docs.turbostack.app/applications/nextcloud/deploy/#requirements","path":"applications/nextcloud/deploy.md","title":"Deploy Nextcloud on TurboStack","heading":"Requirements","keywords":"deploy nextcloud nextcloud hosting nextcloud turbostack self-hosted file sync Redis file locking php 8.4 postgresql large uploads","text":"| Requirement | Recommended |\n| --- | --- |\n| App type | `nextcloud` |\n| Runtime | PHP 8.4 |\n| Database | MySQL 8.4 or PostgreSQL |\n| Cache | Redis (**required** for transactional file locking and cache) |\n| Web server | Nginx or apache2 |\n\n> [!NOTE]\n> Redis is required, not optional. Nextcloud uses it for transactional file locking, so concurrent edits stay consistent."} {"id":"applications/nextcloud/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/nextcloud/deploy/#configure-it","path":"applications/nextcloud/deploy.md","title":"Deploy Nextcloud on TurboStack","heading":"Configure it","keywords":"deploy nextcloud nextcloud hosting nextcloud turbostack self-hosted file sync Redis file locking php 8.4 postgresql large uploads","text":"1. Open your host and go to the Applications tab.\n2. Select **Add app or database** and set **App Type** to `nextcloud`.\n3. Choose PHP 8.4 as the runtime and set the server name for your cloud.\n4. Enable a database (MySQL or PostgreSQL) and enable Redis.\n5. Publish the host to apply the configuration."} {"id":"applications/nextcloud/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/nextcloud/deploy/#example-configuration","path":"applications/nextcloud/deploy.md","title":"Deploy Nextcloud on TurboStack","heading":"Example configuration","keywords":"deploy nextcloud nextcloud hosting nextcloud turbostack self-hosted file sync Redis file locking php 8.4 postgresql large uploads","text":"```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # or: postgresql_version: \"17\"\nredis_enabled: true # REQUIRED: transactional file locking + cache\nsystem_users:\n - username: prod\n vhosts:\n - server_name: cloud.example.com\n app_type: nextcloud\n php_version: \"8.4\"\n cert_type: letsencrypt\n```\n\n> [!TIP]\n> Prefer PostgreSQL? Replace `mysql_version` with `postgresql_version: \"17\"` to provision PostgreSQL as the Nextcloud database instead."} {"id":"applications/nextcloud/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/nextcloud/deploy/#why-these-choices","path":"applications/nextcloud/deploy.md","title":"Deploy Nextcloud on TurboStack","heading":"Why these choices","keywords":"deploy nextcloud nextcloud hosting nextcloud turbostack self-hosted file sync Redis file locking php 8.4 postgresql large uploads","text":"- `app_type: nextcloud` applies the Nextcloud runtime profile and can auto-install the application.\n- Redis is mandatory for transactional file locking and caching under concurrent use.\n- MySQL 8.4 is a solid default; `postgresql_version` is a fully supported alternative.\n- Nginx (or apache2) plus PHP 8.4 matches Nextcloud's recommended stack and large upload handling.\n- Let's Encrypt provides automatic Transport Layer Security (TLS) for the cloud hostname."} {"id":"applications/nextcloud/deploy.md#related","url":"https://docs.turbostack.app/applications/nextcloud/deploy/#related","path":"applications/nextcloud/deploy.md","title":"Deploy Nextcloud on TurboStack","heading":"Related","keywords":"deploy nextcloud nextcloud hosting nextcloud turbostack self-hosted file sync Redis file locking php 8.4 postgresql large uploads","text":"- Technologies used: PHP, MySQL, Redis.\n\n- Best practices - performance & stability.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications (host tab)\n- The Source (YAML) view"} {"id":"applications/nextcloud/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/nextcloud/troubleshooting/","path":"applications/nextcloud/troubleshooting.md","title":"Troubleshooting Nextcloud","heading":"","keywords":"nextcloud troubleshooting nextcloud logs nextcloud error nextcloud turbostack trusted_domains maintenance mode occ nextcloud.log","text":"# Troubleshooting Nextcloud\n\nWhen Nextcloud is not working correctly, the cause is usually one of a few things. Common causes include a hostname not in `trusted_domains`, background jobs not running, Redis or the database being unreachable, upload limits too low, or a half-finished upgrade. This page shows where to look and how to work through a problem methodically. Most fixes use the `occ` command, run as the system user from the `public_html` directory."} {"id":"applications/nextcloud/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/nextcloud/troubleshooting/#where-to-find-the-logs","path":"applications/nextcloud/troubleshooting.md","title":"Troubleshooting Nextcloud","heading":"Where to find the logs","keywords":"nextcloud troubleshooting nextcloud logs nextcloud error nextcloud turbostack trusted_domains maintenance mode occ nextcloud.log","text":"| Component | Where |\n| --- | --- |\n| Nextcloud application log | `data/nextcloud.log` inside the data directory (`/var/www//.../data/nextcloud.log`); also visible under **Administration settings > Logging** |\n| Nginx access/error log | the host's web-server logs under the system user's home, e.g. `/var/www//logs/` |\n| PHP-FPM log | the PHP-FPM pool/error log for the site's runtime |\n| Database | the MySQL/MariaDB or PostgreSQL service log |\n| config.php | `/var/www//.../public_html/config/config.php` - inspect with `occ config:list system`, do not hand-edit while online |\n\nAlso use the host's Health tab for service status and resource alerts, and review recent deploys in History.\n\n> [!TIP]\n> Raise the log level temporarily with `occ log:manage --level debug`, reproduce the issue, then set it back to `warning` so the log stays readable."} {"id":"applications/nextcloud/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/nextcloud/troubleshooting/#common-issues","path":"applications/nextcloud/troubleshooting.md","title":"Troubleshooting Nextcloud","heading":"Common issues","keywords":"nextcloud troubleshooting nextcloud logs nextcloud error nextcloud turbostack trusted_domains maintenance mode occ nextcloud.log","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| \"Access through untrusted domain\" when opening the site | The hostname is not in `trusted_domains` | Add it: `occ config:system:set trusted_domains --value=cloud.example.com`. Behind a proxy/Content Delivery Network (CDN), also set `trusted_proxies` and `overwrite.cli.url`. |\n| Admin warns \"last background job ran long ago\" | Background jobs not running via system cron | Set cron mode: `occ background:job:mode cron` and ensure the system scheduler runs `cron.php` every 5 minutes (`nextcloud_background_cron`). |\n| Site shows \"maintenance mode\" and stays there | Maintenance flag left on after an upgrade/backup | Turn it off: `occ maintenance:mode --off`. If an upgrade was interrupted, run `occ upgrade` then turn it off. |\n| File locking errors / \"files locked\" | Redis unreachable, so transactional locking fails | Confirm Redis is running as a service and reachable on its socket; verify `memcache.locking` in config. As a last resort clear stale locks in the `oc_file_locks` table. |\n| Large files fail to upload / time out | Upload limits or proxy buffering too low | Raise `nextcloud_max_upload_size` and the PHP `upload_max_filesize`/`post_max_size`; ensure `fastcgi_request_buffering off` and a long `fastcgi_read_timeout`. |\n| Admin overview shows \"missing indices\" or pending migrations | Schema changes from an upgrade not applied | Run `occ db:add-missing-indices` (and `occ db:add-missing-columns`); for a stalled upgrade run `occ upgrade`. |\n| 403/permission errors writing files | Data directory ownership/permissions wrong | Ensure the data dir is owned by the system user with directories `0750` and files `0640`, and lives outside the web root. |"} {"id":"applications/nextcloud/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/nextcloud/troubleshooting/#a-troubleshooting-workflow","path":"applications/nextcloud/troubleshooting.md","title":"Troubleshooting Nextcloud","heading":"A troubleshooting workflow","keywords":"nextcloud troubleshooting nextcloud logs nextcloud error nextcloud turbostack trusted_domains maintenance mode occ nextcloud.log","text":"1. **Check Health** - confirm the host is up and not out of CPU, memory or disk; a full data disk is a common, silent cause of failures.\n2. **Read the relevant log** - start with `data/nextcloud.log` (or the admin Logging view), then the Nginx error log and PHP-FPM log for the failing request.\n3. **Check the last deploy** - review History; if a recent change broke the site, revert and re-publish the previous working revision.\n4. **Verify services are running** - confirm PHP-FPM, the database and Redis are up on the Services tab, since Nextcloud needs all three.\n\n> [!WARNING]\n> Always run `occ` as the system user (not root) from the `public_html` directory. Running it as root corrupts file ownership and can break the installation."} {"id":"applications/nextcloud/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/nextcloud/troubleshooting/#getting-help","path":"applications/nextcloud/troubleshooting.md","title":"Troubleshooting Nextcloud","heading":"Getting help","keywords":"nextcloud troubleshooting nextcloud logs nextcloud error nextcloud turbostack trusted_domains maintenance mode occ nextcloud.log","text":"If you are stuck after working through the steps above, see the general platform troubleshooting guide. You can also contact Support with the relevant log excerpts and the time the issue occurred."} {"id":"applications/nextcloud/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/nextcloud/troubleshooting/#related","path":"applications/nextcloud/troubleshooting.md","title":"Troubleshooting Nextcloud","heading":"Related","keywords":"nextcloud troubleshooting nextcloud logs nextcloud error nextcloud turbostack trusted_domains maintenance mode occ nextcloud.log","text":"- Deploy Nextcloud\n- Nextcloud best practices\n- Health\n- Support"} {"id":"applications/nopcommerce/best-practices.md#intro","url":"https://docs.turbostack.app/applications/nopcommerce/best-practices/","path":"applications/nopcommerce/best-practices.md","title":"nopCommerce best practices","heading":"","keywords":"nopcommerce performance nopcommerce optimization nopcommerce caching nopcommerce turbostack dotnet microsoft sql server mssql nginx reverse proxy Redis","text":"# nopCommerce best practices\n\nnopCommerce is a .NET e-commerce platform that runs as its own long-lived process behind Nginx, rather than under PHP-FPM. A fast, stable store depends on the .NET service staying up, a healthy SQL Server connection, and the right caching and asset settings. TurboStack provisions the process management and reverse proxy for you; this page covers what is already configured and which settings to adjust."} {"id":"applications/nopcommerce/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/nopcommerce/best-practices/#what-turbostack-configures-for-you","path":"applications/nopcommerce/best-practices.md","title":"nopCommerce best practices","heading":"What TurboStack configures for you","keywords":"nopcommerce performance nopcommerce optimization nopcommerce caching nopcommerce turbostack dotnet microsoft sql server mssql nginx reverse proxy Redis","text":"When you deploy a `nopcommerce` app, the platform sets up a managed .NET stack:\n\n- **Managed application service** - nopCommerce runs as a systemd user service (`application.service`, or `-application.service` when you name the app) under your system user. It launches `dotnet Nop.Web.dll` from the `application/` directory in your app root.\n- **Automatic restarts** - the service is configured with `Restart=always` (`RestartSec=10s`), so the storefront restarts automatically after a crash or a host reboot.\n- **Nginx reverse proxy** - a nopCommerce-specific vhost (`50main.conf`) proxies all traffic to the .NET process via a per-app upstream (`dotnet_`). It uses HTTP/1.1 with keep-alive for low-latency proxying.\n- **Correct proxy headers** - the vhost forwards `X-Forwarded-Host`, `X-Forwarded-For`, `X-Forwarded-Proto`, and `X-Real-IP`. The service sets `ASPNETCORE_FORWARDEDHEADERS_ENABLED=true` so nopCommerce sees the real client IP and scheme, which is required for correct HTTPS links and security.\n- **Microsoft SQL Server** - nopCommerce stores its data in SQL Server (`mssql_version`); the connection lives in `App_Data/dataSettings.json` inside the application directory.\n- **Environment file** - runtime settings are read from a per-app `conf/.env` file, and the .NET runtime version is pinned with `dotnet_version`."} {"id":"applications/nopcommerce/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/nopcommerce/best-practices/#recommended-optimizations","path":"applications/nopcommerce/best-practices.md","title":"nopCommerce best practices","heading":"Recommended optimizations","keywords":"nopcommerce performance nopcommerce optimization nopcommerce caching nopcommerce turbostack dotnet microsoft sql server mssql nginx reverse proxy Redis","text":"Combine nopCommerce's vendor guidance with the TurboStack options below. Most service toggles live on the host's Services tab.\n\n- **Run in production** - publish a Release build and run with `ASPNETCORE_ENVIRONMENT=Production`. Production disables developer diagnostics and is significantly faster than Development.\n- **Enable bundling and minification** - turn on JS/CSS bundling and minification in **Admin > Configuration > Settings > General settings** to cut request count and payload size.\n- **Use a distributed cache for scale** - for multi-instance or memory-pressured stores, point nopCommerce at Redis in `appsettings.json` instead of the default in-memory cache so cache state survives restarts.\n- **Optimize images and assets** - enable image resizing/caching, serve optimized (WebP) media, and keep `wwwroot` assets cache-friendly.\n- **Front static content with a Content Delivery Network (CDN)** - offload `/content`, `/images`, and theme assets to a CDN to reduce origin load and improve global latency.\n- **Keep the service warm** - nopCommerce has a cold start; the always-on service and automatic restarts already keep it warm, so avoid unnecessary restarts during peak hours.\n- **Let scheduled tasks run** - nopCommerce drives its own schedule tasks (queued emails, keep-alive, cleanup) from within the running app. Keep the service up and review **Admin > System > Schedule Tasks**.\n\n> [!NOTE]\n> Varnish and PHP OPcache do not apply to nopCommerce - it is a .NET application with its own internal caching, not a PHP app. Use nopCommerce's built-in caching (optionally backed by Redis) instead."} {"id":"applications/nopcommerce/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/nopcommerce/best-practices/#sizing-and-scaling","path":"applications/nopcommerce/best-practices.md","title":"nopCommerce best practices","heading":"Sizing and scaling","keywords":"nopcommerce performance nopcommerce optimization nopcommerce caching nopcommerce turbostack dotnet microsoft sql server mssql nginx reverse proxy Redis","text":"TurboStack auto-tunes resource limits from the host's size, so start with the defaults. Override tuning variables only with measured evidence (slow queries, high CPU, memory pressure):\n\n| Variable | Tune when |\n| --- | --- |\n| `redis_memory` | You enable Redis as the nopCommerce distributed cache and it evicts keys under load |\n| SQL Server memory | The database is the bottleneck on a large catalog or high order volume |\n\nBecause nopCommerce uses SQL Server rather than MySQL/Elasticsearch, the MySQL and search-engine tuning variables do not apply. See Performance tuning before changing anything. When a single host can no longer handle the load, scale it up before splitting services."} {"id":"applications/nopcommerce/best-practices.md#stability","url":"https://docs.turbostack.app/applications/nopcommerce/best-practices/#stability","path":"applications/nopcommerce/best-practices.md","title":"nopCommerce best practices","heading":"Stability","keywords":"nopcommerce performance nopcommerce optimization nopcommerce caching nopcommerce turbostack dotnet microsoft sql server mssql nginx reverse proxy Redis","text":"- **Back up regularly** - verify scheduled Backups cover the SQL Server database and the application's `App_Data/` directory.\n- **Watch Health** - monitor CPU, memory, and disk. Confirm the application service stays running.\n- **Keep versions current** - track nopCommerce releases and security patches, and keep your pinned `dotnet_version` and `mssql_version` on supported releases.\n- **Test on a staging clone** - always trial upgrades, plugins, and theme changes on a copy before publishing to production, since plugins recompile against the running runtime."} {"id":"applications/nopcommerce/best-practices.md#related","url":"https://docs.turbostack.app/applications/nopcommerce/best-practices/#related","path":"applications/nopcommerce/best-practices.md","title":"nopCommerce best practices","heading":"Related","keywords":"nopcommerce performance nopcommerce optimization nopcommerce caching nopcommerce turbostack dotnet microsoft sql server mssql nginx reverse proxy Redis","text":"- Deploy nopCommerce\n- Troubleshooting nopCommerce\n- How to manage user system services\n- Services\n- Performance tuning"} {"id":"applications/nopcommerce/deploy.md#intro","url":"https://docs.turbostack.app/applications/nopcommerce/deploy/","path":"applications/nopcommerce/deploy.md","title":"Deploy nopCommerce on TurboStack","heading":"","keywords":"nopcommerce dotnet .net microsoft sql server mssql nginx reverse proxy app_type nopcommerce turbostack","text":"# Deploy nopCommerce on TurboStack\n\nnopCommerce is an open-source e-commerce platform built on .NET. TurboStack runs nopCommerce as its own service behind an Nginx reverse proxy and connects it to Microsoft SQL Server. You only need to declare the application in your host YAML."} {"id":"applications/nopcommerce/deploy.md#requirements","url":"https://docs.turbostack.app/applications/nopcommerce/deploy/#requirements","path":"applications/nopcommerce/deploy.md","title":"Deploy nopCommerce on TurboStack","heading":"Requirements","keywords":"nopcommerce dotnet .net microsoft sql server mssql nginx reverse proxy app_type nopcommerce turbostack","text":"| Component | Value |\n| --- | --- |\n| App type | `nopcommerce` |\n| Runtime | .NET |\n| Database | Microsoft SQL Server |\n| Web server | Nginx (reverse proxy) |\n\n> [!NOTE]\n> nopCommerce uses Microsoft SQL Server, configured with `mssql_version`, rather than PostgreSQL or MySQL."} {"id":"applications/nopcommerce/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/nopcommerce/deploy/#configure-it","path":"applications/nopcommerce/deploy.md","title":"Deploy nopCommerce on TurboStack","heading":"Configure it","keywords":"nopcommerce dotnet .net microsoft sql server mssql nginx reverse proxy app_type nopcommerce turbostack","text":"1. Set `webserver: nginx` at the host level so TurboStack provisions the reverse proxy.\n2. Set `mssql_version` to the Microsoft SQL Server release nopCommerce should use (for example `\"2022\"`).\n3. Add a system user, then define a vhost with `app_type: nopcommerce`. TurboStack starts the service and proxies traffic to it.\n4. Set `dotnet_version` to pin the .NET runtime (for example `\"8.0\"`).\n5. Request a certificate with `cert_type: letsencrypt` for automatic HTTPS.\n\nSee Applications for the full list of supported app types and Publish for how to apply your host configuration."} {"id":"applications/nopcommerce/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/nopcommerce/deploy/#example-configuration","path":"applications/nopcommerce/deploy.md","title":"Deploy nopCommerce on TurboStack","heading":"Example configuration","keywords":"nopcommerce dotnet .net microsoft sql server mssql nginx reverse proxy app_type nopcommerce turbostack","text":"```yaml\nwebserver: nginx\nmssql_version: \"2022\" # nopCommerce uses Microsoft SQL Server\nsystem_users:\n - username: prod\n vhosts:\n - server_name: shop.example.com\n app_type: nopcommerce\n dotnet_version: \"8.0\" # .NET runtime version\n cert_type: letsencrypt\n```"} {"id":"applications/nopcommerce/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/nopcommerce/deploy/#why-these-choices","path":"applications/nopcommerce/deploy.md","title":"Deploy nopCommerce on TurboStack","heading":"Why these choices","keywords":"nopcommerce dotnet .net microsoft sql server mssql nginx reverse proxy app_type nopcommerce turbostack","text":"- `app_type: nopcommerce` tells TurboStack to run the nopCommerce service and configure the Nginx reverse proxy for it.\n- `mssql_version` is required because nopCommerce stores its data in Microsoft SQL Server.\n- `dotnet_version` pins the .NET runtime the application runs on.\n- `webserver: nginx` provides the reverse proxy layer that fronts the .NET process.\n- `cert_type: letsencrypt` issues and renews Transport Layer Security (TLS) certificates without manual steps."} {"id":"applications/nopcommerce/deploy.md#related","url":"https://docs.turbostack.app/applications/nopcommerce/deploy/#related","path":"applications/nopcommerce/deploy.md","title":"Deploy nopCommerce on TurboStack","heading":"Related","keywords":"nopcommerce dotnet .net microsoft sql server mssql nginx reverse proxy app_type nopcommerce turbostack","text":"- Technologies used: .NET, Microsoft SQL Server.\n\n- Best practices - performance & stability.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications\n- The Source (YAML) view"} {"id":"applications/nopcommerce/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/nopcommerce/troubleshooting/","path":"applications/nopcommerce/troubleshooting.md","title":"Troubleshooting nopCommerce","heading":"","keywords":"nopcommerce troubleshooting nopcommerce logs nopcommerce error nopcommerce turbostack nginx 502 dotnet service mssql connection datasettings.json","text":"# Troubleshooting nopCommerce\n\nnopCommerce runs as a .NET service behind nginx. Most problems fall into one of three categories: the application service is not running, Nginx cannot reach it (502), or it cannot connect to SQL Server. This page shows where the logs are and how to work through the common failures."} {"id":"applications/nopcommerce/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/nopcommerce/troubleshooting/#where-to-find-the-logs","path":"applications/nopcommerce/troubleshooting.md","title":"Troubleshooting nopCommerce","heading":"Where to find the logs","keywords":"nopcommerce troubleshooting nopcommerce logs nopcommerce error nopcommerce turbostack nginx 502 dotnet service mssql connection datasettings.json","text":"nopCommerce is a managed systemd **user** service, so its console output goes to the journal rather than a flat file. Combine the journal with Nginx logs and the application's own logging.\n\n| Component | Where |\n| --- | --- |\n| Application (.NET) | `journalctl --user -u application.service` (or `-application.service`) - startup errors, crashes, stack traces |\n| Service status | `systemctl --user status application.service` |\n| Nginx access/error | The host's web server logs (Health tab, or under `/var/log/nginx/`) - proxy and 502 errors |\n| nopCommerce log | **Admin > System > Log** (stored in SQL Server); plugin/runtime files under the app's `App_Data/Logs/` |\n| Database connection | `App_Data/dataSettings.json` in the application directory (connection string, provider) |\n| Environment | `conf/.env` in the app root (runtime environment variables) |\n\nAlso check the host's Health tab for CPU/memory/disk and service state, and recent deploys in History.\n\n> [!TIP]\n> Add `-f` to the journal command (`journalctl --user -u application.service -f`) to watch logs live while you reproduce a problem or restart the service."} {"id":"applications/nopcommerce/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/nopcommerce/troubleshooting/#common-issues","path":"applications/nopcommerce/troubleshooting.md","title":"Troubleshooting nopCommerce","heading":"Common issues","keywords":"nopcommerce troubleshooting nopcommerce logs nopcommerce error nopcommerce turbostack nginx 502 dotnet service mssql connection datasettings.json","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| Site down, Nginx returns 502 | The .NET application service is not running or not listening | `systemctl --user status application.service`; start/restart it and read the journal for the startup error |\n| Service won't start, \"framework not found\" | `dotnet_version` does not match the build's target framework | Pin the correct `dotnet_version` and re-publish (Publishing) |\n| \"Cannot connect to database\" / install screen reappears | Wrong or missing `App_Data/dataSettings.json`, SQL Server down, or bad credentials | Verify `dataSettings.json`, confirm the SQL Server service is reachable, and check the connection string |\n| Plugins or theme changes don't appear | Plugins need to recompile and the app must reload | Restart the service so plugins compile against the runtime; clear the plugin cache if needed |\n| Errors writing config/logs, install fails | `App_Data/` is not writable by the system user | Fix ownership/permissions on `App_Data/` so the system user can write |\n| Scheduled tasks not running (emails stuck) | App not reachable or the task is disabled | Keep the service up; review and enable tasks in **Admin > System > Schedule Tasks** |\n| Wrong scheme in links / HTTPS redirect loop | Forwarded headers not honored | The vhost forwards `X-Forwarded-Proto` and the service sets `ASPNETCORE_FORWARDEDHEADERS_ENABLED=true`; re-publish if the vhost was edited by hand |"} {"id":"applications/nopcommerce/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/nopcommerce/troubleshooting/#a-troubleshooting-workflow","path":"applications/nopcommerce/troubleshooting.md","title":"Troubleshooting nopCommerce","heading":"A troubleshooting workflow","keywords":"nopcommerce troubleshooting nopcommerce logs nopcommerce error nopcommerce turbostack nginx 502 dotnet service mssql connection datasettings.json","text":"1. **Check Health** - confirm the host is up and the application service is running, and look for CPU/memory/disk pressure.\n2. **Read the relevant log** - start with `journalctl --user -u application.service` for a 502 or a crash. Check the Nginx error log if the journal shows the app is healthy. Check **Admin > System > Log** for application-level errors.\n3. **Check the last deploy in History** - if a recent change broke the store, revert and re-publish from Publishing.\n4. **Verify services are running** - confirm the nopCommerce service is active (`systemctl --user status application.service`), Nginx is up, and SQL Server is reachable. Restart any service that is down."} {"id":"applications/nopcommerce/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/nopcommerce/troubleshooting/#getting-help","path":"applications/nopcommerce/troubleshooting.md","title":"Troubleshooting nopCommerce","heading":"Getting help","keywords":"nopcommerce troubleshooting nopcommerce logs nopcommerce error nopcommerce turbostack nginx 502 dotnet service mssql connection datasettings.json","text":"If you are still stuck, see the general platform troubleshooting guide or contact Support with the relevant journal and Nginx log excerpts."} {"id":"applications/nopcommerce/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/nopcommerce/troubleshooting/#related","path":"applications/nopcommerce/troubleshooting.md","title":"Troubleshooting nopCommerce","heading":"Related","keywords":"nopcommerce troubleshooting nopcommerce logs nopcommerce error nopcommerce turbostack nginx 502 dotnet service mssql connection datasettings.json","text":"- Deploy nopCommerce\n- nopCommerce best practices\n- Health\n- Support"} {"id":"applications/odoo/addons.md#intro","url":"https://docs.turbostack.app/applications/odoo/addons/","path":"applications/odoo/addons.md","title":"How to install and upgrade Odoo add-ons","heading":"","keywords":"odoo addons odoo modules install odoo module upgrade odoo module odoo-bin custom addons staging server __manifest__.py","text":"# How to install and upgrade Odoo add-ons"} {"id":"applications/odoo/addons.md#overview","url":"https://docs.turbostack.app/applications/odoo/addons/#overview","path":"applications/odoo/addons.md","title":"How to install and upgrade Odoo add-ons","heading":"Overview","keywords":"odoo addons odoo modules install odoo module upgrade odoo module odoo-bin custom addons staging server __manifest__.py","text":"Upgrade or install Odoo modules using command-line tools. TurboStack servers provide optimal system configurations, but managing Odoo itself remains your responsibility. For the file layout and service details, see Odoo reference.\n\n> [!IMPORTANT]\n> To safely test new modules or updates, use a separate staging server. Do not run staging environments locally on the same production host.\n>\n> Why separate servers?\n>\n> - Prevents production disruption.\n> - Isolates tests and experiments.\n> - Maintains better performance and security.\n>\n> TurboStack offers affordable and optimized staging environments. Contact support to request a staging clone of your production Odoo."} {"id":"applications/odoo/addons.md#upgrade-an-add-on","url":"https://docs.turbostack.app/applications/odoo/addons/#upgrade-an-add-on","path":"applications/odoo/addons.md","title":"How to install and upgrade Odoo add-ons","heading":"Upgrade an add-on","keywords":"odoo addons odoo modules install odoo module upgrade odoo module odoo-bin custom addons staging server __manifest__.py","text":"```bash\nsystemctl --user stop application.service\n~/application/odoo/odoo-bin -u -c ~/conf/odoo.conf --stop-after-init\nsystemctl --user start application.service\n```\n\nReplace `` with your actual add-on/module name."} {"id":"applications/odoo/addons.md#install-a-new-add-on","url":"https://docs.turbostack.app/applications/odoo/addons/#install-a-new-add-on","path":"applications/odoo/addons.md","title":"How to install and upgrade Odoo add-ons","heading":"Install a new add-on","keywords":"odoo addons odoo modules install odoo module upgrade odoo module odoo-bin custom addons staging server __manifest__.py","text":"\n\n1. Upload the module to `~/application/custom/`.\n2. Run:\n\n```bash\nsystemctl --user stop application.service\n~/application/odoo/odoo-bin -i -c ~/conf/odoo.conf --stop-after-init\nsystemctl --user start application.service\n```"} {"id":"applications/odoo/addons.md#notes","url":"https://docs.turbostack.app/applications/odoo/addons/#notes","path":"applications/odoo/addons.md","title":"How to install and upgrade Odoo add-ons","heading":"Notes","keywords":"odoo addons odoo modules install odoo module upgrade odoo module odoo-bin custom addons staging server __manifest__.py","text":"- Always stop the service before upgrades.\n- Make sure your add-on contains a valid `__manifest__.py` file.\n- Keep your structure modular by creating symbolic links inside `~/application/custom/` for large or custom add-on libraries, rather than copying whole trees in.\n- Always keep your `.env` and `odoo.conf` safe and backed up before changing modules, so you can restore a known-good configuration if an upgrade goes wrong."} {"id":"applications/odoo/addons.md#related","url":"https://docs.turbostack.app/applications/odoo/addons/#related","path":"applications/odoo/addons.md","title":"How to install and upgrade Odoo add-ons","heading":"Related","keywords":"odoo addons odoo modules install odoo module upgrade odoo module odoo-bin custom addons staging server __manifest__.py","text":"- Odoo reference\n- How to install Python dependencies for Odoo\n- Deploy Odoo on TurboStack\n- Odoo best practices\n- Troubleshooting Odoo\n- How to manage user system services\n- Connect over SSH"} {"id":"applications/odoo/best-practices.md#intro","url":"https://docs.turbostack.app/applications/odoo/best-practices/","path":"applications/odoo/best-practices.md","title":"Odoo best practices","heading":"","keywords":"odoo performance odoo optimization odoo caching odoo turbostack odoo workers odoo postgresql odoo proxy_mode odoo filestore","text":"# Odoo best practices\n\nOdoo is a Python ERP that runs as its own long-lived service behind an Nginx reverse proxy. Getting good, stable performance is mostly about right-sizing the worker pool, keeping PostgreSQL healthy, and letting Nginx serve static and filestore content. This page covers what TurboStack already configures for you and the optimizations worth applying on top."} {"id":"applications/odoo/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/odoo/best-practices/#what-turbostack-configures-for-you","path":"applications/odoo/best-practices.md","title":"Odoo best practices","heading":"What TurboStack configures for you","keywords":"odoo performance odoo optimization odoo caching odoo turbostack odoo workers odoo postgresql odoo proxy_mode odoo filestore","text":"When you set `app_type: odoo`, the platform provisions a complete, tuned Odoo stack:\n\n- **A dedicated systemd service** that launches `odoo-bin` from your pyenv-managed Python and restarts automatically on failure (`Restart=on-failure`).\n- **An Nginx reverse proxy** with `proxy_mode = True` set in Odoo, forwarding `X-Forwarded-*` and `X-Real-IP` headers so Odoo sees the correct client address and scheme.\n- **Multiprocess workers**, auto-calculated from the server's CPUs, plus `max_cron_threads = 2` for scheduled jobs.\n- **A separate websocket/longpolling endpoint** - Nginx routes `/websocket` (Odoo 16+) and `/longpolling` (Odoo 15 and earlier) to the gevent port (`8072` by default). Normal traffic goes to the main port (`8069`).\n- **Per-worker resource limits**: `limit_memory_soft` (2 GB), `limit_memory_hard` (4 GB), `limit_time_cpu` (3600 s), `limit_time_real` (7200 s) and `limit_request` (8192).\n- **Direct filestore delivery**: `x_sendfile = True` plus an Nginx `internal` `/web/filestore` location, so attachments are streamed by Nginx instead of through Python workers.\n- **A PostgreSQL connection** with a dedicated role and database, plus a generated `admin_passwd` for the database manager.\n- **A ready-made `odoo.conf.sample`** in your `conf/` directory with all of the above as a starting point.\n\n> [!NOTE]\n> An Odoo deployment uses PostgreSQL only. There is no PHP, no MySQL/MariaDB, and no Varnish layer."} {"id":"applications/odoo/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/odoo/best-practices/#recommended-optimizations","path":"applications/odoo/best-practices.md","title":"Odoo best practices","heading":"Recommended optimizations","keywords":"odoo performance odoo optimization odoo caching odoo turbostack odoo workers odoo postgresql odoo proxy_mode odoo filestore","text":"- **Tune the worker count to your workload.** The default scales with CPUs. Odoo's guideline is roughly `(2 x CPU) + 1` HTTP workers, or about one worker per 6 concurrent users - use the lower of the two. More workers serve more concurrent users but cost RAM - see Sizing and scaling.\n- **Keep filestore on disk, not in the database.** The platform already serves it via Nginx; avoid storing attachments in PostgreSQL, which bloats the database and backups.\n- **Run Odoo in production mode.** Do not enable `dev_mode` or `demo` data on a live site; the defaults already disable them (`without_demo = True`).\n- **Pre-compile and cache assets.** Let Odoo bundle and minify JS/CSS (the default), and serve them through Nginx with long cache headers.\n- **Right-size cron threads.** Heavy scheduled actions (mailings, accounting, inventory valuation) run under `max_cron_threads`; keep them modest so cron jobs do not starve HTTP workers.\n- **Tighten timeouts for long operations.** Imports and reports may need higher `limit_time_real`/`limit_time_cpu`; raise them deliberately rather than disabling them.\n- **Front it with HTTP caching/Content Delivery Network (CDN) where safe.** Static assets and public application pages cache well; never cache authenticated `/web` session traffic.\n- **Install Python dependencies in the virtual environment.** Use the project's pip, never system-wide: `pip install -r odoo/requirements.txt` for core, and `pip install -r custom-addons//requirements.txt` per add-on.\n- **Leave `db_maxconn` at its default (64).** The platform's PostgreSQL is tuned for high concurrency; raising it rarely helps and can exhaust connections.\n\nManage the Odoo and PostgreSQL services from the host Services tab."} {"id":"applications/odoo/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/odoo/best-practices/#sizing-and-scaling","path":"applications/odoo/best-practices.md","title":"Odoo best practices","heading":"Sizing and scaling","keywords":"odoo performance odoo optimization odoo caching odoo turbostack odoo workers odoo postgresql odoo proxy_mode odoo filestore","text":"The worker pool and memory limits are auto-tuned from the server's resources, and PostgreSQL is sized by the platform. Override defaults only with measured evidence:\n\n| Variable | Tune when |\n| --- | --- |\n| `workers` | CPUs are consistently busy and requests queue - but ensure RAM covers `workers × limit_memory_soft`. |\n| `limit_memory_soft` / `limit_memory_hard` | Workers are recycled too aggressively under legitimate load. |\n| PostgreSQL memory and connections | The database becomes the bottleneck rather than the app. |\n\n> [!TIP]\n> Each Odoo worker can consume up to ~2-4 GB. Add workers only if free memory comfortably absorbs the extra processes, or you risk swapping and Out Of Memory (OOM) kills.\n\nSee Performance tuning for the general approach to changing auto-tuned values."} {"id":"applications/odoo/best-practices.md#stability","url":"https://docs.turbostack.app/applications/odoo/best-practices/#stability","path":"applications/odoo/best-practices.md","title":"Odoo best practices","heading":"Stability","keywords":"odoo performance odoo optimization odoo caching odoo turbostack odoo workers odoo postgresql odoo proxy_mode odoo filestore","text":"- **Back up regularly.** Ensure both PostgreSQL and the filestore are covered - see Backups. A database backup without the matching filestore loses attachments.\n- **Watch the Health tab** for CPU, memory, and service status; rising memory or worker restarts are early warnings.\n- **Keep Odoo and modules current.** Apply security and point releases, and review third-party modules before upgrading major versions.\n- **Test on a staging clone.** Validate module installs/upgrades (`-u`) and configuration changes on a copy before touching production."} {"id":"applications/odoo/best-practices.md#related","url":"https://docs.turbostack.app/applications/odoo/best-practices/#related","path":"applications/odoo/best-practices.md","title":"Odoo best practices","heading":"Related","keywords":"odoo performance odoo optimization odoo caching odoo turbostack odoo workers odoo postgresql odoo proxy_mode odoo filestore","text":"- Deploy Odoo on TurboStack\n- Odoo reference\n- Troubleshooting Odoo\n- Services\n- Performance tuning"} {"id":"applications/odoo/deploy.md#intro","url":"https://docs.turbostack.app/applications/odoo/deploy/","path":"applications/odoo/deploy.md","title":"Deploy Odoo on TurboStack","heading":"","keywords":"odoo python erp postgresql nginx reverse proxy app_type odoo business apps turbostack letsencrypt","text":"# Deploy Odoo on TurboStack\n\nOdoo is a Python-based suite of open-source business applications covering enterprise resource planning (ERP), customer relationship management (CRM), accounting, inventory and e-commerce. TurboStack runs Odoo as its own service and places an Nginx reverse proxy in front of it, so you only have to declare the application in your host YAML."} {"id":"applications/odoo/deploy.md#requirements","url":"https://docs.turbostack.app/applications/odoo/deploy/#requirements","path":"applications/odoo/deploy.md","title":"Deploy Odoo on TurboStack","heading":"Requirements","keywords":"odoo python erp postgresql nginx reverse proxy app_type odoo business apps turbostack letsencrypt","text":"| Component | Value |\n| --- | --- |\n| App type | `odoo` |\n| Runtime | Python 3 (managed for you, no version key needed) |\n| Database | PostgreSQL |\n| Web server | Nginx (reverse proxy) |\n\n> [!NOTE]\n> Odoo requires PostgreSQL. There is no PHP and no Varnish in an Odoo deployment."} {"id":"applications/odoo/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/odoo/deploy/#configure-it","path":"applications/odoo/deploy.md","title":"Deploy Odoo on TurboStack","heading":"Configure it","keywords":"odoo python erp postgresql nginx reverse proxy app_type odoo business apps turbostack letsencrypt","text":"1. Set `webserver: nginx` at the host level so TurboStack provisions the reverse proxy.\n2. Set `postgresql_version` to the PostgreSQL release Odoo should use (for example `\"17\"`).\n3. Add a system user, then define a vhost with `app_type: odoo`. TurboStack starts the Odoo service and proxies traffic to it.\n4. Request a certificate with `cert_type: letsencrypt` for automatic HTTPS.\n5. (Optional) Override the Odoo ports under an `odoo:` block only if you do not use the defaults.\n\nSee Applications for the full list of supported app types and Publish for how to apply your host configuration."} {"id":"applications/odoo/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/odoo/deploy/#example-configuration","path":"applications/odoo/deploy.md","title":"Deploy Odoo on TurboStack","heading":"Example configuration","keywords":"odoo python erp postgresql nginx reverse proxy app_type odoo business apps turbostack letsencrypt","text":"```yaml\nwebserver: nginx\npostgresql_version: \"17\" # Odoo requires PostgreSQL\nsystem_users:\n - username: prod\n vhosts:\n - server_name: odoo.example.com\n app_type: odoo # TurboStack runs Odoo behind nginx for you\n cert_type: letsencrypt\n # Optional - only if you run Odoo on non-default ports:\n # odoo:\n # main_port: 8069\n # websocket_port: 8072\n```"} {"id":"applications/odoo/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/odoo/deploy/#why-these-choices","path":"applications/odoo/deploy.md","title":"Deploy Odoo on TurboStack","heading":"Why these choices","keywords":"odoo python erp postgresql nginx reverse proxy app_type odoo business apps turbostack letsencrypt","text":"- `app_type: odoo` tells TurboStack to run the Odoo service and configure the Nginx reverse proxy for it automatically.\n- `postgresql_version` is mandatory because Odoo stores all of its data in PostgreSQL.\n- `webserver: nginx` provides the reverse proxy layer that fronts the Odoo process.\n- `cert_type: letsencrypt` issues and renews Transport Layer Security (TLS) certificates without manual steps.\n- The `odoo.main_port` (default 8069) and `odoo.websocket_port` (default 8072) settings are advanced overrides; leave them out unless you have a specific reason to change the ports."} {"id":"applications/odoo/deploy.md#related","url":"https://docs.turbostack.app/applications/odoo/deploy/#related","path":"applications/odoo/deploy.md","title":"Deploy Odoo on TurboStack","heading":"Related","keywords":"odoo python erp postgresql nginx reverse proxy app_type odoo business apps turbostack letsencrypt","text":"- Technologies used: Python, PostgreSQL, Reverse proxy.\n\n- Best practices - performance & stability.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications\n- The Source (YAML) view"} {"id":"applications/odoo/python-requirements.md#intro","url":"https://docs.turbostack.app/applications/odoo/python-requirements/","path":"applications/odoo/python-requirements.md","title":"How to install Python dependencies for Odoo","heading":"","keywords":"odoo python dependencies pip install requirements.txt odoo custom module dependencies pyenv odoo pip odoo core requirements","text":"# How to install Python dependencies for Odoo\n\nInstall dependencies required by Odoo and your custom modules using `pip`. On TurboStack, Python is platform-managed through pyenv, and the `pip` on your `PATH` installs into the environment that runs Odoo. There is no virtual environment to create or activate by hand. For the file layout and service details, see Odoo reference."} {"id":"applications/odoo/python-requirements.md#odoo-core-requirements","url":"https://docs.turbostack.app/applications/odoo/python-requirements/#odoo-core-requirements","path":"applications/odoo/python-requirements.md","title":"How to install Python dependencies for Odoo","heading":"Odoo core requirements","keywords":"odoo python dependencies pip install requirements.txt odoo custom module dependencies pyenv odoo pip odoo core requirements","text":"```bash\ncd ~/application\npip install -r odoo/requirements.txt\n```"} {"id":"applications/odoo/python-requirements.md#custom-modules","url":"https://docs.turbostack.app/applications/odoo/python-requirements/#custom-modules","path":"applications/odoo/python-requirements.md","title":"How to install Python dependencies for Odoo","heading":"Custom modules","keywords":"odoo python dependencies pip install requirements.txt odoo custom module dependencies pyenv odoo pip odoo core requirements","text":"\n\nIf your custom modules include their own `requirements.txt`, install it:\n\n```bash\npip install -r ~/application/custom//requirements.txt\n```\n\nReplace `` with the module's directory name. Repeat for each module that has its own `requirements.txt`."} {"id":"applications/odoo/python-requirements.md#apply-the-changes","url":"https://docs.turbostack.app/applications/odoo/python-requirements/#apply-the-changes","path":"applications/odoo/python-requirements.md","title":"How to install Python dependencies for Odoo","heading":"Apply the changes","keywords":"odoo python dependencies pip install requirements.txt odoo custom module dependencies pyenv odoo pip odoo core requirements","text":"Restart Odoo so it loads the newly installed packages:\n\n```bash\nsystemctl --user restart application.service\n```"} {"id":"applications/odoo/python-requirements.md#best-practices","url":"https://docs.turbostack.app/applications/odoo/python-requirements/#best-practices","path":"applications/odoo/python-requirements.md","title":"How to install Python dependencies for Odoo","heading":"Best practices","keywords":"odoo python dependencies pip install requirements.txt odoo custom module dependencies pyenv odoo pip odoo core requirements","text":"\n\n- Use the `pip` that is already on your `PATH` (the pyenv-managed pip).\n- Avoid installing system-wide."} {"id":"applications/odoo/python-requirements.md#related","url":"https://docs.turbostack.app/applications/odoo/python-requirements/#related","path":"applications/odoo/python-requirements.md","title":"How to install Python dependencies for Odoo","heading":"Related","keywords":"odoo python dependencies pip install requirements.txt odoo custom module dependencies pyenv odoo pip odoo core requirements","text":"- How to install and upgrade Odoo add-ons\n- Odoo reference\n- Deploy Odoo on TurboStack\n- Odoo best practices\n- Troubleshooting Odoo\n- How to manage user system services\n- Connect over SSH"} {"id":"applications/odoo/reference.md#intro","url":"https://docs.turbostack.app/applications/odoo/reference/","path":"applications/odoo/reference.md","title":"Odoo reference","heading":"","keywords":"odoo reference odoo.conf odoo file layout odoo systemd service odoo ports odoo workers odoo configuration keys","text":"# Odoo reference\n\nReference for running Odoo on TurboStack: where the files live, how the service runs, the default ports, and the `odoo.conf` configuration keys. For setup see Deploy Odoo on TurboStack; for tuning see Odoo best practices."} {"id":"applications/odoo/reference.md#file-layout","url":"https://docs.turbostack.app/applications/odoo/reference/#file-layout","path":"applications/odoo/reference.md","title":"Odoo reference","heading":"File layout","keywords":"odoo reference odoo.conf odoo file layout odoo systemd service odoo ports odoo workers odoo configuration keys","text":"Everything lives under your system user's home directory. `~` is that home directory (for example `/var/www/prod/`).\n\n| Path | What it is |\n| --- | --- |\n| `~/application/odoo/` | Odoo source code and working directory |\n| `~/application/odoo/addons/` | Custom modules (add-ons) |\n| `~/conf/odoo.conf` | Main configuration file |\n| `~/conf/.env` | Environment variables |\n| `~/logs/odoo.log` | Application log |\n\nFor ownership and permissions, see Application file layout and permissions."} {"id":"applications/odoo/reference.md#the-odoo-service","url":"https://docs.turbostack.app/applications/odoo/reference/#the-odoo-service","path":"applications/odoo/reference.md","title":"Odoo reference","heading":"The Odoo service","keywords":"odoo reference odoo.conf odoo file layout odoo systemd service odoo ports odoo workers odoo configuration keys","text":"Odoo runs as a systemd user service, so it needs no root access. The unit lives at `~/.config/systemd/user/application.service`. It starts `odoo-bin` from your pyenv-managed Python and loads its environment from `~/conf/.env`:\n\n```ini\n[Unit]\nDescription=Odoo application (main) for %u\nWants=network-online.target\nAfter=network-online.target\nRequires=dbus.socket\nStartLimitIntervalSec=0\n\n[Service]\nLimitNOFILE=819200\nLimitNPROC=819200\nLimitMEMLOCK=infinity\n\nTimeoutStartSec=900\nType=simple\nWorkingDirectory=%h/application/odoo\nEnvironmentFile=%h/conf/.env\n\nExecStart=%h/.pyenv/shims/python %h/application/odoo/odoo-bin -c %h/conf/odoo.conf\nExecStop=/bin/kill -s TERM $MAINPID\nRestart=on-failure\nRestartSec=10s\nKillSignal=SIGQUIT\nStandardOutput=append:%h/logs/odoo.log\n\n[Install]\nWantedBy=default.target\n```\n\nThe high file-descriptor and process limits (`LimitNOFILE`, `LimitNPROC`, `LimitMEMLOCK`) keep Odoo from hitting kernel resource caps under load. `TimeoutStartSec=900` gives module upgrades enough time to finish before systemd considers the start failed. The service restarts on failure after 10 seconds and appends its output to `~/logs/odoo.log`. Manage it with `systemctl --user` - see How to manage user system services."} {"id":"applications/odoo/reference.md#default-ports","url":"https://docs.turbostack.app/applications/odoo/reference/#default-ports","path":"applications/odoo/reference.md","title":"Odoo reference","heading":"Default ports","keywords":"odoo reference odoo.conf odoo file layout odoo systemd service odoo ports odoo workers odoo configuration keys","text":"TurboStack fronts Odoo with an Nginx reverse proxy and sets these ports for you. They are advanced overrides; leave them at the defaults unless you have a specific reason to change them.\n\n| Key | Default | What it is |\n| --- | --- | --- |\n| `odoo.main_port` | `8069` | Main Hypertext Transfer Protocol (HTTP) port |\n| `odoo.websocket_port` | `8072` | Websocket / longpolling port |"} {"id":"applications/odoo/reference.md#configuration-keys","url":"https://docs.turbostack.app/applications/odoo/reference/#configuration-keys","path":"applications/odoo/reference.md","title":"Odoo reference","heading":"Configuration keys","keywords":"odoo reference odoo.conf odoo file layout odoo systemd service odoo ports odoo workers odoo configuration keys","text":"The `workers` count is derived from the server's vCPUs; the other limits are fixed platform defaults. This table is a scannable reference; for when and how to change each value, see Odoo best practices.\n\n| Key | Typical value | What it controls |\n| --- | --- | --- |\n| `workers` | About 3x the vCPU count | Number of Hypertext Transfer Protocol (HTTP) worker processes |\n| `max_cron_threads` | `2` | Threads reserved for scheduled (cron) jobs |\n| `limit_memory_soft` | Per-worker soft cap | Memory at which a worker is recycled after the current request |\n| `limit_memory_hard` | Per-worker hard cap | Memory at which a worker is killed immediately |\n| `limit_request` | `8192` | Requests a worker serves before it is recycled |\n| `limit_time_cpu` | `3600` | Central Processing Unit (CPU) seconds allowed per request |\n| `limit_time_real` | `7200` | Wall-clock seconds allowed per request |\n| `limit_time_real_cron` | `86400` | Wall-clock seconds per cron job (24 hours) |\n| `db_maxconn` | `64` | Maximum PostgreSQL connections per worker |\n| `proxy_mode` | `True` | Required behind the Nginx reverse proxy so Odoo trusts forwarded headers |"} {"id":"applications/odoo/reference.md#sizing-heuristics","url":"https://docs.turbostack.app/applications/odoo/reference/#sizing-heuristics","path":"applications/odoo/reference.md","title":"Odoo reference","heading":"Sizing heuristics","keywords":"odoo reference odoo.conf odoo file layout odoo systemd service odoo ports odoo workers odoo configuration keys","text":"When you do tune `odoo.conf` by hand, size the limits from the server's resources:\n\n- `limit_memory_hard` - about half of total RAM.\n- `limit_memory_soft` - about a quarter of total RAM.\n- `max_cron_threads` - about one third of the CPU cores (up to half in large setups).\n- `limit_time_real_cron` - `0` means unlimited; set it to `86400` (24 hours) to cap long cron jobs."} {"id":"applications/odoo/reference.md#tuning-by-server-size","url":"https://docs.turbostack.app/applications/odoo/reference/#tuning-by-server-size","path":"applications/odoo/reference.md","title":"Odoo reference","heading":"Tuning by server size","keywords":"odoo reference odoo.conf odoo file layout odoo systemd service odoo ports odoo workers odoo configuration keys","text":"Copy-pasteable starting points for two common server sizes. Adjust from the heuristics above and measure before changing further.\n\n8 GB RAM / 4 CPU cores:\n\n```ini\nworkers = 8\nlimit_memory_hard = 4294967296 ; 4 GB\nlimit_memory_soft = 2147483648 ; 2 GB\nlimit_request = 8192\nlimit_time_cpu = 3600\nlimit_time_real = 7200\nlimit_time_real_cron = 0\nmax_cron_threads = 2\nproxy_mode = True\n```\n\n48 GB RAM / 12 CPU cores:\n\n```ini\nworkers = 36\nlimit_memory_hard = 6442450944 ; 6 GB\nlimit_memory_soft = 4294967296 ; 4 GB\nlimit_request = 8192\nlimit_time_cpu = 3600\nlimit_time_real = 7200\nlimit_time_real_cron = 0\nmax_cron_threads = 4\nproxy_mode = True\n```"} {"id":"applications/odoo/reference.md#related","url":"https://docs.turbostack.app/applications/odoo/reference/#related","path":"applications/odoo/reference.md","title":"Odoo reference","heading":"Related","keywords":"odoo reference odoo.conf odoo file layout odoo systemd service odoo ports odoo workers odoo configuration keys","text":"- Deploy Odoo on TurboStack\n- Odoo best practices\n- Troubleshooting Odoo\n- Application file layout and permissions\n- How to manage user system services"} {"id":"applications/odoo/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/odoo/troubleshooting/","path":"applications/odoo/troubleshooting.md","title":"Troubleshooting Odoo","heading":"","keywords":"odoo troubleshooting odoo logs odoo error odoo turbostack odoo service not starting odoo postgresql odoo websocket odoo workers","text":"# Troubleshooting Odoo\n\nWhen Odoo is not working correctly, the cause is almost always in one of three places. These are the Odoo service itself, the Nginx reverse proxy in front of it, or the PostgreSQL database behind it. This page shows where the logs live and how to work through the most common issues."} {"id":"applications/odoo/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/odoo/troubleshooting/#where-to-find-the-logs","path":"applications/odoo/troubleshooting.md","title":"Troubleshooting Odoo","heading":"Where to find the logs","keywords":"odoo troubleshooting odoo logs odoo error odoo turbostack odoo service not starting odoo postgresql odoo websocket odoo workers","text":"Paths below use `` for the system user and `[app/]` for the optional `app_name` subfolder (omit it for a single Odoo on the account).\n\n| Component | Where |\n| --- | --- |\n| Odoo application log | `/var/www//[app/]logs/odoo.log` |\n| Odoo service (systemd) | `journalctl --user -u [app-]application.service` |\n| Odoo config in use | `/var/www//[app/]conf/odoo.conf` |\n| Nginx access/error | `/var/log/nginx/` (host-level access and error logs) |\n| PostgreSQL | system PostgreSQL log (e.g. `/var/log/postgresql/`) |\n\n> [!NOTE]\n> The Odoo service is a **systemd user service**, so use `systemctl --user` and `journalctl --user`. Its stdout is appended to `logs/odoo.log`, which is the first file to check.\n\nAlso use the host Health tab for live CPU/memory/service status, and review recent deploys in History to see whether a change coincided with the problem."} {"id":"applications/odoo/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/odoo/troubleshooting/#common-issues","path":"applications/odoo/troubleshooting.md","title":"Troubleshooting Odoo","heading":"Common issues","keywords":"odoo troubleshooting odoo logs odoo error odoo turbostack odoo service not starting odoo postgresql odoo websocket odoo workers","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| Service won't start | No real `odoo.conf` (only the `.sample`), bad `addons_path`, or Python/env error | Copy `odoo.conf.sample` to `odoo.conf`, verify `addons_path` points to existing folders, then check `journalctl --user` and `logs/odoo.log` for the traceback. |\n| \"database connection failed\" / role errors | PostgreSQL down, wrong `db_user`/`db_password`, or `db_host`/`db_port` mismatch | Confirm PostgreSQL is running on the Services tab; verify the role, database name (`_db`) and port `5432` in `odoo.conf`. |\n| 502 Bad Gateway from Nginx | Odoo process not listening on the main port (`8069`) | Check the service is running and started cleanly; confirm `xmlrpc_port`/`main_port` matches the Nginx upstream. |\n| Live chat / notifications don't update | Websocket traffic not reaching the gevent port (`8072`) | Ensure the `odoo.websocket_port` and Nginx `/websocket` (or `/longpolling` on Odoo 15 and earlier) routing are consistent; restart the service. |\n| Workers crash or restart under load | `limit_memory_soft`/`limit_memory_hard` exceeded, or too many workers for available RAM | Reduce `workers` or raise the memory limits with evidence; watch Health. See Best practices. |\n| Module changes don't take effect | Module not installed/upgraded | Restart with `-u ` (or `-u all`) once, on a staging clone first, then remove the flag. |\n| Attachments / images 404 | Filestore path or `x_sendfile` mismatch | Confirm `data_dir`/filestore folder exists and the Nginx `/web/filestore` location points to it. |"} {"id":"applications/odoo/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/odoo/troubleshooting/#a-troubleshooting-workflow","path":"applications/odoo/troubleshooting.md","title":"Troubleshooting Odoo","heading":"A troubleshooting workflow","keywords":"odoo troubleshooting odoo logs odoo error odoo turbostack odoo service not starting odoo postgresql odoo websocket odoo workers","text":"1. **Check Health** for CPU, memory, and whether the Odoo and PostgreSQL services are up.\n2. **Read the relevant log** - start with `logs/odoo.log` and `journalctl --user -u [app-]application.service`, then Nginx and PostgreSQL logs as needed.\n3. **Check the last deploy in History.** If a recent change broke things, revert and re-apply via Publish.\n4. **Verify services are running** from the host Services tab. Restart the Odoo service and PostgreSQL if needed."} {"id":"applications/odoo/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/odoo/troubleshooting/#getting-help","path":"applications/odoo/troubleshooting.md","title":"Troubleshooting Odoo","heading":"Getting help","keywords":"odoo troubleshooting odoo logs odoo error odoo turbostack odoo service not starting odoo postgresql odoo websocket odoo workers","text":"If you are still stuck, reach out via Support with the relevant log excerpts, and review the general Troubleshooting guide for platform-wide checks."} {"id":"applications/odoo/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/odoo/troubleshooting/#related","path":"applications/odoo/troubleshooting.md","title":"Troubleshooting Odoo","heading":"Related","keywords":"odoo troubleshooting odoo logs odoo error odoo turbostack odoo service not starting odoo postgresql odoo websocket odoo workers","text":"- Deploy Odoo on TurboStack\n- Odoo best practices\n- Health\n- Support"} {"id":"applications/orocommerce/best-practices.md#intro","url":"https://docs.turbostack.app/applications/orocommerce/best-practices/","path":"applications/orocommerce/best-practices.md","title":"OroCommerce best practices","heading":"","keywords":"orocommerce performance orocommerce optimization orocommerce caching orocommerce turbostack oro message queue RabbitMQ consumers symfony opcache Redis","text":"# OroCommerce best practices\n\nOroCommerce is a Symfony-based B2B commerce platform that depends heavily on caching, a message queue, and search indexing to perform well. This page covers the practices that keep an OroCommerce storefront fast and stable on TurboStack. OroCommerce is configuration-only: you bring your own code with Git deployment, and TurboStack provisions the runtime and services around it."} {"id":"applications/orocommerce/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/orocommerce/best-practices/#what-turbostack-configures-for-you","path":"applications/orocommerce/best-practices.md","title":"OroCommerce best practices","heading":"What TurboStack configures for you","keywords":"orocommerce performance orocommerce optimization orocommerce caching orocommerce turbostack oro message queue RabbitMQ consumers symfony opcache Redis","text":"When you set a vhost to `app_type: orocommerce`, the platform provisions the OroCommerce runtime profile:\n\n- An **Nginx vhost** tuned for OroCommerce, with the document root at `public_html` under your system user's home (`/var/www//[/]public_html`).\n- A **PHP-FPM backend** wired to Nginx, with a long `fastcgi_read_timeout` (1200s) so long-running install and admin requests do not time out, plus `fastcgi_intercept_errors` for clean error handling.\n- **Static asset caching** at the web server: images, CSS, JS, PDF and similar files are served with a 1-hour browser cache and access logging disabled.\n- The **MySQL/Percona** database service (PostgreSQL is also supported).\n- Optional **Redis**, **RabbitMQ** (the message queue Oro relies on), and **Varnish**, enabled per host.\n\n> [!NOTE]\n> TurboStack provisions the infrastructure; OroCommerce's own application configuration (cache adapters, queue, search) lives in your code and `.env`/`config` and is deployed with your repository."} {"id":"applications/orocommerce/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/orocommerce/best-practices/#recommended-optimizations","path":"applications/orocommerce/best-practices.md","title":"OroCommerce best practices","heading":"Recommended optimizations","keywords":"orocommerce performance orocommerce optimization orocommerce caching orocommerce turbostack oro message queue RabbitMQ consumers symfony opcache Redis","text":"Combine OroCommerce's own recommendations with the TurboStack services you enable on the Services tab:\n\n- **Run the application in `prod` mode** and compile assets/DI container during deploy; never serve `index_dev.php` in production.\n- **Enable OPcache** for PHP and keep it warm; it is the single biggest PHP performance win for Symfony.\n- **Use Redis** for the Symfony cache, doctrine result cache, and sessions to offload the database.\n- **Run RabbitMQ message-queue consumers** as persistent workers - Oro offloads emails, search indexing, price recalculation and imports to the queue. Without running consumers these jobs stall. Run each consumer as a user system service so it restarts on failure. Add more consumers in parallel to clear a backlog, but keep the total within the host's processor budget (see Scale throughput with more instances).\n- **Keep the search index healthy**: run application search reindexing after catalog changes and on a schedule.\n- **Put Varnish in front of Nginx** for full-page caching of anonymous catalog traffic on high-volume storefronts.\n- **Optimize images and assets**: compress product images and enable an HTTP cache/Content Delivery Network (CDN) in front of static content.\n- **Schedule Oro's cron** (`oro:cron`) so recurring maintenance, cleanup and queued tasks run reliably.\n\n> [!TIP]\n> Message-queue consumers and the Oro cron are the two things most often forgotten. If emails, search updates or imports \"do nothing,\" check these first."} {"id":"applications/orocommerce/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/orocommerce/best-practices/#sizing-and-scaling","path":"applications/orocommerce/best-practices.md","title":"OroCommerce best practices","heading":"Sizing and scaling","keywords":"orocommerce performance orocommerce optimization orocommerce caching orocommerce turbostack oro message queue RabbitMQ consumers symfony opcache Redis","text":"TurboStack auto-tunes service defaults from the host's resources. Override sizing variables only when you have measured evidence of a bottleneck:\n\n| Variable | Tune when |\n| --- | --- |\n| `mysql_innodb_size` | The working set exceeds the buffer pool. |\n| `redis_memory` | Redis is evicting keys under load. |\n| `varnish_cache_size` | The full-page cache hit ratio is low. |\n\nScale message-queue consumers and PHP-FPM workers to match traffic before scaling the database. See Performance tuning."} {"id":"applications/orocommerce/best-practices.md#stability","url":"https://docs.turbostack.app/applications/orocommerce/best-practices/#stability","path":"applications/orocommerce/best-practices.md","title":"OroCommerce best practices","heading":"Stability","keywords":"orocommerce performance orocommerce optimization orocommerce caching orocommerce turbostack oro message queue RabbitMQ consumers symfony opcache Redis","text":"- Keep **Backups** enabled and verify restores periodically - Oro holds catalog, order and customer data.\n- Watch the host **Health** tab for CPU, memory, queue depth and service status.\n- Keep OroCommerce, PHP and the database versions current within supported ranges.\n- Test upgrades, schema migrations and config changes on a **staging clone** before publishing to production.\n\n> [!WARNING]\n> Database schema migrations and reindexing are heavy operations. Run them in a maintenance window and ensure consumers are running so queued post-migration jobs complete."} {"id":"applications/orocommerce/best-practices.md#related","url":"https://docs.turbostack.app/applications/orocommerce/best-practices/#related","path":"applications/orocommerce/best-practices.md","title":"OroCommerce best practices","heading":"Related","keywords":"orocommerce performance orocommerce optimization orocommerce caching orocommerce turbostack oro message queue RabbitMQ consumers symfony opcache Redis","text":"- Deploy OroCommerce\n- Troubleshooting OroCommerce\n- How to manage user system services\n- Services\n- Performance tuning"} {"id":"applications/orocommerce/deploy.md#intro","url":"https://docs.turbostack.app/applications/orocommerce/deploy/","path":"applications/orocommerce/deploy.md","title":"Deploy OroCommerce on TurboStack","heading":"","keywords":"deploy orocommerce orocommerce hosting orocommerce turbostack symfony b2b commerce RabbitMQ message queue php 8.4 Redis Varnish","text":"# Deploy OroCommerce on TurboStack\n\nOroCommerce is a Symfony-based B2B commerce platform. TurboStack provisions the runtime and supporting services, including the message queue OroCommerce relies on for asynchronous processing."} {"id":"applications/orocommerce/deploy.md#requirements","url":"https://docs.turbostack.app/applications/orocommerce/deploy/#requirements","path":"applications/orocommerce/deploy.md","title":"Deploy OroCommerce on TurboStack","heading":"Requirements","keywords":"deploy orocommerce orocommerce hosting orocommerce turbostack symfony b2b commerce RabbitMQ message queue php 8.4 Redis Varnish","text":"| Requirement | Recommended |\n| --- | --- |\n| App type | `orocommerce` |\n| Runtime | PHP 8.4 |\n| Database | MySQL 8.4 (or PostgreSQL) |\n| Cache | Redis |\n| Message queue | RabbitMQ (recommended for async jobs) |\n| Web server | Nginx (Varnish optional) |\n\n> [!NOTE]\n> OroCommerce is configuration-only: bring your own application code and deploy it with Git deployment."} {"id":"applications/orocommerce/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/orocommerce/deploy/#configure-it","path":"applications/orocommerce/deploy.md","title":"Deploy OroCommerce on TurboStack","heading":"Configure it","keywords":"deploy orocommerce orocommerce hosting orocommerce turbostack symfony b2b commerce RabbitMQ message queue php 8.4 Redis Varnish","text":"1. Open your host and go to the Applications tab.\n2. Select **Add app or database** and set **App Type** to `orocommerce`.\n3. Choose PHP 8.4 as the runtime and set the server name for your storefront.\n4. Enable MySQL, Redis, and RabbitMQ for the async message queue.\n5. Publish the host, then deploy your code."} {"id":"applications/orocommerce/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/orocommerce/deploy/#example-configuration","path":"applications/orocommerce/deploy.md","title":"Deploy OroCommerce on TurboStack","heading":"Example configuration","keywords":"deploy orocommerce orocommerce hosting orocommerce turbostack symfony b2b commerce RabbitMQ message queue php 8.4 Redis Varnish","text":"```yaml\nwebserver: nginx\nmysql_version: \"8.4\"\nredis_enabled: true\nsystem_users:\n - username: prod\n vhosts:\n - server_name: oro.example.com\n app_type: orocommerce\n php_version: \"8.4\"\n cert_type: letsencrypt\n rabbitmq_enabled: true # Oro uses a message queue for async jobs\n```\n\n> [!TIP]\n> Add Varnish in front of Nginx if you need full-page caching for high-traffic catalogs."} {"id":"applications/orocommerce/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/orocommerce/deploy/#why-these-choices","path":"applications/orocommerce/deploy.md","title":"Deploy OroCommerce on TurboStack","heading":"Why these choices","keywords":"deploy orocommerce orocommerce hosting orocommerce turbostack symfony b2b commerce RabbitMQ message queue php 8.4 Redis Varnish","text":"- `app_type: orocommerce` applies the OroCommerce runtime profile to the vhost.\n- RabbitMQ is strongly recommended because Oro offloads async jobs to a message queue.\n- MySQL 8.4 stores commerce data; PostgreSQL is supported as an alternative.\n- Redis provides caching and session storage for the Symfony application.\n- PHP 8.4 and Nginx match OroCommerce's supported stack.\n- Let's Encrypt provides automatic Transport Layer Security (TLS) for the storefront hostname."} {"id":"applications/orocommerce/deploy.md#related","url":"https://docs.turbostack.app/applications/orocommerce/deploy/#related","path":"applications/orocommerce/deploy.md","title":"Deploy OroCommerce on TurboStack","heading":"Related","keywords":"deploy orocommerce orocommerce hosting orocommerce turbostack symfony b2b commerce RabbitMQ message queue php 8.4 Redis Varnish","text":"- Technologies used: PHP, MySQL, Redis, RabbitMQ.\n\n- Best practices - performance & stability.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications (host tab)\n- The Source (YAML) view"} {"id":"applications/orocommerce/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/orocommerce/troubleshooting/","path":"applications/orocommerce/troubleshooting.md","title":"Troubleshooting OroCommerce","heading":"","keywords":"orocommerce troubleshooting orocommerce logs orocommerce error orocommerce turbostack RabbitMQ consumers oro cache clear website search reindex","text":"# Troubleshooting OroCommerce\n\nMost OroCommerce problems involve a few key components: the message queue and its consumers, the Symfony cache, the search index, and the runtime/database configuration. This page shows where to look and how to resolve the most common issues on TurboStack."} {"id":"applications/orocommerce/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/orocommerce/troubleshooting/#where-to-find-the-logs","path":"applications/orocommerce/troubleshooting.md","title":"Troubleshooting OroCommerce","heading":"Where to find the logs","keywords":"orocommerce troubleshooting orocommerce logs orocommerce error orocommerce turbostack RabbitMQ consumers oro cache clear website search reindex","text":"OroCommerce runs under your system user, with the document root at `public_html` and the application code in the same vhost directory. Start with these:\n\n| Component | Where |\n| --- | --- |\n| Nginx access/error | Host Nginx logs (see Health); the OroCommerce vhost serves from `/var/www//[/]public_html` |\n| PHP-FPM | The PHP-FPM pool log for the vhost's user |\n| OroCommerce application | The app's own `var/logs/` directory (e.g. `prod.log`) under the application root |\n| Message queue | RabbitMQ service status and consumer output (see Services) |\n| Database | MySQL/Percona (or PostgreSQL) service logs |\n| Platform | Host Health tab; recent deploys in History |\n\n> [!TIP]\n> Set OroCommerce to `prod` mode and watch `var/logs/prod.log` while you reproduce an issue - it usually names the failing service or class."} {"id":"applications/orocommerce/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/orocommerce/troubleshooting/#common-issues","path":"applications/orocommerce/troubleshooting.md","title":"Troubleshooting OroCommerce","heading":"Common issues","keywords":"orocommerce troubleshooting orocommerce logs orocommerce error orocommerce turbostack RabbitMQ consumers oro cache clear website search reindex","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| Emails, imports or price updates never happen | Message-queue consumers not running | Start/restart the RabbitMQ consumers (`oro:message-queue:consume`) and ensure they run as persistent workers; check RabbitMQ on Services |\n| Storefront/admin shows stale data after a change | Symfony cache not cleared/warmed | Run `cache:clear` (and warmup) for `prod`; confirm Redis is up if used for cache |\n| Search returns nothing or stale results | Website search index out of date | Run website search reindex (`oro:website-search:reindex`); ensure consumers process the indexing jobs |\n| Real-time UI (notifications, sync) not updating | WebSocket server not running | Verify the Oro WebSocket (Gos) server process is running and reachable |\n| 500 error or \"service unavailable\" after deploy | Schema migration not run, or bad `.env`/`database_url` | Check `var/logs/prod.log`; run pending migrations; verify `database_url`/Redis config and clear the cache |\n| Requests time out on long admin/import actions | PHP and PHP-FPM limits | Nginx already allows a 1200s `fastcgi_read_timeout`; offload heavy work to the message queue instead of synchronous requests |\n| Scheduled tasks not running | Oro cron not scheduled | Ensure `oro:cron` runs on a schedule; confirm consumers are alive to process queued cron jobs |"} {"id":"applications/orocommerce/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/orocommerce/troubleshooting/#a-troubleshooting-workflow","path":"applications/orocommerce/troubleshooting.md","title":"Troubleshooting OroCommerce","heading":"A troubleshooting workflow","keywords":"orocommerce troubleshooting orocommerce logs orocommerce error orocommerce turbostack RabbitMQ consumers oro cache clear website search reindex","text":"1. Check Health - confirm CPU, memory and that Nginx, PHP-FPM, the database, Redis and RabbitMQ are running.\n2. Read the relevant log - start with `var/logs/prod.log`, then the Nginx error log and PHP-FPM log for the vhost.\n3. Check the last deploy in History - if a recent change broke the site, revert or re-Publish a known-good revision.\n4. Verify services are running - on Services, confirm RabbitMQ and its consumers, Redis, and the WebSocket server are up. Restart any that are down and re-run cache clear/reindex if needed.\n\n> [!WARNING]\n> A site that \"loads but does nothing\" (no emails, no search updates, no imports) almost always means the message-queue consumers are stopped. Check them before anything else."} {"id":"applications/orocommerce/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/orocommerce/troubleshooting/#getting-help","path":"applications/orocommerce/troubleshooting.md","title":"Troubleshooting OroCommerce","heading":"Getting help","keywords":"orocommerce troubleshooting orocommerce logs orocommerce error orocommerce turbostack RabbitMQ consumers oro cache clear website search reindex","text":"If you are stuck, gather the relevant log excerpts and the failing revision, then reach out via Support. For platform-wide issues, see the general Troubleshooting guide."} {"id":"applications/orocommerce/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/orocommerce/troubleshooting/#related","path":"applications/orocommerce/troubleshooting.md","title":"Troubleshooting OroCommerce","heading":"Related","keywords":"orocommerce troubleshooting orocommerce logs orocommerce error orocommerce turbostack RabbitMQ consumers oro cache clear website search reindex","text":"- Deploy OroCommerce\n- OroCommerce best practices\n- Health\n- Support"} {"id":"applications/self-hosted-platforms.md#intro","url":"https://docs.turbostack.app/applications/self-hosted-platforms/","path":"applications/self-hosted-platforms.md","title":"Self-hosted platforms: GitLab and Advanced Database Monitoring","heading":"","keywords":"gitlab advanced database monitoring database monitoring Kubernetes app_type gitlab app_type pmm turbostack","text":"# Self-hosted platforms: GitLab and Advanced Database Monitoring\n\nTurboStack can also run two Kubernetes-based platforms: **GitLab** (`app_type: gitlab`) and **Advanced Database Monitoring** (`app_type: pmm`). Both run on a Kubernetes cluster with several supporting components. They are set up by Hosted Power through Support rather than self-service.\n\n> [!NOTE]\n> GitLab and Advanced Database Monitoring require a Kubernetes cluster and are set up by Hosted Power. Contact Support to have them enabled."} {"id":"applications/self-hosted-platforms.md#gitlab","url":"https://docs.turbostack.app/applications/self-hosted-platforms/#gitlab","path":"applications/self-hosted-platforms.md","title":"Self-hosted platforms: GitLab and Advanced Database Monitoring","heading":"GitLab","keywords":"gitlab advanced database monitoring database monitoring Kubernetes app_type gitlab app_type pmm turbostack","text":"GitLab runs on a Kubernetes cluster alongside the components it depends on: PostgreSQL, Redis, MinIO object storage, cert-manager, and an ingress controller. You select the major version, the edition, the domain, and how much persistent storage the deployment gets.\n\n```yaml\napp_type: gitlab\ngitlab:\n major_version: 18\n edition: ce # Community Edition\n domain: gitlab.example.com\n persistent_data_size: 60Gi\n```"} {"id":"applications/self-hosted-platforms.md#advanced-database-monitoring","url":"https://docs.turbostack.app/applications/self-hosted-platforms/#advanced-database-monitoring","path":"applications/self-hosted-platforms.md","title":"Self-hosted platforms: GitLab and Advanced Database Monitoring","heading":"Advanced Database Monitoring","keywords":"gitlab advanced database monitoring database monitoring Kubernetes app_type gitlab app_type pmm turbostack","text":"Advanced Database Monitoring is deployed with `app_type: pmm`. It is installed via Helm and includes Grafana for dashboards along with a large persistent volume for its time-series metrics data. Size the volume with `pmm_volume_size` according to how much monitoring history you need to retain."} {"id":"applications/self-hosted-platforms.md#related","url":"https://docs.turbostack.app/applications/self-hosted-platforms/#related","path":"applications/self-hosted-platforms.md","title":"Self-hosted platforms: GitLab and Advanced Database Monitoring","heading":"Related","keywords":"gitlab advanced database monitoring database monitoring Kubernetes app_type gitlab app_type pmm turbostack","text":"- Applications overview\n- Networking\n- Support"} {"id":"applications/shopware/best-practices.md#intro","url":"https://docs.turbostack.app/applications/shopware/best-practices/","path":"applications/shopware/best-practices.md","title":"Shopware best practices","heading":"","keywords":"shopware performance shopware optimization shopware caching shopware turbostack shopware Redis shopware Varnish OpenSearch opcache","text":"# Shopware best practices\n\nThis page collects practical recommendations for running a fast, stable Shopware 6 store on TurboStack. The platform already applies a tuned baseline when you deploy; the optimizations below build on it so your storefront stays responsive under load."} {"id":"applications/shopware/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/shopware/best-practices/#what-turbostack-configures-for-you","path":"applications/shopware/best-practices.md","title":"Shopware best practices","heading":"What TurboStack configures for you","keywords":"shopware performance shopware optimization shopware caching shopware turbostack shopware Redis shopware Varnish OpenSearch opcache","text":"When you deploy a `shopware` app, the platform provisions and tunes the following automatically:\n\n- **Nginx vhost** tuned for Shopware, with long static-asset expiry, the `recovery`/installer routes, and PHP-FPM via a dedicated FastCGI backend (`/var/www///nginx/50main.conf`).\n- **Document root** is `public_html`, symlinked to the Shopware `public/` directory so the application root stays outside the web root.\n- **Redis** for both the object/HTTP cache and PHP sessions, configured through `config/packages/hostedpower.yaml` (cache app + object, HTTP, and tags pools; sessions on a persistent Redis socket).\n- **Message queue transport** on Redis, set via `MESSENGER_TRANSPORT_DSN` in `.env.local` (`symfony/redis-messenger` is installed during provisioning).\n- **Varnish full-page cache** with a Shopware-aware VCL (`/etc/varnish/conf.d/50_main.vcl`) using xkey-based tag invalidation and BAN/PURGE support, when `varnish_enabled` is set.\n- **HTTP cache** enabled in `.env.local` (`SHOPWARE_HTTP_CACHE_ENABLED=1`, default Time to Live (TTL) `7200`).\n- **MySQL tuning** for Shopware, including `group_concat_max_len` raised to handle large product datasets (`/etc/mysql/after.conf.d/shopware.cnf`).\n- **Log rotation** for everything under `shopware/var/log/`, plus the `shopware-cli` tool for maintenance and build tasks.\n- **OpenSearch wiring** in `.env.local` (`OPENSEARCH_URL`), ready to enable when you need search at scale.\n\n> [!NOTE]\n> Settings live in `.env.local` and `config/packages/hostedpower.yaml` in your app directory. Run `bin/console cache:clear` after changing them."} {"id":"applications/shopware/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/shopware/best-practices/#recommended-optimizations","path":"applications/shopware/best-practices.md","title":"Shopware best practices","heading":"Recommended optimizations","keywords":"shopware performance shopware optimization shopware caching shopware turbostack shopware Redis shopware Varnish OpenSearch opcache","text":"- **Run in production mode** - keep `APP_ENV=prod` so Shopware uses compiled, cached containers and assets.\n- **Keep Redis for cache and sessions** - already configured; verify both services are enabled under Services.\n- **Run the message queue** - process the queue and scheduled tasks continuously so emails, indexing and background jobs do not accumulate. See Message-queue consumers below.\n- **Enable Varnish** - set `varnish_enabled` for the storefront; it reduces PHP load on catalog and CMS pages.\n- **Enable OpenSearch for large catalogs** - set `SHOPWARE_ES_ENABLED=1` and `SHOPWARE_ES_INDEXING_ENABLED=1`, then run `bin/console es:index` to offload product search from MySQL.\n- **OPcache** - keep it on for the PHP runtime; it is part of the platform's PHP-FPM tuning.\n- **Optimize media** - generate thumbnails ahead of traffic with `bin/console media:generate-thumbnails`; serve images via a Content Delivery Network (CDN) using the configured CDN strategy.\n- **Warm the cache** - after deploys, run `bin/console cache:warmup` (the platform also crawls the storefront to prime Varnish)."} {"id":"applications/shopware/best-practices.md#message-queue-consumers","url":"https://docs.turbostack.app/applications/shopware/best-practices/#message-queue-consumers","path":"applications/shopware/best-practices.md","title":"Shopware best practices","heading":"Message-queue consumers","keywords":"shopware performance shopware optimization shopware caching shopware turbostack shopware Redis shopware Varnish OpenSearch opcache","text":"Shopware offloads emails, search indexing and other background work to a message queue, which TurboStack routes through Redis. In production you run the consumer from the command line instead of the browser-based admin worker.\n\nDisable the admin worker in `config/packages/shopware.yaml` so the queue does not depend on an open Administration tab:\n\n```yaml\nshopware:\n admin_worker:\n enable_admin_worker: false\n```\n\nThen run the consumer and the scheduled-task runner. The `--time-limit` and `--memory-limit` flags stop a worker cleanly so a process manager can restart it fresh:\n\n```bash\nbin/console messenger:consume async low_priority --time-limit=60 --memory-limit=512M\nbin/console scheduled-task:run\n```\n\nRun these as persistent user system services so they restart on failure and survive logout. To clear a backlog faster, run several consumers in parallel, but keep the total within the host's processor budget (see Scale throughput with more instances)."} {"id":"applications/shopware/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/shopware/best-practices/#sizing-and-scaling","path":"applications/shopware/best-practices.md","title":"Shopware best practices","heading":"Sizing and scaling","keywords":"shopware performance shopware optimization shopware caching shopware turbostack shopware Redis shopware Varnish OpenSearch opcache","text":"Defaults are auto-tuned to the host's resources, so start there and scale on evidence, not guesswork. Override these only with measured data from real traffic:\n\n| Variable | Tune when |\n| --- | --- |\n| `mysql_innodb_size` | InnoDB buffer pool for the Shopware database |\n| `redis_memory` | Redis memory ceiling for cache and sessions |\n| `varnish_cache_size` | Varnish full-page cache size |\n| `elasticsearch_heap_size` | OpenSearch heap when search is enabled |\n\nSee Performance tuning for the methodology. Scale vertically first (CPU, RAM, faster storage) before adding complexity.\n\n> [!TIP]\n> Large catalogs benefit most from more InnoDB buffer pool and OpenSearch. Heavy storefront traffic benefits most from Varnish and Redis. Tune the one that matches your bottleneck."} {"id":"applications/shopware/best-practices.md#stability","url":"https://docs.turbostack.app/applications/shopware/best-practices/#stability","path":"applications/shopware/best-practices.md","title":"Shopware best practices","heading":"Stability","keywords":"shopware performance shopware optimization shopware caching shopware turbostack shopware Redis shopware Varnish OpenSearch opcache","text":"- **Back up before changes** - verify scheduled backups cover both the database and the `shopware/` files; see Backups.\n- **Watch the host** - monitor the Health tab for CPU, memory, and disk pressure.\n- **Stay current** - keep Shopware, plugins, and the PHP runtime patched for security and performance fixes; pin `shopware_version` deliberately.\n- **Test on a staging clone** - try plugin and version upgrades on a copy first, then publish to production."} {"id":"applications/shopware/best-practices.md#related","url":"https://docs.turbostack.app/applications/shopware/best-practices/#related","path":"applications/shopware/best-practices.md","title":"Shopware best practices","heading":"Related","keywords":"shopware performance shopware optimization shopware caching shopware turbostack shopware Redis shopware Varnish OpenSearch opcache","text":"- Deploy Shopware\n- Shopware reference\n- Troubleshooting Shopware\n- How to manage user system services\n- Services\n- Performance tuning"} {"id":"applications/shopware/deploy.md#intro","url":"https://docs.turbostack.app/applications/shopware/deploy/","path":"applications/shopware/deploy.md","title":"Deploy Shopware on TurboStack","heading":"","keywords":"deploy shopware shopware hosting shopware turbostack shopware 6 php 8.4 mysql Redis Varnish","text":"# Deploy Shopware on TurboStack\n\nShopware 6 is an API-first e-commerce platform built on Symfony. On TurboStack the platform provisions the PHP runtime, MySQL database, and caching services from your host configuration, and you deploy by publishing."} {"id":"applications/shopware/deploy.md#requirements","url":"https://docs.turbostack.app/applications/shopware/deploy/#requirements","path":"applications/shopware/deploy.md","title":"Deploy Shopware on TurboStack","heading":"Requirements","keywords":"deploy shopware shopware hosting shopware turbostack shopware 6 php 8.4 mysql Redis Varnish","text":"| Requirement | Recommended |\n| --- | --- |\n| App type | `shopware` |\n| Runtime | PHP 8.4 (or newer) |\n| Database | MySQL 8.4 |\n| Cache (Redis) | Enabled (cache + sessions) |\n| Page cache (Varnish) | Enabled (recommended) |\n| Web server | Nginx |\n\n> [!NOTE]\n> TurboStack can install Shopware automatically with `shopware_version`. Shopware also relies on scheduled tasks and cron, which the platform runs for you."} {"id":"applications/shopware/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/shopware/deploy/#configure-it","path":"applications/shopware/deploy.md","title":"Deploy Shopware on TurboStack","heading":"Configure it","keywords":"deploy shopware shopware hosting shopware turbostack shopware 6 php 8.4 mysql Redis Varnish","text":"1. Open the host's Applications tab.\n2. Click **Add app or database**.\n3. Set **App Type** to `shopware` and choose the PHP runtime under **Technologies**.\n4. Enable MySQL, Redis, and Varnish as services.\n5. Publish to apply the configuration."} {"id":"applications/shopware/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/shopware/deploy/#example-configuration","path":"applications/shopware/deploy.md","title":"Deploy Shopware on TurboStack","heading":"Example configuration","keywords":"deploy shopware shopware hosting shopware turbostack shopware 6 php 8.4 mysql Redis Varnish","text":"```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # Shopware core database\nredis_enabled: true # cache and session storage\nsystem_users:\n - username: prod\n vhosts:\n - server_name: shop.example.com www.shop.example.com\n app_type: shopware\n php_version: \"8.4\"\n cert_type: letsencrypt\n varnish_enabled: true # full-page cache for storefront performance\n```"} {"id":"applications/shopware/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/shopware/deploy/#why-these-choices","path":"applications/shopware/deploy.md","title":"Deploy Shopware on TurboStack","heading":"Why these choices","keywords":"deploy shopware shopware hosting shopware turbostack shopware 6 php 8.4 mysql Redis Varnish","text":"- **MySQL 8.4** is the Shopware core database for products, orders, and configuration.\n- **Redis** is used for cache and session storage, which keeps the storefront responsive and offloads the database.\n- **Varnish full-page cache** is recommended; Shopware integrates with reverse-proxy caching to serve storefront pages quickly.\n- **Scheduled tasks and cron** are required by Shopware. Schedule the task runner and run the message-queue consumer for your system user (see the reference), so background jobs run reliably.\n- **Nginx** is the supported web server and pairs with PHP-FPM for Shopware workloads."} {"id":"applications/shopware/deploy.md#related","url":"https://docs.turbostack.app/applications/shopware/deploy/#related","path":"applications/shopware/deploy.md","title":"Deploy Shopware on TurboStack","heading":"Related","keywords":"deploy shopware shopware hosting shopware turbostack shopware 6 php 8.4 mysql Redis Varnish","text":"- Technologies used: PHP, MySQL, Redis, Varnish, OpenSearch.\n\n- Best practices - performance & stability.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications (host tab)\n- The Source (YAML) view"} {"id":"applications/shopware/reference.md#intro","url":"https://docs.turbostack.app/applications/shopware/reference/","path":"applications/shopware/reference.md","title":"Shopware reference","heading":"","keywords":"shopware cli bin/console shopware file layout shopware cron shopware commands message queue consumer shopware reference","text":"# Shopware reference\n\nReference for running Shopware 6 on TurboStack: where the files live, the command-line tool, and the scheduled jobs. For setup see Deploy Shopware on TurboStack; for tuning see Shopware best practices."} {"id":"applications/shopware/reference.md#file-layout","url":"https://docs.turbostack.app/applications/shopware/reference/#file-layout","path":"applications/shopware/reference.md","title":"Shopware reference","heading":"File layout","keywords":"shopware cli bin/console shopware file layout shopware cron shopware commands message queue consumer shopware reference","text":"Everything lives under your system user's home directory. `~` is that home directory (for example `/var/www/prod/`). The base directory is `~/shopware/`, which can be symlinked for release-based deployments.\n\n| Path | What it is |\n| --- | --- |\n| `~/public_html` | Web document root; must point to `~/shopware/public/` (direct or via symlink) |\n| `~/shopware/` | Shopware base directory; run the command-line tool from here |\n| `~/shopware/public/` | Served files, including the `index.php` front controller |\n| `~/shopware/vendor/` | Composer dependencies |\n| `~/shopware/custom/` | Plugins and themes |\n| `~/shopware/config/` | Configuration: `.env`, `packages/` and `services.yaml` |\n| `~/shopware/var/log/` | Logs |\n\nFor ownership and permissions, see Application file layout and permissions."} {"id":"applications/shopware/reference.md#command-line-reference","url":"https://docs.turbostack.app/applications/shopware/reference/#command-line-reference","path":"applications/shopware/reference.md","title":"Shopware reference","heading":"Command-line reference","keywords":"shopware cli bin/console shopware file layout shopware cron shopware commands message queue consumer shopware reference","text":"Shopware ships a command-line interface (CLI) at `bin/console`. Run every command from the Shopware base directory `~/shopware/`. The common commands are below.\n\n| Command | What it does |\n| --- | --- |\n| `cache:clear` | Clear the application cache |\n| `cache:warmup` | Warm the cache after a deploy |\n| `dal:refresh:index` | Rebuild the Data Abstraction Layer (DAL) index |\n| `es:index` | Build the Elasticsearch or OpenSearch index |\n| `media:generate-thumbnails` | Generate media thumbnails |\n| `scheduled-task:run` | Run due scheduled tasks |\n| `messenger:consume` | Process the message queue |\n| `system:update:finish` | Finish an update |\n\nTo clear all caches, run the application cache and the shared caches together:\n\n```bash\ncd ~/shopware && bin/console cache:clear\ntscli redis clear\ntscli varnish clear\n```\n\n`tscli redis clear` and `tscli varnish clear` use the TurboStack CLI.\n\nTo update Shopware, update the dependencies and then finish the update:\n\n```bash\ncd ~/shopware && composer update && bin/console system:update:finish\n```"} {"id":"applications/shopware/reference.md#cron-and-background-workers","url":"https://docs.turbostack.app/applications/shopware/reference/#cron-and-background-workers","path":"applications/shopware/reference.md","title":"Shopware reference","heading":"Cron and background workers","keywords":"shopware cli bin/console shopware file layout shopware cron shopware commands message queue consumer shopware reference","text":"Shopware needs its scheduled tasks run regularly. Add a cron entry for your system user - for example every 5 minutes:\n\n```bash\n*/5 * * * * cd ~/shopware && bin/console scheduled-task:run >> ~/logs/scheduled-task.log 2>&1\n```\n\nThe message queue is processed with `bin/console messenger:consume`. On a busy store, run the consumer as a persistent user system service so it restarts on failure. See How to manage user system services."} {"id":"applications/shopware/reference.md#cart-storage-in-redis-optional","url":"https://docs.turbostack.app/applications/shopware/reference/#cart-storage-in-redis-optional","path":"applications/shopware/reference.md","title":"Shopware reference","heading":"Cart storage in Redis (optional)","keywords":"shopware cli bin/console shopware file layout shopware cron shopware commands message queue consumer shopware reference","text":"By default Shopware stores the cart in the database. On a high-traffic store you can move the cart to Redis to reduce database writes during checkout. Point it at the persistent Redis instance (port `6378`) so carts are not lost when the cache is flushed, and give it its own database index. The configuration key changed in Shopware 6.6.8.0.\n\nOn Shopware 6.6.8.0 and later, define a named connection and point the cart storage at it in `config/packages/shopware.yaml`:\n\n```yaml\nshopware:\n redis:\n connections:\n persistent:\n dsn: 'redis://localhost:6378/3'\n cart:\n storage:\n type: 'redis'\n config:\n connection: 'persistent'\n```\n\nOn Shopware 6.5 and early 6.6 releases, use the single `redis_url` key instead:\n\n```yaml\nshopware:\n cart:\n redis_url: 'redis://localhost:6378/3'\n```\n\nCart lifetime is controlled by `shopware.cart.expire_days` (default `120`). After switching the storage backend, migrate existing carts out of the database:\n\n```bash\nbin/console cart:migrate sql\n```"} {"id":"applications/shopware/reference.md#related","url":"https://docs.turbostack.app/applications/shopware/reference/#related","path":"applications/shopware/reference.md","title":"Shopware reference","heading":"Related","keywords":"shopware cli bin/console shopware file layout shopware cron shopware commands message queue consumer shopware reference","text":"- Deploy Shopware on TurboStack\n- Shopware best practices\n- Troubleshooting Shopware\n- Application file layout and permissions\n- How to manage user system services"} {"id":"applications/shopware/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/shopware/troubleshooting/","path":"applications/shopware/troubleshooting.md","title":"Troubleshooting Shopware","heading":"","keywords":"shopware troubleshooting shopware logs shopware error shopware turbostack shopware 500 error messenger consume OpenSearch indexing","text":"# Troubleshooting Shopware\n\nWhen a Shopware store is not working correctly, the cause is usually a stale cache, a stalled message queue, an indexing issue, or a configuration mismatch. This page shows where to look and how to fix the most common problems on TurboStack."} {"id":"applications/shopware/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/shopware/troubleshooting/#where-to-find-the-logs","path":"applications/shopware/troubleshooting.md","title":"Troubleshooting Shopware","heading":"Where to find the logs","keywords":"shopware troubleshooting shopware logs shopware error shopware turbostack shopware 500 error messenger consume OpenSearch indexing","text":"Most answers are in the application log or the web server log. Your app directory is `/var/www///shopware/` (the `/` segment is only present when an app name is set).\n\n| Component | Where |\n| --- | --- |\n| Shopware application | `/var/www///shopware/var/log/*.log` (e.g. `prod-*.log`) |\n| Nginx access/error | host log directory for the vhost (web server logs) |\n| PHP-FPM | the PHP-FPM pool log for the runtime |\n| Database (MySQL) | the MySQL error/slow-query log on the host |\n| Varnish | Varnish runs in front of the storefront when `varnish_enabled` is set |\n\nAlso check the host's Health tab for resource pressure and service status. Check recent deploys in History to see whether a change coincides with the problem.\n\n> [!TIP]\n> Logs under `var/log/` are rotated automatically. To watch live errors, tail the current `prod-*.log` while reproducing the issue."} {"id":"applications/shopware/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/shopware/troubleshooting/#common-issues","path":"applications/shopware/troubleshooting.md","title":"Troubleshooting Shopware","heading":"Common issues","keywords":"shopware troubleshooting shopware logs shopware error shopware turbostack shopware 500 error messenger consume OpenSearch indexing","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| Stale prices, content, or layout | Outdated application/HTTP cache | Run `bin/console cache:clear`; if Varnish is on, also invalidate it (purge / `cache:clear:http`) |\n| Emails, exports, or jobs never run | Message-queue worker or scheduled tasks not running | Ensure `messenger:consume` and `scheduled-task:run` are running; check the Redis transport in `.env.local` |\n| Search empty or outdated | OpenSearch not indexed / disabled | With `SHOPWARE_ES_ENABLED=1`, run `bin/console es:index`; otherwise run `bin/console dal:refresh:index` |\n| Missing or broken product images | Thumbnails not generated | Run `bin/console media:generate-thumbnails` |\n| HTTP 500 / white screen | App error or bad config | Read the latest `var/log/prod-*.log`; verify `DATABASE_URL` and `APP_URL` in `.env.local`, then `cache:clear` |\n| \"Sales channel could not be found\" / wrong URLs | Sales-channel domain mismatch | Make sure the storefront sales-channel URL matches the host's `server_name`/domain |\n| Redis errors on every page | Redis service down or wrong socket | Confirm Redis is enabled in Services; check the sockets in `config/packages/hostedpower.yaml` |\n\n> [!WARNING]\n> Always run `bin/console` commands as the site's system user from the `shopware/` directory. Running them as root can leave cache and log files unwritable by PHP-FPM, producing fresh 500 errors."} {"id":"applications/shopware/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/shopware/troubleshooting/#a-troubleshooting-workflow","path":"applications/shopware/troubleshooting.md","title":"Troubleshooting Shopware","heading":"A troubleshooting workflow","keywords":"shopware troubleshooting shopware logs shopware error shopware turbostack shopware 500 error messenger consume OpenSearch indexing","text":"1. **Check Health** - check for CPU, memory, or disk exhaustion and confirm services are up.\n2. **Read the relevant log** - start with `var/log/prod-*.log`, then the Nginx and PHP-FPM logs for HTTP 500s.\n3. **Review the last deploy** - open History; if a recent change broke the site, revert and re-publish from Publishing.\n4. **Verify services** - confirm MySQL, Redis, the message-queue worker, and Varnish are running in Services; clear the cache and warm it after any fix."} {"id":"applications/shopware/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/shopware/troubleshooting/#getting-help","path":"applications/shopware/troubleshooting.md","title":"Troubleshooting Shopware","heading":"Getting help","keywords":"shopware troubleshooting shopware logs shopware error shopware turbostack shopware 500 error messenger consume OpenSearch indexing","text":"If you are still stuck, gather the exact error from the logs, the time it started, and any recent deploy, then reach out via Support. The general platform troubleshooting guide covers host-level issues that affect every application."} {"id":"applications/shopware/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/shopware/troubleshooting/#related","path":"applications/shopware/troubleshooting.md","title":"Troubleshooting Shopware","heading":"Related","keywords":"shopware troubleshooting shopware logs shopware error shopware turbostack shopware 500 error messenger consume OpenSearch indexing","text":"- Deploy Shopware\n- Shopware best practices\n- Health\n- Support"} {"id":"applications/wordpress/best-practices.md#intro","url":"https://docs.turbostack.app/applications/wordpress/best-practices/","path":"applications/wordpress/best-practices.md","title":"WordPress best practices","heading":"","keywords":"wordpress performance wordpress optimization wordpress caching wordpress turbostack Varnish wordpress Redis object cache wp-cli woocommerce performance","text":"# WordPress best practices\n\nA fast, stable WordPress site comes from layered caching, a tuned runtime and disciplined change\nmanagement. On TurboStack, much of this is already configured for you when you deploy a `wordpress`\napp. Most of your work is enabling the right plugins and avoiding conflicts. This page covers what\nthe platform configures and the optimizations worth adding on top."} {"id":"applications/wordpress/best-practices.md#what-turbostack-configures-for-you","url":"https://docs.turbostack.app/applications/wordpress/best-practices/#what-turbostack-configures-for-you","path":"applications/wordpress/best-practices.md","title":"WordPress best practices","heading":"What TurboStack configures for you","keywords":"wordpress performance wordpress optimization wordpress caching wordpress turbostack Varnish wordpress Redis object cache wp-cli woocommerce performance","text":"When you deploy WordPress, TurboStack provisions a working, production-shaped stack:\n\n- **Nginx vhost tuned for WordPress** - the document root is `public_html`. Pretty-permalink\n rewrites (`try_files $uri $uri/ /index.php?$args`) are in place. Static assets (`js`, `css`,\n images, `ico`) are served with `expires max`. `xmlrpc.php` is denied to reduce the attack surface.\n- **PHP-FPM backend per site** - PHP requests are passed to a dedicated FastCGI pool with a generous\n `fastcgi_read_timeout` (1200s) so long imports and updates do not time out.\n- **Varnish full-page cache (optional)** - when `varnish_enabled` is set, a WordPress-aware VCL is\n installed. It bypasses the cache for `wp-admin`, logged-in users, the WooCommerce\n cart/checkout/my-account flows, and `wp-cron.php`. It caches static files for a day, normalises\n query strings, and strips tracking parameters (`utm_*`, `fbclid`, `gclid`). It supports `PURGE`\n from the Proxy Cache Purge plugin.\n- **wp-config.php** - generated with your database credentials (`localhost`, dedicated DB and user),\n fresh secret-key salts and `WP_DEBUG` off for production.\n- **Optional auto-install** - with `app_install: true`, wp-cli installs core and sets permalinks to\n `/%postname%/`. It removes the default themes and the Akismet/Hello plugins, then installs and\n activates WP Super Cache."} {"id":"applications/wordpress/best-practices.md#recommended-optimizations","url":"https://docs.turbostack.app/applications/wordpress/best-practices/#recommended-optimizations","path":"applications/wordpress/best-practices.md","title":"WordPress best practices","heading":"Recommended optimizations","keywords":"wordpress performance wordpress optimization wordpress caching wordpress turbostack Varnish wordpress Redis object cache wp-cli woocommerce performance","text":"- **Enable Redis object cache** - turn on Redis as a service and\n install a Redis object-cache plugin (for example `wp-redis`). Repeated queries (options,\n transients, sessions) then hit memory instead of MySQL, which cuts database load - especially for\n WooCommerce and logged-in traffic. Point the plugin at the Redis socket in `wp-config.php`, then\n enable it:\n ```php\n $redis_server = array( 'host' => '/var/run/redis/redis.sock', 'port' => null, 'database' => 1 );\n ```\n ```bash\n wp redis enable\n wp transient delete-all\n ```\n When several sites share one Redis server, give each a different `database` id so they do not\n overwrite each other's cache.\n- **Use the Varnish full-page cache** - enable `varnish_enabled` for content-heavy and marketing\n sites; install the Proxy Cache Purge plugin so edits purge the cache automatically. Validate\n compatibility before enabling on stores with heavy logged-in flows.\n- **Keep one full-page cache** - run a single full-page caching layer. If Varnish is on, prefer it\n and avoid a second page-cache plugin writing conflicting headers. Without Varnish, a plugin such as\n WP Rocket gives good defaults for mostly-static sites. On an Nginx (non-Varnish) setup, pair WP\n Rocket with the Rocket-Nginx configuration so Nginx\n serves WP Rocket's cached pages directly, bypassing PHP.\n- **Consider a few extra speed plugins** - on large sites,\n Index WP Users for Speed keeps the admin\n fast when there are many users, and Speed Up Menu\n reduces the query overhead of large navigation menus.\n- **Index the database** - a plugin such as Index WP MySQL for Speed adds indexes to the core tables\n (`wp_options`, `wp_postmeta`, `wp_posts`, and others), which speeds up slow queries on large sites.\n Install it, add the indexes, then you can remove the plugin again - the indexes stay:\n ```bash\n wp plugin install index-wp-mysql-for-speed\n wp plugin activate index-wp-mysql-for-speed\n wp index-mysql enable wp_commentmeta wp_comments wp_options wp_postmeta wp_posts wp_termmeta wp_usermeta wp_users\n wp plugin deactivate index-wp-mysql-for-speed\n wp plugin uninstall index-wp-mysql-for-speed\n ```\n If it reports that the tables are not found, use your site's actual table prefix instead of `wp_`\n (for example `SsW6eC_commentmeta`, `SsW6eC_options`, and so on).\n- **OPcache** - the PHP runtime ships with OPcache; keep it enabled so compiled PHP is reused across\n requests.\n- **Optimize assets and images** - use a modern image plugin (WebP, lazy-load) and minify/combine\n CSS and JS to cut requests.\n- **Offload heavy media to a Content Delivery Network (CDN)** - front static assets with an HTTP\n cache/CDN to reduce origin load and improve global latency.\n- **Speed up Elementor** - if you build pages with Elementor, enable **Element Caching** under\n `Elementor > Settings > Features`. Elementor assembles pages from many queries and template parts\n on every request; caching those lookups cuts database load and speeds up dynamic and logged-in\n views.\n- **Raise memory in both places** - if you increase WordPress memory, raise the PHP limit too, or\n the change has no effect: set `WP_MEMORY_LIMIT` / `WP_MAX_MEMORY_LIMIT` in `wp-config.php` *and*\n `memory_limit` in `.user.ini`."} {"id":"applications/wordpress/best-practices.md#set-a-default-ttl-for-the-redis-object-cache","url":"https://docs.turbostack.app/applications/wordpress/best-practices/#set-a-default-ttl-for-the-redis-object-cache","path":"applications/wordpress/best-practices.md","title":"WordPress best practices","heading":"Set a default TTL for the Redis object cache","keywords":"wordpress performance wordpress optimization wordpress caching wordpress turbostack Varnish wordpress Redis object cache wp-cli woocommerce performance","text":"By default the Redis object cache does not expire keys that were stored without an explicit\ntime-to-live (TTL), so the cache can keep growing until it evicts entries or fills memory. The\nobject-cache drop-in reads a fallback TTL from a constant in `object-cache.php` (in `wp-content`):\n\n```php\nif ( ! defined( 'WP_REDIS_DEFAULT_EXPIRE_SECONDS' ) ) {\n define( 'WP_REDIS_DEFAULT_EXPIRE_SECONDS', 0 );\n}\n```\n\nA value of `0` means \"never expire\". Set a real fallback - for example `28800` (8 hours) - so keys\nstored without their own TTL still age out:\n\n```php\nif ( ! defined( 'WP_REDIS_DEFAULT_EXPIRE_SECONDS' ) ) {\n define( 'WP_REDIS_DEFAULT_EXPIRE_SECONDS', 28800 );\n}\n```\n\nThe drop-in talks to the TurboStack Redis cache instance - the socket configured above, or\n`localhost` port `6379` with no password. After editing the drop-in, flush the object cache\n(`wp cache flush`) so old entries pick up the new default.\n\nThis fallback only applies to keys stored without their own lifetime. Code that calls\n`wp_cache_set()` with an explicit lifetime keeps that lifetime, and some plugins deliberately store\nkeys that never expire (for example `posts` keys). To find where such keys are created, search the\ncodebase for the calls and filter for the group you are chasing:\n\n```bash\ngrep -Ri \"wp_cache_set(\" wp-content/plugins | grep 'posts'\n```\n\nThen give each of those calls a sensible lifetime instead of leaving it unbounded."} {"id":"applications/wordpress/best-practices.md#run-a-real-cron-job","url":"https://docs.turbostack.app/applications/wordpress/best-practices/#run-a-real-cron-job","path":"applications/wordpress/best-practices.md","title":"WordPress best practices","heading":"Run a real cron job","keywords":"wordpress performance wordpress optimization wordpress caching wordpress turbostack Varnish wordpress Redis object cache wp-cli woocommerce performance","text":"WordPress's built-in `wp-cron.php` runs on page loads, so scheduled tasks fire late on quiet sites\nand too often on busy ones, wasting PHP processes. Replace it with a system cron job.\n\n1. Disable the web trigger in `wp-config.php`:\n ```php\n define( 'DISABLE_WP_CRON', true );\n ```\n2. Add a cron entry (every 5 minutes) that runs the due events. Wrap the command in `cronlock` so a\n slow run cannot overlap with the next one and pile up PHP processes:\n ```bash\n */5 * * * * cronlock wp cron event run --due-now --path=/var/www/prod/public_html > /dev/null 2>&1\n ```\n3. Test it once by hand - it should report the events it executed:\n ```bash\n wp cron event run --due-now --path=/var/www/prod/public_html\n ```\n\nFor a multisite network, run the events for every site, not just once:\n\n```bash\nwp site list --field=url --path=/var/www/prod/public_html \\\n | xargs -n1 -I{} wp cron event run --due-now --path=/var/www/prod/public_html --url=\"{}\"\n```"} {"id":"applications/wordpress/best-practices.md#plugin-hygiene","url":"https://docs.turbostack.app/applications/wordpress/best-practices/#plugin-hygiene","path":"applications/wordpress/best-practices.md","title":"WordPress best practices","heading":"Plugin hygiene","keywords":"wordpress performance wordpress optimization wordpress caching wordpress turbostack Varnish wordpress Redis object cache wp-cli woocommerce performance","text":"- **Do not bulk-update every plugin at once.** Blind \"update all\" is a common cause of broken sites.\n Update selectively, test, and use Blackfire to find what actually slows the\n site before changing it.\n- **Remove the redundant HTTPS plugin.** TurboStack handles HTTPS and redirects at the web-server\n layer, so the `really-simple-ssl` plugin is not needed:\n ```bash\n wp plugin deactivate really-simple-ssl\n wp plugin uninstall really-simple-ssl\n ```"} {"id":"applications/wordpress/best-practices.md#sizing-and-scaling","url":"https://docs.turbostack.app/applications/wordpress/best-practices/#sizing-and-scaling","path":"applications/wordpress/best-practices.md","title":"WordPress best practices","heading":"Sizing and scaling","keywords":"wordpress performance wordpress optimization wordpress caching wordpress turbostack Varnish wordpress Redis object cache wp-cli woocommerce performance","text":"Defaults are auto-tuned to the host, so do not pre-emptively raise them. Override sizing variables\nonly with measured evidence (slow queries, cache evictions, swap):\n\n| Variable | Tune when |\n| --- | --- |\n| `mysql_innodb_size` | MySQL working set no longer fits in the buffer pool |\n| `redis_memory` | The object cache evicts keys under normal load |\n| `varnish_cache_size` | Hot pages are being pushed out of the page cache |\n\nSee Performance tuning for how to measure before you change\nanything."} {"id":"applications/wordpress/best-practices.md#stability","url":"https://docs.turbostack.app/applications/wordpress/best-practices/#stability","path":"applications/wordpress/best-practices.md","title":"WordPress best practices","heading":"Stability","keywords":"wordpress performance wordpress optimization wordpress caching wordpress turbostack Varnish wordpress Redis object cache wp-cli woocommerce performance","text":"- **Back up before every change.** Confirm backups are running so\n you can restore the database and uploads after a bad plugin or update.\n- **Watch Health** for CPU, memory, PHP-FPM and database pressure,\n and act on sustained trends.\n- **Keep WordPress, plugins, themes and PHP current** - most outages and exploits trace back to\n stale code; apply security updates promptly.\n- **Test on a staging clone first.** Trial core upgrades, major plugin changes and theme switches on\n a copy before publishing to production."} {"id":"applications/wordpress/best-practices.md#related","url":"https://docs.turbostack.app/applications/wordpress/best-practices/#related","path":"applications/wordpress/best-practices.md","title":"WordPress best practices","heading":"Related","keywords":"wordpress performance wordpress optimization wordpress caching wordpress turbostack Varnish wordpress Redis object cache wp-cli woocommerce performance","text":"- Deploy WordPress\n- WordPress reference\n- Troubleshooting WordPress\n- Services\n- Performance tuning"} {"id":"applications/wordpress/deploy.md#intro","url":"https://docs.turbostack.app/applications/wordpress/deploy/","path":"applications/wordpress/deploy.md","title":"Deploy WordPress on TurboStack","heading":"","keywords":"deploy wordpress wordpress hosting wordpress turbostack php 8.4 mysql Redis object cache woocommerce wp-cli","text":"# Deploy WordPress on TurboStack\n\nWordPress is a PHP content management system for blogs, marketing sites, and WooCommerce stores. On TurboStack, the platform provisions the PHP runtime, MySQL database, and caching services from your host configuration. You deploy by publishing."} {"id":"applications/wordpress/deploy.md#requirements","url":"https://docs.turbostack.app/applications/wordpress/deploy/#requirements","path":"applications/wordpress/deploy.md","title":"Deploy WordPress on TurboStack","heading":"Requirements","keywords":"deploy wordpress wordpress hosting wordpress turbostack php 8.4 mysql Redis object cache woocommerce wp-cli","text":"| Requirement | Recommended |\n| --- | --- |\n| App type | `wordpress` |\n| Runtime | PHP 8.4 (or newer) |\n| Database | MySQL 8.4 |\n| Cache (Redis) | Enabled (object cache, recommended) |\n| Page cache (Varnish) | Optional (validate plugin compatibility) |\n| Web server | Nginx |\n\n> [!NOTE]\n> TurboStack can auto-install WordPress for you. Set `app_install: true` and the platform uses wp-cli to scaffold the site, so you skip the manual installer."} {"id":"applications/wordpress/deploy.md#configure-it","url":"https://docs.turbostack.app/applications/wordpress/deploy/#configure-it","path":"applications/wordpress/deploy.md","title":"Deploy WordPress on TurboStack","heading":"Configure it","keywords":"deploy wordpress wordpress hosting wordpress turbostack php 8.4 mysql Redis object cache woocommerce wp-cli","text":"1. Open the host's Applications tab.\n2. Click **Add app or database**.\n3. Set **App Type** to `wordpress` and choose the PHP runtime under **Technologies**.\n4. Enable MySQL and Redis as services, and optionally enable Varnish.\n5. Publish to apply the configuration."} {"id":"applications/wordpress/deploy.md#example-configuration","url":"https://docs.turbostack.app/applications/wordpress/deploy/#example-configuration","path":"applications/wordpress/deploy.md","title":"Deploy WordPress on TurboStack","heading":"Example configuration","keywords":"deploy wordpress wordpress hosting wordpress turbostack php 8.4 mysql Redis object cache woocommerce wp-cli","text":"```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # WordPress stores its data in MySQL\nredis_enabled: true # object cache (recommended, esp. WooCommerce)\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com www.example.com\n app_type: wordpress\n php_version: \"8.4\"\n cert_type: letsencrypt # automatic HTTPS\n varnish_enabled: false # optional full-page cache; verify plugin compatibility\n```"} {"id":"applications/wordpress/deploy.md#why-these-choices","url":"https://docs.turbostack.app/applications/wordpress/deploy/#why-these-choices","path":"applications/wordpress/deploy.md","title":"Deploy WordPress on TurboStack","heading":"Why these choices","keywords":"deploy wordpress wordpress hosting wordpress turbostack php 8.4 mysql Redis object cache woocommerce wp-cli","text":"- **MySQL 8.4** is WordPress's canonical datastore; all posts, options, and metadata live there.\n- **Redis** provides a persistent object cache that reduces repeated database queries. The gain is highest for WooCommerce and high-traffic sites.\n- Varnish is left off by default because full-page caching can conflict with logged-in sessions and some plugins. Enable it only after validating compatibility.\n- **Nginx** serves static assets efficiently and pairs well with PHP-FPM for WordPress workloads.\n- **Let's Encrypt** gives automatic, renewing HTTPS with no manual certificate handling."} {"id":"applications/wordpress/deploy.md#related","url":"https://docs.turbostack.app/applications/wordpress/deploy/#related","path":"applications/wordpress/deploy.md","title":"Deploy WordPress on TurboStack","heading":"Related","keywords":"deploy wordpress wordpress hosting wordpress turbostack php 8.4 mysql Redis object cache woocommerce wp-cli","text":"- Technologies used: PHP, MySQL, Redis, Varnish.\n\n- Best practices - performance & stability.\n- WP-CLI command reference - manage WordPress over SSH.\n- Troubleshooting - logs & common fixes.\n- Applications overview\n- Services\n- Applications (host tab)\n- The Source (YAML) view"} {"id":"applications/wordpress/reference.md#intro","url":"https://docs.turbostack.app/applications/wordpress/reference/","path":"applications/wordpress/reference.md","title":"WordPress reference","heading":"","keywords":"wordpress cli wp-cli wp command wordpress file layout wordpress cron wp-cron wordpress reference","text":"# WordPress reference\n\nReference for running WordPress on TurboStack: where the files live, the command-line tool, and the scheduled jobs. For setup see Deploy WordPress on TurboStack; for tuning see WordPress best practices."} {"id":"applications/wordpress/reference.md#file-layout","url":"https://docs.turbostack.app/applications/wordpress/reference/#file-layout","path":"applications/wordpress/reference.md","title":"WordPress reference","heading":"File layout","keywords":"wordpress cli wp-cli wp command wordpress file layout wordpress cron wp-cron wordpress reference","text":"Everything lives under your system user's home directory. `~` is that home directory (for example `/var/www/prod/`). `~/public_html` is both the WordPress root and the web document root.\n\n| Path | What it is |\n| --- | --- |\n| `~/public_html/` | WordPress root and web document root (the served files) |\n| `~/public_html/wp-admin/` | Admin interface |\n| `~/public_html/wp-content/` | Themes, plugins and uploads |\n| `~/public_html/wp-includes/` | Core functions |\n| `~/public_html/wp-config.php` | Site configuration |\n| `~/nginx/` | Custom Nginx configuration |\n\nFor ownership and permissions, see Application file layout and permissions."} {"id":"applications/wordpress/reference.md#command-line-reference","url":"https://docs.turbostack.app/applications/wordpress/reference/#command-line-reference","path":"applications/wordpress/reference.md","title":"WordPress reference","heading":"Command-line reference","keywords":"wordpress cli wp-cli wp command wordpress file layout wordpress cron wp-cron wordpress reference","text":"WordPress ships a command-line interface (CLI) called WP-CLI. Run its commands with the `wp` tool from `~/public_html`. The common command groups are below.\n\n| Command | What it does |\n| --- | --- |\n| `wp core download` / `install` / `update` / `version` / `check-update` | Download, install, update or report the WordPress core |\n| `wp plugin install` / `activate` / `deactivate` / `delete` / `update` / `list` | Manage plugins |\n| `wp theme install` / `activate` / `delete` / `update` / `list` | Manage themes |\n| `wp user create` / `delete` / `list` / `update` / `get` | Manage users |\n| `wp db export` / `import` / `reset` / `check` / `optimize` | Manage the database |\n| `wp media import` / `regenerate` | Import media or regenerate thumbnails |\n| `wp option get` / `update` / `delete` | Read or change a site option |\n| `wp config create` / `set` / `get` | Manage `wp-config.php` values |\n| `wp cron event list` / `run` / `delete` | Inspect or run scheduled events |\n| `wp cache flush` | Flush the object cache |\n| `wp transient get` / `set` / `delete` | Manage transients |\n| `wp search-replace ` | Replace strings across the database (add `--dry-run` first) |\n| `wp site url` | Show or set site URLs |\n| `wp rewrite flush` | Flush permalink rewrite rules |\n| `wp eval` / `wp shell` | Run PHP code or open an interactive shell |\n\nCaching runs in front of WordPress with Redis and Varnish. Page-cache plugins include W3 Total Cache, WP Super Cache and LiteSpeed Cache. Clear the platform caches with the TurboStack command-line tool (`tscli`):\n\n> [!WARNING]\n> `tscli redis clear` and `tscli varnish clear` flush the whole cache. Traffic hits the origin until the cache refills. See TurboStack CLI."} {"id":"applications/wordpress/reference.md#cron","url":"https://docs.turbostack.app/applications/wordpress/reference/#cron","path":"applications/wordpress/reference.md","title":"WordPress reference","heading":"Cron","keywords":"wordpress cli wp-cli wp command wordpress file layout wordpress cron wp-cron wordpress reference","text":"WordPress schedules tasks with `wp-cron`, which runs only on page visits. On quiet sites jobs fire late; on busy sites they fire too often and waste PHP processes. For reliability, disable the web trigger and run a real cron that calls WP-CLI.\n\n1. Disable the web trigger in `wp-config.php`:\n ```php\n define( 'DISABLE_WP_CRON', true );\n ```\n2. Add a cron entry (every 5 minutes) that runs the due events:\n ```bash\n */5 * * * * wp cron event run --due-now --path=/var/www/prod/public_html > /dev/null 2>&1\n ```\n\nFor the multisite variant and full guidance, see WordPress best practices. To run a real cron as a persistent user service, see How to manage user system services."} {"id":"applications/wordpress/reference.md#related","url":"https://docs.turbostack.app/applications/wordpress/reference/#related","path":"applications/wordpress/reference.md","title":"WordPress reference","heading":"Related","keywords":"wordpress cli wp-cli wp command wordpress file layout wordpress cron wp-cron wordpress reference","text":"- Deploy WordPress on TurboStack\n- WordPress best practices\n- Troubleshooting WordPress\n- Application file layout and permissions\n- How to manage user system services"} {"id":"applications/wordpress/troubleshooting.md#intro","url":"https://docs.turbostack.app/applications/wordpress/troubleshooting/","path":"applications/wordpress/troubleshooting.md","title":"Troubleshooting WordPress","heading":"","keywords":"wordpress troubleshooting wordpress logs wordpress error wordpress turbostack white screen of death wordpress 404 permalinks Varnish cache wp-config database error","text":"# Troubleshooting WordPress\n\nMost WordPress problems on TurboStack come from a single change: a plugin or theme update, a caching layer, or a configuration edit. This page shows where the logs live, the issues you are most likely to hit, and a repeatable workflow to isolate the cause quickly."} {"id":"applications/wordpress/troubleshooting.md#where-to-find-the-logs","url":"https://docs.turbostack.app/applications/wordpress/troubleshooting/#where-to-find-the-logs","path":"applications/wordpress/troubleshooting.md","title":"Troubleshooting WordPress","heading":"Where to find the logs","keywords":"wordpress troubleshooting wordpress logs wordpress error wordpress turbostack white screen of death wordpress 404 permalinks Varnish cache wp-config database error","text":"Read logs in the order a request travels: web server, then PHP, then WordPress, then the database.\n\n| Component | Where |\n| --- | --- |\n| Nginx access/error | The host's Nginx log directory (per-vhost access and error logs) |\n| PHP-FPM | The PHP-FPM pool log for the site's system user |\n| WordPress (PHP) | `wp-content/debug.log` in the site's `public_html` (only when debug logging is enabled) |\n| Varnish | The Varnish service log on the host (when `varnish_enabled`) |\n| MySQL | The MySQL error/slow-query log on the host |\n| Nginx vhost config | `/var/www///nginx/50main.conf` |\n| wp-config.php | In the site's `public_html` (DB credentials, salts, `WP_DEBUG`) |\n\nTo capture PHP errors temporarily, set `WP_DEBUG` and `WP_DEBUG_LOG` to `true` in `wp-config.php`; this writes to `wp-content/debug.log`. Turn it off again on production. You can also see resource and service status on the host's Health tab and recent deploys in History."} {"id":"applications/wordpress/troubleshooting.md#common-issues","url":"https://docs.turbostack.app/applications/wordpress/troubleshooting/#common-issues","path":"applications/wordpress/troubleshooting.md","title":"Troubleshooting WordPress","heading":"Common issues","keywords":"wordpress troubleshooting wordpress logs wordpress error wordpress turbostack white screen of death wordpress 404 permalinks Varnish cache wp-config database error","text":"| Symptom | Likely cause | Fix |\n| --- | --- | --- |\n| White screen / HTTP 500 | PHP fatal error from a plugin, theme or update | Enable `WP_DEBUG_LOG` and read `wp-content/debug.log`; deactivate the offending plugin/theme via wp-cli (`wp plugin deactivate `) or by renaming its folder |\n| \"Error establishing a database connection\" | Wrong credentials, or MySQL down/overloaded | Verify the `DB_*` values in `wp-config.php`, confirm MySQL is running in Services, check the MySQL log |\n| Pages 404 except the home page | Rewrite/permalink rules lost | Re-flush permalinks: `wp rewrite flush --hard` (the platform sets `/%postname%/`); confirm the Nginx `try_files ... /index.php?$args` block |\n| Stale content after editing | Full-page cache not purged | Install/configure the Proxy Cache Purge plugin so edits purge Varnish; check the `X-Cacheable` response header to see hits vs passes |\n| Logged-in or cart pages caching wrongly | Page cache caching session traffic | Varnish already bypasses `wp-admin`/cart/`my-account`; avoid stacking a second page-cache plugin and verify custom URLs are in the bypass list |\n| Redis object cache not connecting | Plugin misconfigured or Redis disabled | Enable Redis in Services and reconnect the object-cache plugin; remove a stale `object-cache.php` drop-in if Redis is off |\n| Media upload \"exceeds the maximum\" | PHP/nginx upload limits too low | Raise `upload_max_filesize`/`post_max_size` and the Nginx `client_max_body_size` for the site |\n| Mixed-content warnings after HTTPS | URLs still stored as `http://` | Run `wp search-replace 'http://example.com' 'https://example.com'` and set the site/home URL to `https://` |"} {"id":"applications/wordpress/troubleshooting.md#a-troubleshooting-workflow","url":"https://docs.turbostack.app/applications/wordpress/troubleshooting/#a-troubleshooting-workflow","path":"applications/wordpress/troubleshooting.md","title":"Troubleshooting WordPress","heading":"A troubleshooting workflow","keywords":"wordpress troubleshooting wordpress logs wordpress error wordpress turbostack white screen of death wordpress 404 permalinks Varnish cache wp-config database error","text":"1. **Check Health** - rule out CPU, memory, PHP-FPM or database saturation before chasing application bugs.\n2. **Read the relevant log** - start with the Nginx error log and PHP-FPM/`debug.log` for 500s and white screens; the MySQL log for connection errors.\n3. **Check the last deploy in History** - if a recent change broke the site, revert and Publish the previous working revision.\n4. **Verify services are running** - confirm Nginx, PHP-FPM, MySQL and (if used) Redis and Varnish are up in Services; reload after config changes."} {"id":"applications/wordpress/troubleshooting.md#getting-help","url":"https://docs.turbostack.app/applications/wordpress/troubleshooting/#getting-help","path":"applications/wordpress/troubleshooting.md","title":"Troubleshooting WordPress","heading":"Getting help","keywords":"wordpress troubleshooting wordpress logs wordpress error wordpress turbostack white screen of death wordpress 404 permalinks Varnish cache wp-config database error","text":"If the issue persists after these steps, reach out via Support. For platform-wide problems beyond WordPress itself, see the general Troubleshooting guide. Include the relevant log excerpts and the revision where the problem started."} {"id":"applications/wordpress/troubleshooting.md#related","url":"https://docs.turbostack.app/applications/wordpress/troubleshooting/#related","path":"applications/wordpress/troubleshooting.md","title":"Troubleshooting WordPress","heading":"Related","keywords":"wordpress troubleshooting wordpress logs wordpress error wordpress turbostack white screen of death wordpress 404 permalinks Varnish cache wp-config database error","text":"- Deploy WordPress\n- WordPress best practices\n- Health\n- Support"} {"id":"applications/wordpress/wp-cli.md#intro","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"# WP-CLI command reference\n\nWP-CLI is the command-line interface (CLI) for WordPress. It is installed on every TurboStack host as `wp`, so you can manage a site over SSH instead of clicking through the admin. This makes it fast for updates, bulk changes and scripting across many sites. This page groups the common commands by task. For where the files live and the cron setup, see WordPress reference."} {"id":"applications/wordpress/wp-cli.md#how-to-run-it","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#how-to-run-it","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"How to run it","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"Connect over SSH, change into the WordPress root, then run `wp`:\n\n```bash\ncd ~/public_html\nwp \n```\n\nHere `~` is your system user's home directory (for example `/var/www/prod/`), and `~/public_html` is the WordPress root. WP-CLI reads `wp-config.php` from this directory, so always run it from there (or pass `--path=/var/www/prod/public_html`).\n\nRun `wp help` for the full command list, or `wp help ` for the options and examples of a single command."} {"id":"applications/wordpress/wp-cli.md#core","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#core","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"Core","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"| Command | What it does |\n| --- | --- |\n| `wp core download` | Downloads WordPress core files. |\n| `wp core install` | Runs the WordPress installation. |\n| `wp core update` | Updates WordPress core to the latest version. |\n| `wp core version` | Displays the current WordPress version. |\n| `wp core check-update` | Checks for available core updates. |"} {"id":"applications/wordpress/wp-cli.md#plugins","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#plugins","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"Plugins","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"| Command | What it does |\n| --- | --- |\n| `wp plugin install ` | Installs a plugin by slug or URL. |\n| `wp plugin activate ` / `deactivate ` | Activates or deactivates a plugin. |\n| `wp plugin update ` | Updates a specific plugin. |\n| `wp plugin delete ` | Deletes a plugin. |\n| `wp plugin list` | Lists installed plugins with status. |"} {"id":"applications/wordpress/wp-cli.md#themes","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#themes","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"Themes","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"| Command | What it does |\n| --- | --- |\n| `wp theme install ` | Installs a theme by slug or URL. |\n| `wp theme activate ` | Activates a theme. |\n| `wp theme update ` | Updates a specific theme. |\n| `wp theme delete ` | Deletes a theme. |\n| `wp theme list` | Lists installed themes. |"} {"id":"applications/wordpress/wp-cli.md#users","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#users","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"Users","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"| Command | What it does |\n| --- | --- |\n| `wp user create ` | Creates a new user. |\n| `wp user list` | Lists all users. |\n| `wp user update ` | Updates user information. |\n| `wp user get ` | Displays user data. |\n| `wp user delete ` | Deletes a user. |"} {"id":"applications/wordpress/wp-cli.md#database","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#database","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"Database","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"| Command | What it does |\n| --- | --- |\n| `wp db export` | Exports the database to an SQL file. |\n| `wp db import ` | Imports an SQL file into the database. |\n| `wp db check` | Checks database for errors. |\n| `wp db optimize` | Optimizes the database. |\n| `wp db reset` | Drops all tables and reinitializes the DB. |"} {"id":"applications/wordpress/wp-cli.md#content-and-options","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#content-and-options","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"Content and options","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"| Command | What it does |\n| --- | --- |\n| `wp post create` / `update ` / `delete ` / `list` | Creates, updates, deletes, or lists posts. |\n| `wp media import ` | Imports media files into the Media Library. |\n| `wp media regenerate` | Regenerates image sizes for Media Library. |\n| `wp option get ` / `update ` / `delete ` | Gets, updates, or deletes an option value. |\n| `wp config create` / `set ` / `get ` | Creates a `wp-config.php` file, or sets and gets config values. |"} {"id":"applications/wordpress/wp-cli.md#cron","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#cron","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"Cron","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"| Command | What it does |\n| --- | --- |\n| `wp cron event list` | Lists scheduled cron events. |\n| `wp cron event run ` | Executes a cron event immediately. |\n| `wp cron event run --due-now` | Run all events that are due |\n| `wp cron event delete ` | Deletes a cron event. |\n\nFor reliable scheduling, replace the default web-triggered `wp-cron` with a real cron job that calls WP-CLI - see WordPress reference."} {"id":"applications/wordpress/wp-cli.md#cache-and-search-replace","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#cache-and-search-replace","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"Cache and search-replace","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"| Command | What it does |\n| --- | --- |\n| `wp cache flush` | Clears the object cache. |\n| `wp transient get ` / `set` / `delete` | Gets, sets, or deletes a transient value. |\n| `wp search-replace ` | Replaces strings in DB. |\n| `wp rewrite flush` | Flushes rewrite rules. |\n\n> [!WARNING]\n> Always test `wp search-replace` with `--dry-run` first. It reports how many rows would change without writing anything. This matters most when moving a site between domains (for example `dev.example.com` to `example.com`).\n\n> [!NOTE]\n> `wp cache flush` clears WordPress's own object cache. The platform caches (Redis and Varnish) are separate - clear those with the TurboStack command-line tool (`tscli redis clear`, `tscli varnish clear`). See TurboStack CLI."} {"id":"applications/wordpress/wp-cli.md#wp-cli-itself","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#wp-cli-itself","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"WP-CLI itself","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"| Command | What it does |\n| --- | --- |\n| `wp cli update` | Updates WP-CLI itself to the latest release. |"} {"id":"applications/wordpress/wp-cli.md#related","url":"https://docs.turbostack.app/applications/wordpress/wp-cli/#related","path":"applications/wordpress/wp-cli.md","title":"WP-CLI command reference","heading":"Related","keywords":"wp-cli wp command wordpress cli wp plugin wp db export wp search-replace wp cron manage wordpress ssh","text":"- WordPress reference\n- Deploy WordPress on TurboStack\n- WordPress best practices\n- Troubleshooting WordPress\n- Connect over SSH"} {"id":"concepts/glossary.md#intro","url":"https://docs.turbostack.app/concepts/glossary/","path":"concepts/glossary.md","title":"Glossary","heading":"","keywords":"","text":"# Glossary\n\nA quick reference to the terms you will encounter across TurboStack, grouped by topic. Where a\nterm has a dedicated page, follow the link for the full details."} {"id":"concepts/glossary.md#core-objects","url":"https://docs.turbostack.app/concepts/glossary/#core-objects","path":"concepts/glossary.md","title":"Glossary","heading":"Core objects","keywords":"","text":"| Term | Definition |\n|---|---|\n| **Host** | A single server and the configuration it should run. It is the central object you work with. See Hosts. |\n| **System user** | An operating-system account on a host that owns files and runs applications. Applications are configured beneath a system user. See Applications. |\n| **Application (vhost)** | An individual site or application running under a system user, with its own domain, application type, PHP version and TLS certificate. See Applications. |\n| **Group** | A reusable set of settings, such as SSH keys or security rules, applied to many hosts at once. See Groups. |\n| **Template** | A pre-built host configuration you can apply to new hosts to save setup time. See Templates. |\n| **System type** | How a host's server is managed (`customstack`, `cpanel`, `directadmin` or `windows`), which determines the tabs and options available. See System types. |\n| **Client** | A customer account that owns hosts, groups and templates. You only ever see the resources of the account you are signed in to. See Accounts and access. |"} {"id":"concepts/glossary.md#platform-tools-and-features","url":"https://docs.turbostack.app/concepts/glossary/#platform-tools-and-features","path":"concepts/glossary.md","title":"Glossary","heading":"Platform, tools and features","keywords":"","text":"| Term | Definition |\n|---|---|\n| **TurboStack Platform** | Hosted Power's platform for managing your hosting infrastructure, usable through the GUI, YAML (Source view) or the REST API. See TurboStack Platform. |\n| **Customer Center** | Hosted Power's customer portal for your account, services, domains, billing, contacts and support tickets. See Customer Center. |\n| **TurboStack CLI (`tscli`)** | The command-line tool on every TurboStack server for managing live services and common admin tasks (caches, firewall, email, logs) over SSH. See TurboStack CLI. |\n| **Backups** | Scheduled and on-demand backups of a host's files and databases, with restore to a chosen target. See Backups. |\n| **Monitoring** | Fleet-wide health and alerting across your hosts, plus per-application uptime checks. See Monitoring. |\n| **Migration Hero** | A tool that pulls an existing site from an external host into TurboStack. See Migration Hero. |\n| **Cloning** | Copying an account's files and database to another system user, for example to make a staging copy. See History. |\n| **Staging** | A non-production copy of a site used to test changes before applying them to the live site. |\n| **User system service** | A long-lived application process (queue worker, message-queue consumer or background job) run as a per-user systemd service that restarts on failure and survives logout. See System services. |"} {"id":"concepts/glossary.md#configuration-and-deployment","url":"https://docs.turbostack.app/concepts/glossary/#configuration-and-deployment","path":"concepts/glossary.md","title":"Glossary","heading":"Configuration and deployment","keywords":"","text":"| Term | Definition |\n|---|---|\n| **Publish / Deploy** | Saving and applying a host's configuration to the server so the server matches your intended state. See Publishing changes. |\n| **Full Publish** | A complete deployment that re-applies the whole configuration (**Save & Full Publish**), used after larger changes or to be thorough. See Publishing changes. |\n| **Full & Reset Deploy** | A full deployment that also permanently removes anything you deleted from the configuration (**Save, Delete & Full Publish**), destroying the associated data. See Publishing changes. |\n| **Revision** | A saved snapshot of a configuration, recorded each time you save, that you can review and restore. See History. |\n| **Source (YAML) view** | The raw-YAML editor for a configuration, kept in sync with the GUI editor. See The Source (YAML) view. |\n| **Credentials** | The server and per-account access details for a host. See Credentials. |\n| **Desired state** | The configuration you define for a host as the intended end result; TurboStack deploys the server to match it. See Introduction. |\n| **Wildcard certificate** | A TLS certificate covering all subdomains of a domain (`*.example.com`); it requires the DNS validation challenge. See TLS certificates. |"} {"id":"concepts/glossary.md#health-and-security","url":"https://docs.turbostack.app/concepts/glossary/#health-and-security","path":"concepts/glossary.md","title":"Glossary","heading":"Health and security","keywords":"","text":"| Term | Definition |\n|---|---|\n| **Health** | Live monitoring for a host: top issues plus CPU, memory, disk and service checks. See Health. |\n| **Threat Center** | The host tab that surfaces security findings and vulnerabilities detected on that host. See Threat Center. |\n| **TurboShield** | TurboStack's web-traffic protection: rate limiting, bot classification, search-bot verification, known-exploit blocking, attack detection with auto-expiring bans, and an optional bot challenge. Enabled by default. See What is TurboShield?. |\n| **TurboRadar** | Runtime security detection and scanning that runs after deployment, reporting findings to the Threat Center. Enabled on every host. See Security overview. |\n| **Firewall** | A managed, stateful firewall that automatically blocks malicious IP addresses from brute-force attempts and web attacks, with auto-expiring bans, while honouring your allow-list. See Security overview. |\n| **PrivateNet** | A secure, encrypted private overlay network (a mesh Virtual Private Network, or VPN) connecting your managed servers. See Networking. |"} {"id":"concepts/glossary.md#security-findings-and-scores","url":"https://docs.turbostack.app/concepts/glossary/#security-findings-and-scores","path":"concepts/glossary.md","title":"Glossary","heading":"Security findings and scores","keywords":"","text":"These terms appear in the Threat Center, where you read and act\non a host's security findings. See that page for how to interpret and prioritise them.\n\n| Term | Definition |\n|---|---|\n| **CVE** (Common Vulnerabilities and Exposures) | A public, unique identifier for one specific known security weakness in software, written `CVE-2024-12345`. It names the weakness; the scores below say how urgent it is. |\n| **CVSS** (Common Vulnerability Scoring System) | A severity score from 0.0 to 10.0 for how much damage a weakness could cause *if* exploited (9.0+ Critical, 7.0-8.9 High, 4.0-6.9 Medium, 0.1-3.9 Low). It rates impact, not likelihood. |\n| **EPSS** (Exploit Prediction Scoring System) | A percentage (0-100%) estimating how *likely* a weakness is to be exploited within 30 days. 80% or more is shown as \"Likely exploited\". It rates likelihood, not severity. |\n| **KEV** (Known Exploited Vulnerabilities) | A public catalogue of weaknesses confirmed to be under active attack in the real world. An \"Exploited (KEV)\" badge is the strongest signal to fix immediately. |\n| **Risk score** | A single number TurboStack calculates by combining KEV, EPSS and CVSS, so you can prioritise without weighing each score yourself. The vulnerabilities list is sorted by it, most urgent first. |\n| **IoC** (Indicator of Compromise) | Evidence that a host has *already* been breached, most often a malicious file (web shell, backdoor, skimmer) found on disk. Always treated as Critical. |\n| **Vulnerability** | A known weakness in your software or its dependencies that an attacker could exploit. Usually fixed by updating to the \"Fixed in\" version. |"} {"id":"concepts/glossary.md#applications","url":"https://docs.turbostack.app/concepts/glossary/#applications","path":"concepts/glossary.md","title":"Glossary","heading":"Applications","keywords":"","text":"Application types you can deploy. Each has a deploy guide with example YAML - see Deploying applications.\n\n| Application | What it is |\n|---|---|\n| **Magento 2 / Adobe Commerce** | A PHP e-commerce platform (MySQL, Elasticsearch/OpenSearch, Redis, Varnish). See Magento. |\n| **WordPress** | A PHP content management system (CMS) for applications and blogs (MySQL, Redis). See WordPress. |\n| **Shopware** | A PHP e-commerce platform (MySQL, Redis, Varnish). See Shopware. |\n| **Drupal** | A PHP content management system (MySQL, Redis). See Drupal. |\n| **Laravel** | A PHP web-application framework (MySQL, Redis), with your code deployed via Git. See Laravel. |\n| **Akeneo** | A PHP Product Information Management (PIM) system (MySQL, Elasticsearch, Redis). See Akeneo. |\n| **OroCommerce** | A PHP B2B e-commerce platform (MySQL, Redis, RabbitMQ). See OroCommerce. |\n| **Craft CMS** | A PHP content management system (MySQL, Redis). See Craft CMS. |\n| **Nextcloud** | A PHP self-hosted file-sync and collaboration suite (MySQL or PostgreSQL, Redis). See Nextcloud. |\n| **Odoo** | A Python Enterprise Resource Planning (ERP) and business suite (PostgreSQL), run behind Nginx. See Odoo. |\n| **Medusa** | A Node.js headless commerce platform (PostgreSQL), run behind the Nginx reverse proxy. See Medusa. |\n| **nopCommerce** | A .NET e-commerce platform (Microsoft SQL Server), run behind the Nginx reverse proxy. See nopCommerce. |\n| **GitLab** | A self-hosted DevOps platform, run on Kubernetes and set up by Hosted Power through Support. See Self-hosted platforms. |\n| **Advanced Database Monitoring** | TurboStack's database query-performance and metrics monitoring, run on Kubernetes via a monitoring master server. See Self-hosted platforms. |"} {"id":"concepts/glossary.md#technologies","url":"https://docs.turbostack.app/concepts/glossary/#technologies","path":"concepts/glossary.md","title":"Glossary","heading":"Technologies","keywords":"","text":"The open-source building blocks TurboStack provisions and manages. Each has a \"what is\" and a \"configure\" page - see Technologies.\n\n| Technology | What it is |\n|---|---|\n| **Nginx** | The default web server and reverse proxy. See Nginx. |\n| **Apache** | An alternative web server (`apache2`) for apps that need `.htaccess` or Apache modules. See Apache. |\n| **PHP** | The server-side language behind most applications; multiple versions per application. See PHP. |\n| **PHP-FPM** | The FastCGI Process Manager that runs PHP behind the web server; its worker pool handles requests. |\n| **Node.js** | A server-side JavaScript runtime, run as a process behind the reverse proxy. See Node.js. |\n| **Python** | A general-purpose language, run as a per-application process behind the reverse proxy. See Python. |\n| **Ruby** | A dynamic language, run as an isolated per-user process. See Ruby. |\n| **.NET** | Microsoft's open-source runtime for web apps and services, run behind the reverse proxy. See .NET. |\n| **MySQL** | A widely used open-source relational database (TurboStack runs Percona Server for MySQL). See MySQL. |\n| **MariaDB** | A MySQL-compatible open-source relational database. |\n| **Percona Server** | The performance-tuned MySQL and MongoDB distributions TurboStack runs. |\n| **PostgreSQL** | A standards-compliant open-source relational database. See PostgreSQL. |\n| **MongoDB** | A document-oriented NoSQL database (Percona Server for MongoDB). See MongoDB. |\n| **Microsoft SQL Server** | A relational database used by .NET applications. See Microsoft SQL Server. |\n| **Redis** | An in-memory data store for object cache, sessions and queues. See Redis. |\n| **Varnish** | An HTTP full-page cache that accelerates PHP storefronts, configured with VCL. See Varnish. |\n| **Elasticsearch** | A distributed full-text search and analytics engine. See Elasticsearch. |\n| **OpenSearch** | An open-source, Elasticsearch-compatible search engine. See OpenSearch. |\n| **RabbitMQ** | An Advanced Message Queuing Protocol (AMQP) message broker for asynchronous task and job queues. See RabbitMQ. |\n| **Docker** | Runs a containerized application on an application, with Nginx proxying to the container. See Docker. |\n| **Kubernetes** | A lightweight container orchestrator for running containerized workloads. See Kubernetes. |\n| **Reverse proxy** | Nginx forwarding public traffic to a backend application process or container. See Reverse proxy. |\n| **Process manager** | A supervisor (such as Supervisor or PM2) that keeps long-running app processes and queue workers alive. |\n| **Buffer pool** | The in-memory area MySQL/InnoDB uses to cache data and indexes; the main database performance tuning knob. |\n| **Swap** | Disk space used as overflow when a server runs out of RAM; heavy swapping slows the server. |"} {"id":"concepts/glossary.md#web-serving-and-performance","url":"https://docs.turbostack.app/concepts/glossary/#web-serving-and-performance","path":"concepts/glossary.md","title":"Glossary","heading":"Web serving and performance","keywords":"","text":"Words that appear throughout the technology and troubleshooting pages.\n\n| Term | Definition |\n|---|---|\n| **Backend** | The application process behind the web server that actually builds a response: a PHP-FPM pool, a Node.js or Python process, or a container. Nginx takes the visitor's request and passes it to the backend. |\n| **Upstream** | The backend address Nginx forwards a request to, declared as an `upstream` block in the Nginx configuration. \"The upstream is down\" means the application behind Nginx did not answer. See Reverse proxy. |\n| **Document root (docroot)** | The directory the web server serves a site's files from, usually `public_html`. See Change your Nginx docroot. |\n| **Worker** | One process that handles one unit of work at a time. A PHP-FPM worker is a single PHP process handling one request at a time, so the number of workers is how many requests a site can process at once. A queue worker does the same for background jobs. |\n| **Consumer** | A long-running process that takes messages off a queue and handles them, for example an OroCommerce message-queue consumer. See RabbitMQ. |\n| **Cache hit ratio** | The share of requests answered from the cache instead of the application or database. A low ratio means requests are missing the cache, so PHP and the database do the full work. See Why is my site slow?. |"} {"id":"concepts/glossary.md#email-terms","url":"https://docs.turbostack.app/concepts/glossary/#email-terms","path":"concepts/glossary.md","title":"Glossary","heading":"Email terms","keywords":"","text":"Terms used on the Email deliverability and\nSMTP error codes pages.\n\n| Term | Definition |\n|---|---|\n| **Hard fail (`-all`)** | An SPF record that ends in `-all` tells receiving servers to reject mail from any server it does not list. A soft fail (`~all`) only asks them to treat it as suspicious. |\n| **Alignment** | The DMARC check that the domain a reader sees in the From address belongs to the same domain that passed SPF or DKIM. Strict alignment wants an exact match; relaxed alignment also accepts a parent domain or a subdomain. |\n| **MailFROM domain** | The domain the sending server gives in the SMTP `MAIL FROM` command (the envelope sender). SPF checks this domain, and the reader never sees it. |\n| **Header From domain** | The domain in the `From:` address shown in the reader's mail client. DMARC alignment compares it with the MailFROM domain or the DKIM signing domain. |"} {"id":"concepts/glossary.md#abbreviations-and-acronyms","url":"https://docs.turbostack.app/concepts/glossary/#abbreviations-and-acronyms","path":"concepts/glossary.md","title":"Glossary","heading":"Abbreviations and acronyms","keywords":"","text":"A quick expansion of the abbreviations used across the documentation.\n\n| Abbreviation | Stands for |\n|---|---|\n| **AAAA** | Quad-A record (the DNS record that points a name at an IPv6 address; the A record does the same for IPv4). |\n| **ACME** | Automatic Certificate Management Environment (the protocol Let's Encrypt uses to issue certificates). |\n| **AI** | Artificial Intelligence (software that answers questions or generates content; AI crawlers collect pages to train such software). |\n| **AJAX** | Asynchronous JavaScript and XML (a browser technique that loads data in the background without reloading the page). |\n| **AMQP** | Advanced Message Queuing Protocol (the messaging protocol RabbitMQ uses). |\n| **API** | Application Programming Interface (how software talks to the platform). See API reference. |\n| **APM** | Application Performance Monitoring. See Monitoring. |\n| **CC** | Carbon Copy (extra recipients who also receive an email or the replies on a ticket). |\n| **CDN** | Content Delivery Network. |\n| **CI / CD** | Continuous Integration / Continuous Delivery (an automated pipeline that builds, tests and deploys your code). |\n| **CIDR** | Classless Inter-Domain Routing (an IP-range notation such as `203.0.113.0/24`). |\n| **CISA** | Cybersecurity and Infrastructure Security Agency (the United States agency that publishes the KEV list of exploited weaknesses). |\n| **CLI** | Command-Line Interface (text commands run over SSH; see the TurboStack CLI). |\n| **CMS** | Content Management System (such as WordPress or Drupal). |\n| **CNAME** | Canonical Name (a DNS record that points one name at another name, shown as \"Alias\" in some interfaces). |\n| **CPU** | Central Processing Unit (the server's processor). |\n| **CRM** | Customer Relationship Management (software for tracking customers, leads and sales, such as Odoo). |\n| **CSR** | Certificate Signing Request (submitted to a certificate authority to buy a certificate). |\n| **CSS** | Cascading Style Sheets (the files that control how a web page looks). |\n| **CSV** | Comma-Separated Values (a simple spreadsheet/export file format). |\n| **DAL** | Data Abstraction Layer (Shopware's layer between the application and the database). |\n| **DAV** | Distributed Authoring and Versioning (the WebDAV protocol for working with files over HTTP; CalDAV and CardDAV are its calendar and contacts versions). |\n| **DB** | Database (the short form used in command names, log output and configuration keys). |\n| **DDoS** | Distributed Denial of Service (an attack that floods a site to take it offline). |\n| **DI** | Dependency Injection (how a framework wires classes together; Magento compiles its DI container in production mode). |\n| **DKIM** | DomainKeys Identified Mail (an email-authentication signature). See Email. |\n| **DMARC** | Domain-based Message Authentication, Reporting and Conformance (an email-authentication policy). |\n| **DNS** | Domain Name System (translates domain names to IP addresses). See Connecting your domain. |\n| **DNSSEC** | Domain Name System Security Extensions (signed DNS answers, so a resolver can detect a forged reply). See DNS management. |\n| **EAV** | Entity-Attribute-Value (the flexible database model Magento uses to store product attributes). |\n| **EdDSA** | Edwards-curve Digital Signature Algorithm (the modern SSH key type, used by Ed25519 keys). See Add an SSH key. |\n| **EOL** | End Of Life (a version that no longer receives updates or security fixes). |\n| **EPP** | Extensible Provisioning Protocol (the protocol behind domain registrations; the EPP code is the authorization code you need to transfer a domain). |\n| **ERP** | Enterprise Resource Planning (business-management software such as Odoo). |\n| **ESI** | Edge Side Includes (a Varnish feature that builds one page from separately cached fragments). |\n| **FPM** | FastCGI Process Manager (the part of PHP that runs your code behind the web server; always written PHP-FPM). |\n| **FQDN** | Fully Qualified Domain Name (a complete hostname such as `www.example.com`). |\n| **FTP / SFTP** | File Transfer Protocol / SSH File Transfer Protocol (file upload methods; SFTP is the secure one). |\n| **FTPS** | File Transfer Protocol Secure (classic FTP wrapped in TLS encryption; not the same as SFTP). |\n| **GB** | Gigabyte (a unit of storage or memory; 1 GB is 1024 megabytes). |\n| **GC** | Garbage Collection (a runtime freeing memory it no longer needs; heavy GC pressure slows an application down). |\n| **GD** | The GD Graphics Library (the PHP extension that resizes and converts images; ImageMagick is the alternative). |\n| **GeoIP** | Geographic IP (locating a visitor's country from their IP address). |\n| **GUI** | Graphical User Interface (the web interface of the TurboStack Platform, as opposed to YAML or the API). |\n| **HSTS** | HTTP Strict Transport Security (a header that forces browsers to use HTTPS). |\n| **HTML** | HyperText Markup Language (the code a web page is built from). |\n| **HTTP / HTTPS** | HyperText Transfer Protocol (Secure) - the web protocol; HTTPS is the encrypted version. |\n| **IIS** | Internet Information Services (Microsoft's web server). |\n| **IMAP** | Internet Message Access Protocol (for reading email). |\n| **IoC** | Indicator of Compromise (see the security table above). |\n| **IP / IPv4 / IPv6** | Internet Protocol address (a server or visitor's network address). |\n| **JS** | JavaScript (the programming language that runs in the visitor's browser). |\n| **JSON** | JavaScript Object Notation (the data format the API uses). |\n| **JVM** | Java Virtual Machine (the Java runtime that Elasticsearch and OpenSearch run on; the memory it reserves is called the heap). |\n| **JWT** | JSON Web Token (a signed token an application uses to recognize a signed-in user or service). |\n| **LTS** | Long-Term Support (a release that keeps receiving fixes for an extended period, so it is the safe choice for production). |\n| **MB** | Megabyte (a unit of storage or memory; 1024 MB is 1 GB). |\n| **MX** | Mail Exchanger (the DNS record that says which mail server receives a domain's email). |\n| **NoSQL** | A non-relational database model (such as MongoDB). |\n| **OCSP** | Online Certificate Status Protocol (how a browser checks that a TLS certificate has not been revoked). |\n| **OOM** | Out Of Memory (when a server runs out of usable memory). See Out of memory. |\n| **OPcache** | PHP's compiled-code cache, which speeds up PHP by reusing compiled scripts. |\n| **ORM** | Object-Relational Mapping (a library that maps database tables to objects in your code, such as Laravel's Eloquent). |\n| **OS** | Operating System (the software a server runs on, such as Debian or Ubuntu). |\n| **OSI** | Open Systems Interconnection (the seven-layer network model; layer 3 is the network layer and layer 7 the application layer). |\n| **OWASP** | Open Worldwide Application Security Project (the non-profit that publishes the OWASP Top 10 list of the most common web application risks). |\n| **PDF** | Portable Document Format (the document format used for invoices, labels and exports). |\n| **PEM** | Privacy Enhanced Mail (the plain-text file format for certificates and keys, starting with a `-----BEGIN` line). |\n| **PFX** | Personal Information Exchange (a `.pfx` file bundling a certificate and private key). |\n| **PHP** | PHP: Hypertext Preprocessor (the programming language most web applications on the platform run on). |\n| **PIM** | Product Information Management (product-catalog software such as Akeneo). |\n| **PM2** | A process manager for Node.js applications that keeps them running and restarts them after a crash. |\n| **POP3** | Post Office Protocol version 3 (an older protocol that downloads email to one device; IMAP is the modern choice). |\n| **PTR** | Pointer record (a reverse-DNS record mapping an IP address back to a hostname). |\n| **QR** | Quick Response code (the square barcode you scan with a phone camera). See Two-factor authentication. |\n| **RAM** | Random Access Memory (the server's working memory). |\n| **RBL** | Realtime Block List (a public blocklist of IP addresses and domains known for spam). See Email deliverability. |\n| **REST** | Representational State Transfer (the style of the TurboStack API: ordinary HTTP requests returning JSON). See API reference. |\n| **RSA** | Rivest-Shamir-Adleman (an older public-key algorithm, still supported for SSH keys and certificates). |\n| **SEO** | Search Engine Optimization (the work of making a site rank well in search results). |\n| **SES** | Simple Email Service (Amazon's service for sending bulk email). |\n| **SLA** | Service Level Agreement. |\n| **SMTP** | Simple Mail Transfer Protocol (for sending email). |\n| **SNI** | Server Name Indication (lets one IP address serve certificates for multiple domains). |\n| **SPF** | Sender Policy Framework (an email-authentication record). See Email. |\n| **SQL** | Structured Query Language (the query language for relational databases). |\n| **SSH** | Secure Shell (encrypted remote access to a server). See SSH access. |\n| **SSO** | Single Sign-On (signing in with one identity, such as GitHub or Google). |\n| **STARTTLS** | The mail-protocol command that upgrades a plain connection to an encrypted TLS one. |\n| **TCP** | Transmission Control Protocol (the connection-based transport protocol behind HTTP, SSH and database traffic). |\n| **TLS / SSL** | Transport Layer Security, formerly Secure Sockets Layer (SSL) - the encryption behind HTTPS. See TLS certificates. |\n| **TOTP** | Time-based One-Time Password (the six-digit code an authenticator app generates, valid for about 30 seconds). See Two-factor authentication. |\n| **TTL** | Time To Live (how long a DNS record or cache entry stays valid). |\n| **TXT** | Text record (a DNS record holding free text, used for SPF, DKIM, DMARC and domain-ownership checks). |\n| **UDP** | User Datagram Protocol (a lightweight transport protocol without connections, used by DNS and VPN traffic). |\n| **UI** | User Interface (the screens you click in, as opposed to a command line or the API). |\n| **URL** | Uniform Resource Locator (a web address such as `https://example.com/page`). |\n| **VAT** | Value Added Tax (the European sales tax; your VAT number appears on your invoices). |\n| **VCL** | Varnish Configuration Language (the rules that control Varnish caching). |\n| **VIP** | Virtual IP address (an IP address that can move between servers, so a standby server can take over). |\n| **VPN** | Virtual Private Network (a private, encrypted network). See Networking. |\n| **WAF** | Web Application Firewall (filters web requests to block attacks). See Security. |\n| **WHM** | WebHost Manager (the server-wide administration interface that comes with cPanel). See System types. |\n| **XSS** | Cross-Site Scripting (a web attack that injects malicious scripts into a page). |\n| **YAML** | YAML Ain't Markup Language - the text format used for a host's configuration. See The Source (YAML) view. |"} {"id":"concepts/glossary.md#related","url":"https://docs.turbostack.app/concepts/glossary/#related","path":"concepts/glossary.md","title":"Glossary","heading":"Related","keywords":"","text":"- Core concepts\n- Threat Center"} {"id":"concepts/monitoring.md#intro","url":"https://docs.turbostack.app/concepts/monitoring/","path":"concepts/monitoring.md","title":"Monitoring","heading":"","keywords":"","text":"# Monitoring\n\nTurboStack monitors your infrastructure and applications so problems are caught early. This page explains the monitoring and observability you get and how to use it well.\n\n> [!NOTE]\n> The in-app **Monitoring** screen is documented at Monitoring, and each host has a **Health** tab documented at Health.\n\n> [!TIP]\n> Each host's **Health** tab gives you a live overview of top issues, CPU/memory/disk usage and service checks. The **Monitoring** section in the main navigation collects monitoring across your hosts."} {"id":"concepts/monitoring.md#infrastructure-and-service-monitoring","url":"https://docs.turbostack.app/concepts/monitoring/#infrastructure-and-service-monitoring","path":"concepts/monitoring.md","title":"Monitoring","heading":"Infrastructure and service monitoring","keywords":"","text":"TurboStack's monitoring provides uptime and health checks for your hosts and services. It watches system-level metrics such as disk, memory, load and open ports, and runs dedicated checks for the services you run, including:\n\n| Category | Examples |\n| --- | --- |\n| Databases | PostgreSQL, MySQL, MongoDB |\n| Caching and search | Redis, Elasticsearch/OpenSearch, Varnish |\n\nYou receive email alerts whenever a status changes, and you can review current state on a read-only monitoring dashboard."} {"id":"concepts/monitoring.md#per-application-health-checks","url":"https://docs.turbostack.app/concepts/monitoring/#per-application-health-checks","path":"concepts/monitoring.md","title":"Monitoring","heading":"Per-application health checks","keywords":"","text":"You can set a `monitoring_url` for each application so that every production site is actively monitored. See Applications for where to configure this.\n\n> [!TIP]\n> Set a `monitoring_url` on every production application so each site is checked continuously and you are alerted the moment it goes down."} {"id":"concepts/monitoring.md#application-performance-monitoring-apm","url":"https://docs.turbostack.app/concepts/monitoring/#application-performance-monitoring-apm","path":"concepts/monitoring.md","title":"Monitoring","heading":"Application Performance Monitoring (APM)","keywords":"","text":"For deeper insight into how your applications behave, optional APM integrations are available:\n\n| Tool | What it offers |\n| --- | --- |\n| New Relic | PHP and Python transaction tracing, errors and slow transactions. |\n| Tideways | PHP profiler and APM. |\n| Blackfire | On-demand profiling. |\n\nThese are configured with per-application API keys. See Advanced settings.\n\n> [!TIP]\n> With Blackfire you can profile a page directly from the browser: install the Blackfire browser\n> extension (Chrome or Firefox), sign in with your blackfire.io account, open the page and click\n> **Profile** to see the call graph and timeline. The **Profile all requests** mode (for POST and\n> Ajax calls) currently works in Firefox, not Chrome. You can also start a profile over SSH with\n> `tscli blackfire enable`."} {"id":"concepts/monitoring.md#database-monitoring","url":"https://docs.turbostack.app/concepts/monitoring/#database-monitoring","path":"concepts/monitoring.md","title":"Monitoring","heading":"Database monitoring","keywords":"","text":"Advanced Database Monitoring provides query-performance insight and metrics dashboards for your databases. It uses a central **monitoring master server** that collects metrics from your TurboStack servers.\n\nTo send a server's database metrics to a monitoring master, enable it on the host's **Advanced > Advanced Database Monitoring**. Fill in the master server's hostname and, optionally, the sampling rate. You can also configure it in YAML:\n\n```yaml\npmm_master:\n server_hostname: pmm.example.com\n```\n\n> [!TIP]\n> Keep the default **sampling rate of 50** unless you have a reason to change it. It collects metrics from every Nth query; a lower value gives more detail but adds load to both the monitored server and the master.\n\nOnce a monitoring master is running, open its dashboard at `https://pmm.`. Log in with the `pmmagent` user; its credentials are available from the **Credentials** button in the TurboStack interface.\n\nIf you do not have a monitoring master yet, you can run one on TurboStack - see Self-hosted platforms. For where database services are configured, see Services."} {"id":"concepts/monitoring.md#standards-based-metrics","url":"https://docs.turbostack.app/concepts/monitoring/#standards-based-metrics","path":"concepts/monitoring.md","title":"Monitoring","heading":"Standards-based metrics","keywords":"","text":"An optional OpenTelemetry collector is available for standards-based metrics export, so you can feed monitoring data into your own observability tooling."} {"id":"concepts/monitoring.md#related","url":"https://docs.turbostack.app/concepts/monitoring/#related","path":"concepts/monitoring.md","title":"Monitoring","heading":"Related","keywords":"","text":"- Applications\n- Services\n- Advanced settings\n- Security overview\n- Networking"} {"id":"concepts/networking.md#intro","url":"https://docs.turbostack.app/concepts/networking/","path":"concepts/networking.md","title":"Networking","heading":"","keywords":"","text":"# Networking\n\nTurboStack gives your servers secure, private ways to talk to each other and to your own network. This page explains the networking capabilities you can rely on and the value each one brings. Private networking keeps internal traffic - database replication, backups and monitoring - off the public internet, and high availability reduces downtime; both matter for keeping critical sites online."} {"id":"concepts/networking.md#privatenet","url":"https://docs.turbostack.app/concepts/networking/#privatenet","path":"concepts/networking.md","title":"Networking","heading":"PrivateNet","keywords":"","text":"PrivateNet is a secure, encrypted private overlay network - a mesh Virtual Private Network (VPN) - that connects your managed servers. It lets your servers exchange traffic safely for tasks such as database replication, backups and monitoring, without exposing anything to the public internet.\n\nPrivateNet uses a private Domain Name System (DNS) suffix, so your servers reach each other by name with no public DNS required. Servers join the network automatically, and you get secure, short-lived certificate-based Secure Shell (SSH) access over the overlay."} {"id":"concepts/networking.md#site-to-site-vpn","url":"https://docs.turbostack.app/concepts/networking/#site-to-site-vpn","path":"concepts/networking.md","title":"Networking","heading":"Site-to-site VPN","keywords":"","text":"An optional IPsec site-to-site VPN creates encrypted tunnels between your own network and your servers, so an office network and the servers behave as one private network. Split tunnelling is available so only the traffic you choose travels through the tunnel."} {"id":"concepts/networking.md#remote-access-vpn","url":"https://docs.turbostack.app/concepts/networking/#remote-access-vpn","path":"concepts/networking.md","title":"Networking","heading":"Remote-access VPN","keywords":"","text":"An optional Secure Sockets Layer (SSL) VPN (OpenConnect, compatible with Cisco AnyConnect) gives your team secure remote access to your environment. It supports per-user accounts and split-tunnel routes so users reach your servers without routing all of their traffic through the VPN."} {"id":"concepts/networking.md#high-availability-and-load-balancing","url":"https://docs.turbostack.app/concepts/networking/#high-availability-and-load-balancing","path":"concepts/networking.md","title":"Networking","heading":"High availability and load balancing","keywords":"","text":"For resilient setups, a virtual IP (Internet Protocol) address can fail over between a pair of servers in an active/passive configuration. This means one server handles traffic while a second stands by. Health checks continuously monitor the active server, and if it fails the virtual IP moves to its partner so your service keeps running."} {"id":"concepts/networking.md#how-these-are-set-up","url":"https://docs.turbostack.app/concepts/networking/#how-these-are-set-up","path":"concepts/networking.md","title":"Networking","heading":"How these are set up","keywords":"","text":"Most networking features are provisioned by Hosted Power as part of your setup rather than being self-served toggles, so they are tailored to your environment.\n\n> [!NOTE]\n> To enable a VPN or high-availability configuration, contact support."} {"id":"concepts/networking.md#related","url":"https://docs.turbostack.app/concepts/networking/#related","path":"concepts/networking.md","title":"Networking","heading":"Related","keywords":"","text":"- Security overview\n- Monitoring\n- SSH access\n- Support"} {"id":"concepts/performance-tuning.md#intro","url":"https://docs.turbostack.app/concepts/performance-tuning/","path":"concepts/performance-tuning.md","title":"Performance tuning","heading":"","keywords":"turbostack performance caching Redis Varnish opcache database tuning","text":"# Performance tuning\n\nTurboStack ships with sensible, server-aware defaults so most sites are fast by default. This\npage explains the caching layers available to you and how to override the defaults safely.\n\nFaster pages improve conversion and search ranking, and they keep your site responsive during\ntraffic peaks such as sales campaigns. For online stores, caching is the main tool for staying fast\nunder load.\n\n> [!IMPORTANT]\n> TurboStack auto-tunes memory sizing to the size of your server. Only override these values with\n> **measured evidence**, such as memory pressure, a low cache hit ratio, or garbage-collection\n> (GC) pressure. Guessing at larger values usually makes performance worse, not better."} {"id":"concepts/performance-tuning.md#caching-layers","url":"https://docs.turbostack.app/concepts/performance-tuning/#caching-layers","path":"concepts/performance-tuning.md","title":"Performance tuning","heading":"Caching layers","keywords":"turbostack performance caching Redis Varnish opcache database tuning","text":"Caching is the highest-impact lever for most sites. TurboStack provides several layers, each suited\nto a different workload.\n\n| Layer | What it caches | Notes |\n| --- | --- | --- |\n| Redis (port `6379`) | Transient application cache | Safe to clear at any time |\n| Redis (port `6378`) | Durable sessions and queues | Persistent - do not clear casually |\n| Varnish | Full-page HyperText Markup Language (HTML) responses | For PHP storefronts (Magento, Shopware, WordPress) |\n| OPcache | Compiled PHP bytecode | Per-application; see PHP advanced options |"} {"id":"concepts/performance-tuning.md#redis","url":"https://docs.turbostack.app/concepts/performance-tuning/#redis","path":"concepts/performance-tuning.md","title":"Performance tuning","heading":"Redis","keywords":"turbostack performance caching Redis Varnish opcache database tuning","text":"The cache instance on port `6379` holds transient data and is safe to clear. The persistent\ninstance on port `6378` stores durable data such as sessions and queues, so clearing it can log\nusers out or drop queued jobs. Configure Redis from the host's\nServices tab."} {"id":"concepts/performance-tuning.md#varnish","url":"https://docs.turbostack.app/concepts/performance-tuning/#varnish","path":"concepts/performance-tuning.md","title":"Performance tuning","heading":"Varnish","keywords":"turbostack performance caching Redis Varnish opcache database tuning","text":"Varnish is a full-page cache that sits in front of PHP storefronts. It is most effective for\nread-heavy catalog and content pages on Magento, Shopware, and WordPress."} {"id":"concepts/performance-tuning.md#opcache","url":"https://docs.turbostack.app/concepts/performance-tuning/#opcache","path":"concepts/performance-tuning.md","title":"Performance tuning","heading":"OPcache","keywords":"turbostack performance caching Redis Varnish opcache database tuning","text":"OPcache stores compiled PHP bytecode so scripts do not have to be recompiled on every request. You\ncan tune it per application under\nApplications > Technologies > PHP advanced options, where you\ncan enhance OPcache and set a preload script."} {"id":"concepts/performance-tuning.md#sizing-keys-you-can-override","url":"https://docs.turbostack.app/concepts/performance-tuning/#sizing-keys-you-can-override","path":"concepts/performance-tuning.md","title":"Performance tuning","heading":"Sizing keys you can override","keywords":"turbostack performance caching Redis Varnish opcache database tuning","text":"These values are auto-tuned to your server by default. Change them only with evidence.\n\n| Key | What it controls |\n| --- | --- |\n| `mysql_innodb_size` | InnoDB buffer pool size for MySQL/MariaDB |\n| `postgresql_shared_buffers` | Shared memory PostgreSQL uses for caching data |\n| `redis_memory` | Maximum memory Redis may use before eviction |\n| `elasticsearch_heap_size` | Java Virtual Machine (JVM) heap allocated to Elasticsearch |\n| `varnish_cache_size` | Memory reserved for the Varnish full-page cache |"} {"id":"concepts/performance-tuning.md#php-fpm-and-opcache","url":"https://docs.turbostack.app/concepts/performance-tuning/#php-fpm-and-opcache","path":"concepts/performance-tuning.md","title":"Performance tuning","heading":"PHP-FPM and OPcache","keywords":"turbostack performance caching Redis Varnish opcache database tuning","text":"PHP performance is tuned per application. Under\nApplications > Technologies, the PHP advanced settings let you\nadjust the PHP-FPM process manager (`pm` start, min spare, and max spare servers) and enable OPcache\npreloading. Raise the PHP-FPM worker counts only when you see requests queuing and have the memory\nheadroom to support them. Each worker is one PHP process handling one request at a time."} {"id":"concepts/performance-tuning.md#measure-first","url":"https://docs.turbostack.app/concepts/performance-tuning/#measure-first","path":"concepts/performance-tuning.md","title":"Performance tuning","heading":"Measure first","keywords":"turbostack performance caching Redis Varnish opcache database tuning","text":"Always find the real bottleneck before changing anything. A slow page is often caused by a single\nlayer (database, cache, or PHP) and tuning the wrong one wastes effort.\n\n1. Check the host's Health tab for resource pressure.\n2. Use Monitoring to inspect trends over time.\n3. See Monitoring concepts to understand what the metrics mean.\n\nOnce you have identified the constrained resource, apply the smallest override that relieves it and\nre-measure."} {"id":"concepts/performance-tuning.md#related","url":"https://docs.turbostack.app/concepts/performance-tuning/#related","path":"concepts/performance-tuning.md","title":"Performance tuning","heading":"Related","keywords":"turbostack performance caching Redis Varnish opcache database tuning","text":"- Services\n- Applications\n- Health\n- Monitoring concepts\n- TurboStack CLI - clear Redis, Varnish and OPcache on the server"} {"id":"concepts/roles-and-access.md#intro","url":"https://docs.turbostack.app/concepts/roles-and-access/","path":"concepts/roles-and-access.md","title":"Accounts and access","heading":"","keywords":"","text":"# Accounts and access\n\nWhat you can see and do in TurboStack depends on the account you are signed in to. This page explains\nwhat your account gives you access to, and how multi-account login works for agencies and partners\nwho manage several customer accounts and switch between them without signing out."} {"id":"concepts/roles-and-access.md#what-your-account-can-access","url":"https://docs.turbostack.app/concepts/roles-and-access/#what-your-account-can-access","path":"concepts/roles-and-access.md","title":"Accounts and access","heading":"What your account can access","keywords":"","text":"Your account manages its own resources. You can work with your **Hosts**, **Groups**, **Templates**,\nglobal **Search**, **Monitoring**, **Support** and your account settings. You only ever see the\nresources that belong to your own account."} {"id":"concepts/roles-and-access.md#multi-account-login-and-account-selection","url":"https://docs.turbostack.app/concepts/roles-and-access/#multi-account-login-and-account-selection","path":"concepts/roles-and-access.md","title":"Accounts and access","heading":"Multi-account login and account selection","keywords":"","text":"A single login can be linked to more than one account. When it is, TurboStack shows the **Select\naccount** screen after you sign in so you can choose which account to work in. You can switch to\nanother linked account later without signing out. This is useful for agencies and partners who\nmanage several customer accounts. See Logging in."} {"id":"concepts/roles-and-access.md#permissions","url":"https://docs.turbostack.app/concepts/roles-and-access/#permissions","path":"concepts/roles-and-access.md","title":"Accounts and access","heading":"Permissions","keywords":"","text":"Access in TurboStack is scoped to your account: you only see the hosts, groups and templates that\nbelong to the account you are signed in to. Switching to another linked account changes which\nresources are visible accordingly.\n\nPermissions themselves are not set in TurboStack. They are part of the contact's profile in the\nCustomer Center, so that is where you grant or withdraw them - see\nContacts."} {"id":"concepts/roles-and-access.md#if-you-see-a-permission-message-instead-of-your-hosts","url":"https://docs.turbostack.app/concepts/roles-and-access/#if-you-see-a-permission-message-instead-of-your-hosts","path":"concepts/roles-and-access.md","title":"Accounts and access","heading":"If you see a permission message instead of your hosts","keywords":"","text":"A contact who can sign in but has not been given the right permissions sees a message instead of the\ninterface. There are two:\n\n| Message | What it means | How to fix it |\n|---|---|---|\n| \"You don't have access to GUI TurboStack. Please login to the portal and configure your permissions for TurboStack.\" | The contact may sign in, but does not have the TurboStack **Access UI** permission. | In the Customer Center, open the contact and turn on **Access UI** under the TurboStack permissions. |\n| \"You don't have access to the services of TurboStack. Please login to the portal and configure your services for TurboStack.\" | The contact has access to the interface, but to none of the services on the account, so there is nothing to show. | In the Customer Center, give the contact access to the service (the server) it should manage, under the per-service permissions. |\n\nBoth are corrected in the Customer Center, not in TurboStack. After the change, sign out and sign in\nagain so the new permissions are loaded.\n\n> [!NOTE]\n> Only someone with permission to manage contacts can change this. If that is not you, ask the main\n> account holder or another administrator on the account."} {"id":"concepts/roles-and-access.md#related","url":"https://docs.turbostack.app/concepts/roles-and-access/#related","path":"concepts/roles-and-access.md","title":"Accounts and access","heading":"Related","keywords":"","text":"- Logging in\n- Navigating the interface\n- Contacts - where permissions are granted.\n- Glossary"} {"id":"concepts/security-hardening.md#intro","url":"https://docs.turbostack.app/concepts/security-hardening/","path":"concepts/security-hardening.md","title":"Security hardening checklist","heading":"","keywords":"turbostack security harden server ssh keys turboshield waf 2fa best practices","text":"# Security hardening checklist\n\nTurboStack is secure by default, but a few deliberate choices make your servers and applications significantly harder to attack. Work through this checklist and tighten each area to match your risk."} {"id":"concepts/security-hardening.md#access","url":"https://docs.turbostack.app/concepts/security-hardening/#access","path":"concepts/security-hardening.md","title":"Security hardening checklist","heading":"Access","keywords":"turbostack security harden server ssh keys turboshield waf 2fa best practices","text":"- Use Secure Shell (SSH) keys and disable password authentication (SSH). Keys cannot be guessed the way passwords can.\n- Restrict access with an Internet Protocol (IP) allow-list (Security).\n- Enable two-factor authentication (2FA) on your account, so a stolen password alone is not enough to log in.\n- Treat Credentials as secrets. Store and share them carefully.\n- Use least-privilege extra database users (readonly where possible) (Applications)."} {"id":"concepts/security-hardening.md#web-protection","url":"https://docs.turbostack.app/concepts/security-hardening/#web-protection","path":"concepts/security-hardening.md","title":"Security hardening checklist","heading":"Web protection","keywords":"turbostack security harden server ssh keys turboshield waf 2fa best practices","text":"- Keep TurboShield enabled, and raise it to `high` while under attack.\n- Enable the Web Application Firewall (WAF), which blocks common web attacks such as SQL injection.\n- Consider GeoIP filtering (blocking by the visitor's country) for regions you do not serve.\n- Understand how the layers fit together (Security overview)."} {"id":"concepts/security-hardening.md#encryption-tls","url":"https://docs.turbostack.app/concepts/security-hardening/#encryption-tls","path":"concepts/security-hardening.md","title":"Security hardening checklist","heading":"Encryption (TLS)","keywords":"turbostack security harden server ssh keys turboshield waf 2fa best practices","text":"- Always use Let's Encrypt and redirect all traffic to HTTPS, the encrypted version of HTTP. This keeps data between your visitors and the server private. See Transport Layer Security (TLS) certificates."} {"id":"concepts/security-hardening.md#stay-current-and-watch","url":"https://docs.turbostack.app/concepts/security-hardening/#stay-current-and-watch","path":"concepts/security-hardening.md","title":"Security hardening checklist","heading":"Stay current and watch","keywords":"turbostack security harden server ssh keys turboshield waf 2fa best practices","text":"- Keep your application and runtime versions updated.\n- Review the Threat Center for vulnerabilities and malware.\n- Act promptly on any findings.\n\n> [!TIP]\n> Start with the defaults. TurboStack is secure by default. Tighten settings based on what the Threat Center reports for your hosts."} {"id":"concepts/security-hardening.md#related","url":"https://docs.turbostack.app/concepts/security-hardening/#related","path":"concepts/security-hardening.md","title":"Security hardening checklist","heading":"Related","keywords":"turbostack security harden server ssh keys turboshield waf 2fa best practices","text":"- Security configuration\n- Security overview\n- SSH\n- Threat Center\n- Two-factor authentication\n- TurboStack CLI - manage firewall blocks from the server with `tscli firewall`"} {"id":"concepts/security-overview.md#intro","url":"https://docs.turbostack.app/concepts/security-overview/","path":"concepts/security-overview.md","title":"Security overview","heading":"","keywords":"","text":"# Security overview\n\nTurboStack defends your servers and applications with layered protection that works automatically. This page explains what each layer does in plain language. For the settings you can adjust yourself, see Security configuration.\n\n> [!NOTE]\n> Each host has a **Threat Center** tab that surfaces the security findings detected on that host (see TurboRadar below)."} {"id":"concepts/security-overview.md#turboshield","url":"https://docs.turbostack.app/concepts/security-overview/#turboshield","path":"concepts/security-overview.md","title":"Security overview","heading":"TurboShield","keywords":"","text":"TurboShield filters traffic to your applications and is enabled by default at the `medium` level. It protects your applications without blocking the visitors and search engines you want to reach.\n\nTurboShield provides:\n\n- **Rate limiting** - caps how many requests and connections a single visitor can make, so nobody can consume all your capacity.\n- **Bot classification** - friendly limits for verified good bots (such as Google and Bing) and stricter limits or blocks for scraping and AI training crawlers.\n- **Search-bot verification** - confirms that traffic claiming to be Googlebot or Bingbot is genuine, preventing spoofing.\n- **Known-exploit blocking** - blocks requests matching known exploit signatures before they ever reach your application.\n- **Attack detection** - recognizes attack behavior in your logs (injection probing, file scanning, brute-force logins) and temporarily bans the source at both the web server and the firewall. Bans always expire on their own.\n- **Shared reputation** - blocks sources already known to be malicious on other sites.\n- **Bot challenge (optional)** - an automatic browser check for suspicious visitors, for sites under scraping or credential-stuffing pressure.\n\nYou can choose a level to match your situation:\n\n| Level | What it does |\n| --- | --- |\n| `low` | Relaxed limits for sites with heavy legitimate automation. |\n| `medium` | Balanced protection for most applications (default). |\n| `high` | Tighter limits for sites under sustained bot pressure. |\n| `attack` | Aggressive protection during an active attack: adds distributed-attack and disguised-browser detection, and longer bans. |\n\nTrusted addresses on your allow-list skip every check. See Configure TurboShield.\n\n> [!NOTE]\n> When a visitor exceeds a limit they receive a soft `429` response and can try again shortly. They are not banned at the firewall."} {"id":"concepts/security-overview.md#firewall","url":"https://docs.turbostack.app/concepts/security-overview/#firewall","path":"concepts/security-overview.md","title":"Security overview","heading":"Firewall","keywords":"","text":"TurboStack runs a stateful firewall that protects your server at the network layer. It continuously watches for malicious behavior such as SSH brute-force attempts and web attacks, and automatically blocks offending IP addresses. Bans expire automatically. It applies connection rate limits, honours any IP addresses on your allow-list, and is fully managed by the platform."} {"id":"concepts/security-overview.md#turboradar","url":"https://docs.turbostack.app/concepts/security-overview/#turboradar","path":"concepts/security-overview.md","title":"Security overview","heading":"TurboRadar","keywords":"","text":"TurboRadar adds runtime security detection and scanning that runs after your application is deployed. It:\n\n- detects suspicious process behavior such as web shells, in-memory or fileless malware, and access to credential files;\n- finds known vulnerabilities (Common Vulnerabilities and Exposures, or CVEs) in your packages and containers; and\n- runs commerce-specific malware scans for Magento, WooCommerce and PrestaShop.\n\nFindings are reported to each host's Threat Center tab, where you review them, see how urgent each one is, and act on it."} {"id":"concepts/security-overview.md#encryption-and-access","url":"https://docs.turbostack.app/concepts/security-overview/#encryption-and-access","path":"concepts/security-overview.md","title":"Security overview","heading":"Encryption and access","keywords":"","text":"- **Transport Layer Security (TLS) certificates** - the encryption behind `https://` - are issued and renewed automatically for each application using Let's Encrypt. This keeps traffic between your visitors and the server private. See Applications.\n- **Secure Shell (SSH) access** - encrypted remote access to the server - is key-based rather than password-based, which is far harder to brute-force. See SSH access."} {"id":"concepts/security-overview.md#what-you-should-do","url":"https://docs.turbostack.app/concepts/security-overview/#what-you-should-do","path":"concepts/security-overview.md","title":"Security overview","heading":"What you should do","keywords":"","text":"Most of this protection is automatic, but a few things are yours to act on:\n\n- **Review the Threat Center** on each host now and then, and after any security alert. Fix anything marked **Exploited (Known Exploited Vulnerabilities, KEV)** or **Likely exploited** first.\n- **Keep your applications and their dependencies up to date.** Most vulnerabilities are fixed simply by updating to a newer version.\n- **Leave the defaults on** (TurboShield, the Firewall, the Web Application Firewall, or WAF) unless you have a specific reason to change them.\n- **Raise TurboShield** to `high` or `attack` only while you are under abusive traffic, then return to `medium`."} {"id":"concepts/security-overview.md#defaults","url":"https://docs.turbostack.app/concepts/security-overview/#defaults","path":"concepts/security-overview.md","title":"Security overview","heading":"Defaults","keywords":"","text":"> [!IMPORTANT]\n> By default: TurboShield runs at `medium`, the Firewall is managed automatically, and TurboRadar is enabled on every host."} {"id":"concepts/security-overview.md#related","url":"https://docs.turbostack.app/concepts/security-overview/#related","path":"concepts/security-overview.md","title":"Security overview","heading":"Related","keywords":"","text":"- Security configuration\n- Networking\n- Monitoring\n- Applications\n- SSH access"} {"id":"concepts/versioned-releases.md#intro","url":"https://docs.turbostack.app/concepts/versioned-releases/","path":"concepts/versioned-releases.md","title":"Versioned releases with a symlink layout","heading":"","keywords":"versioned releases atomic deploy symlink deploy public_html releases current shared ci cd deploy","text":"# Versioned releases with a symlink layout\n\nBy default, your website is served from a single `public_html` directory in your home\ndirectory. That works well for a manual upload, but continuous integration and continuous\ndeployment (CI/CD) pipelines usually expect a different layout: each deploy lands in its own\n`releases/` folder, and a `current` symlink points at the release that is live. Switching the\nsymlink makes a new version go live in one step, and switching it back is an instant rollback.\n\nThis page shows you how to replace `public_html` with that layout. Your web root stays at\n`~/public_html`, so nothing changes for the web server: you only change what it points to.\n\n> [!NOTE]\n> Deploy tools such as Deployer, Envoyer, and most custom CI/CD scripts create this structure\n> for you. This page prepares the home directory so those tools can take over the `public_html`\n> path."} {"id":"concepts/versioned-releases.md#the-target-layout","url":"https://docs.turbostack.app/concepts/versioned-releases/#the-target-layout","path":"concepts/versioned-releases.md","title":"Versioned releases with a symlink layout","heading":"The target layout","keywords":"versioned releases atomic deploy symlink deploy public_html releases current shared ci cd deploy","text":"You are aiming for a home directory where `public_html` is a symlink into a versioned release,\nrather than a real directory:\n\n```bash\ncurrent -> releases/\npublic_html -> current\nreleases/\nshared/\n```\n\n- `releases/` holds one directory per deploy (often named by timestamp or commit).\n- `current` is a symlink to the release that should be live.\n- `shared/` holds files that must survive between releases (uploads, `.env`, caches).\n- `public_html` is a symlink to `current`, so the web server always serves the live release."} {"id":"concepts/versioned-releases.md#step-by-step","url":"https://docs.turbostack.app/concepts/versioned-releases/#step-by-step","path":"concepts/versioned-releases.md","title":"Versioned releases with a symlink layout","heading":"Step-by-step","keywords":"versioned releases atomic deploy symlink deploy public_html releases current shared ci cd deploy","text":"Connect to the host over SSH first (see the host SSH tab). Run the\ncommands from your home directory.\n\n1. Remove the existing `public_html` directory. This command only succeeds if the directory is\n empty, which protects you from deleting a live site by accident:\n\n ```bash\n rmdir ~/public_html\n ```\n\n If `rmdir` reports that the directory is not empty, do not force it. Move your current site\n into a first release directory instead, then continue.\n\n2. Create the `releases/` and `shared/` directories, or run a deploy so your pipeline creates\n them. This page assumes your code is already laid out with a `current` symlink pointing at a\n release, for example `current -> releases/2026-07-24-1`.\n\n3. Point `public_html` at the `current` symlink:\n\n ```bash\n ln -s current public_html\n ```\n\n4. Verify that the symlinks resolve as expected:\n\n ```bash\n ls -l\n # current -> releases/\n # public_html -> current\n # releases/\n # shared/\n ```\n\nFrom now on, your pipeline deploys a new release, repoints `current`, and the change is live\nimmediately. To roll back, repoint `current` to the previous release."} {"id":"concepts/versioned-releases.md#a-different-root-directory","url":"https://docs.turbostack.app/concepts/versioned-releases/#a-different-root-directory","path":"concepts/versioned-releases.md","title":"Versioned releases with a symlink layout","heading":"A different root directory","keywords":"versioned releases atomic deploy symlink deploy public_html releases current shared ci cd deploy","text":"Some frameworks keep `current` and `releases/` inside a subdirectory, for example\n`application/`. In that case, only step 3 changes: point `public_html` at the `current` symlink\nunder that subdirectory.\n\n```bash\nln -s application/current public_html\n```\n\n> [!WARNING]\n> `public_html` is your live web root. If the symlink points at a path that does not exist,\n> your site returns an error until you fix it. Always confirm with `ls -l` that\n> `public_html -> current` and that `current` resolves to a real release."} {"id":"concepts/versioned-releases.md#related","url":"https://docs.turbostack.app/concepts/versioned-releases/#related","path":"concepts/versioned-releases.md","title":"Versioned releases with a symlink layout","heading":"Related","keywords":"versioned releases atomic deploy symlink deploy public_html releases current shared ci cd deploy","text":"- Host SSH tab\n- What is SSH?\n- Deployment history\n- Applications\n- Finding and reading logs"} {"id":"concepts/yaml-view.md#intro","url":"https://docs.turbostack.app/concepts/yaml-view/","path":"concepts/yaml-view.md","title":"The Source (YAML) view","heading":"","keywords":"","text":"# The Source (YAML) view\n\nEvery host and group can be edited in two ways: the guided **GUI** editor, and the\n**Source** view, which shows the configuration as raw **YAML**. Both edit the same\nconfiguration. Use whichever suits the task."} {"id":"concepts/yaml-view.md#opening-the-source-view","url":"https://docs.turbostack.app/concepts/yaml-view/#opening-the-source-view","path":"concepts/yaml-view.md","title":"The Source (YAML) view","heading":"Opening the Source view","keywords":"","text":"In a host's header, click the **`` Source** button. This opens the YAML editor at\n`/hosts/yaml/{id}`. The breadcrumb ends in **Source**. To go back, click the **GUI** button in\nthe header.\n\n> [!TIP]\n> The GUI and Source views stay in sync. Changes you make in one are reflected in the other,\n> because they describe the same underlying configuration."} {"id":"concepts/yaml-view.md#what-you-can-do","url":"https://docs.turbostack.app/concepts/yaml-view/#what-you-can-do","path":"concepts/yaml-view.md","title":"The Source (YAML) view","heading":"What you can do","keywords":"","text":"- **Edit the YAML** directly - useful for advanced changes, reviewing the whole configuration at\n a glance, or making many edits quickly.\n- **Copy** - the **Copy** menu can pre-fill the configuration **From host** (another of your\n hosts) or **From template**.\n\nThe YAML mirrors the structure you see in the GUI, for example:\n\n```yaml\nwebserver: nginx\nmysql_version: \"8.4\"\n\nsystem_users:\n - username: prod\n vhosts:\n - server_name: app.example.com\n php_version: \"8.4\"\n cert_type: letsencrypt\n```\n\nSee Core concepts for the configuration model, and\nApplications and Services\nfor what these keys control."} {"id":"concepts/yaml-view.md#saving-and-validating","url":"https://docs.turbostack.app/concepts/yaml-view/#saving-and-validating","path":"concepts/yaml-view.md","title":"The Source (YAML) view","heading":"Saving and validating","keywords":"","text":"Saving from the Source view works exactly like the GUI: **Save** stores the configuration, and\n**Save & Publish** deploys it (see Publishing changes). Before\nsaving, the YAML is validated. Invalid YAML is flagged and the publish action is disabled until\nit is fixed.\n\n> [!WARNING]\n> Because the Source view is free-form, a small mistake (wrong indentation, a typo in a key) can\n> change behavior. If you are unsure, make the change in the GUI and switch to Source to review\n> the result."} {"id":"concepts/yaml-view.md#gui-vs-source-which-to-use","url":"https://docs.turbostack.app/concepts/yaml-view/#gui-vs-source-which-to-use","path":"concepts/yaml-view.md","title":"The Source (YAML) view","heading":"GUI vs. Source: which to use","keywords":"","text":"| Use the GUI when... | Use Source (YAML) when... |\n|---|---|\n| Making everyday changes with guidance and validation. | Making advanced or bulk edits. |\n| You want dropdowns and field help. | Reviewing or copying the whole configuration. |\n| You are new to TurboStack. | You are comfortable with YAML and the configuration keys. |\n\nYou can set your preferred default editing mode in\nProfile & preferences."} {"id":"concepts/yaml-view.md#related","url":"https://docs.turbostack.app/concepts/yaml-view/#related","path":"concepts/yaml-view.md","title":"The Source (YAML) view","heading":"Related","keywords":"","text":"- YAML configuration reference - every key you can set, and what it does\n- Hosts\n- Core concepts\n- Publishing changes"} {"id":"customer-center/account-details/edit-details.md#intro","url":"https://docs.turbostack.app/customer-center/account-details/edit-details/","path":"customer-center/account-details/edit-details.md","title":"Edit details","heading":"","keywords":"edit details profile address vat number company details update account","text":"# Edit details\n\nThe **Edit Details** tab is where you update your profile - the information used for your account and\non invoices. Open **Account details** and select the **Edit Details** tab."} {"id":"customer-center/account-details/edit-details.md#what-you-can-change","url":"https://docs.turbostack.app/customer-center/account-details/edit-details/#what-you-can-change","path":"customer-center/account-details/edit-details.md","title":"Edit details","heading":"What you can change","keywords":"edit details profile address vat number company details update account","text":"- **Account type** - Personal or Organization.\n- **Organization name** and **tax (VAT) number** - the Value Added Tax number, for organizations.\n- **First name** and **Last name**.\n- **Address**, **city**, **state**, **postal code** and **country**.\n- **Phone** and **mobile phone**.\n\nMake your changes and **save** the form. To change your sign-in email or password instead, see\nSign-in details.\n\n> [!NOTE]\n> Your address and tax number appear on invoices, so keep them correct. The\n> billing contact setting decides whose details are used."} {"id":"customer-center/account-details/edit-details.md#related","url":"https://docs.turbostack.app/customer-center/account-details/edit-details/#related","path":"customer-center/account-details/edit-details.md","title":"Edit details","heading":"Related","keywords":"edit details profile address vat number company details update account","text":"- Account details overview\n- Sign-in details"} {"id":"customer-center/account-details/index.md#intro","url":"https://docs.turbostack.app/customer-center/account-details/","path":"customer-center/account-details/index.md","title":"Account details overview","heading":"","keywords":"account details profile account overview customer center account","text":"# Account details overview\n\n**Account details** is where you manage your own profile and account settings. Open it from **Account\ndetails** in the left sidebar. It has five tabs: **Overview**, **Edit details**, **Change email**,\n**Change password** and **Settings**.\n\n\n\nThis section covers:\n\n- Overview - read-only summary of your account information.\n- Edit details - change your name, company, address and contact details.\n- Sign-in details - change your email address and password on the **Change\n email** and **Change password** tabs.\n- Settings - records-per-page, time zone, billing, and which **notifications** you\n receive."} {"id":"customer-center/account-details/index.md#overview","url":"https://docs.turbostack.app/customer-center/account-details/#overview","path":"customer-center/account-details/index.md","title":"Account details overview","heading":"Overview","keywords":"account details profile account overview customer center account","text":"The **Overview** tab lists your account information in a read-only table: account type, organization\nname, tax (VAT) number, name, email address, postal address, country and phone numbers. Each row also\nshows what the information is used for (for example **Billing**).\n\nTo change any of this, use the other tabs - see Edit details and\nSign-in details."} {"id":"customer-center/account-details/index.md#related","url":"https://docs.turbostack.app/customer-center/account-details/#related","path":"customer-center/account-details/index.md","title":"Account details overview","heading":"Related","keywords":"account details profile account overview customer center account","text":"- Edit details\n- Settings\n- Contacts and teams"} {"id":"customer-center/account-details/settings.md#intro","url":"https://docs.turbostack.app/customer-center/account-details/settings/","path":"customer-center/account-details/settings.md","title":"Settings","heading":"","keywords":"settings notifications email notifications invoice delivery nameservers time zone","text":"# Settings\n\nThe **Settings** tab holds account-wide preferences, billing options, your notification choices, and\ndefault nameservers. Open **Account details** and select the **Settings** tab."} {"id":"customer-center/account-details/settings.md#general","url":"https://docs.turbostack.app/customer-center/account-details/settings/#general","path":"customer-center/account-details/settings.md","title":"Settings","heading":"General","keywords":"settings notifications email notifications invoice delivery nameservers time zone","text":"- **Records per page** - how many rows lists show at once.\n- **Time zone** - the time zone used for dates across the portal."} {"id":"customer-center/account-details/settings.md#billing","url":"https://docs.turbostack.app/customer-center/account-details/settings/#billing","path":"customer-center/account-details/settings.md","title":"Settings","heading":"Billing","keywords":"settings notifications email notifications invoice delivery nameservers time zone","text":"- **Default payment gateway** - the payment method used by default.\n- **Invoice delivery method** - **Email** or **Email + Paper**."} {"id":"customer-center/account-details/settings.md#notifications","url":"https://docs.turbostack.app/customer-center/account-details/settings/#notifications","path":"customer-center/account-details/settings.md","title":"Settings","heading":"Notifications","keywords":"settings notifications email notifications invoice delivery nameservers time zone","text":"This is where you choose which emails your **main account** receives.\n\n\n\n> [!IMPORTANT]\n> The main account holder **always receives billing and support emails by default**. If you do not\n> want all of them, turn them off here. (This is separate from contacts\n> and teams, who only receive an email type if you grant them the\n> matching permission.)\n\nUnder **Email notifications** you can enable or disable each type:\n\n| Notification | What you receive |\n|---|---|\n| **Billing** | Invoices, reminders, and administrative and billing emails (and the related tickets). |\n| **Support** | Technical notifications about your Hosted Power services. |\n| **Services** | Emails about your services (for example renewals or changes). |\n| **Domains** | Emails about your domains (for example expiry and transfer notices). |\n\nSelect the types you want and **save**."} {"id":"customer-center/account-details/settings.md#domains","url":"https://docs.turbostack.app/customer-center/account-details/settings/#domains","path":"customer-center/account-details/settings.md","title":"Settings","heading":"Domains","keywords":"settings notifications email notifications invoice delivery nameservers time zone","text":"- **Nameservers** - use Hosted Power's default nameservers for new domains, or set your own custom\n nameservers. See Domains and DNS management."} {"id":"customer-center/account-details/settings.md#related","url":"https://docs.turbostack.app/customer-center/account-details/settings/#related","path":"customer-center/account-details/settings.md","title":"Settings","heading":"Related","keywords":"settings notifications email notifications invoice delivery nameservers time zone","text":"- Account details overview\n- Contacts\n- Teams"} {"id":"customer-center/account-details/sign-in-details.md#intro","url":"https://docs.turbostack.app/customer-center/account-details/sign-in-details/","path":"customer-center/account-details/sign-in-details.md","title":"Sign-in details","heading":"","keywords":"change email change password sign-in login details account security","text":"# Sign-in details\n\nYour sign-in details are your email address and password. You change them on two tabs of **Account\ndetails**: **Change email** and **Change password**."} {"id":"customer-center/account-details/sign-in-details.md#change-email","url":"https://docs.turbostack.app/customer-center/account-details/sign-in-details/#change-email","path":"customer-center/account-details/sign-in-details.md","title":"Sign-in details","heading":"Change email","keywords":"change email change password sign-in login details account security","text":"The **Change email** tab updates the email address you sign in with and that receives account emails.\n\n\n\nEnter the new email address, confirm it, and save. Use an address you can access, because it is also\nwhere notifications are sent."} {"id":"customer-center/account-details/sign-in-details.md#change-password","url":"https://docs.turbostack.app/customer-center/account-details/sign-in-details/#change-password","path":"customer-center/account-details/sign-in-details.md","title":"Sign-in details","heading":"Change password","keywords":"change email change password sign-in login details account security","text":"The **Change password** tab sets a new password for your account.\n\n\n\nEnter your current password, then the new password twice, and save. Choose a strong, unique password.\n\n> [!NOTE]\n> If you sign in with GitHub or Google (single sign-on), you manage your password with\n> that provider, not here."} {"id":"customer-center/account-details/sign-in-details.md#related","url":"https://docs.turbostack.app/customer-center/account-details/sign-in-details/#related","path":"customer-center/account-details/sign-in-details.md","title":"Sign-in details","heading":"Related","keywords":"change email change password sign-in login details account security","text":"- Logging in\n- Account details overview"} {"id":"customer-center/contacts-and-teams/contacts.md#intro","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/contacts/","path":"customer-center/contacts-and-teams/contacts.md","title":"Contacts","heading":"","keywords":"contacts sub-account add contact permissions access ui billing support account access","text":"# Contacts\n\nA **contact** is an extra person on your account - for example a colleague, your developer, or your\naccountant - with their own sign-in and a set of permissions you choose. Contacts let you give people\naccess without sharing your own password, and let you grant each person only what they need.\n\n> [!IMPORTANT]\n> The **primary contact** is always the first point of contact should a critical incident on your\n> environment occur. Keep its details up to date so Hosted Power can always reach the right people."} {"id":"customer-center/contacts-and-teams/contacts.md#add-a-contact","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/contacts/#add-a-contact","path":"customer-center/contacts-and-teams/contacts.md","title":"Contacts","heading":"Add a contact","keywords":"contacts sub-account add contact permissions access ui billing support account access","text":"1. In the left sidebar, select **Manage contacts**.\n2. Open the **Contacts** tab and select **Add new contact**.\n3. Enter the person's name and email and set a password.\n4. Choose the **permissions** they should have (see below).\n5. Save the contact. The person can now sign in with their own details.\n\nOn the **invite** tab you can also invite an existing individual contact, for example an external\nconsultant, instead of creating a new one."} {"id":"customer-center/contacts-and-teams/contacts.md#permissions","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/contacts/#permissions","path":"customer-center/contacts-and-teams/contacts.md","title":"Contacts","heading":"Permissions","keywords":"contacts sub-account add contact permissions access ui billing support account access","text":"Permissions decide what a contact (or a team) can see and do, and which emails they\nreceive. Grant only what each person needs: some permissions are high-impact, and several also **turn on\nautomatic emails**.\n\n\n\nThe permissions are grouped:\n\n| Group | What it controls | Why it matters |\n|---|---|---|\n| **Billing** | View and pay invoices, place orders, see the balance, add funds, edit card details, receive billing notifications. | Decides who handles money and paperwork. **Granting billing permissions sends this person the billing and administrative emails** (invoices, reminders) and the related tickets. |\n| **Support** | Open, view and close tickets; receive email notifications; see all of the organization's tickets. | Decides who can raise and follow support requests. **Granting support permissions sends this person the technical notifications** about your Hosted Power services. |\n| **Misc** | Account-wide controls: manage SSH keys, edit allowed IP access, add/edit contacts, manage teams, full control over services or domains, modify the main profile. | High-impact. Give \"Full control over services/domains\", \"Modify main profile details\", \"Add / Edit contacts\" and \"Manage teams\" only to people you fully trust. |\n| **TurboStack** | **Access UI**, and which departments the contact may use. | **Access UI is required to sign in to the TurboStack Platform** (`my.turbostack.app`) and see and manage the servers there. Without it, the contact cannot open the server-management interface. |\n| **Per service** | For each service (for example a TurboStack server or Domain Name System (DNS) management): view details and billing, request cancellation, upgrade/downgrade, edit information, change owner, and receive that service's emails. | Lets you scope a contact to specific services only - useful when someone should manage one project but not the whole account. |\n\n> [!IMPORTANT]\n> The two email-related groups are opt-in **per contact**: a contact only receives billing emails if\n> they have the billing permissions, and technical/support notifications if they have the support\n> permissions. The **main account holder** is different - it always receives billing and support\n> emails by default. You change that under\n> Account details > Settings > Notifications."} {"id":"customer-center/contacts-and-teams/contacts.md#status-active-or-closed","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/contacts/#status-active-or-closed","path":"customer-center/contacts-and-teams/contacts.md","title":"Contacts","heading":"Status: active or closed","keywords":"contacts sub-account add contact permissions access ui billing support account access","text":"Each contact and each team has a **Status** setting. Set it to **active** to allow the\npermissions you granted, or to **closed** to suspend access. When a contact or team is closed, all of\nits permissions are denied until you set it back to active. This lets you revoke access temporarily\nwithout deleting the contact or team."} {"id":"customer-center/contacts-and-teams/contacts.md#billing-contact","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/contacts/#billing-contact","path":"customer-center/contacts-and-teams/contacts.md","title":"Contacts","heading":"Billing contact","keywords":"contacts sub-account add contact permissions access ui billing support account access","text":"Under the contact list, the **Billing contact** setting controls which details appear on invoices.\nLeave it on **None, use main profile details** to bill the main account holder, or choose a contact.\nSelect **Save changes** to apply."} {"id":"customer-center/contacts-and-teams/contacts.md#related","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/contacts/#related","path":"customer-center/contacts-and-teams/contacts.md","title":"Contacts","heading":"Related","keywords":"contacts sub-account add contact permissions access ui billing support account access","text":"- Teams\n- Notification settings\n- TurboStack Platform"} {"id":"customer-center/contacts-and-teams/teams.md#intro","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/teams/","path":"customer-center/contacts-and-teams/teams.md","title":"Teams","heading":"","keywords":"teams shared access invite code invite team partner access project access permissions","text":"# Teams\n\nA **team** gives a group of people shared access to your account with one set of permissions. Teams\nare the usual way to give **several people access to a project** at once - for example your own\ndevelopers, or an external partner such as a web agency - instead of creating and maintaining a\ncontact for every individual."} {"id":"customer-center/contacts-and-teams/teams.md#why-use-a-team-instead-of-contacts","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/teams/#why-use-a-team-instead-of-contacts","path":"customer-center/contacts-and-teams/teams.md","title":"Teams","heading":"Why use a team instead of contacts","keywords":"teams shared access invite code invite team partner access project access permissions","text":"- **One set of permissions for the whole group.** Set what the team may do once; everyone in the team\n inherits it. You do not repeat the permissions person by person.\n- **Built for projects and partners.** Give a team access to the services that make up a project (for\n example a TurboStack server and its Domain Name System (DNS)), so the right people can work on it\n together.\n- **Easy to invite and remove.** People join with an invite code, and you can change the team's\n permissions or remove the team in one place."} {"id":"customer-center/contacts-and-teams/teams.md#invite-a-team-with-an-invite-code","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/teams/#invite-a-team-with-an-invite-code","path":"customer-center/contacts-and-teams/teams.md","title":"Teams","heading":"Invite a team with an invite code","keywords":"teams shared access invite code invite team partner access project access permissions","text":"You add people to a team with a **unique invite code**:\n\n\n\n1. Select **Manage contacts > Teams**, then **Invite Team**.\n2. Give the team a **Name** and **Description**.\n3. Set the **Invite Code** - a unique code you share with the people who should join. Anyone with the\n code can join the team and receive its permissions, so treat it like a password.\n4. Optionally enable **Allow notifications to remote team members**.\n5. Choose the team's **permissions** (see below), then select **Save changes**.\n\nShare the invite code with the people who should join. To create a team without an invite, use **Add\nnew team** on the same screen."} {"id":"customer-center/contacts-and-teams/teams.md#permissions-and-pre-made-privileges","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/teams/#permissions-and-pre-made-privileges","path":"customer-center/contacts-and-teams/teams.md","title":"Teams","heading":"Permissions and pre-made privileges","keywords":"teams shared access invite code invite team partner access project access permissions","text":"A team uses the **same permissions as a contact** - see\nContacts > Permissions for the full list and what each group does. Two points are worth repeating:\n\n- **TurboStack > Access UI** is required for team members to sign in to the\n TurboStack Platform and manage the servers there.\n- Granting the **Billing** or **Support** permissions sends team members the billing/administrative or\n technical emails for your services.\n\nTo set permissions quickly, use the **Pre-made privileges** presets at the top of the list:\n\n| Preset | Use it for |\n|---|---|\n| **None** | Start from nothing and pick each permission yourself. |\n| **Full privileges** | A trusted team that manages the whole account. |\n| **Accounting** | People who handle invoices and billing. |\n| **Technical staff** | Developers and operators who manage services - typically including Access UI. |\n\nPick a preset as a starting point, then fine-tune the individual permissions."} {"id":"customer-center/contacts-and-teams/teams.md#related","url":"https://docs.turbostack.app/customer-center/contacts-and-teams/teams/#related","path":"customer-center/contacts-and-teams/teams.md","title":"Teams","heading":"Related","keywords":"teams shared access invite code invite team partner access project access permissions","text":"- Contacts\n- Notification settings\n- TurboStack Platform"} {"id":"customer-center/dashboard.md#intro","url":"https://docs.turbostack.app/customer-center/dashboard/","path":"customer-center/dashboard.md","title":"Dashboard","heading":"","keywords":"dashboard customer center my services navigation account menu","text":"# Dashboard\n\nThe **Dashboard** is the first page you see after signing in. It lists your active services and gives\naccess to every area of the Customer Center."} {"id":"customer-center/dashboard.md#my-services","url":"https://docs.turbostack.app/customer-center/dashboard/#my-services","path":"customer-center/dashboard.md","title":"Dashboard","heading":"My services","keywords":"dashboard customer center my services navigation account menu","text":"The **My services** table lists each service on your account with:\n\n| Column | Meaning |\n|---|---|\n| **Product/Service** | The product name and its hostname. |\n| **Status** | For example **Active**. |\n| **Total** | The recurring price. |\n| **Billing cycle** | How often it renews, for example **Monthly**. |\n| **Expiry date** | The next renewal date. |\n\nSelect a service (or the arrow at the end of its row) to manage it - see\nTurboStack servers."} {"id":"customer-center/dashboard.md#navigation","url":"https://docs.turbostack.app/customer-center/dashboard/#navigation","path":"customer-center/dashboard.md","title":"Dashboard","heading":"Navigation","keywords":"dashboard customer center my services navigation account menu","text":"- **Left sidebar** - grouped into **Manage** (Dashboard, Services), **Account** (Account details,\n Manage contacts, Billing, Partner center, Security, History) and **Help** (TurboStack Docs, Support\n Tickets, Downloads). A link to the **TurboStack Platform** is also here.\n- **Top bar** - **Search**, the green **Order** menu (browse products to buy), the shopping cart,\n notifications, your account **Balance**, the **language** selector, and your account menu."} {"id":"customer-center/dashboard.md#related","url":"https://docs.turbostack.app/customer-center/dashboard/#related","path":"customer-center/dashboard.md","title":"Dashboard","heading":"Related","keywords":"dashboard customer center my services navigation account menu","text":"- Order and manage TurboStack servers\n- Contacts and teams\n- Tickets"} {"id":"customer-center/index.md#intro","url":"https://docs.turbostack.app/customer-center/","path":"customer-center/index.md","title":"Customer Center overview","heading":"","keywords":"customer center customer portal account services billing support hosted power portal","text":"# Customer Center overview\n\nThe **Customer Center** is Hosted Power's customer portal at\nportal.hosted-power.com. It is where you manage your account,\norder and manage services, register domains, handle billing, and open support tickets. It is\nseparate from the TurboStack Platform, which is where you configure the\nservers themselves."} {"id":"customer-center/index.md#what-you-can-do-here","url":"https://docs.turbostack.app/customer-center/#what-you-can-do-here","path":"customer-center/index.md","title":"Customer Center overview","heading":"What you can do here","keywords":"customer center customer portal account services billing support hosted power portal","text":"This section covers:\n\n- Registering an account - create your Customer Center account.\n- Logging in - sign in, including single sign-on (SSO).\n- Dashboard - your landing page and an overview of your services.\n- Contacts and teams - give other people access to your account.\n- Services - order and manage TurboStack servers, domains and Domain Name System (DNS) records.\n- Tickets - get help from support."} {"id":"customer-center/index.md#customer-center-vs-the-turbostack-platform","url":"https://docs.turbostack.app/customer-center/#customer-center-vs-the-turbostack-platform","path":"customer-center/index.md","title":"Customer Center overview","heading":"Customer Center vs the TurboStack Platform","keywords":"customer center customer portal account services billing support hosted power portal","text":"The two portals do different jobs and use different sign-ins:\n\n| Customer Center (`portal.hosted-power.com`) | TurboStack Platform (`my.turbostack.app`) |\n|---|---|\n| Account, contacts and teams | Server configuration (web server, databases, caching, security) |\n| Ordering services, domains and DNS | Publishing changes to your servers |\n| Billing and invoices | Health, monitoring and backups |\n| Support tickets | The day-to-day work described in this documentation's Platform section |\n\nYou order a server in the Customer Center, then configure it in the TurboStack Platform.\n\n> [!TIP]\n> Not sure which plan fits, or want to discuss a custom setup? Talk to our\n> sales team."} {"id":"customer-center/index.md#related","url":"https://docs.turbostack.app/customer-center/#related","path":"customer-center/index.md","title":"Customer Center overview","heading":"Related","keywords":"customer center customer portal account services billing support hosted power portal","text":"- Logging in\n- Order and manage TurboStack servers\n- Sales - help choosing or scaling a plan.\n- TurboStack Platform"} {"id":"customer-center/login.md#intro","url":"https://docs.turbostack.app/customer-center/login/","path":"customer-center/login.md","title":"Logging in","heading":"","keywords":"login sign in single sign-on sso github google customer center","text":"# Logging in\n\nSign in to the Customer Center at portal.hosted-power.com."} {"id":"customer-center/login.md#sign-in-with-email-and-password","url":"https://docs.turbostack.app/customer-center/login/#sign-in-with-email-and-password","path":"customer-center/login.md","title":"Logging in","heading":"Sign in with email and password","keywords":"login sign in single sign-on sso github google customer center","text":"1. Open portal.hosted-power.com and select **Login / Register**.\n2. Enter your **Email address** and **Password**.\n3. Select **Submit**.\n\n> [!NOTE]\n> Your Customer Center sign-in is **not** the same as a server or application control-panel login. It is\n> the account you created when registering."} {"id":"customer-center/login.md#single-sign-on-sso-with-github-or-google","url":"https://docs.turbostack.app/customer-center/login/#single-sign-on-sso-with-github-or-google","path":"customer-center/login.md","title":"Logging in","heading":"Single sign-on (SSO) with GitHub or Google","keywords":"login sign in single sign-on sso github google customer center","text":"If you registered with single sign-on (SSO), or linked a provider, sign in with one click:\n\n- **Sign in with GitHub**\n- **Sign in with Google**\n\nSelect the provider and approve access. You are returned to the Customer Center, signed in."} {"id":"customer-center/login.md#forgot-your-password","url":"https://docs.turbostack.app/customer-center/login/#forgot-your-password","path":"customer-center/login.md","title":"Logging in","heading":"Forgot your password","keywords":"login sign in single sign-on sso github google customer center","text":"On the login screen select **Forgot your password?** and follow the email instructions to reset it.\nIf you only ever signed in with GitHub or Google, keep using that provider's button instead."} {"id":"customer-center/login.md#related","url":"https://docs.turbostack.app/customer-center/login/#related","path":"customer-center/login.md","title":"Logging in","heading":"Related","keywords":"login sign in single sign-on sso github google customer center","text":"- Registering an account\n- Dashboard"} {"id":"customer-center/register.md#intro","url":"https://docs.turbostack.app/customer-center/register/","path":"customer-center/register.md","title":"Registering an account","heading":"","keywords":"register create account sign up customer center account github google","text":"# Registering an account\n\nTo use the Customer Center you need an account. You can register with an email address and password,\nor sign up with an existing GitHub or Google account."} {"id":"customer-center/register.md#create-an-account","url":"https://docs.turbostack.app/customer-center/register/#create-an-account","path":"customer-center/register.md","title":"Registering an account","heading":"Create an account","keywords":"register create account sign up customer center account github google","text":"1. Go to portal.hosted-power.com and select **Login / Register**.\n2. On the login screen, select **Create Account**.\n3. Fill in the sign-up form:\n\n\n\n- **Account type** - choose Personal or Organization (an organization adds company and tax fields).\n- **First name** and **Last name**.\n- **Email address** - used to sign in and to receive notifications.\n- **Password** and **Repeat password**.\n- **Country**.\n\n4. Select **Create Account** (or the equivalent submit button) to finish."} {"id":"customer-center/register.md#sign-up-with-github-or-google","url":"https://docs.turbostack.app/customer-center/register/#sign-up-with-github-or-google","path":"customer-center/register.md","title":"Registering an account","heading":"Sign up with GitHub or Google","keywords":"register create account sign up customer center account github google","text":"Instead of a password, you can use single sign-on (SSO). On the sign-up screen select **Sign up with\nGitHub** or **Sign up with Google** and approve access. The Customer Center creates your account from\nthat provider, and you sign in the same way next time. See Logging in.\n\n> [!TIP]\n> After your account is created you can order services right away - see\n> TurboStack servers, Domains and\n> DNS management."} {"id":"customer-center/register.md#related","url":"https://docs.turbostack.app/customer-center/register/#related","path":"customer-center/register.md","title":"Registering an account","heading":"Related","keywords":"register create account sign up customer center account github google","text":"- Logging in\n- Dashboard"} {"id":"customer-center/services/dns-management.md#intro","url":"https://docs.turbostack.app/customer-center/services/dns-management/","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"","keywords":"dns management dns records nameservers a record mx record manage dns","text":"# DNS management\n\n**DNS management** lets you manage the Domain Name System (DNS) records for your domains - the\nrecords that point your domain at your servers and mail. This page covers ordering DNS management;\nonce active, you manage the records from the service itself.\n\n> [!NOTE]\n> If you already run a cPanel or DirectAdmin control panel, we recommend managing DNS with its\n> built-in DNS tools instead of Customer Center DNS management. See the control panel's own\n> documentation for how to manage DNS there."} {"id":"customer-center/services/dns-management.md#order-dns-management","url":"https://docs.turbostack.app/customer-center/services/dns-management/#order-dns-management","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"Order DNS management","keywords":"dns management dns records nameservers a record mx record manage dns","text":"1. Open the **Order** menu and select **DNS Management**.\n2. Select the **Manage dns records for your domains** product and add it to your cart.\n\n\n\n3. Complete the order. The product is **free**, so there is no charge to add it."} {"id":"customer-center/services/dns-management.md#add-a-domain-zone","url":"https://docs.turbostack.app/customer-center/services/dns-management/#add-a-domain-zone","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"Add a domain (zone)","keywords":"dns management dns records nameservers a record mx record manage dns","text":"Open the DNS management service from **Services > DNS Management**. It lists the domains (zones) it\nmanages. Select **Add domain** to add a domain, or **Add domains in bulk** for several at once."} {"id":"customer-center/services/dns-management.md#nameservers","url":"https://docs.turbostack.app/customer-center/services/dns-management/#nameservers","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"Nameservers","keywords":"dns management dns records nameservers a record mx record manage dns","text":"For Hosted Power to answer Domain Name System (DNS) queries for a domain, the domain must point at\nthe Hosted Power nameservers. Set these at the domain's registrar:\n\n```\nns1.hosted-power.com\nns2.hosted-power.com\nns3.hosted-power.com\n```\n\n> [!IMPORTANT]\n> When you transfer a domain, its current nameservers keep answering until you switch. **Add all\n> your DNS records here first, then switch the nameservers** - that way there is no moment where\n> records are missing and your application or mail briefly stops resolving."} {"id":"customer-center/services/dns-management.md#add-and-edit-records","url":"https://docs.turbostack.app/customer-center/services/dns-management/#add-and-edit-records","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"Add and edit records","keywords":"dns management dns records nameservers a record mx record manage dns","text":"1. Tick the domain you want to change in the **Domain** list.\n2. Use the record buttons for the type you need: **Add A record**, **Add MX entry**, **Add new Alias\n Name** (a CNAME), and **More** for the other types. **DNS Templates** apply a set of records at\n once, and **Clone DNS settings** copies records from another zone.\n3. Fill in the record and **Submit**.\n\n\n\nA record has three parts:\n\n- **Name** - the host the record is for (leave it on the default for the domain itself, or enter a\n subdomain such as `www`).\n- **Time to Live (TTL)** - how long resolvers may cache the record (for example 10 minutes).\n- **Content** - the value: an IP address for an **A**/**AAAA** record, a hostname for a **CNAME** or\n **MX** record, or text for a **TXT** record.\n\nCommon records:\n\n| Type | Use it for |\n|---|---|\n| **A** / **AAAA** | Point a name at an IPv4 / IPv6 address. The AAAA record (\"quad-A\") is the IPv6 version of the A record. |\n| **CNAME** (Alias) | Point a name at another name. CNAME is short for Canonical Name. |\n| **MX** | Direct email for the domain. MX stands for Mail Exchanger: the mail server that receives the domain's email. |\n| **TXT** | Verification and mail records, for example Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC). |\n\n> [!TIP]\n> For the SPF, DKIM and DMARC records your mail needs, see Email - it\n> lists exactly which records to add here. To use this service for a domain, point the domain at it\n> from the domain's nameserver settings - see Domains."} {"id":"customer-center/services/dns-management.md#dnssec","url":"https://docs.turbostack.app/customer-center/services/dns-management/#dnssec","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"DNSSEC","keywords":"dns management dns records nameservers a record mx record manage dns","text":"Domain Name System Security Extensions (DNSSEC) add a layer of trust to the Domain Name System\n(DNS). DNSSEC signs the answers for your zone with a cryptographic key. A resolver that looks up your\ndomain can then check the signature and detect if an answer was changed on the way. If the signature\ndoes not match, the resolver treats the answer as invalid instead of sending your visitor to the\nwrong place.\n\nThis protects against a man-in-the-middle attack, where an attacker sits between your visitor and the\nDNS and returns forged records to redirect traffic. DNSSEC is optional. You enable it per zone."} {"id":"customer-center/services/dns-management.md#how-it-works","url":"https://docs.turbostack.app/customer-center/services/dns-management/#how-it-works","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"How it works","keywords":"dns management dns records nameservers a record mx record manage dns","text":"DNSSEC uses a public and private key pair:\n\n- The **private key** stays on the server that manages your DNS zone and signs the records.\n- The **public key** is published at your domain's registrar, so resolvers can verify the\n signatures.\n\nBoth sides must match. This is why enabling DNSSEC always has two parts: sign the zone, then publish\nthe key at the registrar."} {"id":"customer-center/services/dns-management.md#verify-your-setup","url":"https://docs.turbostack.app/customer-center/services/dns-management/#verify-your-setup","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"Verify your setup","keywords":"dns management dns records nameservers a record mx record manage dns","text":"> [!WARNING]\n> A wrong DNSSEC key or a mismatch between the zone and the registrar can make your whole zone fail\n> to validate. Resolvers then reject every answer, and all services on the domain (website and mail)\n> stop resolving. Always verify after any change.\n\nCheck your zone with the DNS visualization tool at https://dnsviz.net/. Enter your domain and it\ndraws the delegation from the root of the internet, to the top-level zone (for example `.com`), down\nto your own zone. If DNSSEC validates, the chain is green. If it is misconfigured, the records for\nyour zone turn red and show the error."} {"id":"customer-center/services/dns-management.md#enable-dnssec-when-turbostack-manages-your-dns","url":"https://docs.turbostack.app/customer-center/services/dns-management/#enable-dnssec-when-turbostack-manages-your-dns","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"Enable DNSSEC when TurboStack manages your DNS","keywords":"dns management dns records nameservers a record mx record manage dns","text":"When your zone runs in the DNS management service in the Customer Center, TurboStack sets up DNSSEC\nfor you. Open a support ticket, tell us which domain you want to enable DNSSEC for, and we handle the\nsigning and the registrar side. See Support."} {"id":"customer-center/services/dns-management.md#enable-dnssec-when-dns-is-hosted-externally","url":"https://docs.turbostack.app/customer-center/services/dns-management/#enable-dnssec-when-dns-is-hosted-externally","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"Enable DNSSEC when DNS is hosted externally","keywords":"dns management dns records nameservers a record mx record manage dns","text":"When your zone is hosted outside TurboStack, you enable DNSSEC in two steps:\n\n1. **Sign the zone at the provider.** Turn on DNSSEC where the zone lives - your external DNS\n provider, or the control panel on your server (for example cPanel or DirectAdmin). This generates\n the key pair and signs the zone. Follow the provider's own guide for the exact steps.\n2. **Publish the key at the registrar.** Copy the public key details the provider gives you and add\n them at your domain's registrar. If Hosted Power is your registrar, open a support ticket with the\n key details and we add them at the domain level. If another company is your registrar, add the\n details in their control panel or contact their support.\n\n> [!NOTE]\n> Some control panels only expose DNSSEC once it is enabled at the server level. If you cannot find\n> the option, check the panel's documentation or ask the party that manages the server."} {"id":"customer-center/services/dns-management.md#related","url":"https://docs.turbostack.app/customer-center/services/dns-management/#related","path":"customer-center/services/dns-management.md","title":"DNS management","heading":"Related","keywords":"dns management dns records nameservers a record mx record manage dns","text":"- Domains\n- Connecting your domain\n- Email (SPF, DKIM, DMARC records)\n- Mail deliverability"} {"id":"customer-center/services/domains.md#intro","url":"https://docs.turbostack.app/customer-center/services/domains/","path":"customer-center/services/domains.md","title":"Domains","heading":"","keywords":"domains register domain domain search transfer domain tld domain name","text":"# Domains\n\nSearch for and register domain names, or transfer an existing domain to Hosted Power, from the\nCustomer Center."} {"id":"customer-center/services/domains.md#search-and-register-a-domain","url":"https://docs.turbostack.app/customer-center/services/domains/#search-and-register-a-domain","path":"customer-center/services/domains.md","title":"Domains","heading":"Search and register a domain","keywords":"domains register domain domain search transfer domain tld domain name","text":"1. Open the **Order** menu and select **Domain Names**.\n2. Type the name you want in the search box and select **Search**.\n\n\n\n3. The results show which names are available and the price per year. Common top-level domains (TLDs)\n such as `.be`, `.com`, `.eu` and `.nl` are listed with their pricing, and the full price list is\n shown below the search.\n4. Add the domain you want to your cart and complete the order.\n\nUse **Bulk Domain Search** to check several names at once."} {"id":"customer-center/services/domains.md#transfer-a-domain","url":"https://docs.turbostack.app/customer-center/services/domains/#transfer-a-domain","path":"customer-center/services/domains.md","title":"Domains","heading":"Transfer a domain","keywords":"domains register domain domain search transfer domain tld domain name","text":"To move a domain you already own to Hosted Power, select **Transfer Domain** (or **Bulk Domain\nTransfer** for several at once). You will need the domain's authorization code (also called an EPP\ncode, short for Extensible Provisioning Protocol, or a transfer code) from your current registrar,\nand the domain must be unlocked.\n\nBefore you start, confirm the domain's administrative contact email is current at your registrar. The\ntransfer authorization email is sent to that address, and you must approve it to complete the transfer."} {"id":"customer-center/services/domains.md#manage-a-domain","url":"https://docs.turbostack.app/customer-center/services/domains/#manage-a-domain","path":"customer-center/services/domains.md","title":"Domains","heading":"Manage a domain","keywords":"domains register domain domain search transfer domain tld domain name","text":"After a domain is registered or transferred, it appears under your services. Open it to manage its\nsettings, such as the nameservers and contact details. To manage the domain's records, see\nDNS management."} {"id":"customer-center/services/domains.md#cancel-a-domain","url":"https://docs.turbostack.app/customer-center/services/domains/#cancel-a-domain","path":"customer-center/services/domains.md","title":"Domains","heading":"Cancel a domain","keywords":"domains register domain domain search transfer domain tld domain name","text":"Domains are registered and paid for **one year at a time**. To stop a domain from renewing, turn off\nits auto-renewal - it then keeps working until the paid period ends and is not charged again:\n\n1. Open **Services > Domains** in the sidebar and select the domain you no longer need (use the arrow\n to open it).\n2. Open the **Auto-renew** setting and set it to **Off**.\n3. **Save** the change.\n\n> [!NOTE]\n> Disabling auto-renewal does not delete the domain right away. It stays active until the current\n> paid period expires, after which it is no longer charged to your account."} {"id":"customer-center/services/domains.md#related","url":"https://docs.turbostack.app/customer-center/services/domains/#related","path":"customer-center/services/domains.md","title":"Domains","heading":"Related","keywords":"domains register domain domain search transfer domain tld domain name","text":"- DNS management\n- TurboStack servers"} {"id":"customer-center/services/turbostack-servers.md#intro","url":"https://docs.turbostack.app/customer-center/services/turbostack-servers/","path":"customer-center/services/turbostack-servers.md","title":"TurboStack servers","heading":"","keywords":"turbostack order server manage server reboot reverse dns server details hosting","text":"# TurboStack servers\n\nYou order **TurboStack** servers in the Customer Center and configure them in the\nTurboStack Platform. This page covers ordering a server and the basic\nserver management available in the portal."} {"id":"customer-center/services/turbostack-servers.md#order-a-turbostack-server","url":"https://docs.turbostack.app/customer-center/services/turbostack-servers/#order-a-turbostack-server","path":"customer-center/services/turbostack-servers.md","title":"TurboStack servers","heading":"Order a TurboStack server","keywords":"turbostack order server manage server reboot reverse dns server details hosting","text":"1. Open the green **Order** menu in the top bar and select **TurboStack**.\n2. Choose a plan and select **Order**.\n\n\n\nThe plans range from a single managed server (**TurboStack Platinum**) to larger and cloud-based\noptions (**TurboStack** and **TurboStack Cloud**). After ordering and paying, the server is\nprovisioned and appears under your services.\n\n> [!TIP]\n> Not sure which plan fits? Talk to sales before you order."} {"id":"customer-center/services/turbostack-servers.md#find-your-servers","url":"https://docs.turbostack.app/customer-center/services/turbostack-servers/#find-your-servers","path":"customer-center/services/turbostack-servers.md","title":"TurboStack servers","heading":"Find your servers","keywords":"turbostack order server manage server reboot reverse dns server details hosting","text":"Select **Services > TurboStack** in the sidebar to list your servers with their hostname, IP address,\nstatus and expiry date. Use the **All / Active / Cancelled** tabs to filter."} {"id":"customer-center/services/turbostack-servers.md#manage-a-server","url":"https://docs.turbostack.app/customer-center/services/turbostack-servers/#manage-a-server","path":"customer-center/services/turbostack-servers.md","title":"TurboStack servers","heading":"Manage a server","keywords":"turbostack order server manage server reboot reverse dns server details hosting","text":"Open a server (from the dashboard or the services list) to see its **Overview**:\n\n\n\n- **Server details** - status (on/off), hostname, IP address, login user and password (select\n **show** to reveal), operating system, location, and the CPU, memory and storage of the plan.\n- **Reboot** and **Shutdown** - power actions for the server. **More** holds further actions.\n- **Reverse DNS** - set the reverse Domain Name System (DNS) name for the server's IP address.\n- **Billing** - the service's billing details and renewal.\n\n> [!NOTE]\n> The Customer Center handles ordering, power actions and billing. To configure what runs on the\n> server - web server, databases, caching, security and applications - use the\n> TurboStack Platform."} {"id":"customer-center/services/turbostack-servers.md#upgrade-resize-your-server","url":"https://docs.turbostack.app/customer-center/services/turbostack-servers/#upgrade-resize-your-server","path":"customer-center/services/turbostack-servers.md","title":"TurboStack servers","heading":"Upgrade (resize) your server","keywords":"turbostack order server manage server reboot reverse dns server details hosting","text":"When your site outgrows its current plan, upgrade it from the Customer Center:\n\n1. Go to **Services > TurboStack** and open the server.\n2. On the right of **Server details**, select **Upgrade**.\n3. Choose the new plan size, select **Continue** to review the billing, then **Submit** to start the\n automated upgrade.\n\nA **TurboStack Platinum** server is resized without a reboot; other plans reboot once as part of the\nupgrade. The whole process is automated.\n\n> [!TIP]\n> Not sure which plan fits your growth, or want to discuss a custom setup? Talk to our\n> sales team - they will help you pick the right size."} {"id":"customer-center/services/turbostack-servers.md#related","url":"https://docs.turbostack.app/customer-center/services/turbostack-servers/#related","path":"customer-center/services/turbostack-servers.md","title":"TurboStack servers","heading":"Related","keywords":"turbostack order server manage server reboot reverse dns server details hosting","text":"- Sales - help choosing or scaling a plan.\n\n- TurboStack Platform\n- Domains\n- DNS management"} {"id":"customer-center/switching-accounts.md#intro","url":"https://docs.turbostack.app/customer-center/switching-accounts/","path":"customer-center/switching-accounts.md","title":"Switching accounts","heading":"","keywords":"switch account multiple accounts invited account account list contact guest team","text":"# Switching accounts\n\nYou can have access to **more than one customer account**. This happens when another account invites\nyou - as a contact, a guest, or through a team.\nFor example, a client can invite your agency so you can manage their services from your own sign-in.\n\nWhen you have access to several accounts, you switch between them without signing out."} {"id":"customer-center/switching-accounts.md#switch-to-another-account","url":"https://docs.turbostack.app/customer-center/switching-accounts/#switch-to-another-account","path":"customer-center/switching-accounts.md","title":"Switching accounts","heading":"Switch to another account","keywords":"switch account multiple accounts invited account account list contact guest team","text":"1. In the top-right corner, open your account menu (it shows **Welcome **).\n2. Select **Switch customer account**.\n3. Choose the account you want from the list.\n\n\n\nEach entry shows the account name and its customer number. After you pick one, the Customer Center\nloads that account, and everything you do applies to it until you switch again. Switch back the same\nway.\n\n> [!NOTE]\n> What you can see and do in another account depends on the permissions that account granted you when\n> it invited you - see Contacts and\n> Teams."} {"id":"customer-center/switching-accounts.md#related","url":"https://docs.turbostack.app/customer-center/switching-accounts/#related","path":"customer-center/switching-accounts.md","title":"Switching accounts","heading":"Related","keywords":"switch account multiple accounts invited account account list contact guest team","text":"- Logging in\n- Contacts\n- Teams"} {"id":"customer-center/tickets/create-a-ticket.md#intro","url":"https://docs.turbostack.app/customer-center/tickets/create-a-ticket/","path":"customer-center/tickets/create-a-ticket.md","title":"Creating a ticket","heading":"","keywords":"create ticket new ticket submit ticket support request department priority","text":"# Creating a ticket\n\nWhen you have a question or a problem, open a support ticket and the support team will reply."} {"id":"customer-center/tickets/create-a-ticket.md#open-a-new-ticket","url":"https://docs.turbostack.app/customer-center/tickets/create-a-ticket/#open-a-new-ticket","path":"customer-center/tickets/create-a-ticket.md","title":"Creating a ticket","heading":"Open a new ticket","keywords":"create ticket new ticket submit ticket support request department priority","text":"1. Select **Support Tickets** in the sidebar, then **Create new** (or use **Support > New ticket**).\n2. Fill in the ticket:\n\n\n\n- **Department** - choose the team that should handle it, for example **Support**.\n- **Priority** - how urgent it is (for example Low).\n- **Subject** - a short summary of the issue.\n- **Message** - the details. Include as much as you can: what you did, what you expected, and what\n happened.\n- **Related service** - link the ticket to a specific service so support has the context.\n- **Additional email recipients (CC)** - other people who should receive replies.\n\n3. Add any attachments (for example a screenshot) and **submit** the ticket.\n\n> [!TIP]\n> One issue per ticket, with a clear subject, gets the fastest answer. You can follow the reply on\n> the ticket dashboard."} {"id":"customer-center/tickets/create-a-ticket.md#related","url":"https://docs.turbostack.app/customer-center/tickets/create-a-ticket/#related","path":"customer-center/tickets/create-a-ticket.md","title":"Creating a ticket","heading":"Related","keywords":"create ticket new ticket submit ticket support request department priority","text":"- Ticket dashboard\n- Dashboard"} {"id":"customer-center/tickets/dashboard.md#intro","url":"https://docs.turbostack.app/customer-center/tickets/dashboard/","path":"customer-center/tickets/dashboard.md","title":"Ticket dashboard","heading":"","keywords":"support tickets ticket dashboard ticket status open tickets support","text":"# Ticket dashboard\n\nThe **Support Tickets** area is where you see and follow every support request on your account. Open\nit from **Support Tickets** in the sidebar."} {"id":"customer-center/tickets/dashboard.md#the-ticket-list","url":"https://docs.turbostack.app/customer-center/tickets/dashboard/#the-ticket-list","path":"customer-center/tickets/dashboard.md","title":"Ticket dashboard","heading":"The ticket list","keywords":"support tickets ticket dashboard ticket status open tickets support","text":"Tickets are shown in a table with:\n\n| Column | Meaning |\n|---|---|\n| **Ticket #** | The reference number for the ticket. |\n| **Subject** | What the ticket is about. |\n| **Status** | For example Open or Answered. |\n| **Department** | The team handling it, such as Support. |\n| **Date** | When it was last updated. |\n\nUse the **All / Open / Answered** tabs to filter the list. Select a ticket to read the conversation\nand reply."} {"id":"customer-center/tickets/dashboard.md#create-a-ticket","url":"https://docs.turbostack.app/customer-center/tickets/dashboard/#create-a-ticket","path":"customer-center/tickets/dashboard.md","title":"Ticket dashboard","heading":"Create a ticket","keywords":"support tickets ticket dashboard ticket status open tickets support","text":"Select **Create new** to open a new support request - see Creating a ticket."} {"id":"customer-center/tickets/dashboard.md#related","url":"https://docs.turbostack.app/customer-center/tickets/dashboard/#related","path":"customer-center/tickets/dashboard.md","title":"Ticket dashboard","heading":"Related","keywords":"support tickets ticket dashboard ticket status open tickets support","text":"- Creating a ticket\n- Dashboard"} {"id":"getting-started/connecting-your-domain.md#intro","url":"https://docs.turbostack.app/getting-started/connecting-your-domain/","path":"getting-started/connecting-your-domain.md","title":"Connecting your domain","heading":"","keywords":"point domain turbostack dns a record aaaa record lets encrypt connect domain","text":"# Connecting your domain\n\nBefore you publish a site with automatic HTTPS, your domain must point to your server. This page\nshows you how to find your server's addresses, create the DNS records, and request a certificate.\n\nDomain Name System (DNS) is the first step because Let's Encrypt validates ownership over HTTP: it connects to your\ndomain and expects to reach your server. If the domain does not resolve to the server, certificate\nissuance fails and your site cannot serve HTTPS."} {"id":"getting-started/connecting-your-domain.md#find-your-server-s-ip-addresses","url":"https://docs.turbostack.app/getting-started/connecting-your-domain/#find-your-server-s-ip-addresses","path":"getting-started/connecting-your-domain.md","title":"Connecting your domain","heading":"Find your server's IP addresses","keywords":"point domain turbostack dns a record aaaa record lets encrypt connect domain","text":"1. Open the host you want to publish to.\n2. Go to the Credentials tab.\n3. Copy the **Server Public IPv4** value, and the **Server Public IPv6** value if you plan to add an\n AAAA record."} {"id":"getting-started/connecting-your-domain.md#create-the-dns-records","url":"https://docs.turbostack.app/getting-started/connecting-your-domain/#create-the-dns-records","path":"getting-started/connecting-your-domain.md","title":"Connecting your domain","heading":"Create the DNS records","keywords":"point domain turbostack dns a record aaaa record lets encrypt connect domain","text":"At your DNS provider, create the records that point your domain to the addresses you just copied. If Hosted Power manages your DNS, create them in the Customer Center DNS management instead.\n\n| Record type | Name | Value | Required |\n| --- | --- | --- | --- |\n| A | `example.com` and `www` | Server Public IPv4 | Yes |\n| AAAA | `example.com` and `www` | Server Public IPv6 | Recommended |\n\n1. Create an **A record** for the apex (`example.com`) pointing to your IPv4 address.\n2. Create an **A record** for `www` pointing to the same IPv4 address.\n3. (Recommended) Create matching **AAAA records** for both names pointing to your IPv6 address.\n\n> [!NOTE]\n> DNS changes are not always instant. Propagation can take anywhere from a few minutes up to a few\n> hours, depending on your provider and the previous record's Time to Live (TTL)."} {"id":"getting-started/connecting-your-domain.md#point-it-in-turbostack","url":"https://docs.turbostack.app/getting-started/connecting-your-domain/#point-it-in-turbostack","path":"getting-started/connecting-your-domain.md","title":"Connecting your domain","heading":"Point it in TurboStack","keywords":"point domain turbostack dns a record aaaa record lets encrypt connect domain","text":"1. Open the application's settings.\n2. Set `server_name` to your domain(s) - for example `example.com www.example.com`.\n3. Set `cert_type: letsencrypt`.\n4. Publish the host.\n\nTurboStack requests the certificate from Let's Encrypt automatically during publishing, then renews\nit for you before it expires.\n\n> [!TIP]\n> For a domain that isn't pointed at the server yet, or for a wildcard certificate, use the **DNS\n> challenge** instead of HTTP validation - see TLS certificates.\n\n> [!NOTE]\n> If your account has DNS management enabled in the platform, you can create and manage these\n> records directly from TurboStack instead of using an external DNS provider."} {"id":"getting-started/connecting-your-domain.md#next-steps","url":"https://docs.turbostack.app/getting-started/connecting-your-domain/#next-steps","path":"getting-started/connecting-your-domain.md","title":"Connecting your domain","heading":"Next steps","keywords":"point domain turbostack dns a record aaaa record lets encrypt connect domain","text":"- TLS certificates - HTTPS for your domain.\n- Publishing changes - deploy your configuration.\n- Applications - manage applications and domains.\n- Credentials - server and account access details.\n- Customer Center DNS management - manage DNS records when Hosted Power runs your DNS.\n- Domains - register or transfer a domain."} {"id":"getting-started/core-concepts.md#intro","url":"https://docs.turbostack.app/getting-started/core-concepts/","path":"getting-started/core-concepts.md","title":"Core concepts","heading":"","keywords":"client host group template publish deploy revision configuration","text":"# Core concepts\n\nUnderstanding a few core concepts makes the rest of TurboStack easy to follow."} {"id":"getting-started/core-concepts.md#objects","url":"https://docs.turbostack.app/getting-started/core-concepts/#objects","path":"getting-started/core-concepts.md","title":"Core concepts","heading":"Objects","keywords":"client host group template publish deploy revision configuration","text":"TurboStack organizes everything into a simple hierarchy.\n\n| Concept | What it is |\n|---|---|\n| **Client** | A customer account. It owns hosts and groups, and defines who can see what. |\n| **Host** | A single server and its configuration - the central object you work with. |\n| **Group** | A reusable set of settings (such as SSH keys or security rules) applied to many hosts at once. |\n| **Template** | A pre-built host configuration you can apply to new hosts to save setup time. |\n\nA **client** contains **hosts** and **groups**. A **host** can belong to one or more groups and\ninherit their settings. **Groups** and **templates** help you manage many hosts efficiently."} {"id":"getting-started/core-concepts.md#hosts-and-their-configuration","url":"https://docs.turbostack.app/getting-started/core-concepts/#hosts-and-their-configuration","path":"getting-started/core-concepts.md","title":"Core concepts","heading":"Hosts and their configuration","keywords":"client host group template publish deploy revision configuration","text":"A host's configuration describes the desired state of a server. It is structured around:\n\n- **System users** - the operating-system accounts that own files and run applications.\n- **Applications (vhosts)** - the individual applications that run under a system user,\n each with its own domain, application type, PHP version, Transport Layer Security (TLS) certificate and more.\n\nYou edit this configuration through the **GUI editor** or directly as **YAML** in\nthe **Source** editor. Both describe the same configuration - use whichever you prefer. See\nConfiguring a host."} {"id":"getting-started/core-concepts.md#publishing-and-deployments","url":"https://docs.turbostack.app/getting-started/core-concepts/#publishing-and-deployments","path":"getting-started/core-concepts.md","title":"Core concepts","heading":"Publishing and deployments","keywords":"client host group template publish deploy revision configuration","text":"Saving and publishing are deliberately separate:\n\n- **Save** stores your changes in TurboStack *without* touching the server.\n- **Publish** (also called *deploy*) saves your changes **and** applies them to the server.\n\nWhile a deployment runs, TurboStack shows live progress and logs. See\nPublishing changes."} {"id":"getting-started/core-concepts.md#revisions","url":"https://docs.turbostack.app/getting-started/core-concepts/#revisions","path":"getting-started/core-concepts.md","title":"Core concepts","heading":"Revisions","keywords":"client host group template publish deploy revision configuration","text":"Every time you save, TurboStack records a **revision** of the configuration. You can review the\nhistory and restore a previous revision if you need to roll back."} {"id":"getting-started/core-concepts.md#default-behavior-worth-knowing","url":"https://docs.turbostack.app/getting-started/core-concepts/#default-behavior-worth-knowing","path":"getting-started/core-concepts.md","title":"Core concepts","heading":"Default behavior worth knowing","keywords":"client host group template publish deploy revision configuration","text":"TurboStack applies sensible, secure defaults so you don't have to configure everything:\n\n- **TurboShield** protection is enabled at the **medium** level by default.\n- **Database and cache sizes** are auto-tuned to the server; only override them with evidence.\n- **Monitoring** is enabled and managed by the platform.\n\n> [!TIP]\n> Because most settings have good defaults, you can start with a minimal configuration and only\n> change what you need."} {"id":"getting-started/core-concepts.md#next-steps","url":"https://docs.turbostack.app/getting-started/core-concepts/#next-steps","path":"getting-started/core-concepts.md","title":"Core concepts","heading":"Next steps","keywords":"client host group template publish deploy revision configuration","text":"- Logging in - access the platform.\n- Deploy your first site - an end-to-end quick start.\n- Managing hosts - put these concepts to work.\n- Glossary - definitions of every term used across the docs."} {"id":"getting-started/first-deployment.md#intro","url":"https://docs.turbostack.app/getting-started/first-deployment/","path":"getting-started/first-deployment.md","title":"Deploy your first site","heading":"","keywords":"turbostack quick start deploy first site publish getting started","text":"# Deploy your first site\n\nThis quick start walks you through deploying an application end to end: open your host, enable the\nservices it needs, add the application, point your domain, and publish.\n\n> [!TIP]\n> New to the concepts? Skim Core concepts first. For a deeper look at a\n> specific application (Magento, WordPress, and others), see Deploying applications."} {"id":"getting-started/first-deployment.md#1-open-your-host","url":"https://docs.turbostack.app/getting-started/first-deployment/#1-open-your-host","path":"getting-started/first-deployment.md","title":"Deploy your first site","heading":"1. Open your host","keywords":"turbostack quick start deploy first site publish getting started","text":"Sign in and open **Hosts**, then select the host you want to configure. Your servers are\nprovisioned by Hosted Power when you order them, so a host is ready in your list.\n\n\n\n> [!NOTE]\n> Don't have a server yet, or not sure which plan? Support can help you\n> get a host provisioned."} {"id":"getting-started/first-deployment.md#2-enable-the-services-you-need","url":"https://docs.turbostack.app/getting-started/first-deployment/#2-enable-the-services-you-need","path":"getting-started/first-deployment.md","title":"Deploy your first site","heading":"2. Enable the services you need","keywords":"turbostack quick start deploy first site publish getting started","text":"Services run at host level, so enable them before you add the application. Go to the\nServices tab and enable what your application requires:\n\n- **Web server** - Nginx or Apache.\n- **Database** - for example MySQL, and pick the version.\n- **Caching and queues** - Redis, Varnish or RabbitMQ.\n- **Search** - Elasticsearch or OpenSearch, if the application needs it.\n\n> [!TIP]\n> Memory sizing is auto-tuned to the server. Enable the service and pick its version; only\n> override the sizing with measured evidence."} {"id":"getting-started/first-deployment.md#3-add-your-application","url":"https://docs.turbostack.app/getting-started/first-deployment/#3-add-your-application","path":"getting-started/first-deployment.md","title":"Deploy your first site","heading":"3. Add your application","keywords":"turbostack quick start deploy first site publish getting started","text":"Go to the Applications tab -> **Add app or database**.\nIn **Configure application**:\n\n1. **Hostnames** - enter your domain in `server_name` (e.g. `example.com www.example.com`) and set\n **Certificate** to **Let's Encrypt** for automatic HTTPS.\n2. **Technologies** - choose the **App Type** (for example WordPress or Magento) and the runtime\n version (such as PHP), then connect the services you enabled in step 2.\n\nSee Deploying applications for ready-to-copy settings per application."} {"id":"getting-started/first-deployment.md#4-connect-your-domain","url":"https://docs.turbostack.app/getting-started/first-deployment/#4-connect-your-domain","path":"getting-started/first-deployment.md","title":"Deploy your first site","heading":"4. Connect your domain","keywords":"turbostack quick start deploy first site publish getting started","text":"For Let's Encrypt to issue a certificate, your domain must point to the server. Copy the server's\n**Public IPv4/IPv6** from the host's Credentials tab and create\nthe matching Domain Name System (DNS) records at your provider. Full steps:\nConnecting your domain."} {"id":"getting-started/first-deployment.md#5-publish","url":"https://docs.turbostack.app/getting-started/first-deployment/#5-publish","path":"getting-started/first-deployment.md","title":"Deploy your first site","heading":"5. Publish","keywords":"turbostack quick start deploy first site publish getting started","text":"Click **Save & Publish**. TurboStack provisions the stack, installs the application, and requests\nthe Transport Layer Security (TLS) certificate so the running server matches your configuration.\n\n\n\nFollow the live progress in the publish dialog. When it finishes, your site is live over HTTPS.\nSee Publishing changes for the deployment types and how to\nreview logs."} {"id":"getting-started/first-deployment.md#6-verify","url":"https://docs.turbostack.app/getting-started/first-deployment/#6-verify","path":"getting-started/first-deployment.md","title":"Deploy your first site","heading":"6. Verify","keywords":"turbostack quick start deploy first site publish getting started","text":"- Open your domain in a browser - it should load over **HTTPS**.\n- Check the host's Health tab for status and resource usage.\n- Retrieve any app/database logins from the Credentials tab."} {"id":"getting-started/first-deployment.md#next-steps","url":"https://docs.turbostack.app/getting-started/first-deployment/#next-steps","path":"getting-started/first-deployment.md","title":"Deploy your first site","heading":"Next steps","keywords":"turbostack quick start deploy first site publish getting started","text":"- Connecting your domain - DNS records in detail.\n- Deploying applications - per-application configuration and YAML.\n- Publishing changes - deploy types, revisions and rollback.\n- Security hardening - lock things down after launch."} {"id":"getting-started/introduction.md#intro","url":"https://docs.turbostack.app/getting-started/introduction/","path":"getting-started/introduction.md","title":"Introduction","heading":"","keywords":"turbostack hosting infrastructure self-service host management","text":"# Introduction\n\n**TurboStack** is Hosted Power's self-service platform for managing your hosting\ninfrastructure. Instead of configuring servers by hand, you describe how each server should\nlook - its web server, databases, caching, security, backups and applications - and TurboStack\napplies that configuration to your servers for you.\n\nTurboStack is a European managed platform built for teams that run business-critical applications and\napplications. Its main users are **web developers** and **DevOps** who want full control and\ntransparency over their stack, **e-commerce and marketing teams** who need their sites to stay fast\nand online during busy campaigns, and **agencies** that manage many client sites from one place. It\nfocuses on e-commerce and other critical applications - such as Magento, Shopware, WooCommerce and\nLaravel - and runs them on a standard, open-source stack, so you are not locked into a proprietary\nplatform."} {"id":"getting-started/introduction.md#how-turbostack-works","url":"https://docs.turbostack.app/getting-started/introduction/#how-turbostack-works","path":"getting-started/introduction.md","title":"Introduction","heading":"How TurboStack works","keywords":"turbostack hosting infrastructure self-service host management","text":"TurboStack is built around a **desired-state** model:\n\n1. **You describe the desired state.** In the TurboStack Platform you define the configuration for each\n server (a *host*). You can use the GUI editor or edit the configuration directly as\n YAML.\n2. **You publish.** When you are happy with the configuration, you publish it.\n3. **TurboStack applies it.** The platform automatically deploys your configuration to the\n server so that the running server matches what you described.\n\n> [!IMPORTANT]\n> TurboStack is the single source of truth for your servers. Manual changes made directly on a\n> server are not tracked and may be overwritten the next time the host is published. Make your\n> changes in TurboStack so they are recorded and consistently applied."} {"id":"getting-started/introduction.md#what-you-can-manage","url":"https://docs.turbostack.app/getting-started/introduction/#what-you-can-manage","path":"getting-started/introduction.md","title":"Introduction","heading":"What you can manage","keywords":"turbostack hosting infrastructure self-service host management","text":"From a single interface you can configure, for each server:\n\n- **Web & applications** - Nginx or Apache, PHP and other runtimes, and application types such\n as WordPress, Magento, Shopware, Drupal and more.\n- **Databases & search** - MySQL, PostgreSQL, MongoDB and search engines such as\n Elasticsearch/OpenSearch.\n- **Caching & queues** - Redis, Varnish and RabbitMQ.\n- **Security** - TurboShield protection, firewall rules, IP allow-lists and a web application\n firewall.\n- **Access** - SSH keys and authentication.\n- **Backups** - restore files and databases from backups.\n\nYou also organize servers with **groups** and **templates**, monitor their health,\nand work faster with **search** and a full **API** for automation."} {"id":"getting-started/introduction.md#your-account","url":"https://docs.turbostack.app/getting-started/introduction/#your-account","path":"getting-started/introduction.md","title":"Introduction","heading":"Your account","keywords":"turbostack hosting infrastructure self-service host management","text":"Your account manages its own hosts, groups and templates - you only ever see the resources that\nbelong to it. A single login can be linked to more than one account, which is useful for agencies\nand partners; TurboStack then shows a **Select account** screen after you sign in. See\nAccounts and access."} {"id":"getting-started/introduction.md#next-steps","url":"https://docs.turbostack.app/getting-started/introduction/#next-steps","path":"getting-started/introduction.md","title":"Introduction","heading":"Next steps","keywords":"turbostack hosting infrastructure self-service host management","text":"- Core concepts - the building blocks: clients, groups, hosts and publishing.\n- Logging in - sign in to the platform.\n- Managing hosts - start working with your servers.\n- Glossary - every term and acronym used across the docs."} {"id":"getting-started/logging-in.md#intro","url":"https://docs.turbostack.app/getting-started/logging-in/","path":"getting-started/logging-in.md","title":"Logging in","heading":"","keywords":"","text":"# Logging in\n\nYou access TurboStack through your web browser. This page covers signing in, two-factor\nauthentication, and choosing an account when you have more than one."} {"id":"getting-started/logging-in.md#signing-in","url":"https://docs.turbostack.app/getting-started/logging-in/#signing-in","path":"getting-started/logging-in.md","title":"Logging in","heading":"Signing in","keywords":"","text":"1. Open the TurboStack Platform in your browser.\n2. Enter your **email address** and **password**.\n3. Press **Enter** or click the sign-in button.\n\n\n\n> [!TIP]\n> Forgot your password? Use the password-reset link on the sign-in screen to receive reset\n> instructions."} {"id":"getting-started/logging-in.md#two-factor-authentication","url":"https://docs.turbostack.app/getting-started/logging-in/#two-factor-authentication","path":"getting-started/logging-in.md","title":"Logging in","heading":"Two-factor authentication","keywords":"","text":"If two-factor authentication (2FA) is enabled on your account, you are asked for a one-time\ncode after entering your password.\n\n1. Open your authenticator app and read the current code.\n2. Enter the code to continue.\n3. Optionally choose to be remembered on this device so you are not asked again for a while.\n\nSee Two-factor authentication to enable or manage 2FA."} {"id":"getting-started/logging-in.md#selecting-an-account","url":"https://docs.turbostack.app/getting-started/logging-in/#selecting-an-account","path":"getting-started/logging-in.md","title":"Logging in","heading":"Selecting an account","keywords":"","text":"If your login is linked to more than one account, TurboStack asks you to choose which one to\nwork in. Select the account to continue to its dashboard. You can switch accounts again later\nin the GUI."} {"id":"getting-started/logging-in.md#after-signing-in","url":"https://docs.turbostack.app/getting-started/logging-in/#after-signing-in","path":"getting-started/logging-in.md","title":"Logging in","heading":"After signing in","keywords":"","text":"You land on the **Hosts** dashboard, your starting point for managing servers. From here,\ncontinue to Navigating the interface or jump straight to\nManaging hosts."} {"id":"getting-started/logging-in.md#next-steps","url":"https://docs.turbostack.app/getting-started/logging-in/#next-steps","path":"getting-started/logging-in.md","title":"Logging in","heading":"Next steps","keywords":"","text":"- Selecting an account - choose an account if your login has more than one.\n- Navigating the interface - find your way around.\n- Two-factor authentication - secure your account."} {"id":"getting-started/navigating-the-interface.md#intro","url":"https://docs.turbostack.app/getting-started/navigating-the-interface/","path":"getting-started/navigating-the-interface.md","title":"Navigating the interface","heading":"","keywords":"navigation interface sidebar hosts groups templates gui editor yaml source editor","text":"# Navigating the interface\n\nOnce you are signed in, TurboStack presents a consistent layout so you always know where you\nare."} {"id":"getting-started/navigating-the-interface.md#main-navigation","url":"https://docs.turbostack.app/getting-started/navigating-the-interface/#main-navigation","path":"getting-started/navigating-the-interface.md","title":"Navigating the interface","heading":"Main navigation","keywords":"navigation interface sidebar hosts groups templates gui editor yaml source editor","text":"The sidebar gives you access to the platform's areas:\n\n- **Hosts** - your servers and their configuration (the default view).\n- **Groups** - shared settings applied across multiple hosts.\n- **Templates** - reusable host configurations.\n- **Search** - find hosts, groups and templates.\n- **Monitoring** - infrastructure and application monitoring.\n- **Support** - help and contact details.\n\nYour **Profile Settings** and **Logout** are also available from the navigation, and\na **Platform updates** link in the page footer opens the release-notes feed."} {"id":"getting-started/navigating-the-interface.md#breadcrumbs","url":"https://docs.turbostack.app/getting-started/navigating-the-interface/#breadcrumbs","path":"getting-started/navigating-the-interface.md","title":"Navigating the interface","heading":"Breadcrumbs","keywords":"navigation interface sidebar hosts groups templates gui editor yaml source editor","text":"A breadcrumb trail at the top of each page (for example *Dashboard / Hosts / your-host*) shows\nwhere you are and lets you step back up at any time."} {"id":"getting-started/navigating-the-interface.md#gui-editor-vs-source-yaml","url":"https://docs.turbostack.app/getting-started/navigating-the-interface/#gui-editor-vs-source-yaml","path":"getting-started/navigating-the-interface.md","title":"Navigating the interface","heading":"GUI editor vs. Source (YAML)","keywords":"navigation interface sidebar hosts groups templates gui editor yaml source editor","text":"When configuring a host, group or template, you can switch between two editing modes using the\n**GUI / Source** toggle:\n\n- **GUI** - a guided editor with dropdowns and fields.\n- **Source** - the raw YAML configuration, for advanced users.\n\nBoth edit the same configuration. You can set your preferred default mode in\nProfile & preferences."} {"id":"getting-started/navigating-the-interface.md#lists-search-and-pagination","url":"https://docs.turbostack.app/getting-started/navigating-the-interface/#lists-search-and-pagination","path":"getting-started/navigating-the-interface.md","title":"Navigating the interface","heading":"Lists, search and pagination","keywords":"navigation interface sidebar hosts groups templates gui editor yaml source editor","text":"List pages (Hosts, Groups, Templates) share the same conveniences:\n\n- A **search box** filters the list as you type.\n- A **Number of Items** control sets how many entries appear per page.\n- **Copy** icons appear next to values such as host names and IP addresses."} {"id":"getting-started/navigating-the-interface.md#real-time-feedback","url":"https://docs.turbostack.app/getting-started/navigating-the-interface/#real-time-feedback","path":"getting-started/navigating-the-interface.md","title":"Navigating the interface","heading":"Real-time feedback","keywords":"navigation interface sidebar hosts groups templates gui editor yaml source editor","text":"Long-running operations - such as publishing a configuration or restoring a backup - open a\ndialog that updates automatically and shows live progress and logs, so you can follow along\nwithout refreshing the page."} {"id":"getting-started/navigating-the-interface.md#next-steps","url":"https://docs.turbostack.app/getting-started/navigating-the-interface/#next-steps","path":"getting-started/navigating-the-interface.md","title":"Navigating the interface","heading":"Next steps","keywords":"navigation interface sidebar hosts groups templates gui editor yaml source editor","text":"- Deploy your first site - an end-to-end quick start.\n- Managing hosts - browse and configure your servers."} {"id":"getting-started/selecting-an-account.md#intro","url":"https://docs.turbostack.app/getting-started/selecting-an-account/","path":"getting-started/selecting-an-account.md","title":"Selecting an account","heading":"","keywords":"select account account list switch account multiple accounts turbostack login","text":"# Selecting an account\n\nSome logins have access to more than one account. After you sign in, TurboStack then shows the\n**Account list** so you can choose which account to work in. If your login has access to a single\naccount, you skip this step and go straight to the Hosts list."} {"id":"getting-started/selecting-an-account.md#how-it-works","url":"https://docs.turbostack.app/getting-started/selecting-an-account/#how-it-works","path":"getting-started/selecting-an-account.md","title":"Selecting an account","heading":"How it works","keywords":"select account account list switch account multiple accounts turbostack login","text":"Each row is an account you can open, listed by its name.\n\n1. Read the list under **Please click at the account you want to login for**.\n2. Click the account you want to open.\n3. TurboStack opens that account and takes you to its Hosts list.\n\nEverything you do next, browsing hosts, editing configuration and publishing, applies to the\naccount you selected."} {"id":"getting-started/selecting-an-account.md#switching-to-another-account","url":"https://docs.turbostack.app/getting-started/selecting-an-account/#switching-to-another-account","path":"getting-started/selecting-an-account.md","title":"Selecting an account","heading":"Switching to another account","keywords":"select account account list switch account multiple accounts turbostack login","text":"To work in a different account, use the account selector in the top bar. You can switch at any\ntime without signing out.\n\n> [!NOTE]\n> The hosts, groups and templates you see always belong to the account you are currently in. If a\n> host you expect is missing, check that you selected the right account."} {"id":"getting-started/selecting-an-account.md#next-steps","url":"https://docs.turbostack.app/getting-started/selecting-an-account/#next-steps","path":"getting-started/selecting-an-account.md","title":"Selecting an account","heading":"Next steps","keywords":"select account account list switch account multiple accounts turbostack login","text":"- Navigating the interface - find your way around.\n- Deploy your first site - an end-to-end quick start.\n- Logging in - back to signing in."} {"id":"index.md#intro","url":"https://docs.turbostack.app/","path":"index.md","title":"TurboStack Documentation","heading":"","keywords":"","text":"# TurboStack Documentation\n\n**TurboStack** is Hosted Power's self-service platform for managing your hosting\ninfrastructure. You define how each server should be configured - web server, databases,\ncaching, security, backups and more - and TurboStack applies that configuration to your servers\nfor you. This documentation explains how to use the platform, step by step.\n\nTurboStack is built for **web developers**, **DevOps** and **e-commerce teams** - and the\n**agencies** that serve them - who run business-critical sites and want them fast, stable and on a\nstandard, open-source stack (no vendor lock-in).\n\n> [!TIP]\n> New to TurboStack? Start with Introduction and\n> Core concepts."} {"id":"index.md#getting-started","url":"https://docs.turbostack.app/#getting-started","path":"index.md","title":"TurboStack Documentation","heading":"Getting started","keywords":"","text":"- Introduction - what TurboStack is and how it works.\n- Core concepts - clients, groups, hosts, templates and publishing.\n- Deploy your first site - an end-to-end quick start.\n- Connecting your domain - Domain Name System (DNS) records for your site.\n- Logging in - signing in, two-factor authentication, account selection.\n- Selecting an account - choose an account when your login has more than one.\n- Navigating the interface - finding your way around."} {"id":"index.md#turbostack-platform","url":"https://docs.turbostack.app/#turbostack-platform","path":"index.md","title":"TurboStack Documentation","heading":"TurboStack Platform","keywords":"","text":"- Platform overview - the main areas of the platform."} {"id":"index.md#hosts","url":"https://docs.turbostack.app/#hosts","path":"index.md","title":"TurboStack Documentation","heading":"Hosts","keywords":"","text":"- Hosts - browse and manage your servers.\n- Publishing changes - save and deploy configuration.\n- History (revisions, deploys and cloning) - change and deployment history.\n- Credentials - server and per-account access details.\n- Health - live host monitoring.\n- Threat Center - security findings.\n- Services - web server, databases, caching, search.\n- SSH - SSH keys and authentication.\n- Security - TurboShield, firewall, allow-lists, Web Application Firewall (WAF).\n- Backups - create backups and restore files and databases.\n\n**Applications (host tab):** Applications | TLS certificates | Git deployment | Migration Hero\n\n**Advanced (host tab):** Advanced settings | Email | Installing extra OS packages | FTP and SFTP access"} {"id":"index.md#groups-and-templates","url":"https://docs.turbostack.app/#groups-and-templates","path":"index.md","title":"TurboStack Documentation","heading":"Groups and templates","keywords":"","text":"- Groups - shared settings across hosts.\n- Templates - reusable host configurations."} {"id":"index.md#tools","url":"https://docs.turbostack.app/#tools","path":"index.md","title":"TurboStack Documentation","heading":"Tools","keywords":"","text":"- Search - find hosts, groups and templates.\n- Monitoring - fleet-wide alerts.\n- Platform updates - release notes.\n- Support - how to get help.\n- Troubleshooting - common questions and fixes."} {"id":"index.md#customer-center","url":"https://docs.turbostack.app/#customer-center","path":"index.md","title":"TurboStack Documentation","heading":"Customer Center","keywords":"","text":"- Customer Center overview - the customer portal for account, services, billing and support.\n- Registering an account | Logging in | Switching accounts | Dashboard\n- Contacts | Teams\n- Account details - profile, sign-in details and notification settings.\n- TurboStack servers | Domains | DNS management\n- Ticket dashboard | Creating a ticket"} {"id":"index.md#applications","url":"https://docs.turbostack.app/#applications","path":"index.md","title":"TurboStack Documentation","heading":"Applications","keywords":"","text":"- Deploying applications - how it works, requirements, example YAML, and file layout/permissions.\n- WordPress | Magento 2 | Shopware | Drupal | Laravel\n- Akeneo PIM | OroCommerce | Craft CMS | Nextcloud\n- Odoo | Medusa | nopCommerce | Self-hosted platforms (GitLab, Advanced Database Monitoring)"} {"id":"index.md#technologies","url":"https://docs.turbostack.app/#technologies","path":"index.md","title":"TurboStack Documentation","heading":"Technologies","keywords":"","text":"- Technologies overview - what each building block is and how to configure it.\n- **Web and runtimes:** Nginx | Apache | PHP | Node.js | Python | Ruby | .NET\n- **Databases and search:** MySQL | PostgreSQL | MongoDB | SQL Server | Redis | RabbitMQ | Elasticsearch | OpenSearch\n- **Caching, proxy and containers:** Varnish | Reverse proxy | Docker | Kubernetes\n- **Security and access:** TurboShield | Firewall | SSH\n- **Server operations:** System services - run background workers and app processes as systemd user services."} {"id":"index.md#troubleshooting","url":"https://docs.turbostack.app/#troubleshooting","path":"index.md","title":"TurboStack Documentation","heading":"Troubleshooting","keywords":"","text":"- Troubleshooting overview - a method for diagnosing host problems.\n- Why is my site slow? | 502/503/504 errors | 403/413/429 errors\n- Out of memory | High CPU and load | Disk full\n- Database problems | TLS certificate problems | Mail deliverability"} {"id":"index.md#platform-concepts","url":"https://docs.turbostack.app/#platform-concepts","path":"index.md","title":"TurboStack Documentation","heading":"Platform concepts","keywords":"","text":"- The Source (YAML) view - edit configuration as YAML.\n- Accounts and access - account access and multi-account login.\n- Security overview - how TurboStack protects your servers.\n- Networking - private networking, Virtual Private Network (VPN) and high availability.\n- Monitoring - the monitoring and observability stack.\n- Performance tuning - caching and when to override defaults.\n- Security hardening - a practical security checklist.\n- Glossary - key TurboStack terms."} {"id":"index.md#your-account","url":"https://docs.turbostack.app/#your-account","path":"index.md","title":"TurboStack Documentation","heading":"Your account","keywords":"","text":"- Profile and preferences - account settings.\n- API tokens - personal access tokens for the API.\n- Two-factor authentication - secure your account."} {"id":"index.md#developers","url":"https://docs.turbostack.app/#developers","path":"index.md","title":"TurboStack Documentation","heading":"Developers","keywords":"","text":"- API reference - manage clients, groups and hosts programmatically.\n- TurboStack CLI - manage caches, services and the firewall on the server with `tscli`.\n- Documentation MCP server - connect Claude, ChatGPT, Gemini or Cursor to this documentation."} {"id":"index.md#trust-and-security","url":"https://docs.turbostack.app/#trust-and-security","path":"index.md","title":"TurboStack Documentation","heading":"Trust and security","keywords":"","text":"- Trust and security overview - how TurboStack keeps your hosting secure and managed.\n- How we protect your platform | DDoS and abuse protection\n- Backups and recovery | Access control and encryption | Reporting a security issue"} {"id":"index.md#frequently-asked-questions","url":"https://docs.turbostack.app/#frequently-asked-questions","path":"index.md","title":"TurboStack Documentation","heading":"Frequently asked questions","keywords":"","text":"- Frequently asked questions - quick answers to common questions, each linking to the full page.\n\n> [!NOTE]\n> This documentation is produced and maintained with a Claude Code documentation agent. See\n> `AGENTS.md` and `PLAN.md` in the repository root for the workflow and structure."} {"id":"platform/changelog.md#intro","url":"https://docs.turbostack.app/platform/changelog/","path":"platform/changelog.md","title":"Changelog","heading":"","keywords":"changelog release notes platform updates turbostack releases new features bug fixes","text":"# Changelog\n\n\n\nNotable customer-facing changes to the TurboStack Platform, newest first. Releases go out roughly\nevery two weeks; each entry is dated by its release. For the live, in-app feed see\nPlatform Updates.\n\nEach entry is labelled: [!badge variant=\"success\" text=\":icon-rocket: New\"]\n[!badge variant=\"info\" text=\":icon-light-bulb: Improved\"] [!badge variant=\"warning\" text=\":icon-tools: Fixes\"]\n[!badge variant=\"danger\" text=\":icon-shield-lock: Security\"].\n\n> [!IMPORTANT]\n> Some changes only take effect on your servers after a **full publish** of the host. See\n> Publishing changes."} {"id":"platform/changelog.md#2026-07-20","url":"https://docs.turbostack.app/platform/changelog/#2026-07-20","path":"platform/changelog.md","title":"Changelog","heading":"2026-07-20","keywords":"changelog release notes platform updates turbostack releases new features bug fixes","text":"- [!badge variant=\"info\" text=\":icon-light-bulb: Improved\"] **Faster firewall block and unblock from the command line** - `tscli firewall block` and `unblock` now apply at the firewall immediately, instead of waiting for the background sync. Repeating a block no longer stacks duplicate rules, and an unblock takes effect right away. See Block an IP address and the CLI reference.\n- [!badge variant=\"warning\" text=\":icon-tools: Fixes\"] **PHP preloading now takes effect reliably** - A configured preload script now loads correctly. It is applied once per PHP version, at the runtime level. Only one application per PHP version can use preloading, as before. See `php_opcache_preload_script`.\n- [!badge variant=\"warning\" text=\":icon-tools: Fixes\"] Account names containing an ampersand (`&`) now display correctly in the account switcher."} {"id":"platform/changelog.md#2026-06-22","url":"https://docs.turbostack.app/platform/changelog/#2026-06-22","path":"platform/changelog.md","title":"Changelog","heading":"2026-06-22","keywords":"changelog release notes platform updates turbostack releases new features bug fixes","text":"- [!badge variant=\"success\" text=\":icon-rocket: New\"] **Monitoring in the main navigation** - Monitoring\n now has its own entry in the left navigation. Each alert opens a detail page with a downloadable\n PDF report, and the host graphs are clearer and more accurate. See Monitoring,\n Monitoring (concepts) and the host Health tab.\n- [!badge variant=\"info\" text=\":icon-light-bulb: Improved\"] **Threat Center: export and manage detections** - You\n can now export Indicators of Compromise, Vulnerabilities and Runtime Detections to CSV, dismiss or\n clear individual detections, and page through long lists more comfortably. See\n Threat Center.\n- [!badge variant=\"success\" text=\":icon-rocket: New\"] **Filter and create hosts over the API** - You can\n now filter the list endpoints by name to find the hosts you need without paging through everything,\n and create a host directly from the API. See the API reference.\n- [!badge variant=\"info\" text=\":icon-light-bulb: Improved\"] **Safer account names** - The Add and Edit Account\n screens now reject reserved or invalid usernames before you save, so a bad name cannot slip\n through. See Applications and accounts.\n- [!badge variant=\"info\" text=\":icon-light-bulb: Improved\"] **Compact responsive sidebar** - The navigation now\n collapses to a compact sidebar on medium-sized screens, so it stays usable on smaller displays.\n- [!badge variant=\"warning\" text=\":icon-tools: Fixes\"] Minor fixes to the host Health\n tab, History tab pagination, and the CPU load graph."} {"id":"platform/changelog.md#2026-06-09","url":"https://docs.turbostack.app/platform/changelog/#2026-06-09","path":"platform/changelog.md","title":"Changelog","heading":"2026-06-09","keywords":"changelog release notes platform updates turbostack releases new features bug fixes","text":"- [!badge variant=\"danger\" text=\":icon-shield-lock: Security\"] **Security alerts with one-click fix** - Hosts\n now show security alerts directly in the interface, for example when a component is out of date.\n Each alert has an optional button that deploys the recommended fix for you, and alerts are hidden\n while a deployment is running. See Security."} {"id":"platform/changelog.md#2026-06-01","url":"https://docs.turbostack.app/platform/changelog/#2026-06-01","path":"platform/changelog.md","title":"Changelog","heading":"2026-06-01","keywords":"changelog release notes platform updates turbostack releases new features bug fixes","text":"- [!badge variant=\"warning\" text=\":icon-tools: Fixes\"] **Clearer deployment errors** - When a step in a\n deployment fails, you now see the actual error message instead of a blank result, so it is clear\n what went wrong. See Publishing changes."} {"id":"platform/changelog.md#2026-05-18","url":"https://docs.turbostack.app/platform/changelog/#2026-05-18","path":"platform/changelog.md","title":"Changelog","heading":"2026-05-18","keywords":"changelog release notes platform updates turbostack releases new features bug fixes","text":"- [!badge variant=\"info\" text=\":icon-light-bulb: Improved\"] **Credentials, database users and FTP** - The\n Credentials area is easier to use. You can create extra database users with a read-only or an admin\n role, and FTP accounts are now grouped under their database. See Credentials\n and Manage database users."} {"id":"platform/changelog.md#2026-05-11","url":"https://docs.turbostack.app/platform/changelog/#2026-05-11","path":"platform/changelog.md","title":"Changelog","heading":"2026-05-11","keywords":"changelog release notes platform updates turbostack releases new features bug fixes","text":"- [!badge variant=\"success\" text=\":icon-rocket: New\"] **Create Backup on demand** - You can now start a\n backup yourself with **Create Backup**, instead of waiting for the scheduled run. See\n Backups.\n- [!badge variant=\"success\" text=\":icon-rocket: New\"] **Ruby application support** - Ruby applications now\n support a custom start command (`ruby_start_cmd`) and an optional Sidekiq background-worker service\n (`ruby_sidekiq`, `ruby_sidekiq_cmd`). See Ruby and the\n application parameters.\n- [!badge variant=\"warning\" text=\":icon-tools: Fixes\"] A host with no system users defined no longer\n causes an error."} {"id":"platform/changelog.md#2026-04-01","url":"https://docs.turbostack.app/platform/changelog/#2026-04-01","path":"platform/changelog.md","title":"Changelog","heading":"2026-04-01","keywords":"changelog release notes platform updates turbostack releases new features bug fixes","text":"- [!badge variant=\"warning\" text=\":icon-tools: Fixes\"] **Search fixes** - Fixed enabling Elasticsearch, an\n Elasticsearch plugin problem, and search-result sorting. See\n Elasticsearch.\n\n> [!NOTE]\n> This changelog is curated from the platform's release history and focuses on changes you can see\n> or use as a customer. Internal, infrastructure and staff-only changes are omitted. For the exact,\n> always-current behavior of a feature, follow the linked documentation page."} {"id":"platform/changelog.md#related","url":"https://docs.turbostack.app/platform/changelog/#related","path":"platform/changelog.md","title":"Changelog","heading":"Related","keywords":"changelog release notes platform updates turbostack releases new features bug fixes","text":"- Platform Updates - the live in-app feed\n- Publishing changes\n- Support"} {"id":"platform/groups.md#intro","url":"https://docs.turbostack.app/platform/groups/","path":"platform/groups.md","title":"Groups","heading":"","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"# Groups\n\nGroups are reusable collections of settings that you apply across multiple hosts at the same time. Instead of repeating the same SSH keys or security rules on every server, you define them once on a group and let every member host inherit them. This keeps security consistent across a fleet of hosts: set the keys and rules once, and every member host stays in sync.\n\n\n\nThis page covers:\n\n- Creating a group - add a group and open it\n- Assigning hosts to a group - manage its membership\n- Publishing a group - apply the group's settings to its hosts\n- Group history - review past changes and deployments, and revert\n- Editing a group and Deleting a group"} {"id":"platform/groups.md#what-you-can-do-with-groups","url":"https://docs.turbostack.app/platform/groups/#what-you-can-do-with-groups","path":"platform/groups.md","title":"Groups","heading":"What you can do with groups","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"- Define **SSH** keys once and share them across every host in the group.\n- Define firewall and **Security** rules once and apply them everywhere.\n- Add or remove hosts from a group at any time without touching each host individually.\n\nSettings defined on a group are inherited by all of its member hosts, so changes you make to a group take effect across the whole membership."} {"id":"platform/groups.md#normal-groups-and-partner-groups","url":"https://docs.turbostack.app/platform/groups/#normal-groups-and-partner-groups","path":"platform/groups.md","title":"Groups","heading":"Normal groups and partner groups","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"There are two kinds of group. A **partner group** is marked with a blue group icon next to its **Manage** button.\n\n- A **normal group** belongs to a single customer account. It applies only to that customer, and you can only add hosts that belong to it.\n- A **partner group** sits one level higher and works across multiple customers. It has the same settings as a normal group, but you can add hosts from any customer account you have TurboStack access to. This lets an agency apply shared SSH keys and security rules across all of its client environments at once, instead of configuring each account separately."} {"id":"platform/groups.md#viewing-groups","url":"https://docs.turbostack.app/platform/groups/#viewing-groups","path":"platform/groups.md","title":"Groups","heading":"Viewing groups","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"To see all groups, open `/groups`. The overview lists every group, with a search box and a `Create` button above it.\n\n\n\nEach group has its own page at `/groups/{group}` with the following tabs:\n\n| Tab | Purpose |\n| --- | --- |\n| `SSH` | Set the SSH keys that member hosts inherit. |\n| `Hosts` | Select which hosts belong to the group. |\n| `Security` | Define firewall and security rules that member hosts inherit. |\n\n> [!TIP]\n> A read-only `Source (YAML)` view of any group is available at `/groups/yaml/{group}` if you want to review the full configuration at a glance. The first icon in the group header opens it."} {"id":"platform/groups.md#creating-a-group","url":"https://docs.turbostack.app/platform/groups/#creating-a-group","path":"platform/groups.md","title":"Groups","heading":"Creating a group","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"1. Go to `/groups`.\n2. Select `Create`.\n3. In the modal, enter a name for the group.\n4. Confirm to create the group and open it."} {"id":"platform/groups.md#assigning-hosts-to-a-group","url":"https://docs.turbostack.app/platform/groups/#assigning-hosts-to-a-group","path":"platform/groups.md","title":"Groups","heading":"Assigning hosts to a group","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"The `Hosts` tab controls the membership of the group. It shows two lists side by side:\n\n- **Available Hosts** - the hosts you can still add.\n- **Selected Hosts** - the hosts that are already in the group.\n\nSelect a host in **Available Hosts** to move it to **Selected Hosts**. Select a host in\n**Selected Hosts** to move it back. Each list has its own search box, so you can filter a long\nlist before you move anything.\n\n\n\n1. Open the group and select the `Hosts` tab.\n2. Search for a host if the list is long, then select it to move it to the other list.\n3. To include every available host at once, use `Add all hosts`. To clear the membership, use\n `Remove all hosts`.\n4. Select `Save`, then publish the group to apply its settings to the new\n member hosts.\n\n> [!NOTE]\n> You can check which groups a host belongs to from that host's `Groups` tab. Any setting defined on a group automatically applies to all of its hosts."} {"id":"platform/groups.md#setting-group-level-ssh-keys","url":"https://docs.turbostack.app/platform/groups/#setting-group-level-ssh-keys","path":"platform/groups.md","title":"Groups","heading":"Setting group-level SSH keys","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"1. Open the group and select the `SSH` tab.\n2. Add the SSH keys you want every member host to receive.\n3. Save your changes. The keys are inherited by all hosts in the group."} {"id":"platform/groups.md#setting-group-level-security-rules","url":"https://docs.turbostack.app/platform/groups/#setting-group-level-security-rules","path":"platform/groups.md","title":"Groups","heading":"Setting group-level security rules","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"1. Open the group and select the `Security` tab.\n2. Define the firewall and security rules to apply.\n3. Save your changes. The rules are inherited by all hosts in the group.\n\n> [!IMPORTANT]\n> Because group settings are inherited, removing a key or rule from a group removes it from every member host. Review the group's membership before making changes."} {"id":"platform/groups.md#publishing-a-group","url":"https://docs.turbostack.app/platform/groups/#publishing-a-group","path":"platform/groups.md","title":"Groups","heading":"Publishing a group","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"Saving a group stores your changes in TurboStack. The member hosts only change once you\n**publish** the group. The buttons for this sit in the group header, next to the group name.\n\n| Action | What it does |\n| --- | --- |\n| `Save` | Stores the group configuration. Nothing is applied to the member hosts yet. |\n| `Save & Publish` | Saves your changes and starts a deployment on the group's hosts right away. |\n| `Save & Full Publish` | In the menu next to `Save & Publish`. Shows a preview of every host in the group first, then re-applies the whole configuration on each of them. |\n\nAbove the header, TurboStack tells you where the group stands: how many unpublished changes it\nhas, or when the last publication succeeded or only partly succeeded. Selecting the unpublished\nchanges message opens the History view."} {"id":"platform/groups.md#the-deploy-preview","url":"https://docs.turbostack.app/platform/groups/#the-deploy-preview","path":"platform/groups.md","title":"Groups","heading":"The deploy preview","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"`Save & Full Publish` opens a preview before anything is deployed. It lists every host in the\ngroup, so you can see what the deployment will do:\n\n| Column | What it shows |\n| --- | --- |\n| **Hostname** | The member host that will be deployed. |\n| **Pending local changes** | How many unpublished changes that host still has of its own. Zero is shown in green, anything higher in yellow. |\n| **Components** | The parts of the configuration that will be deployed on that host, for example `firewall` or `webserver`. A dash means no specific components. |\n| **Deploy Type** | `Deploy` when specific components are listed, or `Full Deploy` when the whole configuration is re-applied. |\n| **Open Host** | Opens that host in a new browser tab, so you can check it before you publish. |\n\nThe list is paginated when the group has many hosts.\n\nSelect `Deploy` to continue, or `Cancel` to close the preview without deploying. A confirmation\nthen asks whether you are sure, because this deploys all hosts. Select `Yes, Deploy` to start the\ndeployment, or `No` to go back."} {"id":"platform/groups.md#following-the-deployment","url":"https://docs.turbostack.app/platform/groups/#following-the-deployment","path":"platform/groups.md","title":"Groups","heading":"Following the deployment","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"While a publication runs, a **PUBLISHING** progress indicator appears at the top right of the\ngroup page and fills up as the run proceeds. The publish buttons stay disabled until the run\nfinishes, so two deployments cannot overlap.\n\nIf a host fails, TurboStack reports an error and lists each failing host with the output of its\ndeployment, so you can see what went wrong before you close the message. The full result of every\nrun is kept in the History view.\n\n> [!NOTE]\n> After a publication that only partly succeeded, a normal `Save & Publish` retries just the hosts\n> that failed. Use `Save & Full Publish` when you want every host in the group to run again."} {"id":"platform/groups.md#group-history","url":"https://docs.turbostack.app/platform/groups/#group-history","path":"platform/groups.md","title":"Groups","heading":"Group history","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"The clock icon in the group header opens the **History** view, with two tabs: **Revisions** and\n**Deploys**."} {"id":"platform/groups.md#deploys","url":"https://docs.turbostack.app/platform/groups/#deploys","path":"platform/groups.md","title":"Groups","heading":"Deploys","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"Each row is one publication of the group: who started it, the date, the status (`published`,\n`partially published` or `error`), the deploy type, the components, and the start and finish\ntimes. Select the arrow at the start of a row to expand it and see the result per host: the host\nname, its status, deploy type, components, output, and start and finish times. When the output is\nlong, `Show full error` shows it in full.\n\nThis is where you check a publication that reported a problem: the per-host output usually names\nthe step that failed."} {"id":"platform/groups.md#revisions","url":"https://docs.turbostack.app/platform/groups/#revisions","path":"platform/groups.md","title":"Groups","heading":"Revisions","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"Every save is recorded as a revision. The table lists the user and date, the configuration\n**Path** that changed, the components, whether the change is already published, and the **From**\nand **To** values, so you can see exactly what changed. Revisions that have been reverted are\nshown on a gray background.\n\n`Revert` on a row restores the group configuration to that revision. A confirmation shows the\n**Current** configuration and the configuration **After Revert**, one above the other, so you can\ncompare them before you apply the change.\n\n> [!TIP]\n> Reverting only changes the stored configuration. Publish afterwards to\n> apply the rollback to the member hosts."} {"id":"platform/groups.md#editing-a-group","url":"https://docs.turbostack.app/platform/groups/#editing-a-group","path":"platform/groups.md","title":"Groups","heading":"Editing a group","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"`Edit` in the group header opens the **Edit group** window, where you change the group name.\n\n1. Select `Edit`.\n2. Enter the new name. Names accept letters only: dashes and other special characters are\n rejected.\n3. Select `Save` to apply the new name, or `Cancel` to keep the current one."} {"id":"platform/groups.md#deleting-a-group","url":"https://docs.turbostack.app/platform/groups/#deleting-a-group","path":"platform/groups.md","title":"Groups","heading":"Deleting a group","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"`Delete` in the group header removes the group from TurboStack. TurboStack asks you to confirm\nfirst: select `Delete` to confirm, or `Cancel` to keep the group.\n\n> [!WARNING]\n> Deleting a group cannot be undone. Its SSH keys and security rules are no longer inherited by\n> the hosts that were members, so review the membership before you delete it."} {"id":"platform/groups.md#common-use-cases","url":"https://docs.turbostack.app/platform/groups/#common-use-cases","path":"platform/groups.md","title":"Groups","heading":"Common use cases","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"Groups are most useful when you organize access and hosts by role. Two common scenarios are\nrole-based SSH access and role-based node grouping."} {"id":"platform/groups.md#scenario-1-role-based-ssh-access-tiers","url":"https://docs.turbostack.app/platform/groups/#scenario-1-role-based-ssh-access-tiers","path":"platform/groups.md","title":"Groups","heading":"Scenario 1: role-based SSH access tiers","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"Use groups to centralize user rights with SSH keys, so people get access based on their role.\n\n1. Identify the different **levels of access** required within your system.\n2. Create groups based on these access levels - for example `admin`, `developers`, and `sysadmins`.\n3. Add each person to the group that matches their role and responsibilities.\n4. Have each person generate their own SSH key pair, then add it to the group's SSH keys.\n5. Have people from different groups sign in over SSH to confirm access is restricted according to\n the group-based configuration.\n6. Review group memberships regularly so they still match your organization's requirements.\n\n> [!NOTE]\n> Hosted Power monitors system logs for unauthorized access attempts and takes appropriate action if\n> necessary."} {"id":"platform/groups.md#scenario-2-role-based-node-grouping","url":"https://docs.turbostack.app/platform/groups/#scenario-2-role-based-node-grouping","path":"platform/groups.md","title":"Groups","heading":"Scenario 2: role-based node grouping","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"Use groups to manage TurboStack nodes by the role they fulfill, keeping configuration consistent\nacross your infrastructure.\n\n1. Determine the different **roles** your nodes will fulfill - for example web node, database node,\n and application node.\n2. Create a group for each server role.\n3. Assign each node to the group that matches its role."} {"id":"platform/groups.md#related","url":"https://docs.turbostack.app/platform/groups/#related","path":"platform/groups.md","title":"Groups","heading":"Related","keywords":"groups SSH keys shared settings security rules fleet management publish group group history revert","text":"- Managing hosts\n- Security\n- SSH access\n- Publishing changes (per host)\n- History (revisions, deploys and cloning)"} {"id":"platform/hosts/advanced/email.md#intro","url":"https://docs.turbostack.app/platform/hosts/advanced/email/","path":"platform/hosts/advanced/email.md","title":"Email","heading":"","keywords":"turbostack email postfix dkim spf dmarc mail deliverability","text":"# Email\n\nTurboStack is primarily an application-hosting platform. Outbound (transactional) mail is handled by the **local mail service** on your host. Domain authentication (DKIM) and a development mail-catcher are set up under the host's **Advanced > Mail Settings** (Advanced)."} {"id":"platform/hosts/advanced/email.md#sending-mail","url":"https://docs.turbostack.app/platform/hosts/advanced/email/#sending-mail","path":"platform/hosts/advanced/email.md","title":"Email","heading":"Sending mail","keywords":"turbostack email postfix dkim spf dmarc mail deliverability","text":"Your applications send through the **local mail service** by default - no external SMTP credentials\nare required for basic delivery. To keep that mail out of spam folders, publish the DNS records below\n(SPF, DKIM, DMARC). For high-volume or marketing mail, use an external SMTP provider instead."} {"id":"platform/hosts/advanced/email.md#common-email-ports","url":"https://docs.turbostack.app/platform/hosts/advanced/email/#common-email-ports","path":"platform/hosts/advanced/email.md","title":"Email","heading":"Common email ports","keywords":"turbostack email postfix dkim spf dmarc mail deliverability","text":"When you configure an application's outbound mail or a desktop mail client, use these standard ports. Simple Mail Transfer Protocol (SMTP) sends mail; Internet Message Access Protocol (IMAP) and Post Office Protocol version 3 (POP3) read it.\n\n| Service | Port | Encryption |\n| --- | --- | --- |\n| SMTP submission (from a client) | `587` | STARTTLS |\n| SMTP submission (implicit TLS) | `465` | Transport Layer Security (TLS) on connect |\n| SMTP (server to server) | `25` | opportunistic |\n| IMAP | `143` | STARTTLS |\n| IMAP over TLS | `993` | TLS on connect |\n| POP3 | `110` | STARTTLS |\n| POP3 over TLS | `995` | TLS on connect |\n\nPrefer the encrypted submission ports (`587` with STARTTLS, or `465` with implicit TLS) for sending from an application. Port `25` is for server-to-server delivery, not client submission."} {"id":"platform/hosts/advanced/email.md#deliverability-dns-records","url":"https://docs.turbostack.app/platform/hosts/advanced/email/#deliverability-dns-records","path":"platform/hosts/advanced/email.md","title":"Email","heading":"Deliverability (DNS records)","keywords":"turbostack email postfix dkim spf dmarc mail deliverability","text":"To land in inboxes rather than spam folders, authenticate your domain with three Domain Name System (DNS) records. Add these where you manage your domain's DNS. If Hosted Power manages your DNS, add them in the Customer Center DNS management; otherwise add them at your DNS provider - see Connecting your domain.\n\n| Record | Type | Purpose |\n| --- | --- | --- |\n| **Sender Policy Framework (SPF)** | TXT | Authorises the server to send mail for your domain. |\n| **DomainKeys Identified Mail (DKIM)** | TXT | Cryptographically signs your mail - use the selector and key from Mail Settings. |\n| **Domain-based Message Authentication, Reporting and Conformance (DMARC)** | TXT | Sets the policy for how receivers handle messages that fail SPF or DKIM. |"} {"id":"platform/hosts/advanced/email.md#set-up-dkim","url":"https://docs.turbostack.app/platform/hosts/advanced/email/#set-up-dkim","path":"platform/hosts/advanced/email.md","title":"Email","heading":"Set up DKIM","keywords":"turbostack email postfix dkim spf dmarc mail deliverability","text":"DKIM signs your outbound mail so receiving servers can confirm it genuinely came from your domain.\nSet it up from the host's **Advanced > Mail Settings**:\n\n1. Enter the **Fully Qualified Domain Name (FQDN)** you send mail from.\n2. Choose a **selector** - this becomes the subdomain part of the DKIM record.\n3. Connect over SSH and run `tscli dkim records` to get the DKIM record to publish.\n4. Add that record as a **TXT** record in your domain's DNS - in the\n Customer Center DNS management if Hosted\n Power manages your DNS, otherwise at your DNS provider.\n5. Back on the server, run `tscli dkim validate` to confirm the record was created correctly."} {"id":"platform/hosts/advanced/email.md#spf-record-syntax","url":"https://docs.turbostack.app/platform/hosts/advanced/email/#spf-record-syntax","path":"platform/hosts/advanced/email.md","title":"Email","heading":"SPF record syntax","keywords":"turbostack email postfix dkim spf dmarc mail deliverability","text":"An SPF record is a single DNS TXT record that starts with `v=spf1`, lists the mechanisms that authorise senders, and ends with an `all` mechanism. Each mechanism carries a qualifier that sets the result when it matches.\n\n| Qualifier | Result | Meaning |\n| --- | --- | --- |\n| `+` | pass | Authorised (the default when no qualifier is written) |\n| `-` | fail | Not authorised; reject |\n| `~` | softfail | Probably not authorised; accept but mark |\n| `?` | neutral | No statement |\n\n| Mechanism | Matches |\n| --- | --- |\n| `ip4:` / `ip6:` | A specific IPv4 or IPv6 address or range |\n| `a` / `mx` | The domain's A record(s) or MX host(s) |\n| `include:` | The SPF record of another domain, for a third-party sender |\n| `all` | Everything; put it last, as `-all` or `~all` |\n\nExamples:\n\n```text\nv=spf1 mx -all\nv=spf1 ip4:203.0.113.10 include:example.net -all\n```\n\nKeep one SPF record per domain and stay within the 10-lookup limit - see Mail deliverability."} {"id":"platform/hosts/advanced/email.md#development-mail","url":"https://docs.turbostack.app/platform/hosts/advanced/email/#development-mail","path":"platform/hosts/advanced/email.md","title":"Email","heading":"Development mail","keywords":"turbostack email postfix dkim spf dmarc mail deliverability","text":"**Mailpit** and **Mailhog** are development mail-catchers that capture outbound mail so you can inspect it without delivering it. Enable one from **Advanced > Mail Settings** (the mail capturing/testing option); it is then reachable at `https:///mailpit` or `https:///mailhog` with your system user's credentials. Mailpit is recommended (Mailhog is no longer maintained).\n\n> [!WARNING]\n> Never enable a mail-catcher on a production host - it intercepts mail instead of sending it.\n\n> [!NOTE]\n> For high-volume or marketing email, use a dedicated email/SMTP provider."} {"id":"platform/hosts/advanced/email.md#related","url":"https://docs.turbostack.app/platform/hosts/advanced/email/#related","path":"platform/hosts/advanced/email.md","title":"Email","heading":"Related","keywords":"turbostack email postfix dkim spf dmarc mail deliverability","text":"- Advanced settings\n- Connecting your domain\n- Customer Center DNS management - add the SPF, DKIM and DMARC records.\n- Mail deliverability - fix mail landing in spam, blocklists and authentication.\n- Security hardening checklist\n- Hosts"} {"id":"platform/hosts/advanced/ftp-access.md#intro","url":"https://docs.turbostack.app/platform/hosts/advanced/ftp-access/","path":"platform/hosts/advanced/ftp-access.md","title":"FTP and SFTP access","heading":"","keywords":"ftp sftp ftp user filezilla ftp_sftp file transfer erp integration","text":"# FTP and SFTP access\n\nYou can create dedicated FTP and Secure File Transfer Protocol (SFTP) users with their own **home directory**, separate from your main\nsystem user. This is most often used to connect an external system - for example an Enterprise Resource Planning (ERP) system - to a\nstore, giving it access only to the files it needs (product images, stock exports, report PDFs)."} {"id":"platform/hosts/advanced/ftp-access.md#in-the-gui","url":"https://docs.turbostack.app/platform/hosts/advanced/ftp-access/#in-the-gui","path":"platform/hosts/advanced/ftp-access.md","title":"FTP and SFTP access","heading":"In the GUI","keywords":"ftp sftp ftp user filezilla ftp_sftp file transfer erp integration","text":"1. Open the host and go to **Applications**. Expand the account, open its settings (the cogwheel), and\n select **Add FTP user**.\n2. Enter the user name and the **home directory** (keep it a subfolder, not the account's home), and\n enable Transport Layer Security (TLS) if your client needs it.\n3. **Save**, then **Save & Publish**."} {"id":"platform/hosts/advanced/ftp-access.md#in-yaml","url":"https://docs.turbostack.app/platform/hosts/advanced/ftp-access/#in-yaml","path":"platform/hosts/advanced/ftp-access.md","title":"FTP and SFTP access","heading":"In YAML","keywords":"ftp sftp ftp user filezilla ftp_sftp file transfer erp integration","text":"Add an `ftp` block under the system user - see The Source (YAML) view:\n\n```yaml\nsystem_users:\n - username: prod\n vhosts:\n - server_name: www.example.com\n app_type: shopware\n php_version: \"8.4\"\n cert_type: letsencrypt\n ftp:\n - user: prod_ftp\n homedir: /var/www/prod/public_html/ftp\n```"} {"id":"platform/hosts/advanced/ftp-access.md#choose-ftp-or-sftp","url":"https://docs.turbostack.app/platform/hosts/advanced/ftp-access/#choose-ftp-or-sftp","path":"platform/hosts/advanced/ftp-access.md","title":"FTP and SFTP access","heading":"Choose FTP or SFTP","keywords":"ftp sftp ftp user filezilla ftp_sftp file transfer erp integration","text":"A host uses **either** FTP or SFTP for all users. To use SFTP, add this above `system_users`:\n\n```yaml\nftp_sftp: true\n```\n\nSFTP runs over port **222** through the existing FTP daemon and users, not the SSH service. Port 22\nstays reserved for SSH. If your ERP needs another port, set it:\n\n```yaml\nftp_sftp_port: 2222\n```\n\nPlain FTP uses port **21**."} {"id":"platform/hosts/advanced/ftp-access.md#connect","url":"https://docs.turbostack.app/platform/hosts/advanced/ftp-access/#connect","path":"platform/hosts/advanced/ftp-access.md","title":"FTP and SFTP access","heading":"Connect","keywords":"ftp sftp ftp user filezilla ftp_sftp file transfer erp integration","text":"Get the user name and password from the host's Credentials tab, then connect\nwith a client such as FileZilla using the host name, the user, and the right port (21 for FTP, 222 -\nor your custom port - for SFTP)."} {"id":"platform/hosts/advanced/ftp-access.md#fix-a-login-failed-error","url":"https://docs.turbostack.app/platform/hosts/advanced/ftp-access/#fix-a-login-failed-error","path":"platform/hosts/advanced/ftp-access.md","title":"FTP and SFTP access","heading":"Fix a \"Login failed\" error","keywords":"ftp sftp ftp user filezilla ftp_sftp file transfer erp integration","text":"- **Wrong credentials** - even a stray space in the password causes a `530` login error.\n- **Home directory does not exist** - the path assigned to the user must exist on the server.\n- **No TLS** - TLS is required and enforced. Enable \"Explicit FTP over TLS\" in your client. Only\n disable it for a system that genuinely cannot do TLS (passwords would be sent in plain text).\n- **IP blocked** - your IP may be (temporarily) firewalled. Add it to the allow-list under the host's\n **Security** tab - see Security."} {"id":"platform/hosts/advanced/ftp-access.md#related","url":"https://docs.turbostack.app/platform/hosts/advanced/ftp-access/#related","path":"platform/hosts/advanced/ftp-access.md","title":"FTP and SFTP access","heading":"Related","keywords":"ftp sftp ftp user filezilla ftp_sftp file transfer erp integration","text":"- Advanced settings\n- Applications\n- Credentials\n- Security"} {"id":"platform/hosts/advanced/index.md#intro","url":"https://docs.turbostack.app/platform/hosts/advanced/","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"# Advanced settings\n\nThe host's **Advanced** tab gathers configuration options for mail, caching services, file transfer, the operating system, and database monitoring. These options control the host's runtime environment.\n\n\n\n> [!NOTE]\n> Many Advanced options are hidden for cPanel and DirectAdmin hosts.\n\nThis tab covers:\n\n- Mail settings - set up DomainKeys Identified Mail (DKIM) and a development mail catcher\n- Varnish options - tune the Varnish HTTP cache\n- RabbitMQ options - configure the RabbitMQ message broker plugins\n- FTP server options - SFTP and FTPS file-transfer access\n- Operating system - choose the OS, extra packages, and the maintenance window\n- Advanced database monitoring - deep monitoring for your databases\n- New Relic Infrastructure - send server metrics to your own New Relic account"} {"id":"platform/hosts/advanced/index.md#mail-settings","url":"https://docs.turbostack.app/platform/hosts/advanced/#mail-settings","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"Mail settings","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"Set up **DKIM** (your mail domain's FQDN and a selector) so receivers can authenticate your outbound mail. You can also enable a **development mail catcher** (Mailpit or Mailhog) that captures outgoing mail so you can inspect it without delivering it. See Email.\n\n> [!WARNING]\n> A development mail catcher intercepts mail instead of sending it. Never enable it on a production host."} {"id":"platform/hosts/advanced/index.md#varnish-options","url":"https://docs.turbostack.app/platform/hosts/advanced/#varnish-options","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"Varnish options","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"Varnish provides HTTP caching. You can tune Varnish behavior from the Advanced tab. These options appear once an application has Varnish enabled. For details on caching strategy and configuration, see Services.\n\n\n\n| Setting | Description |\n| --- | --- |\n| **Varnish Cache Size** | The memory Varnish uses to store cached content. It auto-scales to the server by default. Turn the toggle on to set your own size and unit. |\n| **Varnish Flavor** | Choose the Varnish build: **Open Source** or **Enterprise**. Open Source is free. Enterprise needs a separate license. Written to the host YAML as `varnish_type`. |\n| **Varnish Modules** | Available with the Open Source build. Turn it on to install the extra Varnish modules. |\n| **Custom VCL** | Turn this on to use your own Varnish Configuration Language (VCL) instead of the default. |\n\nBy default, Varnish uses a default VCL that TurboStack tunes for your application type. To supply your own, turn on the custom VCL option and place your VCL file in `/etc/varnish/conf.d/` on the server.\n\n> [!TIP]\n> Start with the default VCL. Only switch to a custom VCL when you need caching rules the default does not cover."} {"id":"platform/hosts/advanced/index.md#rabbitmq-options","url":"https://docs.turbostack.app/platform/hosts/advanced/#rabbitmq-options","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"RabbitMQ options","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"RabbitMQ provides message queuing for your applications. The Advanced tab configures the broker itself. See Services for related service configuration.\n\nThis pane is only usable once RabbitMQ is in use on the host. Until then it shows the message that RabbitMQ is not activated, and asks you to first create an application with RabbitMQ enabled. Enable RabbitMQ on an application under **Configure application > Technologies**, then return here.\n\nWhen RabbitMQ is active, you can select the broker plugins to install (`rabbitmq_plugins`). The field is a multi-select, so you can pick more than one:\n\n| Plugin | What it adds |\n| --- | --- |\n| `rabbitmq_prometheus` | Exposes broker metrics in the Prometheus format, so you can collect them in your own metrics tooling. |\n| `rabbitmq_shovel` | Moves messages from a queue on this broker to another broker. |\n| `rabbitmq_shovel_management` | Adds the shovel configuration and status to the RabbitMQ management interface. |\n\n```yaml\nrabbitmq_plugins: [rabbitmq_shovel, rabbitmq_shovel_management]\n```\n\nPublish the host to install the plugins you selected."} {"id":"platform/hosts/advanced/index.md#ftp-server-options","url":"https://docs.turbostack.app/platform/hosts/advanced/#ftp-server-options","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"FTP server options","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"You can configure file transfer access, including SSH File Transfer Protocol (SFTP) and FTPS settings and the protocols you want to allow. These options appear once the host has an FTP user. For interactive shell access, see SSH access.\n\n**Enable Valid Certificate For FTP Server** generates a Transport Layer Security (TLS) certificate for the FTP daemon using a hostname you choose. Turn the toggle on, then enter the **FTP hostname**. Clients that connect over FTPS then see a valid certificate instead of a self-signed one.\n\n> [!IMPORTANT]\n> The FTP hostname must point to the server's IP address, or the certificate cannot be issued."} {"id":"platform/hosts/advanced/index.md#operating-system","url":"https://docs.turbostack.app/platform/hosts/advanced/#operating-system","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"Operating system","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"You can select and configure the host's operating system and related settings.\n\n\n\n| Setting | Description |\n| --- | --- |\n| OS selection | Choose the operating system, such as Debian or AlmaLinux. |\n| Composer version | Choose the Composer version installed for your PHP applications (`composer_version`). |\n| Supervisord support | Install a process manager for long-running background processes (`supervisor_enabled`). |\n| `os_extra_packages` | Add extra OS packages - see Installing extra OS packages. Keep this list minimal. |\n| Automatic update time | The daily time when routine package updates that do not need a reboot are installed (`system_packages_upgrade_time`). |\n| Maintenance window | Set when updates that require a reboot are applied, so you can pick your least-critical time (`maintenance`). Add one or more day and hour windows. |\n\n> [!TIP]\n> Keep `os_extra_packages` as small as possible. Each added package increases the host's maintenance and security surface.\n\n> [!TIP]\n> Most security updates are applied automatically without a reboot. The **maintenance window** is for the occasional update that does need a reboot - set it to a low-traffic time (for example overnight) so the reboot never lands during your busiest hours."} {"id":"platform/hosts/advanced/index.md#supervisor","url":"https://docs.turbostack.app/platform/hosts/advanced/#supervisor","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"Supervisor","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"**Supervisord support** (`supervisor_enabled`) installs a process manager on the host. A process manager keeps a long-running process running: it starts the process, restarts it when it exits, and collects its output in a log file. Use it for queue workers, message-queue consumers and other background processes that must not stop.\n\nEach system user gets its own instance, so you configure your processes without root access:\n\n| Path | What it is |\n| --- | --- |\n| `~/.config/supervisor/conf.d/` | Your program configuration files. A sample file is placed here for you. |\n| `~/.config/supervisor/log/` | The log output of the processes you defined. |\n\n`~` is your system user's home directory, for example `/var/www/prod/`. After you add or change a configuration file, apply it with the `supervisorctl` command over SSH.\n\nTurboStack's own way of running background processes is a user system service, managed by systemd. That needs no host-level setting and is the better starting point: it is already used for the queue workers and consumers of the supported applications. Turn on Supervisord support when your application or deployment tooling expects a supervisor instead."} {"id":"platform/hosts/advanced/index.md#windows-update-schedule","url":"https://docs.turbostack.app/platform/hosts/advanced/#windows-update-schedule","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"Windows update schedule","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"On a Windows host, the Operating System pane shows a **Windows update** schedule instead of the Linux settings above. The schedule is the Windows counterpart of the maintenance window. It sets the day and the hour when Windows updates are installed, so a reboot happens at a moment you choose.\n\nThe schedule is a table with a **Day** and an **Hours** column. Click **Edit** on the entry, select a day and an hour, then click **Save**. A new host starts with Sunday 09:00.\n\n\n\n> [!NOTE]\n> This applies only to hosts running Windows. On Linux hosts you set the maintenance window instead, and the Composer, Supervisord and extra-package settings are not shown on a Windows host."} {"id":"platform/hosts/advanced/index.md#advanced-database-monitoring","url":"https://docs.turbostack.app/platform/hosts/advanced/#advanced-database-monitoring","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"Advanced database monitoring","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"**Advanced Database Monitoring** collects query-level metrics for the databases on this host and sends them to a central monitoring master server, where you read the dashboards. Enable it when you need to see which queries are slow, not only that the database is busy. See Monitoring.\n\n\n\nThe pane is only usable when the host has a database service configured (MySQL, PostgreSQL, Microsoft SQL Server or MongoDB). Without one it shows **No database server configured** - add a database on the Services tab first.\n\n| Setting | Description |\n| --- | --- |\n| Enable | Turns advanced database monitoring on for this host. The remaining fields appear once it is on. |\n| Master server hostname | The host name of the monitoring master server that collects the metrics (`pmm_master.server_hostname`). Required when monitoring is enabled. |\n| Sampling rate | Under **Advanced Settings**. Metrics are collected from every Nth query (`pmm_sampling_rate`, default `50`). A lower number gives more detail, and adds more load to this server and to the master. |\n\n```yaml\npmm_master:\n server_hostname: monitoring.example.com\npmm_sampling_rate: 50\n```\n\n> [!TIP]\n> Keep the default sampling rate unless you are investigating a specific problem. Lower it temporarily, then set it back.\n\nIf you do not have a monitoring master server yet, you can run one on TurboStack - see Self-hosted platforms."} {"id":"platform/hosts/advanced/index.md#new-relic-infrastructure","url":"https://docs.turbostack.app/platform/hosts/advanced/#new-relic-infrastructure","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"New Relic Infrastructure","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"The **New Relic Infra** pane connects the server itself to your own New Relic account. Server metrics such as processor, memory, disk and processes then appear next to the application data you already collect there. This is a bring-your-own-account setting: TurboStack installs and configures the agent, you supply the license key and keep your own New Relic subscription.\n\nThe pane only appears in the left menu when at least one application on this host has New Relic application performance monitoring enabled. Turn that on first under **Configure application > Monitoring > New Relic APM** - see Applications.\n\n| Field | Description |\n| --- | --- |\n| **License Key** | The license key of your New Relic account. Use the main account license key, not the separate infrastructure key. |\n| **Log Configuration** | Optional. Paste valid YAML that tells the infrastructure agent which log files to forward. TurboStack writes it to `/etc/newrelic-infra/logging.d/customer.yml` on the server, so use the format the agent expects there. Leave it empty to forward no logs. |\n\nLeave the license key empty to not install the infrastructure agent. Publish the host to apply either change.\n\n> [!NOTE]\n> This pane covers the server's own metrics. The **application performance monitoring** keys for New Relic, Tideways and Blackfire, and the **Docker** and **Kubernetes** settings, are configured **per application** - in the **Configure application** dialog (Technologies and Monitoring tabs), not on the host's Advanced tab. See Applications."} {"id":"platform/hosts/advanced/index.md#related","url":"https://docs.turbostack.app/platform/hosts/advanced/#related","path":"platform/hosts/advanced/index.md","title":"Advanced settings","heading":"Related","keywords":"advanced settings mail settings varnish rabbitmq operating system docker host advanced supervisor windows update new relic infrastructure database monitoring","text":"- Installing extra OS packages\n- FTP and SFTP access\n- User system services - the alternative to Supervisor.\n- Services\n- Applications\n- SSH access\n- Monitoring\n- Hosts"} {"id":"platform/hosts/advanced/install-packages.md#intro","url":"https://docs.turbostack.app/platform/hosts/advanced/install-packages/","path":"platform/hosts/advanced/install-packages.md","title":"Installing extra OS packages","heading":"","keywords":"os_extra_packages install apt package extra os packages debian package php extension package","text":"# Installing extra OS packages\n\nTurboStack manages your servers for you, so you do not have root access to run `apt install` yourself.\nTo add extra operating-system packages - for example an extra PHP extension - you declare them in\nyour host configuration with **`os_extra_packages`**, and TurboStack installs them for you. Because\nthe list lives in your configuration, the same packages are reproduced when you set up similar\nservers later.\n\n> [!WARNING]\n> This is an advanced feature. Do **not** use `os_extra_packages` to install packages for services\n> that TurboStack already manages - such as MySQL/MariaDB, PostgreSQL, Elasticsearch/OpenSearch,\n> Redis, Varnish, PHP or the web server. Installing your own versions of these conflicts with the\n> managed setup and can break the host. Use it only for genuinely extra packages (for example a small\n> tool or a PHP extension). If you are not sure exactly what you need here, **contact\n> support first** - they will set it up safely with you."} {"id":"platform/hosts/advanced/install-packages.md#where-to-set-it","url":"https://docs.turbostack.app/platform/hosts/advanced/install-packages/#where-to-set-it","path":"platform/hosts/advanced/install-packages.md","title":"Installing extra OS packages","heading":"Where to set it","keywords":"os_extra_packages install apt package extra os packages debian package php extension package","text":"You can set `os_extra_packages` in two ways:\n\n- **Advanced tab** - open the host, go to **Advanced > Operating System > OS Extra Packages**, and\n pick from the common packages offered. See Advanced settings.\n- **Source (YAML) view** - for any package that is not in the list, add it directly as YAML. See\n The Source (YAML) view.\n\n\n\n`os_extra_packages` is a **list** (it must be an array, not a single value). It can be set on a host,\nor on a group to apply to every member host.\n\n```yaml\nos_extra_packages:\n - acl\n```"} {"id":"platform/hosts/advanced/install-packages.md#find-the-exact-package-name","url":"https://docs.turbostack.app/platform/hosts/advanced/install-packages/#find-the-exact-package-name","path":"platform/hosts/advanced/install-packages.md","title":"Installing extra OS packages","heading":"Find the exact package name","keywords":"os_extra_packages install apt package extra os packages debian package php extension package","text":"Packages are installed with Debian's apt package manager, so you need the exact apt package name.\nConnect over SSH and search for it (this also shows whether it is already installed):\n\n```bash\napt search \n```\n\nFor example, to find PHP extension packages for PHP 8.2:\n\n```bash\napt search php8.2\n```\n\nCopy the exact names into your configuration:\n\n```yaml\nos_extra_packages:\n - php8.2-amqp\n - php8.2-ssh2\n - php8.4-dom\n```"} {"id":"platform/hosts/advanced/install-packages.md#install-packages-for-your-active-php-version","url":"https://docs.turbostack.app/platform/hosts/advanced/install-packages/#install-packages-for-your-active-php-version","path":"platform/hosts/advanced/install-packages.md","title":"Installing extra OS packages","heading":"Install packages for your active PHP version","keywords":"os_extra_packages install apt package extra os packages debian package php extension package","text":"If your configuration defines `php_main_version`, you can reference it so the right PHP packages are\ninstalled automatically when you change versions:\n\n```yaml\nphp_main_version: \"8.2\"\nos_extra_packages:\n - php{{ php_main_version }}-amqp\n - php{{ php_main_version }}-ssh2\n```"} {"id":"platform/hosts/advanced/install-packages.md#apply-and-verify","url":"https://docs.turbostack.app/platform/hosts/advanced/install-packages/#apply-and-verify","path":"platform/hosts/advanced/install-packages.md","title":"Installing extra OS packages","heading":"Apply and verify","keywords":"os_extra_packages install apt package extra os packages debian package php extension package","text":"1. **Save & Publish** the host. TurboStack installs the listed packages (apt, kept at \"present\")\n while applying the configuration - see Publishing changes.\n2. Verify over SSH that a package is installed:\n ```bash\n dpkg -l \n ```\n\n> [!TIP]\n> Keep `os_extra_packages` as small as possible. Every extra package adds to the host's maintenance\n> and security surface. Add only what your application needs."} {"id":"platform/hosts/advanced/install-packages.md#related","url":"https://docs.turbostack.app/platform/hosts/advanced/install-packages/#related","path":"platform/hosts/advanced/install-packages.md","title":"Installing extra OS packages","heading":"Related","keywords":"os_extra_packages install apt package extra os packages debian package php extension package","text":"- Advanced settings\n- The Source (YAML) view\n- Publishing changes\n- SSH access\n- Support\n- Hosts"} {"id":"platform/hosts/applications/git-deployment.md#intro","url":"https://docs.turbostack.app/platform/hosts/applications/git-deployment/","path":"platform/hosts/applications/git-deployment.md","title":"Git deployment","heading":"","keywords":"git deployment deploy from git git integration continuous deployment","text":"# Git deployment\n\nGit Deployment lets you deploy your application code from a Git repository onto a TurboStack host."} {"id":"platform/hosts/applications/git-deployment.md#opening-the-git-tab","url":"https://docs.turbostack.app/platform/hosts/applications/git-deployment/#opening-the-git-tab","path":"platform/hosts/applications/git-deployment.md","title":"Git deployment","heading":"Opening the GIT tab","keywords":"git deployment deploy from git git integration continuous deployment","text":"1. Go to the **Applications** tab of your host.\n2. Open the settings for the application you want to deploy to.\n3. In the **Configure application** dialog, select the **GIT** tab."} {"id":"platform/hosts/applications/git-deployment.md#adding-a-git-integration","url":"https://docs.turbostack.app/platform/hosts/applications/git-deployment/#adding-a-git-integration","path":"platform/hosts/applications/git-deployment.md","title":"Git deployment","heading":"Adding a Git integration","keywords":"git deployment deploy from git git integration continuous deployment","text":"1. Select **Add GIT integration**.\n2. In **Git Settings**, configure the integration:\n\n| Setting | Description |\n|---|---|\n| **Remote repository** | The Git repository to deploy from. |\n| **Version/branch** | The branch or version to deploy. |\n| **Deployment path** | The path on the host where the code is deployed. |\n\n3. Save your changes.\n\nYou can add multiple repositories to a single application by repeating these steps."} {"id":"platform/hosts/applications/git-deployment.md#private-repositories-over-ssh","url":"https://docs.turbostack.app/platform/hosts/applications/git-deployment/#private-repositories-over-ssh","path":"platform/hosts/applications/git-deployment.md","title":"Git deployment","heading":"Private repositories over SSH","keywords":"git deployment deploy from git git integration continuous deployment","text":"For private repositories accessed over SSH, the server must be able to authenticate to the repository.\n\n1. Save or generate the system user's SSH keys on the server - a notice in the **GIT** tab reminds you to do this.\n2. Add the resulting public key to your Git provider as a deploy key.\n3. Configure the Git integration with the SSH repository URL.\n\n> [!IMPORTANT]\n> Without the system user's SSH keys saved on the server, deployments from private repositories over SSH will fail to authenticate.\n\n> [!TIP]\n> Use a dedicated branch for deployments so you control exactly what reaches the server."} {"id":"platform/hosts/applications/git-deployment.md#related","url":"https://docs.turbostack.app/platform/hosts/applications/git-deployment/#related","path":"platform/hosts/applications/git-deployment.md","title":"Git deployment","heading":"Related","keywords":"git deployment deploy from git git integration continuous deployment","text":"- Applications\n- Versioned releases with a symlink layout - atomic deploys and rollback from CI/CD.\n- SSH\n- Credentials\n- Hosts"} {"id":"platform/hosts/applications/index.md#intro","url":"https://docs.turbostack.app/platform/hosts/applications/","path":"platform/hosts/applications/index.md","title":"Applications","heading":"","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"# Applications\n\nThe host's **Applications** tab is where you manage what the server runs. It uses a simple\ntwo-level model: a host has one or more **system users** (operating-system accounts that own\nfiles and run apps), and each system user has one or more **applications** - also called\n*applications* or *vhosts*.\n\n> [!NOTE]\n> On cPanel, DirectAdmin and Windows hosts, accounts and applications are managed by the control\n> panel and this tab is presented differently.\n\nThis tab covers:\n\n- Working with an account - expand a system user, edit its settings, or add new ones\n- Clone an application - copy an existing account into a new one\n- Configure application - hostnames, certificates, technologies, monitoring, Git, and databases\n- FTP users - add FTP/SSH File Transfer Protocol (SFTP) access for a system user"} {"id":"platform/hosts/applications/index.md#working-with-an-account","url":"https://docs.turbostack.app/platform/hosts/applications/#working-with-an-account","path":"platform/hosts/applications/index.md","title":"Applications","heading":"Working with an account","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"Each system user appears as a collapsible row. Click the **▾ chevron** on the right to expand it.\n\n\n\nWhen expanded, the row shows:\n\n- **Account actions** (icons next to the name): **copy** the username, **edit** the account,\n **settings**, and **delete**.\n- **Applications** - the list of applications under this account, each with **copy**, **settings**\n (opens *Configure application*) and **delete** icons, plus an **Add app or database** button.\n- **FTP Users** - FTP accounts for this user, with an **Add FTP user** button.\n\nAt the bottom of the tab:\n\n- **Add new app** - create a new system user (enter a **Username** and optional **Description**).\n- **Clone app** - copy an existing account's configuration into a new one.\n- **Migration Hero** - migrate an existing site onto the host with guided assistance.\n\n> [!WARNING]\n> Deleting a system user removes the applications that belong to it. Review its contents first."} {"id":"platform/hosts/applications/index.md#clone-an-application","url":"https://docs.turbostack.app/platform/hosts/applications/#clone-an-application","path":"platform/hosts/applications/index.md","title":"Applications","heading":"Clone an application","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"**Clone app** copies an existing account into a new one. It replicates the account's configuration\nand can also copy its files and its database. Use it to build a staging copy from production, or to\npromote a staging setup to production, without configuring everything again.\n\nThe clone wizard runs in these steps:\n\n1. At the bottom of the **Applications** tab, click **Clone app**.\n2. Select the **source host** and the **account** to clone. The source can be this host or another\n host you manage.\n3. Choose the **destination account**. Pick an existing account or create a new one. Then choose\n whether to clone the **database**, the **files**, or both. Click **Next**.\n4. Select the **hostname(s)** for the new account and the **certificate** type to activate. Click\n **Next** to start the clone.\n5. TurboStack clones the account. The **publishing** indicator in the top left shows progress. When\n it finishes, the top right shows a success message with a timestamp.\n\n> [!TIP]\n> Clone from production to a staging account to test a change on a real copy of your site before you\n> apply it live.\n\n> [!NOTE]\n> Cloning the database and files copies data as well as configuration. Clone into a staging account,\n> not over a live one you still need."} {"id":"platform/hosts/applications/index.md#configure-application","url":"https://docs.turbostack.app/platform/hosts/applications/#configure-application","path":"platform/hosts/applications/index.md","title":"Applications","heading":"Configure application","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"Use **Add app or database**, or the **settings** icon on an application, to open the **Configure\napplication** dialog. Its settings are organized into tabs."} {"id":"platform/hosts/applications/index.md#name","url":"https://docs.turbostack.app/platform/hosts/applications/#name","path":"platform/hosts/applications/index.md","title":"Applications","heading":"Name","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"Give the application a name, or leave **Default** enabled to use the default naming."} {"id":"platform/hosts/applications/index.md#hostnames","url":"https://docs.turbostack.app/platform/hosts/applications/#hostnames","path":"platform/hosts/applications/index.md","title":"Applications","heading":"Hostnames","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"Set the domain(s) the application answers to, and its Transport Layer Security (TLS) certificate.\n\n\n\n- **Hostname** - one or more domains (`server_name`); add or remove rows with **Add hostname**\n / **Delete**.\n- **Certificate** - the certificate type:\n - **Let's Encrypt** - automatic certificates. Choose a **Certificate provider** (and, for\n Cloudflare Domain Name System (DNS), supply a **Cloudflare API token**) and, under **Advanced settings**, a\n **Certificate challenge** (`http` is recommended as the most compatible).\n - **Self-signed** - a self-signed certificate.\n - **Custom** - paste your own **certificate** and **private key**.\n\n> [!IMPORTANT]\n> Custom certificate and private-key material is sensitive - treat it like any other secret."} {"id":"platform/hosts/applications/index.md#technologies","url":"https://docs.turbostack.app/platform/hosts/applications/#technologies","path":"platform/hosts/applications/index.md","title":"Applications","heading":"Technologies","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"Enable the runtimes and services this application needs. The left menu lists each technology;\nselecting one shows its settings.\n\n\n\n| Technology | What you configure |\n|---|---|\n| **Application Settings** | The **App Type** (e.g. Generic, WordPress, Magento, Odoo...). |\n| **PHP** | Enable PHP and pick a **version**; advanced PHP-FPM tuning, OPcache and IonCube. |\n| **Python** | Enable Python and set a **version**. |\n| **Ruby** | Enable Ruby, set a **version** and startup command, optionally **Sidekiq**. |\n| **Docker** | Run the application in Docker. |\n| **K8s** | Enable Kubernetes for the application. |\n| **Varnish** | Enable the Varnish HTTP cache for this application. |\n| **NodeJS** | Enable Node.js and pick a **version**. |\n| **.NET** | Enable .NET, pick a **version** and an optional listen port. |\n| **RabbitMQ** | Enable the RabbitMQ message broker for this application. |\n| **Reverse Proxy** | Forward requests to a backend: set the upstream **IP/Hostname** and **Port**. |\n\nSee Services for the server-level versions these build on."} {"id":"platform/hosts/applications/index.md#monitoring","url":"https://docs.turbostack.app/platform/hosts/applications/#monitoring","path":"platform/hosts/applications/index.md","title":"Applications","heading":"Monitoring","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"Set a **Monitoring URL** for the application's health check, and optionally enable application\nperformance monitoring - **New Relic**, **Tideways**, or **Blackfire**. See\nMonitoring (concepts)."} {"id":"platform/hosts/applications/index.md#git","url":"https://docs.turbostack.app/platform/hosts/applications/#git","path":"platform/hosts/applications/index.md","title":"Applications","heading":"Git","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"Configure Git-based deployment: the **remote repository**, **version/branch** and **deployment\npath**. Add multiple repositories with **Add GIT integration**."} {"id":"platform/hosts/applications/index.md#database-info","url":"https://docs.turbostack.app/platform/hosts/applications/#database-info","path":"platform/hosts/applications/index.md","title":"Applications","heading":"Database info","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"View and manage the application's databases.\n\n\n\n- **MySQL** / **PostgreSQL** - the auto-provisioned **database**, **username** and **password**\n (hidden by default; use the eye and copy icons). Open **phpMyAdmin** directly when available.\n- **RabbitMQ** - only listed when this application has RabbitMQ enabled. It shows the **VHost**,\n **Username** and **Password** to connect to the message broker, plus a **Go to RabbitMQ** button\n that opens the management interface. The virtual host and the user are named after the system\n user, so each account keeps its own queues.\n- **User Credentials** - the system user's own login.\n- **Extra database users** - add additional database users with a **readonly** or **admin**\n role (each gets its own password). Use **Add extra database user**; remove with the delete icon.\n\n> [!TIP]\n> Use an extra **readonly** user for reporting or integrations that should not modify data."} {"id":"platform/hosts/applications/index.md#ftp-users","url":"https://docs.turbostack.app/platform/hosts/applications/#ftp-users","path":"platform/hosts/applications/index.md","title":"Applications","heading":"FTP users","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"Add an FTP/SFTP account for a system user with **Add FTP user**: set the **user**, the **home\ndirectory**, and whether **TLS** is required. Manage credentials later from the\nCredentials tab."} {"id":"platform/hosts/applications/index.md#related","url":"https://docs.turbostack.app/platform/hosts/applications/#related","path":"platform/hosts/applications/index.md","title":"Applications","heading":"Related","keywords":"applications system users vhosts applications PHP databases FTP certificates technologies","text":"- Services - web server, databases, caching and search.\n- Git deployment - deploy application code from a Git repository.\n- Migration Hero - migrate an existing site onto this host.\n- Credentials - retrieve the access details created here.\n- FTP and SFTP access - give an external system file access.\n- Publishing changes - apply your changes to the server.\n- Source (YAML) view - edit the same configuration as YAML."} {"id":"platform/hosts/applications/migration-hero.md#intro","url":"https://docs.turbostack.app/platform/hosts/applications/migration-hero/","path":"platform/hosts/applications/migration-hero.md","title":"Migration Hero","heading":"","keywords":"migration hero migrate site move application site migration","text":"# Migration Hero\n\nMigration Hero copies an existing site from an external server onto a TurboStack host, guiding you through the process with a step-by-step wizard. It transfers the configuration, files and database for a fast setup with minimal effort.\n\n\n\n> [!NOTE]\n> To move a site from one TurboStack host to another, use Account Cloning instead of Migration Hero."} {"id":"platform/hosts/applications/migration-hero.md#before-you-start","url":"https://docs.turbostack.app/platform/hosts/applications/migration-hero/#before-you-start","path":"platform/hosts/applications/migration-hero.md","title":"Migration Hero","heading":"Before you start","keywords":"migration hero migrate site move application site migration","text":"The destination application must already exist and have completed a successful Save & Publish at least once. Migration Hero copies data into an existing account; it does not create one for you.\n\nYou also need valid SSH credentials for the remote source (a password or an SSH key). Without them, TurboStack cannot connect to copy the data and databases."} {"id":"platform/hosts/applications/migration-hero.md#opening-migration-hero","url":"https://docs.turbostack.app/platform/hosts/applications/migration-hero/#opening-migration-hero","path":"platform/hosts/applications/migration-hero.md","title":"Migration Hero","heading":"Opening Migration Hero","keywords":"migration hero migrate site move application site migration","text":"1. Open the host you want to migrate into.\n2. Go to the **Applications** tab.\n3. Select **Migration Hero**."} {"id":"platform/hosts/applications/migration-hero.md#running-the-wizard","url":"https://docs.turbostack.app/platform/hosts/applications/migration-hero/#running-the-wizard","path":"platform/hosts/applications/migration-hero.md","title":"Migration Hero","heading":"Running the wizard","keywords":"migration hero migrate site move application site migration","text":"Migration Hero is a three-step wizard."} {"id":"platform/hosts/applications/migration-hero.md#1-source-information","url":"https://docs.turbostack.app/platform/hosts/applications/migration-hero/#1-source-information","path":"platform/hosts/applications/migration-hero.md","title":"Migration Hero","heading":"1. Source Information","keywords":"migration hero migrate site move application site migration","text":"Describe the remote server you are migrating from:\n\n| Field | Description |\n|---|---|\n| **IP/Hostname Remote Source** | The address of the external server holding the site. |\n| **Username Remote Source** | The user account used to connect to the remote server. |\n| **Authentication Method** | How TurboStack authenticates: a password or an SSH key. |\n\nThen provide the credentials for the method you chose:\n\n- **Password** - enter the password for the remote user, then click **Next**.\n- **SSH key** - click **Generate SSH Key**, add the generated public key to the `.ssh/authorized_keys` file of the remote user on the source server, then click **Next**."} {"id":"platform/hosts/applications/migration-hero.md#2-destination-app","url":"https://docs.turbostack.app/platform/hosts/applications/migration-hero/#2-destination-app","path":"platform/hosts/applications/migration-hero.md","title":"Migration Hero","heading":"2. Destination app","keywords":"migration hero migrate site move application site migration","text":"Choose the destination account on this host that will receive the site. This must be an existing account.\n\nThen select what to migrate using the toggles:\n\n- **Clone files** - copy the application files.\n- **Clone database** - copy the database.\n\nEnable one or both, then click **Next**."} {"id":"platform/hosts/applications/migration-hero.md#3-destination-vhost","url":"https://docs.turbostack.app/platform/hosts/applications/migration-hero/#3-destination-vhost","path":"platform/hosts/applications/migration-hero.md","title":"Migration Hero","heading":"3. Destination VHost","keywords":"migration hero migrate site move application site migration","text":"For each application, set the **hostname(s)** it should listen on and choose the **certificate type** to generate (for example `letsencrypt`). When you are done, click **Start Import** to begin the migration.\n\nA migration progress popup appears in the bottom-right corner. When it finishes, the migration is complete."} {"id":"platform/hosts/applications/migration-hero.md#what-migration-hero-changes","url":"https://docs.turbostack.app/platform/hosts/applications/migration-hero/#what-migration-hero-changes","path":"platform/hosts/applications/migration-hero.md","title":"Migration Hero","heading":"What Migration Hero changes","keywords":"migration hero migrate site move application site migration","text":"Migration Hero only copies the data and database(s) from the remote host. It makes no changes on the remote system, so your source server keeps running untouched.\n\n> [!NOTE]\n> Because the migration is a copy, you can safely test the result on the destination before switching any traffic away from the original server."} {"id":"platform/hosts/applications/migration-hero.md#related","url":"https://docs.turbostack.app/platform/hosts/applications/migration-hero/#related","path":"platform/hosts/applications/migration-hero.md","title":"Migration Hero","heading":"Related","keywords":"migration hero migrate site move application site migration","text":"- Applications\n- Git deployment\n- Publishing changes\n- Hosts"} {"id":"platform/hosts/applications/tls-certificates.md#intro","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"# Transport Layer Security (TLS) certificates\n\nTurboStack secures your applications with HTTPS. You choose how each application gets its certificate on\nthe **Applications** tab, under an application's **Hostnames** settings (`cert_type`)."} {"id":"platform/hosts/applications/tls-certificates.md#certificate-types","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#certificate-types","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Certificate types","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"| `cert_type` | Use it for |\n|---|---|\n| `letsencrypt` | **Recommended.** Free, automatic certificates that renew themselves. |\n| `selfsigned` | Internal/test sites where a trusted certificate isn't required. |\n| `custom` | **Bring your own certificate** - buy one from any authority and import the **certificate**, **chain** and **private key** (GUI or YAML). |\n\n> [!IMPORTANT]\n> Custom certificate and private-key material is sensitive - treat it like any other secret."} {"id":"platform/hosts/applications/tls-certificates.md#let-s-encrypt-automatic-https","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#let-s-encrypt-automatic-https","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Let's Encrypt (automatic HTTPS)","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"Set `cert_type: letsencrypt` and publish. TurboStack requests the certificate and **renews it\nautomatically** before it expires. List every hostname the site answers to in `server_name`\n(space-separated) so they are all covered.\n\n> [!NOTE]\n> For Let's Encrypt to succeed, the domain must already point to the server - see\n> Connecting your domain.\n\n> [!TIP]\n> If you cannot adjust DNS yet but still need HTTPS, start with a `selfsigned` certificate and switch\n> to `letsencrypt` once the domain points to the server."} {"id":"platform/hosts/applications/tls-certificates.md#validation-challenge-http-vs-dns","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#validation-challenge-http-vs-dns","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Validation challenge: HTTP vs DNS","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"Under **Advanced settings** you can choose the `cert_challenge`:\n\n- **`http`** (recommended, most compatible) - validates by serving a file over HTTP. The domain\n must resolve to the server.\n- **`dns`** - validates via a Domain Name System (DNS) record. Use it for wildcard certificates, or for domains\n that don't yet point to the server. When your domain uses **Hosted Power DNS**, TurboStack creates\n the validation record automatically. For domains on **Cloudflare**, you supply a **Cloudflare API\n token** so TurboStack can create the record for you."} {"id":"platform/hosts/applications/tls-certificates.md#wildcards-and-multiple-domains","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#wildcards-and-multiple-domains","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Wildcards and multiple domains","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"- **Multiple domains/subdomains:** add them all to `server_name`.\n- **Wildcard (`*.example.com`):** requires the **DNS** challenge."} {"id":"platform/hosts/applications/tls-certificates.md#bring-your-own-certificate","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#bring-your-own-certificate","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Bring your own certificate","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"Most sites only need Let's Encrypt. To use a certificate you bought yourself, buy it from any\ncertificate authority, then set `cert_type: custom` and import it - either in the GUI (the application's\n**Hostnames** settings) or in YAML. Paste the **private key** and the **full chain** in order: your\ncertificate, then the intermediate certificate(s), then the root. If the publish fails, the\nintermediates are usually in the wrong order.\n\n> [!NOTE]\n> You almost never need to buy a certificate - Let's Encrypt covers nearly all cases. If you are\n> unsure, contact support."} {"id":"platform/hosts/applications/tls-certificates.md#generate-a-csr","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#generate-a-csr","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Generate a CSR","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"To buy a certificate you provide a Certificate Signing Request (CSR).\n\nGenerate the key and CSR on the server so the private key never leaves it. Create a config file\n`server.san` (use `*.example.com` as `commonName` for a wildcard):\n\n```ini\n[ req ]\ndefault_bits = 4096\ndistinguished_name = req_distinguished_name\nreq_extensions = req_ext\nprompt = no\n[ req_distinguished_name ]\ncountryName = BE\norganizationName = Example Company\ncommonName = www.example.com\n[ req_ext ]\nsubjectAltName = @alt_names\n[alt_names]\nDNS.1 = www.example.com\nDNS.2 = example.com\n```\n\n```bash\nopenssl req -sha256 -new -newkey rsa:4096 -nodes -keyout server.key -out server.csr -config server.san\n```\n\nGive `server.csr` to your certificate authority."} {"id":"platform/hosts/applications/tls-certificates.md#extract-a-certificate-from-a-pfx-file","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#extract-a-certificate-from-a-pfx-file","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Extract a certificate from a PFX file","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"If you were given a `.pfx` (Personal Information Exchange) file, split it into the certificate and key to paste them in:\n\n```bash\nopenssl pkcs12 -in certificate.pfx -nokeys -out certificate.pem -nodes # certificates\nopenssl pkcs12 -in certificate.pfx -nocerts -out priv-key.pem -nodes # private key\n```"} {"id":"platform/hosts/applications/tls-certificates.md#build-a-pfx-file","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#build-a-pfx-file","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Build a PFX file","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"To hand a certificate to a Windows or Internet Information Services (IIS) system, combine the private key, certificate and chain into one `.pfx`:\n\n```bash\nopenssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt -certfile chain.pem\n```\n\n> [!NOTE]\n> OpenSSL 3.x uses a newer default encryption that some older Windows or IIS versions cannot import. If the target refuses the file, add `-legacy`:\n> `openssl pkcs12 -export -legacy -out server.pfx -inkey server.key -in server.crt -certfile chain.pem`"} {"id":"platform/hosts/applications/tls-certificates.md#buy-a-certificate-through-the-customer-center","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#buy-a-certificate-through-the-customer-center","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Buy a certificate through the Customer Center","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"You can also order a paid certificate, still commonly sold as a Secure Sockets Layer (SSL)\ncertificate, through the Customer Center at\nportal.hosted-power.com. The portal generates the Certificate\nSigning Request (CSR) for you and handles the paperwork, then hands you the issued certificate to\nimport.\n\n> [!NOTE]\n> You almost never need to buy a certificate. Let's Encrypt covers nearly all cases. If you are\n> unsure whether a paid certificate is right for you, contact support first.\n\nTo order a certificate:\n\n1. Open the Customer Center and start a new certificate order.\n2. Choose the certificate product. Unless you were told to get a specific type, choose a **Sectigo\n Positive SSL** certificate.\n3. Provide the CSR. If you already have one, paste it. If not, choose the option to generate a new\n CSR now, and the portal creates it for you.\n4. Enter the organization data for the requesting organization. For a Sectigo Positive SSL\n certificate this data is not verified against public records.\n5. For **Certificate Common Name**, enter the domain you want the certificate to cover.\n6. Choose the approver email address for domain-control validation (see below)."} {"id":"platform/hosts/applications/tls-certificates.md#domain-control-validation","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#domain-control-validation","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Domain-control validation","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"The certificate authority confirms you control the domain by sending a validation email. The approver\naddress must be on the root domain of the requested domain, and it must be one of these five\naddresses:\n\n- `admin@example.com`\n- `administrator@example.com`\n- `hostmaster@example.com`\n- `webmaster@example.com`\n- `postmaster@example.com`\n\n> [!IMPORTANT]\n> Make sure you can receive mail at one of these five addresses on your domain before you order.\n> No other address is accepted for validation.\n\nAfter you complete the order, the validation email arrives at the address you chose. Follow its\ninstructions to confirm the request. Once validated, the certificate is usually issued within about\n10 minutes and becomes available in the Customer Center. Import it into your application as a custom\ncertificate (see Bring your own certificate)."} {"id":"platform/hosts/applications/tls-certificates.md#redirecting-to-https","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#redirecting-to-https","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Redirecting to HTTPS","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"On TurboStack the HTTP-to-HTTPS redirect is handled for you once a certificate is active - see\nForce HTTPS. Also set your application's site URL to\n`https://` so it generates secure links."} {"id":"platform/hosts/applications/tls-certificates.md#related","url":"https://docs.turbostack.app/platform/hosts/applications/tls-certificates/#related","path":"platform/hosts/applications/tls-certificates.md","title":"TLS certificates","heading":"Related","keywords":"turbostack tls ssl certificate lets encrypt https wildcard certificate dns challenge cloudflare hosted power dns bring your own certificate","text":"- Applications - where you set `server_name` and `cert_type`.\n- Connecting your domain - DNS prerequisites.\n- Security and Security hardening.\n- Hosts"} {"id":"platform/hosts/backups.md#intro","url":"https://docs.turbostack.app/platform/hosts/backups/","path":"platform/hosts/backups.md","title":"Backups and restore","heading":"","keywords":"backups restore backup jobs file backup database backup recovery","text":"# Backups and restore\n\nThe host's **Backups** tab lets you browse backup jobs and restore data from them. You can restore files and databases to different targets so you can verify recovered data before it overwrites your live environment.\n\n\n\nThis tab covers:\n\n- Automatic backups - the scheduled backups TurboStack takes for you\n- Browsing backup jobs - find a backup and open its contents\n- Creating an on-demand backup - start a backup yourself\n- Tracking backup jobs - follow backup and restore jobs in progress\n- Restoring files - recover files to a chosen target\n- Restoring MySQL - recover MySQL databases, tables, or a dump\n- Restoring PostgreSQL - recover PostgreSQL databases, tables, or a dump"} {"id":"platform/hosts/backups.md#automatic-backups","url":"https://docs.turbostack.app/platform/hosts/backups/#automatic-backups","path":"platform/hosts/backups.md","title":"Backups and restore","heading":"Automatic backups","keywords":"backups restore backup jobs file backup database backup recovery","text":"TurboStack takes **automatic daily backups** of your host, kept for **20 days**, in addition to the on-demand backups you can start yourself. Backups cover your files and databases. Use the steps below to browse and restore from any available backup.\n\n> [!TIP]\n> Want your backups kept longer than 20 days, or extra snapshots? Ask Support."} {"id":"platform/hosts/backups.md#browsing-backup-jobs","url":"https://docs.turbostack.app/platform/hosts/backups/#browsing-backup-jobs","path":"platform/hosts/backups.md","title":"Backups and restore","heading":"Browsing backup jobs","keywords":"backups restore backup jobs file backup database backup recovery","text":"Each backup job in the list shows:\n\n| Field | Description |\n| --- | --- |\n| Job ID | The unique identifier for the backup job. |\n| Date/time | When the backup was taken. |\n| Size | The size of the backup. |\n| Actions | A **Contents** button opens the backup so you can browse it and choose what to restore. |\n\nBackups are grouped by content type - **Files**, **MySQL** and **PostgreSQL** - which you select on the left. When you start a restore, a dialog opens and updates automatically with progress until the restore completes.\n\n> [!TIP]\n> Restore to `~/hprestore` or to a new database first, then verify the recovered data before overwriting live data."} {"id":"platform/hosts/backups.md#creating-an-on-demand-backup","url":"https://docs.turbostack.app/platform/hosts/backups/#creating-an-on-demand-backup","path":"platform/hosts/backups.md","title":"Backups and restore","heading":"Creating an on-demand backup","keywords":"backups restore backup jobs file backup database backup recovery","text":"Besides the automatic scheduled backups, you can create a backup yourself at any time.\n\n1. Open the host's **Backups** tab and select **Create Backup** from the left.\n2. In the dialog, tick what to include - **Files**, **MySQL** and/or **PostgreSQL**. The database\n options appear only for the databases enabled on the host.\n3. Click **Create Backup**."} {"id":"platform/hosts/backups.md#tracking-backup-jobs","url":"https://docs.turbostack.app/platform/hosts/backups/#tracking-backup-jobs","path":"platform/hosts/backups.md","title":"Backups and restore","heading":"Tracking backup jobs","keywords":"backups restore backup jobs file backup database backup recovery","text":"The **Jobs** entry on the left shows the status of backup and restore jobs in progress, so you\ncan follow a running backup or restore to completion. Each row lists the user, the date, the job\ntype, the backup type, the status and the time it finished; the eye icon at the end of a row opens\nthe job's details."} {"id":"platform/hosts/backups.md#restoring-files","url":"https://docs.turbostack.app/platform/hosts/backups/#restoring-files","path":"platform/hosts/backups.md","title":"Backups and restore","heading":"Restoring files","keywords":"backups restore backup jobs file backup database backup recovery","text":"When you restore files, choose one of the following targets:\n\n| Target | Description |\n| --- | --- |\n| Recovery folder | Restore into the dedicated `~/hprestore` folder. |\n| Overwrite existing | Restore files back to their original location, overwriting what is there. |\n| Custom path | Restore into a path you type, so you can recover to a specific location. |\n\nTo restore files:\n\n1. Open the host's **Backups** tab.\n2. Select the backup job you want to restore from.\n3. Choose **Files** as the content type.\n4. Select a target: the `~/hprestore` recovery folder, overwrite existing files, or a custom path you\n enter.\n5. Start the restore and follow the progress in the dialog."} {"id":"platform/hosts/backups.md#restoring-mysql","url":"https://docs.turbostack.app/platform/hosts/backups/#restoring-mysql","path":"platform/hosts/backups.md","title":"Backups and restore","heading":"Restoring MySQL","keywords":"backups restore backup jobs file backup database backup recovery","text":"To restore MySQL data:\n\n1. Open the host's **Backups** tab.\n2. Select the backup job you want to restore from.\n3. Choose **MySQL** as the content type.\n4. In the tree browser, select the databases (and, if needed, individual tables) to restore from the backup.\n5. Start the restore. The selected data is restored into your `~/hprestore` folder, not directly into the live database - from there you can review and import it."} {"id":"platform/hosts/backups.md#restoring-postgresql","url":"https://docs.turbostack.app/platform/hosts/backups/#restoring-postgresql","path":"platform/hosts/backups.md","title":"Backups and restore","heading":"Restoring PostgreSQL","keywords":"backups restore backup jobs file backup database backup recovery","text":"PostgreSQL restores the same way as MySQL:\n\n1. Open the host's **Backups** tab.\n2. Select the backup job you want to restore from.\n3. Choose **PostgreSQL** as the content type.\n4. In the tree browser, select the databases (and, if needed, individual tables) to restore from the backup.\n5. Start the restore. The selected data is restored into your `~/hprestore` folder, not directly into the live database - from there you can review and import it."} {"id":"platform/hosts/backups.md#related","url":"https://docs.turbostack.app/platform/hosts/backups/#related","path":"platform/hosts/backups.md","title":"Backups and restore","heading":"Related","keywords":"backups restore backup jobs file backup database backup recovery","text":"- Services\n- Applications\n- Backups and recovery\n- Hosts"} {"id":"platform/hosts/credentials.md#intro","url":"https://docs.turbostack.app/platform/hosts/credentials/","path":"platform/hosts/credentials.md","title":"Credentials","heading":"","keywords":"credentials passwords access details database credentials FTP server access","text":"# Credentials\n\nThe **Credentials** tab gathers the access details for a host - server-level access and the\ncredentials for each system user account.\n\n\n\nThis tab covers:\n\n- Server - host-level access, addresses, and platform details\n- Per-account credentials - databases, FTP, and user passwords\n\n> [!IMPORTANT]\n> Credentials are secrets. Passwords are hidden by default - click the eye icon to reveal one.\n> Use the copy icons rather than retyping, and never share or store these values insecurely."} {"id":"platform/hosts/credentials.md#server","url":"https://docs.turbostack.app/platform/hosts/credentials/#server","path":"platform/hosts/credentials.md","title":"Credentials","heading":"Server","keywords":"credentials passwords access details database credentials FTP server access","text":"The **Server** section lists host-level access:\n\n- **Hostname** - the server's fully-qualified name.\n- **Server Public IPv4** and **Server Public IPv6** - the server's public addresses.\n- **Platform**, **Webserver**, and the database version.\n\nOn a host managed by a control panel (cPanel or DirectAdmin, see\nSystem types), the Server section also shows the panel's\n**admin** login (the `admin` account and its password). Use it to sign in to the control panel\nitself. The server's root password is not shown; server-level access is managed for you by\nHosted Power."} {"id":"platform/hosts/credentials.md#per-account-credentials","url":"https://docs.turbostack.app/platform/hosts/credentials/#per-account-credentials","path":"platform/hosts/credentials.md","title":"Credentials","heading":"Per-account credentials","keywords":"credentials passwords access details database credentials FTP server access","text":"Each system user has its own section showing its account name, PHP version and applications, plus\nthe credentials it owns:\n\n- **MySQL databases** - database, user and password for each database.\n- **Database extra users** - additional read-only or admin database users.\n- **PostgreSQL databases** - same layout as MySQL, when PostgreSQL is enabled.\n- **FTP users** - FTP username, password and path.\n\nEvery value has a copy icon, and passwords have a reveal toggle."} {"id":"platform/hosts/credentials.md#related","url":"https://docs.turbostack.app/platform/hosts/credentials/#related","path":"platform/hosts/credentials.md","title":"Credentials","heading":"Related","keywords":"credentials passwords access details database credentials FTP server access","text":"- Applications\n- SSH access\n- Hosts"} {"id":"platform/hosts/health.md#intro","url":"https://docs.turbostack.app/platform/hosts/health/","path":"platform/hosts/health.md","title":"Health","heading":"","keywords":"health monitoring top issues service checks CPU memory disk host monitoring","text":"# Health\n\nThe **Health** tab is a live overview of a host. It surfaces the most important problems first\nand shows real-time resource usage and the status of every monitored service.\n\n\n\nThis tab covers:\n\n- Top issues - ranked list of detected problems\n- Latest reports - investigation reports for this host\n- Host monitoring - CPU, memory, swap, and disk graphs\n- Services - status of every monitored service check"} {"id":"platform/hosts/health.md#top-issues","url":"https://docs.turbostack.app/platform/hosts/health/#top-issues","path":"platform/hosts/health.md","title":"Health","heading":"Top issues","keywords":"health monitoring top issues service checks CPU memory disk host monitoring","text":"A ranked list of the most important problems detected on the host. Each issue shows a severity\n(CRITICAL / HIGH / MEDIUM / LOW / INFO) and a category (PERFORMANCE / AVAILABILITY / SECURITY /\nSTABILITY). Expand an issue to see what is happening, a recommended fix, and links to open the\nrelated investigation reports.\n\n> [!TIP]\n> The list is ordered by importance, and not every issue is equally urgent. Start with **CRITICAL**\n> and **HIGH** - these affect availability, performance or security right now. **MEDIUM**, **LOW**\n> and **INFO** are worth knowing about but rarely need immediate action; handle them during normal\n> maintenance.\n\nWhen nothing has been detected, the panel is empty and reports that there are no top issues for the\nhost."} {"id":"platform/hosts/health.md#latest-reports","url":"https://docs.turbostack.app/platform/hosts/health/#latest-reports","path":"platform/hosts/health.md","title":"Health","heading":"Latest reports","keywords":"health monitoring top issues service checks CPU memory disk host monitoring","text":"The most recent investigation reports for the host, newest first. Open a report to read its\nfull details, or download the Portable Document Format (PDF) when available.\n\nWhen you open a report, its address appears in the browser URL, so the report is bookmarkable\nand shareable. Use the **Link** button in the report header to copy that address to your\nclipboard (the button confirms with **Copied**). Anyone who opens the copied link, and who has\naccess to the host, lands on the Health tab with the same report already open.\n\n\n\n> [!TIP]\n> Paste the link into a support ticket or a message to a colleague so they see the exact report\n> you are looking at, instead of describing it."} {"id":"platform/hosts/health.md#host-monitoring","url":"https://docs.turbostack.app/platform/hosts/health/#host-monitoring","path":"platform/hosts/health.md","title":"Health","heading":"Host monitoring","keywords":"health monitoring top issues service checks CPU memory disk host monitoring","text":"Resource-usage cards for the four things that most often cause a slow or failing site. Each card\nshows a current percentage, an OK / Warning / Critical status, and a graph. Use the\n**1H / 8H / 1D / 7D** buttons to change the time range (1 hour to 7 days). The view refreshes\nautomatically.\n\n| Card | What it measures | What a high value means and what to do |\n| --- | --- | --- |\n| **CPU** (Central Processing Unit) | How busy the server's processor is. | Sustained high CPU means the server is doing more work than it can keep up with, so pages slow down. Look for a traffic spike, a heavy task, or inefficient code. See High CPU and load. |\n| **RAM** (Random Access Memory) | How much of the server's working memory is in use. | High memory use is normal up to a point. The risk is running out - see swap below. |\n| **Memory swap** | Disk space used as overflow when RAM is full. | If swap is rising, the server has run out of fast memory and is using slow disk instead, which makes everything slower. See Out of memory. |\n| **Disk** | How full the server's storage is. | A full disk causes uploads, logs, databases and backups to fail. Free up space before it reaches 100%. See Disk space. |\n\n> [!TIP]\n> Use the 7-day (7D) view to tell a one-off spike from a steady trend. A single short spike is\n> usually harmless; a line that climbs day after day needs attention."} {"id":"platform/hosts/health.md#services","url":"https://docs.turbostack.app/platform/hosts/health/#services","path":"platform/hosts/health.md","title":"Health","heading":"Services","keywords":"health monitoring top issues service checks CPU memory disk host monitoring","text":"A list of all monitored service checks for the host - for example the database, web server, cache and\nconnectivity checks. Each check shows its status (OK, Warning, Critical or Unknown), the latest output\nfrom the check, and when it last ran. An **Unknown** status means the check could not determine the\nservice state, for example because it did not return a result.\n\nA check in Warning, Critical or Unknown state is the place to start when something is wrong: the output\nusually names the exact problem (for example a service that is not running, or a certificate about to\nexpire). Many issues can be resolved from the command-line tool or by\npublishing a corrected configuration.\n\n> [!TIP]\n> The Health tab covers one host. For an overview across all your hosts, use\n> Monitoring. For how monitoring works, see\n> Monitoring (concepts)."} {"id":"platform/hosts/health.md#related","url":"https://docs.turbostack.app/platform/hosts/health/#related","path":"platform/hosts/health.md","title":"Health","heading":"Related","keywords":"health monitoring top issues service checks CPU memory disk host monitoring","text":"- Monitoring\n- Threat Center\n- Hosts"} {"id":"platform/hosts/index.md#intro","url":"https://docs.turbostack.app/platform/hosts/","path":"platform/hosts/index.md","title":"Hosts","heading":"","keywords":"hosts server list host workspace configuration tabs","text":"# Hosts\n\nA **host** represents one of your servers and the configuration it should run. The **Hosts**\narea is your starting point: browse all your servers, check their live health, and open any host\nto configure it.\n\n> [!NOTE]\n> Editing a host changes its *intended* configuration. Changes only take effect on the server\n> once you **publish** them - see Publishing changes.\n\n- The Hosts list - browse and search your servers\n- The host workspace - configuration tabs and header actions"} {"id":"platform/hosts/index.md#the-hosts-list","url":"https://docs.turbostack.app/platform/hosts/#the-hosts-list","path":"platform/hosts/index.md","title":"Hosts","heading":"The Hosts list","keywords":"hosts server list host workspace configuration tabs","text":"After signing in you land on the **Hosts** dashboard (also reachable from the sidebar, at `/`).\n\n\n\nEach row shows the **host name**, a **configuration summary** (application types, web server,\ndatabase versions), a **server usage** badge, live **health indicators** (status, memory, CPU,\ndisk - hover for details), and a **Manage** button.\n\nUse the **search box** to filter by name; the **Number of Items** control sets the page size. To\nsearch across groups and templates too, use the global Search."} {"id":"platform/hosts/index.md#the-host-workspace","url":"https://docs.turbostack.app/platform/hosts/#the-host-workspace","path":"platform/hosts/index.md","title":"Hosts","heading":"The host workspace","keywords":"hosts server list host workspace configuration tabs","text":"Click **Manage** on a host to open it (`/hosts/{id}`). The configuration is organized into tabs,\nwith action buttons in the top-right header."} {"id":"platform/hosts/index.md#configuration-tabs","url":"https://docs.turbostack.app/platform/hosts/#configuration-tabs","path":"platform/hosts/index.md","title":"Hosts","heading":"Configuration tabs","keywords":"hosts server list host workspace configuration tabs","text":"| Tab | What it covers |\n|---|---|\n| Health | Live monitoring: top issues, CPU/memory/disk usage, service checks |\n| Threat Center | Security findings and vulnerabilities (TurboRadar) |\n| Applications | Applications (vhosts) and their system users |\n| Services | Web server, databases, caching and search engines |\n| Advanced | Mail, Varnish, RabbitMQ, FTP server, operating system |\n| Groups | Group membership for this host |\n| SSH | SSH keys and authentication |\n| Security | TurboShield, IP allow-list, GeoIP, web application firewall |\n| Backups | Restore files and databases from backups |\n| Credentials | Server and per-account access details |"} {"id":"platform/hosts/index.md#header-actions","url":"https://docs.turbostack.app/platform/hosts/#header-actions","path":"platform/hosts/index.md","title":"Hosts","heading":"Header actions","keywords":"hosts server list host workspace configuration tabs","text":"- **`` Source** - switch to the YAML editor (`/hosts/yaml/{id}`); in Source view a **GUI**\n button switches back and a **Copy** button copies the configuration.\n- **Revisions** (clock icon) - open the History view (revisions, deploys, cloning).\n- **Save** - store changes without deploying. **Save & Publish** - store *and* deploy (see\n Publishing changes).\n\n> [!TIP]\n> Prefer the **GUI** editor for everyday changes and **Source** (YAML) for advanced or bulk\n> edits. Both edit the same configuration. Set your default in\n> Profile & preferences.\n\nWhen a host's configuration is empty, you can pre-fill it with **Copy > From host** or\n**Copy > From template** (see Templates)."} {"id":"platform/hosts/index.md#next-steps","url":"https://docs.turbostack.app/platform/hosts/#next-steps","path":"platform/hosts/index.md","title":"Hosts","heading":"Next steps","keywords":"hosts server list host workspace configuration tabs","text":"- Publishing changes - apply your configuration to the server.\n- Applications and Services - configure what the host runs."} {"id":"platform/hosts/publishing.md#intro","url":"https://docs.turbostack.app/platform/hosts/publishing/","path":"platform/hosts/publishing.md","title":"Publishing changes","heading":"","keywords":"publish deploy save and publish full publish deployment types rollback","text":"# Publishing changes\n\nChanging a host's configuration does not affect the running server until you **publish** it.\n\n- Save vs. publish - what each action does\n- Deployment types - choose the right publish mode\n- Preview what publishing will do - the On publish indicator\n- Following a deployment - track progress and review logs"} {"id":"platform/hosts/publishing.md#save-vs-publish","url":"https://docs.turbostack.app/platform/hosts/publishing/#save-vs-publish","path":"platform/hosts/publishing.md","title":"Publishing changes","heading":"Save vs. publish","keywords":"publish deploy save and publish full publish deployment types rollback","text":"- **Save** stores your changes in TurboStack only. The server is unchanged, and an **unpublished\n changes** badge appears as a reminder.\n- **Save & Publish** stores your changes *and* deploys them so the server matches your\n configuration."} {"id":"platform/hosts/publishing.md#deployment-types","url":"https://docs.turbostack.app/platform/hosts/publishing/#deployment-types","path":"platform/hosts/publishing.md","title":"Publishing changes","heading":"Deployment types","keywords":"publish deploy save and publish full publish deployment types rollback","text":"Open the **Save & Publish** menu (the ▾ next to the button) to choose how the configuration is\napplied:\n\n| Action | What it does | When to use |\n|---|---|---|\n| **Save & Publish** | Applies your (unpublished) configuration changes to the server. | Everyday changes. |\n| **Save & Full Publish** | Runs a complete deployment that re-applies the whole configuration. | After larger changes, or to be thorough. |\n| **Save, Delete & Full Publish** | Full deployment that **permanently removes** anything you deleted from the configuration. | Only when you intend to remove resources and their data. |\n\n\n\n> [!WARNING]\n> **Save, Delete & Full Publish** permanently destroys the data associated with objects you\n> removed from the configuration. You must type `DELETE` to confirm. Use it only when you are\n> certain."} {"id":"platform/hosts/publishing.md#preview-what-publishing-will-do","url":"https://docs.turbostack.app/platform/hosts/publishing/#preview-what-publishing-will-do","path":"platform/hosts/publishing.md","title":"Publishing changes","heading":"Preview what publishing will do","keywords":"publish deploy save and publish full publish deployment types rollback","text":"Before you publish, TurboStack shows an **On publish** indicator in the host header and in the\nHistory view. It tells you the scope of the next publish, so there are no\nsurprises:\n\n| On publish shows | What it means |\n|---|---|\n| **Nothing to publish** | The server already matches your saved configuration. |\n| A list of components (for example `nginx`, `php`, `mysql`) | Only these parts are redeployed, which is faster. |\n| **Full Deploy** | The whole configuration is re-applied. |\n\nTurboStack only escalates to a full deployment when a change is structural, such as adding a\nsystem user. Ordinary setting changes redeploy just the affected components. Changes that cancel\neach other out, or backup settings, do not trigger a deployment on their own."} {"id":"platform/hosts/publishing.md#following-a-deployment","url":"https://docs.turbostack.app/platform/hosts/publishing/#following-a-deployment","path":"platform/hosts/publishing.md","title":"Publishing changes","heading":"Following a deployment","keywords":"publish deploy save and publish full publish deployment types rollback","text":"When you publish, a progress dialog tracks the deployment with a live spinner and the latest log\noutput, refreshing automatically until the job finishes, errors, or times out. While a\ndeployment is running, the publish and credentials actions are temporarily disabled to prevent\noverlapping deployments.\n\nYou can review every past deployment - including who triggered it, the result, and the full\nlogs - on the **Deploys** tab of the History view.\n\n> [!TIP]\n> If a change causes a problem, restore an earlier revision from the\n> History view and publish it to roll back."} {"id":"platform/hosts/publishing.md#related","url":"https://docs.turbostack.app/platform/hosts/publishing/#related","path":"platform/hosts/publishing.md","title":"Publishing changes","heading":"Related","keywords":"publish deploy save and publish full publish deployment types rollback","text":"- History (revisions, deploys & cloning)\n- Credentials\n- Hosts"} {"id":"platform/hosts/revisions.md#intro","url":"https://docs.turbostack.app/platform/hosts/revisions/","path":"platform/hosts/revisions.md","title":"History - revisions, deploys and cloning","heading":"","keywords":"revisions history deploys cloning revert rollback configuration history","text":"# History - revisions, deploys and cloning\n\nThe **Revisions** button (clock icon) in a host's header opens the **History** view. It has\nthree tabs: **Revisions**, **Deploys**, and **Cloning**. Each tab uses a two-pane layout: a\nsearchable list on the left, and the full detail of the selected entry on the right.\n\n\n\n- Revisions - view and revert configuration changes\n- Deploys - deployment log and full output\n- Cloning - copy an account between hosts or users\n\nThe header of the History view also shows an **On publish** indicator: it tells you what\npublishing will do right now, before you start. See\nPreview what publishing will do."} {"id":"platform/hosts/revisions.md#revisions","url":"https://docs.turbostack.app/platform/hosts/revisions/#revisions","path":"platform/hosts/revisions.md","title":"History - revisions, deploys and cloning","heading":"Revisions","keywords":"revisions history deploys cloning revert rollback configuration history","text":"Every time you save, TurboStack records a **revision**. The left pane lists the change history,\nnewest first, with the author, their avatar, and how long ago the change was made. Consecutive\nsaves that belong to one change are grouped into a single entry. Select an entry to see its\ndetail: which configuration paths changed, the before and after values (the net difference), and\nwhether the revision has been published. Use the search box to filter the list.\n\n- **Revert revision** - restore the configuration to an earlier state. A confirmation shows the\n current configuration next to the after-revert preview before you apply it.\n\n> [!TIP]\n> Reverting only changes the configuration; publish afterwards to apply the rollback to the\n> server (see Publishing changes)."} {"id":"platform/hosts/revisions.md#deploys","url":"https://docs.turbostack.app/platform/hosts/revisions/#deploys","path":"platform/hosts/revisions.md","title":"History - revisions, deploys and cloning","heading":"Deploys","keywords":"revisions history deploys cloning revert rollback configuration history","text":"The Deploys tab is the deployment log. The left pane lists each deployment with its author,\ndate, and status (**Published**, **Error**, or **Partially published**). Select an entry to see\nits detail: the deploy type (**Deploy** / **Full Deploy** / **Full & Reset Deploy**), the\n**Components** deployed, the start and finish times, and the full **Output**. The output is shown\ninline, which is useful for diagnosing a failed publish. For a deployment that ran across several\nhosts, the output is grouped per host."} {"id":"platform/hosts/revisions.md#cloning","url":"https://docs.turbostack.app/platform/hosts/revisions/#cloning","path":"platform/hosts/revisions.md","title":"History - revisions, deploys and cloning","heading":"Cloning","keywords":"revisions history deploys cloning revert rollback configuration history","text":"The Cloning tab is a read-only record of **account clones**. Cloning copies an application\naccount (its files and/or its database) from a source to a destination:\n\n| Field | Meaning |\n|---|---|\n| Source Host / Source User | The account being copied from. |\n| Destination User | The account being copied to. |\n| Clone Files | Whether file data is copied. |\n| Clone Database | Whether database data is copied. |\n\nSelect an entry to see its full **Parameters**. You start a new clone from the **Applications**\ntab (the **Clone app** button in the footer), not from this tab - see\nApplications."} {"id":"platform/hosts/revisions.md#related","url":"https://docs.turbostack.app/platform/hosts/revisions/#related","path":"platform/hosts/revisions.md","title":"History - revisions, deploys and cloning","heading":"Related","keywords":"revisions history deploys cloning revert rollback configuration history","text":"- Publishing changes\n- Applications\n- Hosts"} {"id":"platform/hosts/security.md#intro","url":"https://docs.turbostack.app/platform/hosts/security/","path":"platform/hosts/security.md","title":"Security","heading":"","keywords":"security turboshield firewall web application firewall waf virtual patching owasp top 10 waf notification email ip allow-list geoip","text":"# Security\n\nThe host's **Security** tab is where you configure how incoming web traffic is protected. This page covers the practical configuration steps. For how the underlying protections work, see the Security overview.\n\n\n\n> [!NOTE]\n> Security settings can also be applied at the **group** level and inherited by every host in the group. See Groups.\n\nThis tab covers:\n\n- TurboShield - traffic filtering, bot controls and attack detection\n- IP allow-list - trusted IP addresses and ranges that bypass blocking\n- GeoIP filtering - allow or block traffic by country\n- Web Application Firewall - block requests matching known attack patterns\n- Automatically managed protections - the firewall TurboStack manages for you"} {"id":"platform/hosts/security.md#turboshield","url":"https://docs.turbostack.app/platform/hosts/security/#turboshield","path":"platform/hosts/security.md","title":"Security","heading":"TurboShield","keywords":"security turboshield firewall web application firewall waf virtual patching owasp top 10 waf notification email ip allow-list geoip","text":"TurboShield protects your applications against malicious web traffic and Distributed Denial of Service (DDoS) attacks - attempts to overwhelm your site with so many requests that it goes offline. It applies rate limits, a cap on how many requests one visitor can make. It adds bot controls, which tell good automated visitors from bad ones. It also detects attack behavior and temporarily bans the source. You can enable or disable it per host and choose a protection level. For everything it does and every setting, see What is TurboShield? and Configure TurboShield.\n\nThrottled visitors receive a soft `429` (Too Many Requests) response rather than being banned at the firewall, so legitimate traffic recovers automatically once it slows down. This matters for you because it means search engines and real customers are not locked out when traffic spikes. Bans, which only follow clear attack behavior, always expire on their own.\n\n| Level | Behavior |\n| --- | --- |\n| `low` | Lenient rate limits; minimal bot controls. |\n| `medium` | Balanced protection. This is the default. |\n| `high` | Stricter rate limits and tighter bot controls. |\n| `attack` | Most aggressive limits, intended for active attacks. |\n\nTo configure TurboShield:\n\n1. Open the host's **Security** tab.\n2. Enable **TurboShield**.\n3. Select a protection level. The default is `medium`.\n4. Save your changes.\n\n> [!TIP]\n> Start with `medium` and only raise the level if you observe abusive traffic. Switch to `attack` temporarily while an attack is in progress, then return to your normal level.\n\nFor details on how TurboShield evaluates traffic, see the Security overview."} {"id":"platform/hosts/security.md#ip-allow-list","url":"https://docs.turbostack.app/platform/hosts/security/#ip-allow-list","path":"platform/hosts/security.md","title":"Security","heading":"IP allow-list","keywords":"security turboshield firewall web application firewall waf virtual patching owasp top 10 waf notification email ip allow-list geoip","text":"The IP allow-list (`firewall_whitelist`) lets you define trusted Internet Protocol (IP) addresses, and ranges of them, that bypass rate-limiting and blocking. An IP address is the network address of a device or office, such as `203.0.113.10`. A range is written in Classless Inter-Domain Routing (CIDR) notation, such as `203.0.113.0/24`, which means a block of addresses. This is useful for office networks, monitoring services, and integration partners that should never be throttled or blocked.\n\nA trusted IP is also allowed through the host firewall, so it can reach ports that are otherwise closed to the public.\n\n1. Open the host's **Security** tab.\n2. Add each trusted IP address or CIDR range to the `firewall_whitelist`.\n3. Save your changes.\n\n> [!WARNING]\n> Validate every source before adding it. Wide ranges grant unrestricted access and can expose your host to abuse. Add the narrowest range that meets your need."} {"id":"platform/hosts/security.md#geoip-filtering","url":"https://docs.turbostack.app/platform/hosts/security/#geoip-filtering","path":"platform/hosts/security.md","title":"Security","heading":"GeoIP filtering","keywords":"security turboshield firewall web application firewall waf virtual patching owasp top 10 waf notification email ip allow-list geoip","text":"GeoIP filtering lets you allow or block web traffic based on the visitor's country.\n\n| Setting | Effect |\n| --- | --- |\n| `firewall_country_allow` | Allow traffic only from the listed countries. |\n| `firewall_country_block` | Block traffic from the listed countries. |\n\n> [!WARNING]\n> Country-based filtering carries a high risk of false positives. Visitors using VPNs, mobile networks, or proxies may be misidentified by country. Test carefully before relying on GeoIP rules in production."} {"id":"platform/hosts/security.md#web-application-firewall","url":"https://docs.turbostack.app/platform/hosts/security/#web-application-firewall","path":"platform/hosts/security.md","title":"Security","heading":"Web Application Firewall","keywords":"security turboshield firewall web application firewall waf virtual patching owasp top 10 waf notification email ip allow-list geoip","text":"The Web Application Firewall (WAF) inspects each incoming web request against a managed set of rules and blocks ones that match known attack patterns. TurboStack uses Imunify for this, which also scans the files on the host for malware. It works at the application layer, which is layer 7 of the Open Systems Interconnection (OSI) network model, so it can inspect the content of a request. This is a deeper level than the network firewall, which filters traffic at the network layer (layer 3). Working at layer 7 lets the WAF stop application-level attacks from the OWASP Top 10. That is the Open Worldwide Application Security Project's industry list of the most common web application risks. The two most common patterns it stops are:\n\n- **SQL injection** - an attacker tries to smuggle database commands through a form or URL to read or change your data.\n- **Cross-site scripting (XSS)** - an attacker tries to inject malicious code into your pages so it runs in your visitors' browsers.\n\nThe WAF also applies virtual patches. A virtual patch closes a known, exploited vulnerability at the firewall before the application itself is patched. This means a newly disclosed leak can be blocked immediately, instead of waiting for an application update.\n\nYou do not write these rules yourself; TurboStack maintains them. You choose whether the WAF is on and where it sends alerts.\n\n1. Open the host's **Security** tab.\n2. Enable the **Web Application Firewall**.\n3. Enter a **notification email** address. TurboStack sends WAF security alerts, such as malware detections, to this address.\n4. Save your changes.\n\n> [!TIP]\n> Keep the WAF enabled. If a rule ever blocks a legitimate request in your application (a false positive), contact support to adjust it rather than turning the whole WAF off."} {"id":"platform/hosts/security.md#automatically-managed-protections","url":"https://docs.turbostack.app/platform/hosts/security/#automatically-managed-protections","path":"platform/hosts/security.md","title":"Security","heading":"Automatically managed protections","keywords":"security turboshield firewall web application firewall waf virtual patching owasp top 10 waf notification email ip allow-list geoip","text":"The Firewall is managed automatically by TurboStack and does not require manual configuration. See the Security overview for how they fit into the overall protection model."} {"id":"platform/hosts/security.md#related","url":"https://docs.turbostack.app/platform/hosts/security/#related","path":"platform/hosts/security.md","title":"Security","heading":"Related","keywords":"security turboshield firewall web application firewall waf virtual patching owasp top 10 waf notification email ip allow-list geoip","text":"- Security overview\n- Groups\n- Advanced settings\n- Threat Center\n- SSH access"} {"id":"platform/hosts/services.md#intro","url":"https://docs.turbostack.app/platform/hosts/services/","path":"platform/hosts/services.md","title":"Services","heading":"","keywords":"services web server nginx Apache MySQL PostgreSQL Redis Elasticsearch OpenSearch databases client only separate database server Kibana OpenSearch Dashboards SQL Server edition","text":"# Services\n\nThe host's **Services** tab is where you choose the server-level services: the web server, the\ndatabases, the caching layers, and the search engine. Enable a service and pick its version; the\nleft-hand menu lists each service.\n\n\n\nThis tab covers:\n\n- Web server - Nginx or Apache\n- Databases - MySQL, PostgreSQL, MongoDB, and SQL Server\n- Caching and queues - Redis, Varnish, and RabbitMQ\n- Search - Elasticsearch and OpenSearch\n\n> [!TIP]\n> Memory sizing (database buffers, cache size, search heap) is auto-tuned to the server. Only\n> override it with measured evidence. Changing a service's **major version** can be disruptive -\n> plan and test it."} {"id":"platform/hosts/services.md#web-server","url":"https://docs.turbostack.app/platform/hosts/services/#web-server","path":"platform/hosts/services.md","title":"Services","heading":"Web server","keywords":"services web server nginx Apache MySQL PostgreSQL Redis Elasticsearch OpenSearch databases client only separate database server Kibana OpenSearch Dashboards SQL Server edition","text":"Each host runs one web server, selected with `webserver`:\n\n| Value | Description |\n|---|---|\n| `nginx` | High-performance web server and reverse proxy. Recommended for most workloads. |\n| `apache2` | Widely compatible; useful when an app needs `.htaccess` or Apache modules. |\n\n> [!NOTE]\n> PHP and other language runtimes are chosen **per application** on the Applications\n> tab (a host can serve several PHP versions side by side)."} {"id":"platform/hosts/services.md#databases","url":"https://docs.turbostack.app/platform/hosts/services/#databases","path":"platform/hosts/services.md","title":"Services","heading":"Databases","keywords":"services web server nginx Apache MySQL PostgreSQL Redis Elasticsearch OpenSearch databases client only separate database server Kibana OpenSearch Dashboards SQL Server edition","text":"Enable and pick a version for each database you need:\n\n| Service | Setting | Notes |\n|---|---|---|\n| MySQL (Percona) | `mysql_version` | e.g. 8.0-8.4. Buffer pool auto-sized (`mysql_innodb_size`). |\n| PostgreSQL | `postgresql_version` | e.g. 16-18. Shared buffers auto-sized (`postgresql_shared_buffers`). |\n| MongoDB (Percona) | enable + version | e.g. 7.0-8.0. |\n| Microsoft SQL Server | enable + version | When required. |\n\n> [!IMPORTANT]\n> Network bind addresses (`mysql_bindaddress`, `postgresql_listen_addresses`, `mongodb_bindip`) are\n> security-sensitive - keep them restricted to trusted networks. All three accept the keyword\n> **`ANY`**, which listens on *every* interface the server has, including any public one. Prefer a\n> specific private address, and restrict access with the firewall.\n\n> [!WARNING]\n> On a host that also runs **Kubernetes or Docker**, the databases listen on every interface unless\n> you set the bind address yourself - the containers have to be able to reach them. MongoDB does\n> this even when its bind address is set to `127.0.0.1`. Set the address explicitly on such a host\n> if you need it narrower, and make sure the firewall is closed.\n\nYou can administer MySQL through **phpMyAdmin**, and enable **Advanced Database Monitoring**\n(under the host's **Advanced** tab) for deep database monitoring - see Monitoring (concepts)."} {"id":"platform/hosts/services.md#client-only-mode","url":"https://docs.turbostack.app/platform/hosts/services/#client-only-mode","path":"platform/hosts/services.md","title":"Services","heading":"Client-only mode","keywords":"services web server nginx Apache MySQL PostgreSQL Redis Elasticsearch OpenSearch databases client only separate database server Kibana OpenSearch Dashboards SQL Server edition","text":"MySQL and PostgreSQL each have a **Client only** toggle. Turn it on when the database does not run\non this host but on another server. TurboStack then installs only the database client tools, and the\nserver settings (bind address, buffer sizes, extensions, extra access) disappear from the form.\n\n\n\nTwo fields replace them:\n\n| Field | What to enter |\n|---|---|\n| **Client Host Name** | The host name of the server that runs the database (`mysql_client_host_name` / `postgresql_client_host_name`). |\n| **Client Host IP** | The address of that same server (`mysql_client_host_ip` / `postgresql_client_host_ip`). |\n\nThis is the application-server half of a split setup: this host runs the web server and the\napplication, and a separate host runs the database engine. It keeps database load off the\napplication server, and lets several application servers share one database.\n\n```yaml\n# Application server: no local database engine, connect to db1 instead\nmysql_version: \"8.4\"\nmysql_server: false # what the \"Client only\" toggle sets for MySQL\nmysql_client_host_name: db1.example.com\nmysql_client_host_ip: 10.0.0.5\n\n# PostgreSQL uses its own key for the same thing\n# postgresql_client_only: true\n# postgresql_client_host_name: db1.example.com\n# postgresql_client_host_ip: 10.0.0.5\n```\n\n> [!IMPORTANT]\n> The database server must accept connections from this host. On the database server, open the\n> bind address or listen addresses to the private network and grant the user access. Never open a\n> database to the public internet.\n\nThe database server itself is a second host configuration - see\nApplication server plus a separate database server."} {"id":"platform/hosts/services.md#microsoft-sql-server-edition","url":"https://docs.turbostack.app/platform/hosts/services/#microsoft-sql-server-edition","path":"platform/hosts/services.md","title":"Services","heading":"Microsoft SQL Server edition","keywords":"services web server nginx Apache MySQL PostgreSQL Redis Elasticsearch OpenSearch databases client only separate database server Kibana OpenSearch Dashboards SQL Server edition","text":"When you enable Microsoft SQL Server you also pick an **edition** (`mssql_edition`): `Developer`,\n`Enterprise`, `Express`, `Standard` or `Web`. If you do not choose one, `Express` is installed.\nThe editions differ in features, in the limits they impose, and in licensing, so check what your\nlicense allows before you pick one."} {"id":"platform/hosts/services.md#caching-and-queues","url":"https://docs.turbostack.app/platform/hosts/services/#caching-and-queues","path":"platform/hosts/services.md","title":"Services","heading":"Caching and queues","keywords":"services web server nginx Apache MySQL PostgreSQL Redis Elasticsearch OpenSearch databases client only separate database server Kibana OpenSearch Dashboards SQL Server edition","text":"| Service | Notes |\n|---|---|\n| **Redis** | Enabled by default. Two instances by convention: port `6379` = **cache** (transient, safe to clear) and `6378` = **persistent** (durable sessions/critical state). |\n| **Varnish** | HTTP reverse-proxy cache, enabled per application (`varnish_enabled`); size auto-tuned. Advanced users can supply custom VCL (expert feature - easy to break). |\n| **RabbitMQ** | AMQP message broker for background/async job queues. |\n\n> [!TIP]\n> Use Redis `6379` for transient cache and `6378` for durable sessions and queues - never store\n> data you cannot lose on the cache instance."} {"id":"platform/hosts/services.md#search","url":"https://docs.turbostack.app/platform/hosts/services/#search","path":"platform/hosts/services.md","title":"Services","heading":"Search","keywords":"services web server nginx Apache MySQL PostgreSQL Redis Elasticsearch OpenSearch databases client only separate database server Kibana OpenSearch Dashboards SQL Server edition","text":"Enable **Elasticsearch** or **OpenSearch** and pick a version (Elasticsearch 8.x-9.x, OpenSearch\n2.x-3.x). The JVM heap is auto-sized; plugins are configurable. OpenSearch supports nightly snapshots\nof your indices.\n\nBoth engines offer the same three extras once you pick a type and a version:\n\n| Setting | Description |\n|---|---|\n| **Install Kibana** / **Install OpenSearch Dashboards** | Installs the engine's web interface, so you can inspect indexes and run queries in a browser (`elasticsearch_kibana`, `opensearch_dashboards`). Off by default. |\n| **Plugins** | A multi-select of extra engine plugins, for example language-specific analysis for better search results (`elasticsearch_plugins`, `opensearch_plugins`). |\n| **Heap size** | The memory the engine may use. It is auto-scaled to the server by default; turn the toggle on to enter your own size and unit (`elasticsearch_heap_size`, `opensearch_heap_size`). |\n\n```yaml\nopensearch_version: \"3.x\"\nopensearch_dashboards: true\nopensearch_plugins: [analysis-icu]\n```"} {"id":"platform/hosts/services.md#reaching-the-web-interface","url":"https://docs.turbostack.app/platform/hosts/services/#reaching-the-web-interface","path":"platform/hosts/services.md","title":"Services","heading":"Reaching the web interface","keywords":"services web server nginx Apache MySQL PostgreSQL Redis Elasticsearch OpenSearch databases client only separate database server Kibana OpenSearch Dashboards SQL Server edition","text":"Once installed, the interface is served by the host's own web server on a fixed path:\n\n| Interface | Address |\n|---|---|\n| Kibana (Elasticsearch) | `https:///kibana` |\n| OpenSearch Dashboards | `https:///dashboards` |\n\nThe web server asks for a user name and password before it lets you through, and it accepts the\nhost's **system user accounts** - the same credentials you use for SSH. The interface itself is\nnever exposed directly; the web server reaches it over localhost.\n\n> [!NOTE]\n> That login is the web server's, not the search engine's. OpenSearch Dashboards has no user\n> accounts of its own unless you turn user management on, which is only available in the\n> Source (YAML) view (`opensearch_dashboards_usermanagement`).\n> Turn it on when you need per-user access inside the dashboards rather than one shared door."} {"id":"platform/hosts/services.md#related","url":"https://docs.turbostack.app/platform/hosts/services/#related","path":"platform/hosts/services.md","title":"Services","heading":"Related","keywords":"services web server nginx Apache MySQL PostgreSQL Redis Elasticsearch OpenSearch databases client only separate database server Kibana OpenSearch Dashboards SQL Server edition","text":"- Applications - per-application PHP, runtimes and proxying.\n- Advanced settings and Backups & restore.\n- Configuration recipes - including a separate database server.\n- Hosts"} {"id":"platform/hosts/ssh.md#intro","url":"https://docs.turbostack.app/platform/hosts/ssh/","path":"platform/hosts/ssh.md","title":"SSH access","heading":"","keywords":"ssh ssh keys ssh access key authentication host ssh","text":"# SSH access\n\nThe host's **SSH** tab controls how you and your team connect to a host over SSH. From here you manage the public keys allowed to log in, the port SSH listens on, and whether password-based login is permitted.\n\n\n\n> [!NOTE]\n> SSH settings are hidden for Windows hosts.\n\nThis tab covers:\n\n- SSH keys - manage the public keys allowed to log in\n- SSH port - change the port SSH listens on\n- Password authentication - allow or disable password-based login"} {"id":"platform/hosts/ssh.md#ssh-keys","url":"https://docs.turbostack.app/platform/hosts/ssh/#ssh-keys","path":"platform/hosts/ssh.md","title":"SSH access","heading":"SSH keys","keywords":"ssh ssh keys ssh access key authentication host ssh","text":"The `ssh_keys` list defines the public SSH keys allowed to access the server. Add, edit, or delete keys as your team changes.\n\nEach key supports an optional name or label to help you identify its owner or purpose. Both `ed25519` and RSA (Rivest-Shamir-Adleman) keys are supported. For a step-by-step walkthrough of generating a keypair, see Add an SSH key.\n\nTo add a key:\n\n1. Open the **SSH** tab for the host.\n2. Select **Add SSH key**.\n3. Paste the public key.\n4. Optionally enter a name or label for the key.\n5. Save your changes."} {"id":"platform/hosts/ssh.md#inherited-group-keys","url":"https://docs.turbostack.app/platform/hosts/ssh/#inherited-group-keys","path":"platform/hosts/ssh.md","title":"SSH access","heading":"Inherited group keys","keywords":"ssh ssh keys ssh access key authentication host ssh","text":"SSH keys can also be defined at the **group** level. When a host belongs to a group, it inherits the group's SSH keys in addition to any keys defined directly on the host. This lets you grant a set of keys access across many hosts at once. See Groups for how inheritance works."} {"id":"platform/hosts/ssh.md#ssh-port","url":"https://docs.turbostack.app/platform/hosts/ssh/#ssh-port","path":"platform/hosts/ssh.md","title":"SSH access","heading":"SSH port","keywords":"ssh ssh keys ssh access key authentication host ssh","text":"The `ssh_port` setting controls which port the SSH service listens on. Changing it from the default can reduce noise from automated scans.\n\n> [!WARNING]\n> If you change `ssh_port`, make sure your firewall rules allow the new port, otherwise you may lock yourself out. See Security to review firewall settings."} {"id":"platform/hosts/ssh.md#password-authentication","url":"https://docs.turbostack.app/platform/hosts/ssh/#password-authentication","path":"platform/hosts/ssh.md","title":"SSH access","heading":"Password authentication","keywords":"ssh ssh keys ssh access key authentication host ssh","text":"The `ssh_passwords` toggle controls whether password-based SSH login is allowed. When disabled, users can connect only with an SSH key.\n\n> [!TIP]\n> Use key-based authentication and disable password authentication. Keys are far harder to guess or brute-force than passwords, so turning off password login significantly improves the security of your host.\n\nBefore disabling password authentication, confirm that every user who needs access has a working SSH key configured so that no one is locked out."} {"id":"platform/hosts/ssh.md#related","url":"https://docs.turbostack.app/platform/hosts/ssh/#related","path":"platform/hosts/ssh.md","title":"SSH access","heading":"Related","keywords":"ssh ssh keys ssh access key authentication host ssh","text":"- TurboStack CLI - the `tscli` tool you run once connected over SSH\n- Security\n- Groups\n- Applications\n- Hosts overview"} {"id":"platform/hosts/threat-center.md#intro","url":"https://docs.turbostack.app/platform/hosts/threat-center/","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"# Threat Center\n\nThe **Threat Center** tab is the security inbox for a single host. It shows what TurboStack's\nsecurity scanning (TurboRadar) found on that server: known weaknesses in your software, confirmed\nmalware, and suspicious activity caught while the server is running.\n\nYou do not need to be a security specialist to use it. This page explains each finding type, what\nthe scores mean, and - most importantly - how to decide what to fix first and what to do about it.\n\n> [!IMPORTANT]\n> **Not every vulnerability is equally important - and most are not urgent.** A long list of CVEs is\n> normal; what matters is the handful that are both severe and likely to be attacked. Focus on\n> findings that combine a high CVSS (severe impact) with a high EPSS (likely to be exploited), plus\n> anything carrying an **Exploited (KEV)** or **Likely exploited** badge. The list\n> is already sorted by risk score, so these sit at the top - work down from there and do not get\n> distracted by the low-risk, low-EPSS findings near the bottom. See\n> How to decide what to fix first.\n\n\n\nThis tab covers:\n\n- How scanning works - where the findings come from\n- Reading the security scores - CVE, CVSS, EPSS, KEV and risk score\n- How to decide what to fix first - a simple priority guide\n- Vulnerabilities - known weaknesses in your software\n- Indicators of compromise - confirmed malware\n- Runtime detections - suspicious activity caught live\n- Status and actions - heartbeat, rescan, export and clear"} {"id":"platform/hosts/threat-center.md#how-scanning-works","url":"https://docs.turbostack.app/platform/hosts/threat-center/#how-scanning-works","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"How scanning works","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"TurboRadar is TurboStack's security scanning. It runs on the host and reports its findings back to\nthe platform, where they appear in this tab. It looks at three different things:\n\n- **Your software and its dependencies** - to find publicly known weaknesses (see\n Vulnerabilities).\n- **Your files** - to find malware such as web shells, backdoors and payment-page skimmers (see\n Indicators of compromise).\n- **The running system** - to catch suspicious behavior as it happens (see\n Runtime detections).\n\nScans run **automatically on a weekly schedule**. You can also start one yourself at any time with\n**Rescan now** - do this after you apply a fix, to confirm the finding is gone. The\nstatus header shows when the last scan ran and whether the host is currently\nreporting."} {"id":"platform/hosts/threat-center.md#reading-the-security-scores","url":"https://docs.turbostack.app/platform/hosts/threat-center/#reading-the-security-scores","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"Reading the security scores","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"A vulnerability finding can carry several scores. They answer different questions, and reading them\ntogether is what tells you how urgent a finding really is. Here is what each one means in plain\nlanguage."} {"id":"platform/hosts/threat-center.md#cve-the-identity-of-the-weakness","url":"https://docs.turbostack.app/platform/hosts/threat-center/#cve-the-identity-of-the-weakness","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"CVE - the identity of the weakness","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"A **Common Vulnerabilities and Exposures (CVE)** identifier is a public, unique name for one\nspecific security weakness in a piece of software, written as `CVE-2024-12345`. Anyone in the world\nrefers to that exact weakness by that ID, and the full description lives in a public database (the\nNational Vulnerability Database). In the Threat Center, the CVE links to that advisory.\n\nA CVE is only an **identifier** - it says *which* weakness was found, not how dangerous or likely it\nis. For that, read the scores below.\n\n> [!NOTE]\n> Some findings have no CVE (for example a malware signature). Those show a signature name instead of\n> a CVE."} {"id":"platform/hosts/threat-center.md#cvss-how-severe-it-is","url":"https://docs.turbostack.app/platform/hosts/threat-center/#cvss-how-severe-it-is","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"CVSS - how severe it is","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"The **Common Vulnerability Scoring System (CVSS)** is a severity score from **0.0 to 10.0**. It\nrates how much damage the weakness could cause *if* an attacker exploits it - the technical impact.\nHigher is worse.\n\n| CVSS score | Severity | Plain meaning |\n| --- | --- | --- |\n| 9.0 - 10.0 | Critical | Could fully compromise the server or data. |\n| 7.0 - 8.9 | High | Serious impact if exploited. |\n| 4.0 - 6.9 | Medium | Limited or harder-to-reach impact. |\n| 0.1 - 3.9 | Low | Minor impact. |\n\nCVSS describes the worst case, not the chance it will happen. A weakness can score 9.8 and still\nalmost never be attacked in practice. That is why you also need EPSS and KEV."} {"id":"platform/hosts/threat-center.md#epss-how-likely-it-is-to-be-attacked","url":"https://docs.turbostack.app/platform/hosts/threat-center/#epss-how-likely-it-is-to-be-attacked","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"EPSS - how likely it is to be attacked","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"The **Exploit Prediction Scoring System (EPSS)** is a percentage from **0% to 100%**. It estimates\nthe probability that this weakness will be **exploited by attackers in the next 30 days**, based on\nreal-world data. Higher means more likely.\n\n- A high EPSS (for example 80% or more) means attackers are actively targeting this weakness right\n now, or are very likely to soon.\n- A low EPSS means that, although the weakness exists, it is rarely attacked in practice.\n\nWhen a finding is not yet confirmed as actively exploited but its EPSS is **80% or higher**, the\nThreat Center shows a **Likely exploited** badge so you can spot it quickly.\n\n> [!TIP]\n> CVSS and EPSS answer different questions. CVSS = \"how bad if it happens\". EPSS = \"how likely it is\n> to happen\". A weakness that is both severe (high CVSS) and likely (high EPSS) is the most urgent."} {"id":"platform/hosts/threat-center.md#kev-confirmed-to-be-exploited-right-now","url":"https://docs.turbostack.app/platform/hosts/threat-center/#kev-confirmed-to-be-exploited-right-now","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"KEV - confirmed to be exploited right now","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"**Known Exploited Vulnerabilities (KEV)** is a public catalogue, maintained by the United States\ncybersecurity agency (CISA), of weaknesses that are **confirmed to be under active attack in the real\nworld**. This is the strongest possible signal: it is no longer a prediction.\n\nA finding on this list shows an **Exploited (KEV)** badge. Treat these as urgent regardless of their\nother scores."} {"id":"platform/hosts/threat-center.md#risk-score-the-single-number-that-ranks-everything","url":"https://docs.turbostack.app/platform/hosts/threat-center/#risk-score-the-single-number-that-ranks-everything","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"Risk score - the single number that ranks everything","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"Reading three scores for every finding is a lot of work. To save you that, TurboStack combines the\nsignals above - whether it is exploited (KEV), how likely it is (EPSS), and how severe it is (CVSS) -\ninto a single **risk score**, shown as a large number on the right of each finding. Higher means more\nurgent.\n\nThe vulnerabilities list is **sorted by risk score**, most urgent first, so the findings that need\nyour attention are always at the top. The coloured **severity** label (Critical, High, Medium, Low,\nInfo) is the priority band that the risk assessment puts the finding in; use the severity filter to\nfocus on a band."} {"id":"platform/hosts/threat-center.md#how-to-decide-what-to-fix-first","url":"https://docs.turbostack.app/platform/hosts/threat-center/#how-to-decide-what-to-fix-first","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"How to decide what to fix first","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"You rarely need to read every score. For each finding near the top of the list, ask three questions\nin order, and act on the first one that applies.\n\n| Look for | What it tells you | What to do |\n| --- | --- | --- |\n| **Exploited (KEV)** badge | Attackers are using this weakness right now. | Fix immediately. This is the top priority. |\n| **Likely exploited** badge, or EPSS 80%+ | A real attack is likely very soon. | Fix within days. |\n| **Critical / High** severity with a high risk score | Severe, and ranked near the top. | Schedule a fix promptly. |\n| **Medium / Low**, low EPSS, no badges | The weakness exists but is unlikely to be attacked. | Fix during your normal maintenance. |\n\n> [!TIP]\n> The short version: work from the top of the list down. The list is already ordered by risk, so the\n> first findings you see are the ones that matter most."} {"id":"platform/hosts/threat-center.md#fixing-a-vulnerability","url":"https://docs.turbostack.app/platform/hosts/threat-center/#fixing-a-vulnerability","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"Fixing a vulnerability","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"Most vulnerabilities are fixed by **updating the affected software to a version that is no longer\nvulnerable**. Each finding shows the **package** and its **installed version**, and - when a fix\nexists - the **Fixed in** version (in green).\n\n1. Note the **package** and the **Fixed in** version.\n2. Update that package to the **Fixed in** version (or newer). How you do this depends on the\n component - for example through your application's dependency manager, or by updating the platform,\n theme or extension that includes it.\n3. Publish the change if it is part of your host configuration.\n4. Run **Rescan now** to confirm the finding is gone.\n\nIf there is **no fix available yet**, reduce your exposure in the meantime: keep the\nWeb Application Firewall and\nTurboShield enabled, and restrict access to the affected area where you\ncan. Re-check after the next scan.\n\n> [!NOTE]\n> You can **dismiss** a finding you have reviewed and decided is not relevant to you (for example a\n> weakness in a feature you do not use). Dismiss it from its dismiss action. Dismissing only hides\n> it - it does not fix anything."} {"id":"platform/hosts/threat-center.md#understanding-false-positives-backported-patches","url":"https://docs.turbostack.app/platform/hosts/threat-center/#understanding-false-positives-backported-patches","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"Understanding false positives (backported patches)","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"Some findings - often around system packages such as OpenSSH - are **false positives**. Linux\ndistributions like Debian fix security issues by **backporting** the patch into the existing version\nwithout changing the version number. A scanner that only compares version numbers to a CVE database\nthen flags a package (for example `OpenSSH_8.0p1`) as vulnerable even though the specific CVE is\nalready fixed.\n\nTurboStack applies security updates automatically (once a day), so these packages\nare kept patched. To confirm a specific case over SSH:\n\n```bash\ndpkg -l | grep openssh # the installed package (and its patched build)\nssh -V # the running OpenSSH version\n```\n\nYou can then check whether the CVE is already patched in the distribution's security tracker. If it\nis, dismiss the finding; if you are unsure, contact support."} {"id":"platform/hosts/threat-center.md#vulnerabilities","url":"https://docs.turbostack.app/platform/hosts/threat-center/#vulnerabilities","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"Vulnerabilities","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"Known weaknesses found in your software and its dependencies. Filter by severity (Critical, High,\nMedium, Low, Info). Each finding shows:\n\n- The title and the **CVE** identifier, linked to the public advisory (or a signature name when\n there is no CVE).\n- The affected **package** or application type, and the **installed version**.\n- The **Fixed in** version, when a fix is available.\n- The scores and badges described above: **CVSS**, **EPSS**, **Exploited (KEV)** or **Likely\n exploited**, and the combined **risk score**.\n- When it was first and last detected, and which scanner found it.\n\nSee How to decide what to fix first for how to act on these."} {"id":"platform/hosts/threat-center.md#indicators-of-compromise","url":"https://docs.turbostack.app/platform/hosts/threat-center/#indicators-of-compromise","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"Indicators of compromise","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"An **Indicator of Compromise (IoC)** is evidence that your host has already been breached - most\noften a malicious file found on disk, such as a web shell, a backdoor, or a skimmer that steals\npayment details. These are not predictions: the malicious file is present. Every IoC is treated as\n**Critical**, and a red banner appears when any are found.\n\nEach entry shows the detection, the affected application type, the scanner, and the **file path** of\nthe suspicious file.\n\n> [!WARNING]\n> A confirmed malware finding needs immediate action. Suggested steps:\n> 1. Treat the site as compromised. Do not assume it is harmless.\n> 2. Remove the malicious file, or restore the site from a known-clean\n> backup taken before the infection.\n> 3. Change passwords and keys that the host can reach (database, application admin, API tokens).\n> 4. Find and close the entry point - usually an out-of-date application or a vulnerable extension\n> (see Vulnerabilities).\n> 5. Contact support if you need help with cleanup or investigation.\n\nAfter cleaning up, run **Rescan now** to confirm the file is gone."} {"id":"platform/hosts/threat-center.md#runtime-detections","url":"https://docs.turbostack.app/platform/hosts/threat-center/#runtime-detections","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"Runtime detections","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"Runtime detections are suspicious actions caught **while the server is running**, rather than found\nby scanning files. Examples are a web process starting a command shell, or a program running from a\ntemporary folder - patterns that often indicate an intrusion in progress.\n\nEach detection shows a severity (for example CRITICAL or WARNING), the rule that matched, the source\nor container it came from, a timestamp, and the command or file path involved.\n\nUnlike vulnerabilities, these are a live stream of events and can include occasional false alarms\n(for example a maintenance script doing something unusual). Review each one:\n\n- If you recognise it (for example it matches a deploy or a task you ran), it is expected.\n- If it is unexpected, treat it like a possible compromise and follow the steps under\n Indicators of compromise."} {"id":"platform/hosts/threat-center.md#status-and-actions","url":"https://docs.turbostack.app/platform/hosts/threat-center/#status-and-actions","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"Status and actions","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"The header shows the host's reporting status and the controls for the tab.\n\n- **TurboStack Heartbeat** - whether the host is currently sending data. A fresh heartbeat (within a\n few minutes) confirms the scanning is connected. \"No signal yet\" means the host has not reported\n recently; if it persists, contact support.\n- **Last scan** - when the most recent scan finished, or \"never\" if none has run yet.\n- A findings summary: total vulnerabilities (with the Critical count), indicators of compromise, and\n runtime events.\n\nAvailable actions:\n\n- **Rescan now** - start a fresh scan immediately. Progress is shown as each scanner finishes. Use\n this after applying a fix to confirm the finding is resolved.\n- **Export** - download the current list as a CSV (comma-separated values) file, for example to share\n with a developer or track in a spreadsheet.\n- **Clear all** - clear the findings in the current list (asks for confirmation). You can also\n dismiss findings one at a time.\n\n> [!TIP]\n> For how these protections work across the whole platform, see the\n> Security overview."} {"id":"platform/hosts/threat-center.md#related","url":"https://docs.turbostack.app/platform/hosts/threat-center/#related","path":"platform/hosts/threat-center.md","title":"Threat Center","heading":"Related","keywords":"threat center TurboRadar vulnerabilities CVE CVSS EPSS KEV risk score malware IoC security scan runtime detections","text":"- Security overview (how protection works)\n- Security (configuration)\n- Backups\n- Glossary\n- Hosts"} {"id":"platform/index.md#intro","url":"https://docs.turbostack.app/platform/","path":"platform/index.md","title":"TurboStack Platform","heading":"","keywords":"platform overview hosts groups templates monitoring","text":"# TurboStack Platform\n\nThe TurboStack Platform is where you manage your hosting infrastructure. The sidebar gives you\naccess to its main areas, described below. If you manage many hosts - for example across several\nclients - the Hosts, Groups and Templates areas let you operate them together rather than one by\none. You order servers, manage billing and open support tickets in the Customer Center."} {"id":"platform/index.md#ways-to-use-it","url":"https://docs.turbostack.app/platform/#ways-to-use-it","path":"platform/index.md","title":"TurboStack Platform","heading":"Ways to use it","keywords":"platform overview hosts groups templates monitoring","text":"You manage the TurboStack Platform in whichever way fits the task:\n\n- **GUI** - the guided web interface this section describes.\n- **Source (YAML)** - edit a host's configuration directly as YAML.\n- **REST API** - read and manage the same objects from your own tooling.\n\nThe GUI, Source (YAML) and API all change the same *intended* configuration, which TurboStack then\ndeploys. In addition, the **TurboStack CLI (`tscli`)** runs on the server itself to\nmanage live services and run common admin tasks - restarting services, clearing caches, the\nfirewall, email checks and log searches."} {"id":"platform/index.md#areas","url":"https://docs.turbostack.app/platform/#areas","path":"platform/index.md","title":"TurboStack Platform","heading":"Areas","keywords":"platform overview hosts groups templates monitoring","text":"| Area | What you do there |\n|---|---|\n| Hosts | Manage your servers and their full configuration (Health, Applications, Services, Security, Backups, and more). |\n| Groups | Apply shared settings (SSH keys, security) across many hosts at once. |\n| Templates | Reuse pre-built configurations to set up new hosts quickly. |\n| Search | Find hosts, groups and templates across the platform. |\n| Monitoring | See alerts and health across all your hosts. |\n\nOther entry points: **Support** (get help), **Platform updates**\n(release notes), and your account settings under\nProfile & preferences."} {"id":"platform/index.md#most-of-your-work-happens-in-hosts","url":"https://docs.turbostack.app/platform/#most-of-your-work-happens-in-hosts","path":"platform/index.md","title":"TurboStack Platform","heading":"Most of your work happens in Hosts","keywords":"platform overview hosts groups templates monitoring","text":"A **host** is one server and the configuration it should run. Opening a host gives you a\nworkspace organized into tabs - from live Health and\nThreat Center to Applications,\nServices, Security and\nBackups - plus publishing changes to the server.\nStart at Hosts."} {"id":"platform/index.md#next-steps","url":"https://docs.turbostack.app/platform/#next-steps","path":"platform/index.md","title":"TurboStack Platform","heading":"Next steps","keywords":"platform overview hosts groups templates monitoring","text":"- Hosts - manage your servers.\n- Core concepts - the underlying model.\n- Glossary - what the terms and abbreviations mean."} {"id":"platform/monitoring.md#intro","url":"https://docs.turbostack.app/platform/monitoring/","path":"platform/monitoring.md","title":"Monitoring","heading":"","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"# Monitoring\n\nThe **Monitoring** area gives you a fleet-wide view of alerts across all your hosts, so you can\nspot problems without opening each host individually. For teams running business-critical sites,\nthis helps you notice and react to problems quickly - for example during a busy campaign - before\nthey affect visitors."} {"id":"platform/monitoring.md#the-alerts-dashboard","url":"https://docs.turbostack.app/platform/monitoring/#the-alerts-dashboard","path":"platform/monitoring.md","title":"Monitoring","heading":"The alerts dashboard","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"Alerts are grouped by priority - from **P1** (most urgent) down to **P4** - and sorted so the most\ncritical issues are always at the top. They are split into four categories:\n\n- **Alerts** - the main server and application checks in a non-OK state.\n- **Mail Problems** - mail-specific issues, such as a growing mail queue or Sender Policy Framework (SPF) or Domain Name System (DNS) warnings.\n- **Security Issues** - hosts with security or system packages that still need updating (for example\n an `apt` check reporting critical updates to apply).\n- **Other** - lower-priority signals worth reviewing but not urgent.\n\nEach alert names the affected host and service (for example a disk, swap, certificate, or\ncache-hit-ratio check) with a short status message and how long it has been active. Selecting an\nalert row opens the alert detail page for that check. The host name in\nthe row is a separate link and opens the host instead. The dashboard refreshes as new alerts\narrive."} {"id":"platform/monitoring.md#the-alert-detail-page","url":"https://docs.turbostack.app/platform/monitoring/#the-alert-detail-page","path":"platform/monitoring.md","title":"Monitoring","heading":"The alert detail page","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"Selecting an alert opens a page for that one service check, at `/monitoring/!`. The\nheading shows the host name followed by the check name, and the host name links to the host. You\nalso reach this page from the CPU, RAM and Disk graphs on a host's Health tab,\nwhich open it in a new browser tab.\n\n\n\nThe page reads the current state from monitoring every time you open it. It has three panels and\none action:\n\n- Status - the current state and the check output\n- Graph - the measured values over time\n- Incident reports - reports written about this check\n- Create a ticket - hand the alert over to support\n\nSelect a panel header to collapse or expand it.\n\n> [!NOTE]\n> If the check no longer exists in monitoring, the page reports that it cannot be found. Go back\n> to the dashboard and pick a current alert."} {"id":"platform/monitoring.md#status","url":"https://docs.turbostack.app/platform/monitoring/#status","path":"platform/monitoring.md","title":"Monitoring","heading":"Status","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"A badge next to the panel title shows the current state: **OK**, **WARNING**, **CRITICAL** or\n**UNKNOWN**. The panel lists:\n\n| Field | What it tells you |\n| --- | --- |\n| **Since** | How long the check has been in this state, with the date and time it changed. |\n| **Groups** | The monitoring groups this check belongs to. |\n| **Plugin Output** | The message the check returned. It usually names the exact problem, for example a filesystem that is nearly full or a certificate that is about to expire. |\n\nEach field is shown only when there is a value for it."} {"id":"platform/monitoring.md#graph","url":"https://docs.turbostack.app/platform/monitoring/#graph","path":"platform/monitoring.md","title":"Monitoring","heading":"Graph","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"The **Graph** panel plots what the check measured. Use the **1H / 8H / 1D / 7D** buttons to change\nthe time range, from one hour to seven days. The panel is not shown for checks that record no\nmeasurements, such as a check that only reports a state.\n\n> [!TIP]\n> Compare the 1-hour and 7-day views before you act. A single short spike is usually harmless; a\n> line that climbs day after day needs attention."} {"id":"platform/monitoring.md#incident-reports","url":"https://docs.turbostack.app/platform/monitoring/#incident-reports","path":"platform/monitoring.md","title":"Monitoring","heading":"Incident reports","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"When incident reports exist for this host and check, they are listed here, with the number of\nreports next to the panel title. Each entry shows the report title, the alarm it relates to, and\nhow long ago it was written.\n\n- **Open report** shows the full report in a window on top of the page.\n- **PDF** opens the same report as a Portable Document Format (PDF) file in a new browser tab,\n where you can read or save it. The button appears only when a PDF version exists.\n\nThe report window has the same **PDF** button in its header. Select **Close** or the cross in the\nheader to return to the alert."} {"id":"platform/monitoring.md#create-a-ticket","url":"https://docs.turbostack.app/platform/monitoring/#create-a-ticket","path":"platform/monitoring.md","title":"Monitoring","heading":"Create a ticket","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"**Create ticket**, at the top right of the page, opens the Hosted Power ticket portal in a new\nbrowser tab. The subject is filled in with the host name and the check, so you do not have to\nretype it. Use it when an alert needs follow-up from the support team - see\nSupport."} {"id":"platform/monitoring.md#per-host-health","url":"https://docs.turbostack.app/platform/monitoring/#per-host-health","path":"platform/monitoring.md","title":"Monitoring","heading":"Per-host health","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"For the live health of a single host - top issues, CPU/memory/disk usage and individual service\nchecks - open that host's Health tab."} {"id":"platform/monitoring.md#understanding-the-metrics","url":"https://docs.turbostack.app/platform/monitoring/#understanding-the-metrics","path":"platform/monitoring.md","title":"Monitoring","heading":"Understanding the metrics","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"The per-host view (and the Health tab) report four core resource metrics:\n\n| Metric | What it means |\n|---|---|\n| **CPU usage** | How busy the processor is. Sustained high values mean the host is CPU-bound. |\n| **RAM usage** | Used memory. Consistently high RAM with rising swap points to memory pressure. |\n| **Memory swap** | Memory spilled to disk. Steady swap use hurts performance - a sign to investigate. |\n| **Disk usage** | How full each filesystem is. A full disk causes failures; act before it fills. |\n\nEach service the host runs (web server, databases, Redis, search, mail, certificates, and more) is also\nchecked individually and reports OK / Warning / Critical."} {"id":"platform/monitoring.md#alert-priorities","url":"https://docs.turbostack.app/platform/monitoring/#alert-priorities","path":"platform/monitoring.md","title":"Monitoring","heading":"Alert priorities","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"Alerts are grouped by priority so you can triage quickly:\n\n| Priority | Meaning |\n|---|---|\n| **P1** | Critical - something is down or broken and impacting the server. Needs immediate action. Max resolution time: **immediate**. |\n| **P2** | Very urgent - down, broken or degraded. Max resolution time: **1 hour**. |\n| **P3** | Urgent - a problem that could escalate if left unhandled. Max resolution time: **4 hours**. |\n| **P4** | Not urgent - worth reviewing for long-term stability. Max resolution time: **48 hours**. |\n\n> [!IMPORTANT]\n> Not every alert is equally urgent, and not all of them need action. Triage them in order:\n>\n> - **P1 and P2 first** - these affect, or are about to affect, your live sites. Act on them right away.\n> - **P3 next** - look at these when you have time; usually a trend to watch rather than an outage.\n> - **P4 is optional** - informational only, fine to review during normal maintenance.\n>\n> Working top-down (P1 first) keeps your attention on what actually impacts visitors.\n\nAlerts are also grouped by type, such as **Mail Problems** and **Other**. Hosted Power's team\nmonitors these alerts; follow up through Support for anything affecting your sites."} {"id":"platform/monitoring.md#how-monitoring-works","url":"https://docs.turbostack.app/platform/monitoring/#how-monitoring-works","path":"platform/monitoring.md","title":"Monitoring","heading":"How monitoring works","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"TurboStack monitors your infrastructure and applications, and can integrate application\nperformance monitoring. For the underlying tools and what each provides, see\nMonitoring (concepts)."} {"id":"platform/monitoring.md#related","url":"https://docs.turbostack.app/platform/monitoring/#related","path":"platform/monitoring.md","title":"Monitoring","heading":"Related","keywords":"monitoring alerts alert detail incident reports create ticket P1 P2 P3 health dashboard fleet alerts","text":"- Health (per host)\n- Monitoring concepts\n- Support\n- Hosts"} {"id":"platform/platform-updates.md#intro","url":"https://docs.turbostack.app/platform/platform-updates/","path":"platform/platform-updates.md","title":"Platform Updates","heading":"","keywords":"platform updates release notes changelog announcements","text":"# Platform Updates\n\nPlatform Updates is a date-ordered feed of release notes, new features and announcements about the TurboStack Platform. Check it to stay informed about changes that may affect how you work."} {"id":"platform/platform-updates.md#what-you-ll-find","url":"https://docs.turbostack.app/platform/platform-updates/#what-you-ll-find","path":"platform/platform-updates.md","title":"Platform Updates","heading":"What you'll find","keywords":"platform updates release notes changelog announcements","text":"Entries typically cover:\n\n- **New features** and improvements to the platform.\n- **Fixes** to existing behavior.\n- **Security notices** and recommended actions.\n- **Breaking changes** to be aware of.\n\n> [!IMPORTANT]\n> Some updates only take effect on your servers after a **full publish** of the host - an entry\n> says so when that applies. See Publishing changes."} {"id":"platform/platform-updates.md#viewing-updates","url":"https://docs.turbostack.app/platform/platform-updates/#viewing-updates","path":"platform/platform-updates.md","title":"Platform Updates","heading":"Viewing updates","keywords":"platform updates release notes changelog announcements","text":"Open the feed from the **Platform updates** link in the page footer (at `/platform-updates`). The newest entries appear first, so the most recent changes are always at the top.\n\n\n\n1. Go to `/platform-updates`.\n2. Browse the feed from newest to oldest.\n3. Open an entry to read its full details.\n\n> [!TIP]\n> Visit Platform Updates regularly so you do not miss new features or important announcements."} {"id":"platform/platform-updates.md#related","url":"https://docs.turbostack.app/platform/platform-updates/#related","path":"platform/platform-updates.md","title":"Platform Updates","heading":"Related","keywords":"platform updates release notes changelog announcements","text":"- Changelog - dated release notes in the documentation\n- Support\n- Introduction"} {"id":"platform/search.md#intro","url":"https://docs.turbostack.app/platform/search/","path":"platform/search.md","title":"Search","heading":"","keywords":"search global search find host find group find template","text":"# Search\n\nGlobal search lets you find matches across all of your hosts, groups and templates in a single place. Use it to jump directly to what you are looking for without browsing each list in turn."} {"id":"platform/search.md#using-global-search","url":"https://docs.turbostack.app/platform/search/#using-global-search","path":"platform/search.md","title":"Search","heading":"Using global search","keywords":"search global search find host find group find template","text":"Open global search at `/search`. As you type, results appear instantly and update with each keystroke, so you can refine your query until you find the right match.\n\n1. Go to `/search`.\n2. Start typing the name of a host, group or template.\n3. Review the matching results, which are grouped by type.\n4. Select a result to open it directly.\n\nWhen there are many matches, results are paginated. Use the pagination controls to move through additional pages."} {"id":"platform/search.md#global-search-versus-list-filters","url":"https://docs.turbostack.app/platform/search/#global-search-versus-list-filters","path":"platform/search.md","title":"Search","heading":"Global search versus list filters","keywords":"search global search find host find group find template","text":"Global search is different from the search boxes on the **Hosts**, **Groups** and **Templates** pages:\n\n- **Global search** (`/search`) looks across all hosts, groups and templates at once.\n- **List search boxes** filter only the list you are currently viewing. For example, the search box on the Hosts page filters that list of hosts only.\n\n> [!TIP]\n> Use a per-list search box when you are already on a page and want to narrow that list. Use global search when you are not sure where something lives or want to move quickly between different types of items."} {"id":"platform/search.md#common-tasks","url":"https://docs.turbostack.app/platform/search/#common-tasks","path":"platform/search.md","title":"Search","heading":"Common tasks","keywords":"search global search find host find group find template","text":"- **Jump to a host by name** when you know what you are looking for but not where it is.\n- **Find a group** to review or update its members.\n- **Locate a template** before applying it to a host."} {"id":"platform/search.md#related","url":"https://docs.turbostack.app/platform/search/#related","path":"platform/search.md","title":"Search","heading":"Related","keywords":"search global search find host find group find template","text":"- Managing Hosts\n- Groups\n- Templates\n- Navigating the Interface"} {"id":"platform/support.md#intro","url":"https://docs.turbostack.app/platform/support/","path":"platform/support.md","title":"Support","heading":"","keywords":"support contact help SLA service level agreement terms of service TOS general conditions contract report issue","text":"# Support\n\nThe Support page brings together the different ways to get help with TurboStack when you need more than the documentation can offer."} {"id":"platform/support.md#what-you-will-find","url":"https://docs.turbostack.app/platform/support/#what-you-will-find","path":"platform/support.md","title":"Support","heading":"What you will find","keywords":"support contact help SLA service level agreement terms of service TOS general conditions contract report issue","text":"On the Support page you can find:\n\n- **Contact details**, including phone and email, for reaching the support team.\n- **Links to documentation** for self-service help.\n- **Service Level Agreement (SLA) and service information** describing the support you can expect."} {"id":"platform/support.md#service-level-agreement-and-terms-of-service","url":"https://docs.turbostack.app/platform/support/#service-level-agreement-and-terms-of-service","path":"platform/support.md","title":"Support","heading":"Service Level Agreement and Terms of Service","keywords":"support contact help SLA service level agreement terms of service TOS general conditions contract report issue","text":"The Support page links to your SLA. Both documents are published on the Hosted Power website:\n\n| Document | Link |\n| --- | --- |\n| **Service Level Agreement (SLA)** - the service levels, response times and support commitments that apply to your environment. | https://www.hosted-power.com/en/service-level-agreement-legal |\n| **Terms of Service** - the general conditions of your contract with Hosted Power. | https://www.hosted-power.com/en/tos |\n\nThe published documents are the binding versions. For questions about which agreement applies to your\naccount, contact sales."} {"id":"platform/support.md#contact-the-service-desk","url":"https://docs.turbostack.app/platform/support/#contact-the-service-desk","path":"platform/support.md","title":"Support","heading":"Contact the service desk","keywords":"support contact help SLA service level agreement terms of service TOS general conditions contract report issue","text":"Reach the support team by email at support@hosted-power.com or by\nphone:\n\n| Region | Phone |\n| --- | --- |\n| Belgium | +32 53 599 000 |\n| Netherlands | 085 888 4 555 |\n| France | 04 83 97 97 97 |\n\nOffice hours are **Monday to Thursday, 08:45 - 17:30** and **Friday, 08:45 - 16:30**. Outside those\nhours, use the emergency service below."} {"id":"platform/support.md#round-the-clock-emergency-service","url":"https://docs.turbostack.app/platform/support/#round-the-clock-emergency-service","path":"platform/support.md","title":"Support","heading":"Round-the-clock emergency service","keywords":"support contact help SLA service level agreement terms of service TOS general conditions contract report issue","text":"When the service desk is closed, an emergency service runs around the clock for failures that cause\nthe **critical unavailability** of services Hosted Power is contracted to provide or support. Access\nto the emergency hotline is included when your **Service Level Agreement (SLA)** covers it; you can\nfind the number in your Hosted Power Customer Center. Report the issue by phone first, then send a\nconfirming email to support@hosted-power.com describing it (unless\nagreed otherwise).\n\nTurboStack also monitors your environments proactively, 24 hours a day, 7 days a week, so many\nproblems are caught before they affect your site. When a critical situation is detected, an on-call\nprocedure starts and an on-call engineer responds within the response time set by your SLA - for\nexample under 30 minutes on a Standard SLA, or under 15 minutes on a Platinum SLA.\nIf the issue is not resolved, it follows a fixed escalation path: from the operations engineer to the\ntechnical team lead, and, if needed, to the CEO. For **commercial** matters the escalation follows a\nseparate path, starting with your **account manager** and moving to the COO and, if needed, the CEO."} {"id":"platform/support.md#critical-and-non-critical-issues","url":"https://docs.turbostack.app/platform/support/#critical-and-non-critical-issues","path":"platform/support.md","title":"Support","heading":"Critical and non-critical issues","keywords":"support contact help SLA service level agreement terms of service TOS general conditions contract report issue","text":"When you report an issue, TurboStack decides whether it is a critical unavailability. This analysis\nhappens within the Service Level Agreement (SLA) response time and is done remotely, by phone,\nemail, or monitoring tools.\n\nA **critical** issue is anything that prevents the correct functioning of your server and needs\nimmediate attention. This covers defects in the data center infrastructure, the network, the\nhardware, and the server services that cause a proven unavailability of the services provided.\n\nA **non-critical** issue is any other question that does not cause unavailability. Examples include:\n\n- Questions about how to use the services.\n- Software support for applications TurboStack provides.\n- Configuration changes that are not needed to fix a critical problem.\n\nNon-critical issues are also analyzed within the SLA response time and handled remotely. You may be\nasked for more information, or to carry out simple checks or changes together with the support team."} {"id":"platform/support.md#when-to-use-support","url":"https://docs.turbostack.app/platform/support/#when-to-use-support","path":"platform/support.md","title":"Support","heading":"When to use Support","keywords":"support contact help SLA service level agreement terms of service TOS general conditions contract report issue","text":"Use the Support page when you need help beyond the documentation - technical and operational issues. You can also contact Support to enable platform features that Hosted Power provisions, such as Virtual Private Network (VPN) or high availability. For **commercial** questions - plans, pricing, upgrades or contracts - contact sales instead.\n\n> [!NOTE]\n> Some features, such as those described in Networking, are provisioned by Hosted Power. Contact Support through this page to request them."} {"id":"platform/support.md#before-you-contact-support","url":"https://docs.turbostack.app/platform/support/#before-you-contact-support","path":"platform/support.md","title":"Support","heading":"Before you contact support","keywords":"support contact help SLA service level agreement terms of service TOS general conditions contract report issue","text":"Many issues have a self-service fix - check these first:\n\n- The host's Health tab and the Monitoring dashboard.\n- Recent deployments in History, and the application's troubleshooting page\n under Applications.\n- The general Troubleshooting page."} {"id":"platform/support.md#what-to-include-in-a-request","url":"https://docs.turbostack.app/platform/support/#what-to-include-in-a-request","path":"platform/support.md","title":"Support","heading":"What to include in a request","keywords":"support contact help SLA service level agreement terms of service TOS general conditions contract report issue","text":"For a faster answer, include:\n\n- The **host name** and the **application/domain** affected.\n- **What you expected** versus **what happened**, and when it started.\n- Any **error message** or relevant **log output** (see the application's Troubleshooting page).\n- Whether a recent **publish/deploy** preceded the problem."} {"id":"platform/support.md#related","url":"https://docs.turbostack.app/platform/support/#related","path":"platform/support.md","title":"Support","heading":"Related","keywords":"support contact help SLA service level agreement terms of service TOS general conditions contract report issue","text":"- Troubleshooting\n- Networking\n- Platform Updates\n- Introduction"} {"id":"platform/templates.md#intro","url":"https://docs.turbostack.app/platform/templates/","path":"platform/templates.md","title":"Templates","heading":"","keywords":"templates host configuration reusable setup server provisioning","text":"# Templates\n\nTemplates are pre-built, reusable host configurations. Use them to standardize how new servers are set up, save time, and ensure consistency across your hosts. If you set up similar servers often, such as when onboarding a new project, save the configuration once as a template and reuse it."} {"id":"platform/templates.md#global-and-custom-templates","url":"https://docs.turbostack.app/platform/templates/#global-and-custom-templates","path":"platform/templates.md","title":"Templates","heading":"Global and custom templates","keywords":"templates host configuration reusable setup server provisioning","text":"TurboStack provides a set of global default templates to get you started. You can also create your own custom templates that capture the exact configuration your projects need."} {"id":"platform/templates.md#viewing-templates","url":"https://docs.turbostack.app/platform/templates/#viewing-templates","path":"platform/templates.md","title":"Templates","heading":"Viewing templates","keywords":"templates host configuration reusable setup server provisioning","text":"To see all available templates, open `/templates`. Select any template to open it at `/templates/{template}` and review or edit its configuration."} {"id":"platform/templates.md#creating-a-template","url":"https://docs.turbostack.app/platform/templates/#creating-a-template","path":"platform/templates.md","title":"Templates","heading":"Creating a template","keywords":"templates host configuration reusable setup server provisioning","text":"1. Go to `/templates`.\n2. Select `Create`.\n3. In the modal, enter a name for the template.\n4. Optionally add an `image` or `icon` to make the template easy to recognise.\n5. Confirm to create the template and open it for editing.\n\nCreating a template opens the YAML editor. Here you paste a generalized configuration of a server\nthat you want to reuse. This is useful when you regularly deploy servers with a similar setup, such\nas a fixed MySQL version or a common set of PHP packages.\n\nHere is an example template that sets up an Odoo application behind Nginx:\n\n```yaml\n---\nwebserver: nginx\n\npostgresql_version: 16\n\nos_extra_packages:\n- libxml2-dev\n- libxslt1-dev\n- libldap2-dev\n- libsasl2-dev\n\nsystem_users:\n- username: prod\n vhosts:\n - server_name: example.com www.example.com\n app_name: odoo\n app_type: odoo\n python_version: 3.10.17\n docker_enabled: true\n cert_type: selfsigned\n```\n\nSee The Source (YAML) view for how the YAML editor maps to the GUI\nconfiguration."} {"id":"platform/templates.md#editing-a-template","url":"https://docs.turbostack.app/platform/templates/#editing-a-template","path":"platform/templates.md","title":"Templates","heading":"Editing a template","keywords":"templates host configuration reusable setup server provisioning","text":"1. Open the template from `/templates`.\n2. Adjust the configuration to suit your needs.\n3. Save your changes.\n\n> [!TIP]\n> Keep a small number of well-maintained templates rather than many similar ones. This makes it easier to apply a consistent setup across every new host."} {"id":"platform/templates.md#applying-a-template-to-a-host","url":"https://docs.turbostack.app/platform/templates/#applying-a-template-to-a-host","path":"platform/templates.md","title":"Templates","heading":"Applying a template to a host","keywords":"templates host configuration reusable setup server provisioning","text":"You install a template's configuration onto a host to apply its settings. A host only accepts a\ntemplate while its configuration is still empty, because installing a template overrides any\nexisting settings. When a host's configuration is empty, TurboStack shows a banner above the\nconfiguration to tell you so."} {"id":"platform/templates.md#install-a-template-onto-a-host","url":"https://docs.turbostack.app/platform/templates/#install-a-template-onto-a-host","path":"platform/templates.md","title":"Templates","heading":"Install a template onto a host","keywords":"templates host configuration reusable setup server provisioning","text":"1. Open the host and confirm the empty-configuration banner is shown.\n2. In the left-hand menu, select `Templates`.\n3. On the template you want, select `Install`. This opens the template setup window.\n4. Choose the server you want to install the template to from the drop-down menu.\n5. Enter the `server name`, the URL you want your application to be reachable at.\n6. Fill in any remaining configuration options, then select `Install` to send the configuration to\n the server.\n7. Return to the host's page. The new application is added to the configuration.\n8. Select `Save & publish` to deploy the configuration to your server.\n\n\n\n> [!IMPORTANT]\n> Installing a template only fills in the configuration. Nothing is deployed until you select\n> `Save & publish`."} {"id":"platform/templates.md#pre-fill-a-host-from-a-template","url":"https://docs.turbostack.app/platform/templates/#pre-fill-a-host-from-a-template","path":"platform/templates.md","title":"Templates","heading":"Pre-fill a host from a template","keywords":"templates host configuration reusable setup server provisioning","text":"As an alternative to installing from the **Templates** page, you can pre-fill an empty host\nconfiguration with the `Copy` option:\n\n1. Open the host you want to configure.\n2. Select `Copy`.\n3. Choose `From template`.\n4. Select the template you want to use.\n\nThe host's configuration is filled in from the template, ready for you to review and adjust.\n\n> [!NOTE]\n> Both methods only work on hosts whose configuration has not yet been set. See\n> Managing hosts for more on the `Copy` options."} {"id":"platform/templates.md#common-use-cases","url":"https://docs.turbostack.app/platform/templates/#common-use-cases","path":"platform/templates.md","title":"Templates","heading":"Common use cases","keywords":"templates host configuration reusable setup server provisioning","text":"- Standardize the setup of every new server.\n- Save time by reusing a known-good configuration.\n- Ensure consistency across hosts that serve the same role."} {"id":"platform/templates.md#related","url":"https://docs.turbostack.app/platform/templates/#related","path":"platform/templates.md","title":"Templates","heading":"Related","keywords":"templates host configuration reusable setup server provisioning","text":"- Managing hosts\n- Groups"} {"id":"platform/troubleshooting.md#intro","url":"https://docs.turbostack.app/platform/troubleshooting/","path":"platform/troubleshooting.md","title":"Troubleshooting","heading":"","keywords":"troubleshooting common issues publish changes certificate credentials","text":"# Troubleshooting\n\nThis page covers common questions and how to resolve them. Each item includes a short answer and a link to the relevant documentation."} {"id":"platform/troubleshooting.md#my-changes-aren-t-visible-on-the-server","url":"https://docs.turbostack.app/platform/troubleshooting/#my-changes-aren-t-visible-on-the-server","path":"platform/troubleshooting.md","title":"Troubleshooting","heading":"My changes aren't visible on the server","keywords":"troubleshooting common issues publish changes certificate credentials","text":"Configuration changes are stored in TurboStack until you deploy them. You must **publish** your changes for the server to match your configuration. See Publishing changes."} {"id":"platform/troubleshooting.md#a-deployment-failed","url":"https://docs.turbostack.app/platform/troubleshooting/#a-deployment-failed","path":"platform/troubleshooting.md","title":"Troubleshooting","heading":"A deployment failed","keywords":"troubleshooting common issues publish changes certificate credentials","text":"Open the **Deploys** tab in the host's History to read the logs and find the cause. Fix the configuration, then publish again. See History."} {"id":"platform/troubleshooting.md#my-let-s-encrypt-certificate-isn-t-issuing","url":"https://docs.turbostack.app/platform/troubleshooting/#my-let-s-encrypt-certificate-isn-t-issuing","path":"platform/troubleshooting.md","title":"Troubleshooting","heading":"My Let's Encrypt certificate isn't issuing","keywords":"troubleshooting common issues publish changes certificate credentials","text":"For the `http` challenge, the domain must point to the server so the challenge can be completed. For wildcards or domains that do not yet point to the server, use the `dns` challenge instead. See Applications."} {"id":"platform/troubleshooting.md#where-do-i-find-server-database-credentials","url":"https://docs.turbostack.app/platform/troubleshooting/#where-do-i-find-server-database-credentials","path":"platform/troubleshooting.md","title":"Troubleshooting","heading":"Where do I find server/database credentials?","keywords":"troubleshooting common issues publish changes certificate credentials","text":"Server and database credentials are available on the **Credentials** tab. See Credentials."} {"id":"platform/troubleshooting.md#i-can-t-sign-in-two-factor-problems","url":"https://docs.turbostack.app/platform/troubleshooting/#i-can-t-sign-in-two-factor-problems","path":"platform/troubleshooting.md","title":"Troubleshooting","heading":"I can't sign in / two-factor problems","keywords":"troubleshooting common issues publish changes certificate credentials","text":"Review the Two-factor authentication guide. If you are locked out, contact support."} {"id":"platform/troubleshooting.md#i-need-more-help","url":"https://docs.turbostack.app/platform/troubleshooting/#i-need-more-help","path":"platform/troubleshooting.md","title":"Troubleshooting","heading":"I need more help","keywords":"troubleshooting common issues publish changes certificate credentials","text":"If your issue is not covered here, reach out for assistance. See Support.\n\n> [!TIP]\n> When reporting a problem to support, include the host name, the time of the issue, and any relevant deployment logs to speed up diagnosis."} {"id":"platform/troubleshooting.md#related","url":"https://docs.turbostack.app/platform/troubleshooting/#related","path":"platform/troubleshooting.md","title":"Troubleshooting","heading":"Related","keywords":"troubleshooting common issues publish changes certificate credentials","text":"- Publishing changes\n- History\n- Support\n- TurboStack CLI - reload services, clear caches and inspect the firewall over SSH"} {"id":"reference/yaml/applications.md#intro","url":"https://docs.turbostack.app/reference/yaml/applications/","path":"reference/yaml/applications.md","title":"Application parameters","heading":"","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"\n\n# Application parameters\n\nEvery key on this page is set per application, under `system_users[].vhosts[]`.\nA [!badge variant=\"success\" text=\"GUI\"] key has a field in the interface; a\n[!badge variant=\"warning\" text=\"YAML only\"] key is set in the\nSource (YAML) view, which accepts the same configuration."} {"id":"reference/yaml/applications.md#domain-and-application-type","url":"https://docs.turbostack.app/reference/yaml/applications/#domain-and-application-type","path":"reference/yaml/applications.md","title":"Application parameters","heading":"Domain and application type","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"Every application needs at least a domain and a certificate. The application type tells\nTurboStack which software to provision and configure.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com www.example.com\n app_type: wordpress # leave empty for a plain PHP site\n app_install: true # run the installer, not just prepare the config\n app_name: shop # only for a second app under the same user\n monitoring_url: /health # what uptime monitoring requests\n```"} {"id":"reference/yaml/applications.md#server-name","url":"https://docs.turbostack.app/reference/yaml/applications/#server-name","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`server_name`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"danger\" text=\"required\"]\n\nThe domain names this application answers on, separated by spaces. This is the application's address. Without it the application is not reachable.\n\n**Note:** required. Must be unique across the host."} {"id":"reference/yaml/applications.md#app-type","url":"https://docs.turbostack.app/reference/yaml/applications/#app-type","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`app_type`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nFor example `wordpress`, `magento2`, `shopware`, `laravel`, `odoo`, `generic` - the GUI dropdown lists the values available now.\n\nTells TurboStack which application to provision, so it applies the right web server rules, caching and file layout. Saves you from configuring the stack by hand for a known application.\n\n**Note:** leave it empty for a plain PHP site. The GUI dropdown lists the currently supported types."} {"id":"reference/yaml/applications.md#app-install","url":"https://docs.turbostack.app/reference/yaml/applications/#app-install","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`app_install`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"warning\" text=\"YAML only\"]\n\nDefault `false`.\n\nActually runs the installer for the chosen application type, instead of only preparing the configuration. Get a working installation without downloading and installing the software yourself."} {"id":"reference/yaml/applications.md#app-name","url":"https://docs.turbostack.app/reference/yaml/applications/#app-name","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`app_name`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nNames a secondary application under the same system user, in its own subfolder. Run several applications under one account, for example a shop and a separate blog.\n\n**Note:** lowercase letters and digits, starting with a letter, at most 33 characters. Only one application per user may leave this empty."} {"id":"reference/yaml/applications.md#monitoring-url","url":"https://docs.turbostack.app/reference/yaml/applications/#monitoring-url","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`monitoring_url`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nThe URL that uptime monitoring requests for this application. Point monitoring at a health-check endpoint instead of the homepage."} {"id":"reference/yaml/applications.md#certificates","url":"https://docs.turbostack.app/reference/yaml/applications/#certificates","path":"reference/yaml/applications.md","title":"Application parameters","heading":"Certificates","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"Every application gets HTTPS through a Transport Layer Security (TLS) certificate. The\ncertificate source is set per application. See\nTLS certificates for the full\nexplanation.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com www.example.com\n cert_type: letsencrypt # letsencrypt | selfsigned | custom\n cert_challenge: dns # http | dns (dns is needed for wildcards)\n cert_provider: cloudflare # hostedpower | cloudflare\n cert_cloudflare_api_token: \"cf_xxxxxxxxxxxx\"\n # For a certificate you bought instead of Let's Encrypt:\n # cert_type: custom\n # cert_fullchain: |\n # -----BEGIN CERTIFICATE-----\n # cert_pvk: |\n # -----BEGIN PRIVATE KEY-----\n```"} {"id":"reference/yaml/applications.md#cert-type","url":"https://docs.turbostack.app/reference/yaml/applications/#cert-type","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`cert_type`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"danger\" text=\"required\"]\n\nOne of `letsencrypt`, `selfsigned`, `custom`.\n\nSelects where the certificate comes from - issued automatically, self-signed, or supplied by you. Choose `letsencrypt` for free automatic HTTPS that renews itself, or `custom` for a certificate you bought.\n\n**Note:** required once `server_name` is set."} {"id":"reference/yaml/applications.md#cert-fullchain","url":"https://docs.turbostack.app/reference/yaml/applications/#cert-fullchain","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`cert_fullchain`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nThe certificate chain, in PEM format, for a certificate you supply yourself. Use a certificate from your own supplier, for example an extended-validation certificate.\n\n**Note:** only with `cert_type: custom`. Must match `cert_pvk`, which is verified before deployment."} {"id":"reference/yaml/applications.md#cert-pvk","url":"https://docs.turbostack.app/reference/yaml/applications/#cert-pvk","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`cert_pvk`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nThe private key, in PEM format, belonging to `cert_fullchain`. Required alongside your own certificate.\n\n**Note:** only with `cert_type: custom`.\n\n> [!WARNING]\n> A mismatch between key and certificate stops the deployment."} {"id":"reference/yaml/applications.md#cert-challenge","url":"https://docs.turbostack.app/reference/yaml/applications/#cert-challenge","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`cert_challenge`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"]\n\nOne of `http`, `dns`. Default `http`.\n\nHow ownership of the domain is proven when a certificate is issued. Domain Name System (DNS) validation is the only way to get a wildcard certificate, and it works before the domain points at the server."} {"id":"reference/yaml/applications.md#cert-provider","url":"https://docs.turbostack.app/reference/yaml/applications/#cert-provider","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`cert_provider`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"]\n\nOne of `hostedpower`, `cloudflare`.\n\nWhich DNS provider is used for DNS validation. Lets the platform create the validation record for you automatically.\n\n**Note:** only with `cert_challenge: dns`."} {"id":"reference/yaml/applications.md#cert-cloudflare-api-token","url":"https://docs.turbostack.app/reference/yaml/applications/#cert-cloudflare-api-token","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`cert_cloudflare_api_token`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nThe API token used to create the DNS validation record. Needed when your domain is managed at Cloudflare and you use DNS validation.\n\n**Note:** only with `cert_provider: cloudflare`."} {"id":"reference/yaml/applications.md#runtimes","url":"https://docs.turbostack.app/reference/yaml/applications/#runtimes","path":"reference/yaml/applications.md","title":"Application parameters","heading":"Runtimes","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"Each application picks its own runtime and version, so applications on one host can run\ndifferent versions side by side. Setting the version key is what enables that runtime -\nthere is no separate \"enable\" key.\n\nPrefer a version that is still supported. Older versions keep working if your application\nneeds them, but they may no longer receive security updates, so plan to upgrade one\napplication at a time. The GUI dropdown always lists the versions available now.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com\n php_version: \"8.4\" # one runtime per application\n # nodejs_version: \"24\" # Node.js app (usually with proxy_enabled)\n # python_version: \"3.13\" # Python app\n # ruby_version: \"3.4\" # Ruby app\n # ruby_start_cmd: bundle exec puma -C config/puma.rb\n # ruby_sidekiq: true\n # ruby_sidekiq_cmd: bundle exec sidekiq -q default\n # dotnet_version: \"10.0\" # .NET app\n docker_enabled: false # run a containerized app\n k8s_enabled: false # run Kubernetes workloads\n rabbitmq_enabled: false # give this app a message broker\n```"} {"id":"reference/yaml/applications.md#php-version","url":"https://docs.turbostack.app/reference/yaml/applications/#php-version","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`php_version`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nFor example `8.2`, `8.3`, `8.4` - the GUI dropdown lists the values available now.\n\nThe PHP version this application runs on, with its own process pool. Match the version your application supports, and upgrade one application at a time.\n\n**Note:** quote the value, for example `\"8.4\"`. The GUI dropdown lists the installed versions."} {"id":"reference/yaml/applications.md#nodejs-version","url":"https://docs.turbostack.app/reference/yaml/applications/#nodejs-version","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`nodejs_version`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nFor example `22`, `24` - the GUI dropdown lists the values available now.\n\nInstalls the given Node.js major version for this application. Run a Node.js application. Setting this key is what enables the runtime.\n\n**Note:** quote the value, for example `\"24\"`. Usually combined with `proxy_enabled`."} {"id":"reference/yaml/applications.md#python-version","url":"https://docs.turbostack.app/reference/yaml/applications/#python-version","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`python_version`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nFor example `3.12`, `3.13` - the GUI dropdown lists the values available now.\n\nInstalls the given Python version for this application. Run a Python application."} {"id":"reference/yaml/applications.md#ruby-version","url":"https://docs.turbostack.app/reference/yaml/applications/#ruby-version","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`ruby_version`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nFor example `3.3`, `3.4` - the GUI dropdown lists the values available now.\n\nInstalls the given Ruby version for this application. Run a Ruby application such as Rails."} {"id":"reference/yaml/applications.md#ruby-start-cmd","url":"https://docs.turbostack.app/reference/yaml/applications/#ruby-start-cmd","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`ruby_start_cmd`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: A standard Puma start command.\n\nThe command used to start the Ruby application server. Use a different application server than the default."} {"id":"reference/yaml/applications.md#ruby-sidekiq","url":"https://docs.turbostack.app/reference/yaml/applications/#ruby-sidekiq","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`ruby_sidekiq`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nRuns a Sidekiq background-worker service for this application. Process background jobs for a Ruby application."} {"id":"reference/yaml/applications.md#ruby-sidekiq-cmd","url":"https://docs.turbostack.app/reference/yaml/applications/#ruby-sidekiq-cmd","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`ruby_sidekiq_cmd`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nOverrides the command used to start Sidekiq. Pass your own queue or concurrency options."} {"id":"reference/yaml/applications.md#dotnet-version","url":"https://docs.turbostack.app/reference/yaml/applications/#dotnet-version","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`dotnet_version`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nFor example `8.0`, `10.0` - the GUI dropdown lists the values available now.\n\nInstalls the given .NET version and runs your application as a service behind the web server. Run a .NET application."} {"id":"reference/yaml/applications.md#docker-enabled","url":"https://docs.turbostack.app/reference/yaml/applications/#docker-enabled","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`docker_enabled`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `false`.\n\nAllows this application's system user to run containers. Run a containerized application, with the web server proxying to the container.\n\n**Note:** usually combined with `proxy_enabled` and `proxy_upstream_port`."} {"id":"reference/yaml/applications.md#k8s-enabled","url":"https://docs.turbostack.app/reference/yaml/applications/#k8s-enabled","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`k8s_enabled`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nInstalls a lightweight Kubernetes orchestrator on the host. Run container workloads that need orchestration."} {"id":"reference/yaml/applications.md#rabbitmq-enabled","url":"https://docs.turbostack.app/reference/yaml/applications/#rabbitmq-enabled","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`rabbitmq_enabled`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `false`.\n\nProvisions a message-broker account for this application, and installs the broker on the host if needed. Applications that process work in the background, such as OroCommerce, need a message broker."} {"id":"reference/yaml/applications.md#application-code-from-a-git-repository","url":"https://docs.turbostack.app/reference/yaml/applications/#application-code-from-a-git-repository","path":"reference/yaml/applications.md","title":"Application parameters","heading":"Application code from a Git repository","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"TurboStack can clone a Git repository for an application and update it on every publish, so\nthe code on the server always matches the branch or tag you chose. Add repositories in the\ninterface under **Configure application**, on the **GIT** tab.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com\n git:\n - repo: git@github.com:example/shop.git\n version: main # branch, tag or commit\n path: public_html # relative to the account's own folder\n```"} {"id":"reference/yaml/applications.md#git","url":"https://docs.turbostack.app/reference/yaml/applications/#git","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`git`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `empty`.\n\nThe repositories that are cloned and kept up to date for this application. Deploy from your own repository instead of copying files to the server by hand.\n\n**Note:** the clone runs as the account that owns the application, so the files get the right owner straight away."} {"id":"reference/yaml/applications.md#git-repo","url":"https://docs.turbostack.app/reference/yaml/applications/#git-repo","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`git.repo`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"danger\" text=\"required\"]\n\nThe address of the repository to clone, either an HTTPS or an SSH address. Tells the platform where your code lives.\n\n**Note:** required for every entry. An entry without it is skipped."} {"id":"reference/yaml/applications.md#git-version","url":"https://docs.turbostack.app/reference/yaml/applications/#git-version","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`git.version`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `main`.\n\nWhich branch, tag or commit is checked out. Follow a branch on a staging host, and pin a production host to a released tag."} {"id":"reference/yaml/applications.md#git-path","url":"https://docs.turbostack.app/reference/yaml/applications/#git-path","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`git.path`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault: The account's own folder.\n\nWhere the repository is placed, relative to the account's folder. Put the code straight into the folder the application is served from, for example `public_html`.\n\n**Note:** the path is read as relative to the account's folder, so a leading slash is ignored. Leave it empty to clone into the account's folder itself."} {"id":"reference/yaml/applications.md#caching-and-proxying","url":"https://docs.turbostack.app/reference/yaml/applications/#caching-and-proxying","path":"reference/yaml/applications.md","title":"Application parameters","heading":"Caching and proxying","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"Use these to put a cache in front of an application, or to publish an application that runs\nas its own process such as Node.js, Python or a container.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com\n varnish_enabled: true # full-page cache (PHP storefronts)\n # For a Node.js/Python/.NET/container app instead:\n # proxy_enabled: true\n # proxy_upstream_port: 3000 # local port your app listens on\n # proxy_upstream_host: 127.0.0.1\n```"} {"id":"reference/yaml/applications.md#varnish-enabled","url":"https://docs.turbostack.app/reference/yaml/applications/#varnish-enabled","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`varnish_enabled`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `false`.\n\nPuts this application behind the full-page cache. The single biggest speed win for PHP storefronts such as Magento and Shopware.\n\n**Note:** nothing at host level - turning this on is what installs Varnish on the host, and the platform picks the version. The host keys under Caching and queues only tune it. Do not use this for Node.js applications."} {"id":"reference/yaml/applications.md#proxy-enabled","url":"https://docs.turbostack.app/reference/yaml/applications/#proxy-enabled","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`proxy_enabled`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `false`.\n\nMakes the web server forward requests to an application running on a local port. The standard way to publish a Node.js, Python, .NET or containerized application."} {"id":"reference/yaml/applications.md#proxy-upstream-port","url":"https://docs.turbostack.app/reference/yaml/applications/#proxy-upstream-port","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`proxy_upstream_port`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"integer\"] [!badge variant=\"secondary\" text=\"port\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"danger\" text=\"required\"]\n\nDefault `3000`.\n\nThe local port your application listens on. Tells the web server where to send the requests.\n\n**Note:** required when `proxy_enabled` is true."} {"id":"reference/yaml/applications.md#proxy-upstream-host","url":"https://docs.turbostack.app/reference/yaml/applications/#proxy-upstream-host","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`proxy_upstream_host`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `127.0.0.1`.\n\nThe address the web server forwards to. Only change it when the application runs somewhere other than this server."} {"id":"reference/yaml/applications.md#php-tuning","url":"https://docs.turbostack.app/reference/yaml/applications/#php-tuning","path":"reference/yaml/applications.md","title":"Application parameters","heading":"PHP tuning","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"These override the automatically tuned PHP process pool for one application. The defaults\nsuit almost every site - change them only with measured evidence.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com\n php_version: \"8.4\"\n # Override the auto-tuned PHP-FPM pool only with evidence:\n php_fpm_pm_max_children: 40\n php_fpm_pm_start_servers: 8\n php_fpm_pm_min_spare_servers: 5\n php_fpm_pm_max_spare_servers: 12\n php_fpm_pm_max_requests: 500\n php_enhance: true # skip file-change checks (reload after deploy)\n php_opcache_preload_script: /var/www/prod/example.com/config/preload.php\n php_user_tmp_dir: true # dedicated temp folder for this app\n```"} {"id":"reference/yaml/applications.md#php-fpm-pm-max-children","url":"https://docs.turbostack.app/reference/yaml/applications/#php-fpm-pm-max-children","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`php_fpm_pm_max_children`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"integer\"] [!badge variant=\"secondary\" text=\"count\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Inherited from the host.\n\nThe maximum number of PHP processes this application may run at once. Raise it for a busy application, lower it to stop one application using all the memory.\n\n> [!WARNING]\n> Too high a value can exhaust server memory and take down every application on the host."} {"id":"reference/yaml/applications.md#php-fpm-pm-start-servers","url":"https://docs.turbostack.app/reference/yaml/applications/#php-fpm-pm-start-servers","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`php_fpm_pm_start_servers`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"integer\"] [!badge variant=\"secondary\" text=\"count\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Inherited from the host.\n\nHow many PHP processes are started immediately. Reduces warm-up delay after a restart on a busy application."} {"id":"reference/yaml/applications.md#php-fpm-pm-min-spare-servers","url":"https://docs.turbostack.app/reference/yaml/applications/#php-fpm-pm-min-spare-servers","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`php_fpm_pm_min_spare_servers`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"integer\"] [!badge variant=\"secondary\" text=\"count\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Inherited from the host.\n\nThe minimum number of idle PHP processes kept ready. Absorbs traffic spikes without waiting for new processes."} {"id":"reference/yaml/applications.md#php-fpm-pm-max-spare-servers","url":"https://docs.turbostack.app/reference/yaml/applications/#php-fpm-pm-max-spare-servers","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`php_fpm_pm_max_spare_servers`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"integer\"] [!badge variant=\"secondary\" text=\"count\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Inherited from the host.\n\nThe maximum number of idle PHP processes kept ready. Frees memory again after a spike."} {"id":"reference/yaml/applications.md#php-fpm-pm-max-requests","url":"https://docs.turbostack.app/reference/yaml/applications/#php-fpm-pm-max-requests","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`php_fpm_pm_max_requests`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"integer\"] [!badge variant=\"secondary\" text=\"count\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Inherited from the host.\n\nHow many requests a PHP process handles before it is recycled. Recycling limits the impact of memory leaks in application code."} {"id":"reference/yaml/applications.md#php-enhance","url":"https://docs.turbostack.app/reference/yaml/applications/#php-enhance","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`php_enhance`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nStops PHP from checking whether source files changed on disk. A real speed gain on production applications that are deployed, not edited live.\n\n> [!WARNING]\n> Code changes are ignored until PHP is reloaded. Never use it on a site you edit directly."} {"id":"reference/yaml/applications.md#php-opcache-preload-script","url":"https://docs.turbostack.app/reference/yaml/applications/#php-opcache-preload-script","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`php_opcache_preload_script`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nLoads your framework into memory once at startup, instead of on every request. A large speed gain for frameworks that support preloading, such as Symfony and Laravel.\n\n**Note:** only one application per PHP version may set this, and the file must exist. Otherwise the deployment fails."} {"id":"reference/yaml/applications.md#php-user-tmp-dir","url":"https://docs.turbostack.app/reference/yaml/applications/#php-user-tmp-dir","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`php_user_tmp_dir`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nGives this application its own temporary folder instead of the shared one. Keeps sessions and uploads separated between applications on the same host."} {"id":"reference/yaml/applications.md#performance-monitoring","url":"https://docs.turbostack.app/reference/yaml/applications/#performance-monitoring","path":"reference/yaml/applications.md","title":"Application parameters","heading":"Performance monitoring","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"Connect an external application-performance monitoring product to a single application.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com\n newrelic_appname: \"Example production\"\n newrelic_license: \"nr_xxxxxxxxxxxx\"\n # Tideways instead of, or next to, New Relic:\n tideways_apikey: \"tw_xxxxxxxxxxxx\"\n tideways_service: web\n tideways_sample_rate: 25\n```"} {"id":"reference/yaml/applications.md#newrelic-appname","url":"https://docs.turbostack.app/reference/yaml/applications/#newrelic-appname","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`newrelic_appname`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nThe name this application reports under in New Relic. Recognise the application in your monitoring dashboard."} {"id":"reference/yaml/applications.md#newrelic-license","url":"https://docs.turbostack.app/reference/yaml/applications/#newrelic-license","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`newrelic_license`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nThe licence key used to send performance data. Enables application performance monitoring for this application only."} {"id":"reference/yaml/applications.md#tideways-apikey","url":"https://docs.turbostack.app/reference/yaml/applications/#tideways-apikey","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`tideways_apikey`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nThe key used to send profiling data to Tideways. Find slow code paths in a PHP application."} {"id":"reference/yaml/applications.md#tideways-service","url":"https://docs.turbostack.app/reference/yaml/applications/#tideways-service","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`tideways_service`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nThe service name this application reports under. Separate several applications in the same Tideways account."} {"id":"reference/yaml/applications.md#tideways-sample-rate","url":"https://docs.turbostack.app/reference/yaml/applications/#tideways-sample-rate","path":"reference/yaml/applications.md","title":"Application parameters","heading":"`tideways_sample_rate`","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"[!badge variant=\"info\" text=\"integer\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nWhat percentage of requests is profiled. Lower it to reduce the overhead of profiling on a busy site."} {"id":"reference/yaml/applications.md#related","url":"https://docs.turbostack.app/reference/yaml/applications/#related","path":"reference/yaml/applications.md","title":"Application parameters","heading":"Related","keywords":"vhost parameters application yaml server_name app_type php_version cert_type git","text":"- YAML configuration reference\n- The Source (YAML) view\n- Publishing changes"} {"id":"reference/yaml/host-services.md#intro","url":"https://docs.turbostack.app/reference/yaml/host-services/","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"\n\n# Host service parameters\n\nEvery key on this page is set once per host, at the top of the configuration.\nA [!badge variant=\"success\" text=\"GUI\"] key has a field in the interface; a\n[!badge variant=\"warning\" text=\"YAML only\"] key is set in the\nSource (YAML) view, which accepts the same configuration."} {"id":"reference/yaml/host-services.md#web-server","url":"https://docs.turbostack.app/reference/yaml/host-services/#web-server","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"Web server","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"One web server runs per host and serves every application on it.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nwebserver: nginx # nginx | apache2\n# da_webserver: nginx_apache # DirectAdmin hosts only - the panel builds its own web server\n```"} {"id":"reference/yaml/host-services.md#webserver","url":"https://docs.turbostack.app/reference/yaml/host-services/#webserver","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`webserver`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"]\n\nOne of `nginx`, `apache2`. Default `nginx`.\n\nSelects the web server for this host. Nginx suits almost every workload. Choose Apache when an application needs `.htaccess` files or Apache modules."} {"id":"reference/yaml/host-services.md#da-webserver","url":"https://docs.turbostack.app/reference/yaml/host-services/#da-webserver","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`da_webserver`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nOne of `apache`, `nginx`, `nginx_apache`. Default: `nginx_apache` when TurboShield is on, otherwise `apache`.\n\nWhich web server the DirectAdmin control panel builds and runs. `nginx_apache` puts Nginx in front of Apache, which keeps `.htaccess` support while Nginx serves the traffic. A DirectAdmin host manages its own web server, so it needs a separate setting from `webserver`.\n\n**Note:** only on hosts that run the DirectAdmin control panel. Every other host chooses its web server with `webserver`."} {"id":"reference/yaml/host-services.md#databases","url":"https://docs.turbostack.app/reference/yaml/host-services/#databases","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"Databases","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"Enable the database your application needs and pick its version. You rarely need to set a\nmemory size. The platform sizes the database to the server's memory for you and re-tunes it\nevery time you publish, so the sizing grows automatically as the server grows. Only set a\nsize key when a measurement shows the automatic value is wrong for your workload.\n\nPrefer a version that is still supported. Older versions keep working, but may no longer\nreceive security updates. The GUI dropdown lists the versions available now.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\n# MySQL (Percona) - most PHP apps\nmysql_version: \"8.4\" # 5.7 | 8.0 | 8.4\nmysql_innodb_size: 8G # buffer pool, auto-tuned; override with evidence\nmysql_bindaddress: 127.0.0.1 # keep restricted to trusted networks\nmysql_server: true\n# mysql_timezone: Europe/Brussels # default DB time zone\n# Split app/database-server topology instead:\n# mysql_server_only: true\n# mysql_client_host_name: db1.example.com\n# mysql_client_host_ip: 10.0.0.5\n\n# PostgreSQL - Odoo, Medusa and others\npostgresql_version: \"17\"\npostgresql_shared_buffers: 8GB\npostgresql_extensions: [pg_stat_statements]\npostgresql_listen_addresses: localhost\npostgresql_extra_access:\n - {type: host, database: appdb, user: reporting, address: 10.0.0.0/24, auth_method: scram-sha-256}\n# postgresql_client_only: true\n# postgresql_client_host_name: db1.example.com\n# postgresql_client_host_ip: 10.0.0.5\n\n# MongoDB\nmongodb_version: \"8.0\" # 7.0 | 8.0\nmongodb_bindip: 127.0.0.1\n\n# Microsoft SQL Server - .NET apps\nmssql_version: \"2022\" # 2019 | 2022 | 2025 (depends on the server OS)\nmssql_edition: Developer # Developer | Enterprise | Express | Standard | Web\n```"} {"id":"reference/yaml/host-services.md#mysql-version","url":"https://docs.turbostack.app/reference/yaml/host-services/#mysql-version","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mysql_version`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"]\n\nOne of `5.7`, `8.0`, `8.4`.\n\nInstalls MySQL in the given version. Leave it out, or set `0`, to not install it. The database most PHP applications use, including WordPress, Magento and Shopware.\n\n> [!WARNING]\n> Changing the major version on a live host is a migration, not a setting. Plan and test it."} {"id":"reference/yaml/host-services.md#mysql-innodb-size","url":"https://docs.turbostack.app/reference/yaml/host-services/#mysql-innodb-size","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mysql_innodb_size`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"secondary\" text=\"size (MB/GB)\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Tuned to the server.\n\nHow much memory MySQL uses to cache data and indexes (the InnoDB buffer pool). The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows as the server grows. It is the most effective database performance setting, but only override the automatic value with measured evidence."} {"id":"reference/yaml/host-services.md#mysql-bindaddress","url":"https://docs.turbostack.app/reference/yaml/host-services/#mysql-bindaddress","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mysql_bindaddress`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Local only.\n\nWhich network addresses MySQL accepts connections on. Give an address, or the keyword `ANY` to listen on every interface. Needed when a separate application server must reach this database.\n\n**Note:** on a host that runs Kubernetes or Docker, MySQL listens on every interface unless you set this key yourself.\n\n> [!WARNING]\n> `ANY` puts the database on every interface, including any public one. Exposing a database to the public internet is a serious risk - give a specific private address and restrict access with the firewall."} {"id":"reference/yaml/host-services.md#mysql-server","url":"https://docs.turbostack.app/reference/yaml/host-services/#mysql-server","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mysql_server`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `true`.\n\nWhether the database server itself is installed. Set it to false on an application server that only needs the client tools."} {"id":"reference/yaml/host-services.md#mysql-server-only","url":"https://docs.turbostack.app/reference/yaml/host-services/#mysql-server-only","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mysql_server_only`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nInstalls only the database server, without the local application-side setup. For a dedicated database server that hosts no applications."} {"id":"reference/yaml/host-services.md#mysql-client-host-name","url":"https://docs.turbostack.app/reference/yaml/host-services/#mysql-client-host-name","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mysql_client_host_name`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nPoints this server's database client at a database on another server. Split application and database across two servers."} {"id":"reference/yaml/host-services.md#mysql-client-host-ip","url":"https://docs.turbostack.app/reference/yaml/host-services/#mysql-client-host-ip","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mysql_client_host_ip`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nThe address of that remote database server. Used together with `mysql_client_host_name`."} {"id":"reference/yaml/host-services.md#mysql-timezone","url":"https://docs.turbostack.app/reference/yaml/host-services/#mysql-timezone","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mysql_timezone`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: The server's time zone.\n\nSets the default time zone of the MySQL database server. Make database timestamps match the time zone your application expects, regardless of the server's own time zone."} {"id":"reference/yaml/host-services.md#postgresql-version","url":"https://docs.turbostack.app/reference/yaml/host-services/#postgresql-version","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`postgresql_version`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nFor example `16`, `17`, `18` - the GUI dropdown lists the values available now.\n\nInstalls PostgreSQL in the given version. The database used by Odoo and Medusa, and an option for several other applications.\n\n> [!WARNING]\n> Changing the major version on a live host is a migration. Plan and test it."} {"id":"reference/yaml/host-services.md#postgresql-shared-buffers","url":"https://docs.turbostack.app/reference/yaml/host-services/#postgresql-shared-buffers","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`postgresql_shared_buffers`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"secondary\" text=\"size (MB/GB)\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Tuned to the server.\n\nHow much memory PostgreSQL uses for caching (shared buffers). The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. It is the main PostgreSQL performance setting, but only override the automatic value with measured evidence."} {"id":"reference/yaml/host-services.md#postgresql-extensions","url":"https://docs.turbostack.app/reference/yaml/host-services/#postgresql-extensions","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`postgresql_extensions`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nOne of `vector`, `postgis`, `timescaledb`, `pg_stat_statements`. Default `empty`.\n\nEnables extra PostgreSQL extensions. Adds capabilities such as geographic data or vector search.\n\n**Note:** only these four names are accepted. Any other value stops the deployment with an error."} {"id":"reference/yaml/host-services.md#postgresql-listen-addresses","url":"https://docs.turbostack.app/reference/yaml/host-services/#postgresql-listen-addresses","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`postgresql_listen_addresses`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Local only.\n\nWhich addresses PostgreSQL accepts connections on. Give an address, or the keyword `ANY` to listen on every interface. Needed for a separate application server.\n\n**Note:** on a host that runs Kubernetes or Docker, PostgreSQL listens on every interface unless you set this key yourself.\n\n> [!WARNING]\n> `ANY` puts the database on every interface, including any public one. Give a specific private address and restrict access with the firewall."} {"id":"reference/yaml/host-services.md#postgresql-extra-access","url":"https://docs.turbostack.app/reference/yaml/host-services/#postgresql-extra-access","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`postgresql_extra_access`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `empty`.\n\nExtra access rules stating which user may reach which database from which address. Grant a specific external system access without opening the database entirely."} {"id":"reference/yaml/host-services.md#postgresql-client-only","url":"https://docs.turbostack.app/reference/yaml/host-services/#postgresql-client-only","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`postgresql_client_only`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nInstalls only the client tools, not the server. For an application server that connects to a database elsewhere."} {"id":"reference/yaml/host-services.md#postgresql-client-host-name","url":"https://docs.turbostack.app/reference/yaml/host-services/#postgresql-client-host-name","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`postgresql_client_host_name`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nPoints this server's database client at a PostgreSQL database on another server. Split application and database across two servers.\n\n**Note:** used with `postgresql_client_only` and `postgresql_client_host_ip`."} {"id":"reference/yaml/host-services.md#postgresql-client-host-ip","url":"https://docs.turbostack.app/reference/yaml/host-services/#postgresql-client-host-ip","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`postgresql_client_host_ip`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nThe address of that remote PostgreSQL server. Used together with `postgresql_client_host_name`."} {"id":"reference/yaml/host-services.md#mongodb-version","url":"https://docs.turbostack.app/reference/yaml/host-services/#mongodb-version","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mongodb_version`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nOne of `7.0`, `8.0`.\n\nInstalls MongoDB in the given version. For applications that store documents rather than tables."} {"id":"reference/yaml/host-services.md#mongodb-bindip","url":"https://docs.turbostack.app/reference/yaml/host-services/#mongodb-bindip","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mongodb_bindip`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Local only.\n\nWhich addresses MongoDB accepts connections on. Give a comma-separated list of addresses, or the keyword `ANY` to listen on every interface. Needed for a separate application server.\n\n**Note:** on a host that runs Kubernetes or Docker, MongoDB listens on every interface. Unlike the other databases it does so even when this key is set to `127.0.0.1`, so give a specific private address if you need to keep it narrow.\n\n> [!WARNING]\n> `ANY` puts the database on every interface, including any public one. Give specific private addresses and restrict access with the firewall."} {"id":"reference/yaml/host-services.md#mssql-version","url":"https://docs.turbostack.app/reference/yaml/host-services/#mssql-version","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mssql_version`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nOne of `2019`, `2022`, `2025`.\n\nInstalls Microsoft SQL Server. Required by .NET applications such as nopCommerce.\n\n**Note:** which versions are available depends on the server operating system."} {"id":"reference/yaml/host-services.md#mssql-edition","url":"https://docs.turbostack.app/reference/yaml/host-services/#mssql-edition","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mssql_edition`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nOne of `Developer`, `Enterprise`, `Express`, `Standard`, `Web`.\n\nWhich SQL Server edition is installed. Editions differ in features and licensing. The GUI dropdown lists the available ones."} {"id":"reference/yaml/host-services.md#caching-and-queues","url":"https://docs.turbostack.app/reference/yaml/host-services/#caching-and-queues","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"Caching and queues","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"Caching keeps your application fast, and a message broker lets it process work in the\nbackground. As with the databases, the cache sizes (`redis_memory`, `varnish_cache_size`)\nare set to the server's memory automatically and re-tuned on every publish, so they grow\nwith the server. Only override a size when a measurement shows you need to.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nredis_enabled: true\nredis_memory: 2gb # cache instance maxmemory\n# redis_persistent_memory: 1gb # persistent (on-disk) instance maxmemory\nredis_listen_addresses: localhost\n# Varnish is installed by turning on varnish_enabled for an application - there is no host\n# key to install it, and the platform chooses the version itself. These only tune it:\nvarnish_cache_size: 512m\nvarnish_type: opensource # opensource | enterprise\n# varnish_customvcl: | # advanced: your own cache rules\n# sub vcl_recv { }\n# varnish_modules: false # advanced: leave out the extra module set (vmods)\n# varnish_backend_host: origin.example.com # advanced: custom origin\n# varnish_backend_port: 8080\nrabbitmq_version: latest # latest | a series such as 4.0.x\nrabbitmq_plugins: [rabbitmq_shovel, rabbitmq_shovel_management]\n```"} {"id":"reference/yaml/host-services.md#redis-enabled","url":"https://docs.turbostack.app/reference/yaml/host-services/#redis-enabled","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`redis_enabled`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `true`.\n\nInstalls Redis, used for sessions and object caching. Recommended for almost every application, which is why it is on by default."} {"id":"reference/yaml/host-services.md#redis-memory","url":"https://docs.turbostack.app/reference/yaml/host-services/#redis-memory","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`redis_memory`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"secondary\" text=\"size (MB/GB)\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Tuned to the server.\n\nHow much memory the cache instance may use. Rarely needs changing. The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. The automatic value accounts for disk use as well as memory.\n\n> [!WARNING]\n> Raising it also increases disk use. Override the automatic value only after measuring."} {"id":"reference/yaml/host-services.md#redis-persistent-memory","url":"https://docs.turbostack.app/reference/yaml/host-services/#redis-persistent-memory","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`redis_persistent_memory`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"secondary\" text=\"size (MB/GB)\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Tuned to the server.\n\nHow much memory the persistent Redis instance may use - the instance that keeps its data on disk. The platform sizes this to the server's memory automatically and re-tunes it on every publish. Override only after measuring, for workloads that persist a lot of cache or session data.\n\n> [!WARNING]\n> Raising it also increases disk use."} {"id":"reference/yaml/host-services.md#redis-listen-addresses","url":"https://docs.turbostack.app/reference/yaml/host-services/#redis-listen-addresses","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`redis_listen_addresses`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nOnly `internal`. Default: Local only.\n\nWhich addresses Redis accepts connections on. Leave it unset to stay on localhost; `internal` also binds the host's private network addresses. Needed when another server must reach the cache.\n\n**Note:** `internal` is the only accepted value. Anything else, including `any`, stops the deployment with an error. On a host that runs Kubernetes or Docker, Redis uses `internal` unless you set this key yourself.\n\n> [!WARNING]\n> Keep it restricted to trusted networks. Setting `internal` turns off the Redis protected mode, and so does running Kubernetes or Docker on the host."} {"id":"reference/yaml/host-services.md#varnish-version","url":"https://docs.turbostack.app/reference/yaml/host-services/#varnish-version","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`varnish_version`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nFor example `7.6`, `8.0` - the GUI dropdown lists the values available now. Default: Chosen by the platform.\n\nPins the version of the full-page cache. You almost never set this. Nothing has to be set at host level to run Varnish. Turning on `varnish_enabled` for any application installs it, and the platform picks the version itself: 8.0, or 7.6 on Debian 11 and older, or 6.0 for the Enterprise edition. Setting this key by hand only does anything on a host where no application has `varnish_enabled` at all. That installs the cache before anything uses it.\n\n> [!WARNING]\n> As soon as one application on the host has `varnish_enabled`, the platform's own choice replaces whatever you put here, and it does not warn you that it did."} {"id":"reference/yaml/host-services.md#varnish-cache-size","url":"https://docs.turbostack.app/reference/yaml/host-services/#varnish-cache-size","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`varnish_cache_size`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"secondary\" text=\"size (MB/GB)\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Tuned to the server.\n\nHow much memory the full-page cache may use. The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. A larger cache holds more pages, but takes memory from the applications, so only override the automatic value after measuring."} {"id":"reference/yaml/host-services.md#varnish-type","url":"https://docs.turbostack.app/reference/yaml/host-services/#varnish-type","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`varnish_type`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nOne of `opensource`, `enterprise`. Default `opensource`.\n\nWhich edition of the cache is installed. The commercial edition adds features that need a licence.\n\n**Note:** `enterprise` only works when Hosted Power has put a licence in place for this host. Without it the deployment stops with an error, so leave it on `opensource` unless the licence has been arranged."} {"id":"reference/yaml/host-services.md#varnish-customvcl","url":"https://docs.turbostack.app/reference/yaml/host-services/#varnish-customvcl","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`varnish_customvcl`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nReplaces the generated cache rules with your own. For caching behavior the standard configuration cannot express.\n\n> [!WARNING]\n> Custom cache rules are easy to get wrong and can serve the wrong content to visitors."} {"id":"reference/yaml/host-services.md#varnish-modules","url":"https://docs.turbostack.app/reference/yaml/host-services/#varnish-modules","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`varnish_modules`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `true`.\n\nInstalls the extra Varnish module set (vmods) alongside the cache. Custom VCL often calls functions that only exist in these modules.\n\n**Note:** open-source Varnish only. The Enterprise edition ships its own modules and ignores this key."} {"id":"reference/yaml/host-services.md#varnish-backend-host","url":"https://docs.turbostack.app/reference/yaml/host-services/#varnish-backend-host","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`varnish_backend_host`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: The local application.\n\nPoints the cache at a custom backend host instead of the local application. Put the full-page cache in front of an origin that runs on another server.\n\n**Note:** set together with `varnish_backend_port`; the custom backend is only used when both are set."} {"id":"reference/yaml/host-services.md#varnish-backend-port","url":"https://docs.turbostack.app/reference/yaml/host-services/#varnish-backend-port","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`varnish_backend_port`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"integer\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nThe port of the custom cache backend host. Used together with `varnish_backend_host`."} {"id":"reference/yaml/host-services.md#rabbitmq-version","url":"https://docs.turbostack.app/reference/yaml/host-services/#rabbitmq-version","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`rabbitmq_version`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nFor example `latest`, `4.0.x` - the GUI dropdown lists the values available now. Default `latest`.\n\nPins the message broker to a specific version. Match a version your application is tested against."} {"id":"reference/yaml/host-services.md#rabbitmq-plugins","url":"https://docs.turbostack.app/reference/yaml/host-services/#rabbitmq-plugins","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`rabbitmq_plugins`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `empty`.\n\nEnables extra broker plugins. Adds protocols or management features your application needs."} {"id":"reference/yaml/host-services.md#search","url":"https://docs.turbostack.app/reference/yaml/host-services/#search","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"Search","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"A search engine powers product and content search. Magento requires one; most other\napplications do not need it. The heap size is set to the server's memory automatically and\nre-tuned on every publish, so it grows with the server. Only set a heap key when a\nmeasurement shows you need to.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\n# Use either Elasticsearch or OpenSearch on a host, not both.\nelasticsearch_version: \"8.x\" # required by Magento 2\nelasticsearch_heap_size: 2g\nelasticsearch_plugins: [analysis-icu]\n# elasticsearch_kibana: true # Kibana web interface\n# elasticsearch_network_host: INTERNAL # private network only, never public\n# opensearch_version: \"2.x\"\n# opensearch_heap_size: 2g\n# opensearch_plugins: [analysis-icu]\n# opensearch_dashboards: true\n# opensearch_dashboards_usermanagement: true # login for the dashboards\n```"} {"id":"reference/yaml/host-services.md#elasticsearch-version","url":"https://docs.turbostack.app/reference/yaml/host-services/#elasticsearch-version","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`elasticsearch_version`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nFor example `8.x`, `9.x` - the GUI dropdown lists the values available now.\n\nInstalls Elasticsearch in the given version. Required by Magento 2 and used by Akeneo for catalog search.\n\n**Note:** the value is a release channel such as `8.x`, not an exact version. To not install it, omit the key or set an empty string `\"\"` - never the integer `0`, which fails the deployment.\n\n> [!WARNING]\n> Changing the major version usually means rebuilding your indexes."} {"id":"reference/yaml/host-services.md#elasticsearch-heap-size","url":"https://docs.turbostack.app/reference/yaml/host-services/#elasticsearch-heap-size","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`elasticsearch_heap_size`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"secondary\" text=\"size (MB/GB)\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Tuned to the server.\n\nHow much memory the search engine may use (the JVM heap). The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. Too little makes search slow; too much starves the rest of the server, so only override the automatic value after measuring."} {"id":"reference/yaml/host-services.md#elasticsearch-plugins","url":"https://docs.turbostack.app/reference/yaml/host-services/#elasticsearch-plugins","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`elasticsearch_plugins`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `empty`.\n\nInstalls extra search plugins. Adds language-specific analysis for better search results."} {"id":"reference/yaml/host-services.md#elasticsearch-kibana","url":"https://docs.turbostack.app/reference/yaml/host-services/#elasticsearch-kibana","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`elasticsearch_kibana`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nInstalls the Kibana web interface for Elasticsearch, reachable at `https:///kibana`. Inspect indexes and run queries in a browser.\n\n**Note:** an `elasticsearch_version` must be set. The web server proxies the path and asks for a login first - use one of the host's system user accounts."} {"id":"reference/yaml/host-services.md#elasticsearch-network-host","url":"https://docs.turbostack.app/reference/yaml/host-services/#elasticsearch-network-host","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`elasticsearch_network_host`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `localhost`.\n\nWhich address Elasticsearch listens on - `localhost`, `INTERNAL` for private-network addresses, or a specific address. Reach the search engine from another server on a private network.\n\n**Note:** `INTERNAL` resolves to the loopback addresses plus the host's private IPv4 addresses - the same keyword `redis_listen_addresses` uses.\n\n> [!WARNING]\n> Never bind it to a public address."} {"id":"reference/yaml/host-services.md#opensearch-version","url":"https://docs.turbostack.app/reference/yaml/host-services/#opensearch-version","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`opensearch_version`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nFor example `2.x`, `3.x` - the GUI dropdown lists the values available now.\n\nInstalls OpenSearch in the given version. An alternative search engine, used by Shopware among others.\n\n**Note:** use either Elasticsearch or OpenSearch on a host, not both. The value is a release channel such as `2.x`; to not install it, omit the key or set an empty string `\"\"`, never the integer `0`."} {"id":"reference/yaml/host-services.md#opensearch-heap-size","url":"https://docs.turbostack.app/reference/yaml/host-services/#opensearch-heap-size","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`opensearch_heap_size`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"secondary\" text=\"size (MB/GB)\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Tuned to the server.\n\nHow much memory OpenSearch may use (the JVM heap). Set to the server's memory automatically and re-tuned on every publish, so it grows with the server. Same trade-off as the Elasticsearch heap - only override the automatic value after measuring."} {"id":"reference/yaml/host-services.md#opensearch-plugins","url":"https://docs.turbostack.app/reference/yaml/host-services/#opensearch-plugins","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`opensearch_plugins`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `empty`.\n\nInstalls extra OpenSearch plugins. Adds language-specific analysis."} {"id":"reference/yaml/host-services.md#opensearch-dashboards","url":"https://docs.turbostack.app/reference/yaml/host-services/#opensearch-dashboards","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`opensearch_dashboards`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nInstalls the OpenSearch web interface, reachable at `https:///dashboards`. Inspect indexes and run queries in a browser.\n\n**Note:** the web server proxies the path and asks for a login first - use one of the host's system user accounts."} {"id":"reference/yaml/host-services.md#opensearch-dashboards-usermanagement","url":"https://docs.turbostack.app/reference/yaml/host-services/#opensearch-dashboards-usermanagement","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`opensearch_dashboards_usermanagement`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nTurns on login and user management for the OpenSearch dashboards. Protect the dashboards with authentication and user accounts.\n\n**Note:** `opensearch_dashboards` must be enabled."} {"id":"reference/yaml/host-services.md#host-wide-runtime-and-packages","url":"https://docs.turbostack.app/reference/yaml/host-services/#host-wide-runtime-and-packages","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"Host-wide runtime and packages","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"Settings that apply to the whole server rather than to one application.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nphp_main_version: \"8.4\" # PHP used on the command line\n# php_versions: [\"8.3\", \"8.4\"] # install extra PHP versions side by side\n# php_ioncube_enabled: true # ionCube loader for encoded/licensed apps\ncomposer_version: lts # latest | lts | 2 | 2.2\n# composer_keep_updated: true # auto-update the Composer binary\nos_extra_packages: [imagemagick, jq]\nsystem_packages_upgrade_time: \"03:30\"\nmaintenance: # window for updates that need a reboot\n - day: 4 # 1 = Sunday ... 7 = Saturday\n hour: 22 # 0-23\nsupervisor_enabled: false\n```"} {"id":"reference/yaml/host-services.md#php-versions","url":"https://docs.turbostack.app/reference/yaml/host-services/#php-versions","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`php_versions`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"warning\" text=\"YAML only\"]\n\nFor example `['8.3', '8.4']` - the GUI dropdown lists the values available now. Default: The versions your applications use.\n\nWhich PHP versions are installed and available on the server. Run applications that need different PHP versions side by side. Normally derived from your applications; set it to install an extra version explicitly."} {"id":"reference/yaml/host-services.md#php-ioncube-enabled","url":"https://docs.turbostack.app/reference/yaml/host-services/#php-ioncube-enabled","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`php_ioncube_enabled`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nInstalls the ionCube loader for PHP. Required to run commercial PHP software distributed as encrypted, licensed code."} {"id":"reference/yaml/host-services.md#php-main-version","url":"https://docs.turbostack.app/reference/yaml/host-services/#php-main-version","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`php_main_version`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nFor example `8.2`, `8.3`, `8.4` - the GUI dropdown lists the values available now. Default: The lowest version any application uses.\n\nWhich PHP version is used on the command line. Matters when you run scripts over SSH and several PHP versions are installed."} {"id":"reference/yaml/host-services.md#composer-keep-updated","url":"https://docs.turbostack.app/reference/yaml/host-services/#composer-keep-updated","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`composer_keep_updated`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `true`.\n\nKeeps the Composer binary automatically updated. Always run a current Composer without updating it by hand."} {"id":"reference/yaml/host-services.md#composer-version","url":"https://docs.turbostack.app/reference/yaml/host-services/#composer-version","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`composer_version`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"]\n\nOne of `latest`, `lts`, `2`, `2.2`. Default `lts`.\n\nWhich Composer version is installed. Some applications need a specific Composer version to install correctly."} {"id":"reference/yaml/host-services.md#os-extra-packages","url":"https://docs.turbostack.app/reference/yaml/host-services/#os-extra-packages","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`os_extra_packages`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `empty`.\n\nInstalls extra operating-system packages. Add a tool or library your application needs, without root access."} {"id":"reference/yaml/host-services.md#system-packages-upgrade-time","url":"https://docs.turbostack.app/reference/yaml/host-services/#system-packages-upgrade-time","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`system_packages_upgrade_time`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nWhen automatic package updates are installed. These are routine updates that do not need a reboot. Move updates to a quiet moment for your business."} {"id":"reference/yaml/host-services.md#maintenance","url":"https://docs.turbostack.app/reference/yaml/host-services/#maintenance","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`maintenance`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault: a weekly window managed by the platform.\n\nSets the weekly window when the platform applies updates that need a reboot. Pick a low-traffic moment so a reboot does not interrupt visitors during your busy hours.\n\n**Note:** each entry has a day (1 = Sunday through 7 = Saturday) and an hour (0-23). Set it from the Advanced tab, which offers day and hour dropdowns."} {"id":"reference/yaml/host-services.md#supervisor-enabled","url":"https://docs.turbostack.app/reference/yaml/host-services/#supervisor-enabled","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`supervisor_enabled`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nInstalls a process manager for long-running background processes. An alternative to user system services for keeping workers running."} {"id":"reference/yaml/host-services.md#mail","url":"https://docs.turbostack.app/reference/yaml/host-services/#mail","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"Mail","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"TurboStack signs outgoing mail with DomainKeys Identified Mail (DKIM), so a receiving server\ncan check that a message really came from your domain. A separate setting turns a host into a\nmail testing host, where messages are collected on the server instead of being delivered. Both\nlive on the **Advanced** tab, under **Mail Settings**. For the DNS side of mail authentication,\nsee Email deliverability.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\ndkim:\n keys:\n - fqdn: example.com # sign mail sent from this domain\n - fqdn: shop.example.com\n selector: shop2026 # optional, default is cloud\n# Development and staging hosts only - collect mail instead of delivering it:\nmail_devtool: mailpit # mailpit | mailhog\n# mailhog_install: true # written by the interface toggle; mail_devtool does the work\n```"} {"id":"reference/yaml/host-services.md#dkim-keys","url":"https://docs.turbostack.app/reference/yaml/host-services/#dkim-keys","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`dkim.keys`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `empty`.\n\nThe mail domains this host signs outgoing mail for. A signing key pair is generated on the server for each entry, and existing keys are never overwritten. Signed mail is far more likely to reach the inbox instead of the spam folder.\n\n**Note:** `dkim` must be a map that contains a `keys` list. The older `dkim: true` form is refused and stops the deployment. After the key is generated, publish the matching public record in the Domain Name System (DNS)."} {"id":"reference/yaml/host-services.md#dkim-keys-fqdn","url":"https://docs.turbostack.app/reference/yaml/host-services/#dkim-keys-fqdn","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`dkim.keys.fqdn`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"danger\" text=\"required\"]\n\nThe mail domain this key signs for, written in full. Tells the platform which sender domain the key belongs to.\n\n**Note:** required for every entry. An entry without it stops the deployment."} {"id":"reference/yaml/host-services.md#dkim-keys-selector","url":"https://docs.turbostack.app/reference/yaml/host-services/#dkim-keys-selector","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`dkim.keys.selector`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `cloud`.\n\nThe label that identifies this key in DNS. The record you publish is the selector, followed by `._domainkey.` and the domain. Lets one domain hold more than one key, which is what makes it possible to replace a key without a gap in signing."} {"id":"reference/yaml/host-services.md#mail-devtool","url":"https://docs.turbostack.app/reference/yaml/host-services/#mail-devtool","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mail_devtool`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nOne of `mailpit`, `mailhog`.\n\nInstalls a mail testing tool with a web interface that collects the messages your applications send. See exactly what your application sends, including the full message, without anything reaching a real recipient.\n\n**Note:** only the two values above are accepted; anything else stops the deployment. The platform also points PHP at the collector by default.\n\n> [!WARNING]\n> Use this on development and staging hosts only. While it is set, mail your applications send is kept on the server instead of being delivered."} {"id":"reference/yaml/host-services.md#mailhog-install","url":"https://docs.turbostack.app/reference/yaml/host-services/#mailhog-install","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`mailhog_install`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `false`.\n\nRecords that mail collecting is switched on for this host. The interface writes it when you enable **Enable mail capturing and mail testing**, which then shows the `mail_devtool` field. Only meaningful together with `mail_devtool`.\n\n**Note:** on its own this key installs nothing. `mail_devtool` is what selects and installs the tool, so set that as well."} {"id":"reference/yaml/host-services.md#advanced-database-monitoring","url":"https://docs.turbostack.app/reference/yaml/host-services/#advanced-database-monitoring","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"Advanced database monitoring","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"Advanced database monitoring collects query-level statistics from the databases on this host\nand sends them to a central collection server, where slow queries, locks and load are kept over\ntime. Set it up on the **Advanced** tab, under **Advanced Database Monitoring**.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\npmm_master:\n server_hostname: monitor.example.com # the server that collects the statistics\npmm_sampling_rate: 50 # record one query in every fifty\n```"} {"id":"reference/yaml/host-services.md#pmm-master-server-hostname","url":"https://docs.turbostack.app/reference/yaml/host-services/#pmm-master-server-hostname","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`pmm_master.server_hostname`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nThe collection server this host sends its database statistics to. Setting it is what switches advanced database monitoring on. Find the queries that make a database slow, with history you can compare against a quiet period.\n\n**Note:** at least one database must be configured on the host. Without one, the panel stays empty."} {"id":"reference/yaml/host-services.md#pmm-sampling-rate","url":"https://docs.turbostack.app/reference/yaml/host-services/#pmm-sampling-rate","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"`pmm_sampling_rate`","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"[!badge variant=\"info\" text=\"integer\"] [!badge variant=\"secondary\" text=\"count\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `50`.\n\nHow often a query is recorded. A value of `50` records one query in every fifty, not one in two. Lower it for a more complete picture on a quiet database, raise it to keep the measuring itself cheap on a busy one.\n\n**Note:** only used together with `pmm_master.server_hostname`."} {"id":"reference/yaml/host-services.md#related","url":"https://docs.turbostack.app/reference/yaml/host-services/#related","path":"reference/yaml/host-services.md","title":"Host service parameters","heading":"Related","keywords":"host yaml webserver mysql_version redis varnish elasticsearch services dkim mail_devtool","text":"- YAML configuration reference\n- The Source (YAML) view\n- Publishing changes"} {"id":"reference/yaml/index.md#intro","url":"https://docs.turbostack.app/reference/yaml/","path":"reference/yaml/index.md","title":"YAML configuration reference","heading":"","keywords":"yaml reference turbostack yaml configuration parameters host configuration ansible variables","text":"\n\n# YAML configuration reference\n\nA host's configuration is one YAML document. This reference lists every key you can set,\nwhat it changes on the server, and why you would use it.\n\nThe GUI and the Source (YAML) view describe the same\nconfiguration, so anything here can also be set through the forms where a field exists.\nKeys marked **YAML only** have no field in the GUI.\n\n> [!NOTE]\n> Version numbers, application types and similar option lists are not repeated here,\n> because they change over time. The GUI dropdown always shows the values available today.\n\n> [!TIP]\n> In a hurry? The configuration recipes are complete, copy-ready\n> configurations for common scenarios - a simple site, an online store, Odoo and more."} {"id":"reference/yaml/index.md#the-sections","url":"https://docs.turbostack.app/reference/yaml/#the-sections","path":"reference/yaml/index.md","title":"YAML configuration reference","heading":"The sections","keywords":"yaml reference turbostack yaml configuration parameters host configuration ansible variables","text":"| Section | What it covers | Keys |\n|---|---|---|\n| Applications | The YAML keys you set per application (vhost) - domain, certificate, runtime, code deployment, proxying and per-application tuning. | 43 |\n| Host services | The YAML keys you set once per host - web server, databases, caching, queues, search, mail and database monitoring. | 61 |\n| Users and access | The YAML keys for system users, their applications, file transfer accounts, extra database users and SSH access. | 14 |\n| Security | The YAML keys for TurboShield and the firewall - protection level, bot lists, trusted clients, country rules and ports. | 12 |"} {"id":"reference/yaml/index.md#how-a-host-configuration-is-structured","url":"https://docs.turbostack.app/reference/yaml/#how-a-host-configuration-is-structured","path":"reference/yaml/index.md","title":"YAML configuration reference","heading":"How a host configuration is structured","keywords":"yaml reference turbostack yaml configuration parameters host configuration ansible variables","text":"Host-level keys sit at the top. Below them, `system_users` lists the accounts, and each\naccount has `vhosts`: its applications. A key belongs to exactly one of those three levels,\nwhich the **Scope** of every key tells you.\n\n```yaml\n# Host level: services shared by every application on this server\nwebserver: nginx\nmysql_version: \"8.4\"\nredis_enabled: true\n\nturboshield:\n enabled: true\n level: medium\n\nfirewall_whitelist:\n - 203.0.113.10 # office\n\n# The accounts on this server\nsystem_users:\n - username: prod\n\n # The applications owned by this account\n vhosts:\n - server_name: example.com www.example.com\n app_type: wordpress\n php_version: \"8.4\"\n cert_type: letsencrypt\n varnish_enabled: true\n```"} {"id":"reference/yaml/index.md#keys-you-will-not-find-here","url":"https://docs.turbostack.app/reference/yaml/#keys-you-will-not-find-here","path":"reference/yaml/index.md","title":"YAML configuration reference","heading":"Keys you will not find here","keywords":"yaml reference turbostack yaml configuration parameters host configuration ansible variables","text":"Some variables appear in server output or in examples elsewhere but cannot be set by you:\n\n- **Computed values.** The platform derives them from what you did set. For example, the\n Node.js runtime is enabled by setting `nodejs_version` on an application, and there is no\n separate key to switch it on.\n- **Platform-managed settings.** The system type, monitoring level and backup schedule are\n set by Hosted Power for your server."} {"id":"reference/yaml/index.md#related","url":"https://docs.turbostack.app/reference/yaml/#related","path":"reference/yaml/index.md","title":"YAML configuration reference","heading":"Related","keywords":"yaml reference turbostack yaml configuration parameters host configuration ansible variables","text":"- The Source (YAML) view - how to open and edit the YAML\n- Publishing changes - how to apply it\n- API reference - the same model over HTTP"} {"id":"reference/yaml/recipes.md#intro","url":"https://docs.turbostack.app/reference/yaml/recipes/","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"\n\n# Configuration recipes\n\nEach recipe below is a complete host configuration for a common scenario. Copy the one\nclosest to your situation into the Source (YAML) view,\nchange the domain and version to suit, and publish. Every key used here is explained in\nthe parameter reference.\n\n> [!NOTE]\n> You do not set memory sizes in any of these recipes. The platform sizes each service to\n> the server automatically and re-tunes it on every publish, so a bigger server scales the\n> configuration up without any change here."} {"id":"reference/yaml/recipes.md#a-simple-website-wordpress","url":"https://docs.turbostack.app/reference/yaml/recipes/#a-simple-website-wordpress","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"A simple website (WordPress)","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"A content site or blog on its own domain, with automatic HTTPS.\n\n```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # WordPress stores its data in MySQL\nredis_enabled: true # object cache (recommended, especially WooCommerce)\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com www.example.com\n app_type: wordpress\n php_version: \"8.4\"\n cert_type: letsencrypt # automatic HTTPS\n```\n\nThis is the smallest useful configuration: one application, a database and a\ncache. You do not size anything - the platform tunes MySQL and Redis to the\nserver automatically. Setting `cert_type: letsencrypt` requests a certificate\nand redirects HTTP to HTTPS once it is issued."} {"id":"reference/yaml/recipes.md#a-busy-online-store-magento-2","url":"https://docs.turbostack.app/reference/yaml/recipes/#a-busy-online-store-magento-2","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"A busy online store (Magento 2)","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"A Magento 2 storefront that must stay fast during a sale.\n\n```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # Magento core database\nelasticsearch_version: \"8.x\" # required by Magento for catalog search\nredis_enabled: true # sessions and object cache\nsystem_users:\n - username: prod\n vhosts:\n - server_name: shop.example.com www.shop.example.com\n app_type: magento2\n php_version: \"8.4\"\n cert_type: letsencrypt\n varnish_enabled: true # installs and fronts the full-page cache\n```\n\nMagento needs all four performance layers: the database, a search engine,\nRedis for sessions and the object cache, and Varnish for full-page caching.\nVarnish needs nothing at host level: `varnish_enabled` on the storefront\ninstalls it and puts the store behind it.\nEvery memory size (buffer pool, Redis, Varnish, search heap) is auto-tuned to\nthe server and re-tuned on every publish, so a bigger server scales the store\nup without any change here."} {"id":"reference/yaml/recipes.md#a-shopware-store","url":"https://docs.turbostack.app/reference/yaml/recipes/#a-shopware-store","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"A Shopware store","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"A Shopware 6 storefront with caching.\n\n```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # Shopware core database\nredis_enabled: true # cache and session storage\nsystem_users:\n - username: prod\n vhosts:\n - server_name: shop.example.com www.shop.example.com\n app_type: shopware\n php_version: \"8.4\"\n cert_type: letsencrypt\n varnish_enabled: true # full-page cache for storefront performance\n```\n\nLike Magento, Shopware benefits from Redis and a full-page cache. It does not\nrequire a separate search engine on TurboStack. If you prefer OpenSearch over\nElasticsearch for product search, set `opensearch_version` instead - never\nboth on one host."} {"id":"reference/yaml/recipes.md#odoo-business-software","url":"https://docs.turbostack.app/reference/yaml/recipes/#odoo-business-software","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"Odoo (business software)","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"Move an Odoo installation onto TurboStack.\n\n```yaml\nwebserver: nginx\npostgresql_version: \"17\" # Odoo requires PostgreSQL\nsystem_users:\n - username: prod\n vhosts:\n - server_name: odoo.example.com\n app_type: odoo # TurboStack runs Odoo behind nginx for you\n cert_type: letsencrypt\n```\n\nOdoo uses PostgreSQL, not MySQL, and runs as a service behind an Nginx reverse\nproxy that TurboStack sets up from `app_type: odoo`. You do not set a PHP\nversion - Odoo is a Python application managed by the platform."} {"id":"reference/yaml/recipes.md#a-laravel-application","url":"https://docs.turbostack.app/reference/yaml/recipes/#a-laravel-application","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"A Laravel application","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"A PHP application built on Laravel, with background queues.\n\n```yaml\nwebserver: nginx\nmysql_version: \"8.4\" # application database\nredis_enabled: true # queues, cache and sessions\nsystem_users:\n - username: prod\n vhosts:\n - server_name: app.example.com\n app_type: laravel\n php_version: \"8.4\"\n cert_type: letsencrypt\n # rabbitmq_enabled: true # add a message broker if your jobs need one\n```\n\nLaravel uses Redis for its queue, cache and session drivers, so `redis_enabled`\ncovers most background-job needs. Add a dedicated message broker with\n`rabbitmq_enabled` only if your application specifically uses one."} {"id":"reference/yaml/recipes.md#a-node-js-application","url":"https://docs.turbostack.app/reference/yaml/recipes/#a-node-js-application","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"A Node.js application","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"A Node.js service (for example an API or a JavaScript framework).\n\n```yaml\nwebserver: nginx\nsystem_users:\n - username: prod\n vhosts:\n - server_name: api.example.com\n app_type: generic\n nodejs_version: \"24\" # setting the version enables the Node.js runtime\n proxy_enabled: true # nginx forwards requests to your Node process\n proxy_upstream_port: 3000\n cert_type: letsencrypt\n```\n\nA Node.js application is enabled simply by setting `nodejs_version` - there is\nno separate \"enable\" key. Because the application listens on its own port,\n`proxy_enabled` tells the web server to forward requests to it, and\n`proxy_upstream_port` is the port your process listens on."} {"id":"reference/yaml/recipes.md#several-applications-on-one-host","url":"https://docs.turbostack.app/reference/yaml/recipes/#several-applications-on-one-host","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"Several applications on one host","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"Two applications, each with its own runtime, on the same server.\n\n```yaml\nwebserver: nginx\nmysql_version: \"8.4\"\nredis_enabled: true\nsystem_users:\n - username: shop\n vhosts:\n - server_name: shop.example.com\n app_type: magento2\n php_version: \"8.4\"\n cert_type: letsencrypt\n varnish_enabled: true\n - username: api\n vhosts:\n - server_name: api.example.com\n app_type: generic\n nodejs_version: \"24\"\n proxy_enabled: true\n proxy_upstream_port: 3000\n cert_type: letsencrypt\n```\n\nOne host can run several applications side by side, each under its own system\nuser and with its own runtime and version. Host services (MySQL, Redis) are\nshared; the per-application keys under each `vhosts` entry are independent."} {"id":"reference/yaml/recipes.md#application-server-plus-a-separate-database-server","url":"https://docs.turbostack.app/reference/yaml/recipes/#application-server-plus-a-separate-database-server","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"Application server plus a separate database server","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"Keep the database on its own server for larger workloads.\n\n```yaml\n# On the application server:\nwebserver: nginx\nmysql_client_host_name: db1.example.com\nmysql_client_host_ip: 10.0.0.5\nsystem_users:\n - username: prod\n vhosts:\n - server_name: app.example.com\n app_type: laravel\n php_version: \"8.4\"\n cert_type: letsencrypt\n# On the database server (separate host configuration):\n# mysql_version: \"8.4\"\n# mysql_server_only: true\n```\n\nFor a larger workload you can split the database onto its own server. The\napplication host points at it with `mysql_client_host_name` and\n`mysql_client_host_ip`. The database host is configured with\n`mysql_server_only: true`, so it installs the server without a web stack."} {"id":"reference/yaml/recipes.md#dependencies-and-rules","url":"https://docs.turbostack.app/reference/yaml/recipes/#dependencies-and-rules","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"Dependencies and rules","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"The rules that connect keys. Keep these in mind when you change a configuration.\n\n- **A runtime is enabled by setting its version key.** There is no separate enable key. `php_version`, `nodejs_version`, `python_version`, `ruby_version` and `dotnet_version` each enable that runtime just by being set.\n- **Varnish is enabled per application, and that is the whole of it.** `varnish_enabled: true` on any application installs Varnish on the host and puts that application behind it. There is no host key to install it first, and the platform chooses the version. The host keys under Caching and queues (`varnish_cache_size`, `varnish_type`, `varnish_customvcl`) only tune a cache that an application has already asked for.\n- **A host uses either Elasticsearch or OpenSearch, never both.** Set `elasticsearch_version` or `opensearch_version`, not both on the same host.\n- **To not install a search engine, omit the key or set an empty string.** `elasticsearch_version: \"\"` disables it. Never use the integer `0` - it fails the deployment.\n- **A proxied runtime (Node.js and similar) needs the proxy turned on.** Set `proxy_enabled: true` and `proxy_upstream_port` so the web server forwards requests to the application process.\n- **A separate database server uses the client/server split keys.** On the database host set `mysql_server_only: true`; on the application host set `mysql_client_host_name` and `mysql_client_host_ip` to point at it.\n- **Memory sizes are auto-tuned - do not set them up front.** `mysql_innodb_size`, `redis_memory`, `varnish_cache_size`, `elasticsearch_heap_size` and similar are sized to the server automatically and re-tuned on every publish. Override only with measured evidence.\n- **Prefer a supported (non-EOL) version.** Older versions still install but may not receive security updates. The GUI dropdown lists the versions available now."} {"id":"reference/yaml/recipes.md#related","url":"https://docs.turbostack.app/reference/yaml/recipes/#related","path":"reference/yaml/recipes.md","title":"Configuration recipes","heading":"Related","keywords":"yaml example config example magento config wordpress config odoo config sample configuration recipe","text":"- YAML configuration reference\n- The Source (YAML) view\n- Publishing changes"} {"id":"reference/yaml/security.md#intro","url":"https://docs.turbostack.app/reference/yaml/security/","path":"reference/yaml/security.md","title":"Security parameters","heading":"","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"\n\n# Security parameters\n\nEvery key on this page is set once per host, at the top of the configuration.\nA [!badge variant=\"success\" text=\"GUI\"] key has a field in the interface; a\n[!badge variant=\"warning\" text=\"YAML only\"] key is set in the\nSource (YAML) view, which accepts the same configuration."} {"id":"reference/yaml/security.md#turboshield","url":"https://docs.turbostack.app/reference/yaml/security/#turboshield","path":"reference/yaml/security.md","title":"Security parameters","heading":"TurboShield","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"TurboShield protects your applications against malicious traffic. For what each mechanism\ndoes, see What is TurboShield?.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nturboshield:\n enabled: true\n level: medium # low | medium | high | attack\n allow_bots: [channable]\n limit_bots: [bytespider, gptbot]\n bot_protection: true # browser check for suspicious visitors (Nginx)\n```"} {"id":"reference/yaml/security.md#turboshield-enabled","url":"https://docs.turbostack.app/reference/yaml/security/#turboshield-enabled","path":"reference/yaml/security.md","title":"Security parameters","heading":"`turboshield.enabled`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `true`.\n\nTurns the protection on for this host. On by default. Switching it off removes the protection completely."} {"id":"reference/yaml/security.md#turboshield-level","url":"https://docs.turbostack.app/reference/yaml/security/#turboshield-level","path":"reference/yaml/security.md","title":"Security parameters","heading":"`turboshield.level`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"]\n\nOne of `low`, `medium`, `high`, `attack`. Default `medium`.\n\nHow aggressive the limits are, and whether the attack-only mechanisms run. Raise it while an attack is happening, and lower it again afterwards."} {"id":"reference/yaml/security.md#turboshield-allow-bots","url":"https://docs.turbostack.app/reference/yaml/security/#turboshield-allow-bots","path":"reference/yaml/security.md","title":"Security parameters","heading":"`turboshield.allow_bots`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `empty`.\n\nBots that are never slowed down. Protects crawlers your revenue depends on, such as marketplace and comparison feeds."} {"id":"reference/yaml/security.md#turboshield-limit-bots","url":"https://docs.turbostack.app/reference/yaml/security/#turboshield-limit-bots","path":"reference/yaml/security.md","title":"Security parameters","heading":"`turboshield.limit_bots`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `empty`.\n\nBots that are strictly slowed down. Your lever against crawlers that consume capacity without bringing customers."} {"id":"reference/yaml/security.md#turboshield-bot-protection","url":"https://docs.turbostack.app/reference/yaml/security/#turboshield-bot-protection","path":"reference/yaml/security.md","title":"Security parameters","heading":"`turboshield.bot_protection`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"warning\" text=\"YAML only\"]\n\nDefault `false`.\n\nShows suspicious visitors an automatic browser check before they reach your site. Effective against scraping and credential stuffing spread across many addresses.\n\n**Note:** requires Nginx."} {"id":"reference/yaml/security.md#trusted-addresses-and-the-firewall","url":"https://docs.turbostack.app/reference/yaml/security/#trusted-addresses-and-the-firewall","path":"reference/yaml/security.md","title":"Security parameters","heading":"Trusted addresses and the firewall","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"The firewall controls which networks and ports reach the server at all. The trusted list is\nshared with TurboShield.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nfirewall_whitelist:\n - 203.0.113.10 # office\n - 198.51.100.0/24 # partner integration\nfirewall_country_block: \"CN,RU\"\n# Or restrict to only certain countries instead:\n# firewall_country_allow: \"BE,NL,FR\"\nfirewall_tcp_ports: [80, 443, 8080]\nfirewall_udp_ports: [53]\n```"} {"id":"reference/yaml/security.md#firewall-whitelist","url":"https://docs.turbostack.app/reference/yaml/security/#firewall-whitelist","path":"reference/yaml/security.md","title":"Security parameters","heading":"`firewall_whitelist`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `empty`.\n\nAddresses that bypass every check and can never be blocked automatically. The most important list to maintain. Prevents your own office, integrations and monitoring from being locked out.\n\n> [!WARNING]\n> A trusted address skips all protection. Keep the list short and never add a broad public range."} {"id":"reference/yaml/security.md#firewall-country-block","url":"https://docs.turbostack.app/reference/yaml/security/#firewall-country-block","path":"reference/yaml/security.md","title":"Security parameters","heading":"`firewall_country_block`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nRefuses all traffic from the listed countries. Cuts a lot of unwanted traffic when you only sell in certain regions.\n\n> [!WARNING]\n> Blocks real customers and travelling staff in those countries."} {"id":"reference/yaml/security.md#firewall-country-allow","url":"https://docs.turbostack.app/reference/yaml/security/#firewall-country-allow","path":"reference/yaml/security.md","title":"Security parameters","heading":"`firewall_country_allow`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nAllows traffic only from the listed countries. For applications meant for one region only, such as an internal tool.\n\n> [!WARNING]\n> Everything else is refused, including search engines and monitoring."} {"id":"reference/yaml/security.md#firewall-tcp-ports","url":"https://docs.turbostack.app/reference/yaml/security/#firewall-tcp-ports","path":"reference/yaml/security.md","title":"Security parameters","heading":"`firewall_tcp_ports`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"warning\" text=\"YAML only\"]\n\nDefault: Detected automatically.\n\nWhich TCP ports the firewall opens. Open a port for your own service.\n\n> [!WARNING]\n> Every open port is a way in. Only open what you actually use."} {"id":"reference/yaml/security.md#firewall-udp-ports","url":"https://docs.turbostack.app/reference/yaml/security/#firewall-udp-ports","path":"reference/yaml/security.md","title":"Security parameters","heading":"`firewall_udp_ports`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"list\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault: Detected automatically.\n\nWhich UDP ports the firewall opens. For services that do not use TCP."} {"id":"reference/yaml/security.md#web-application-firewall","url":"https://docs.turbostack.app/reference/yaml/security/#web-application-firewall","path":"reference/yaml/security.md","title":"Security parameters","heading":"Web Application Firewall","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"The Web Application Firewall (WAF) inspects incoming requests and blocks attacks against the\napplication itself, such as SQL injection and cross-site scripting. It also scans the files on\nthe host for malware. TurboStack uses Imunify for this. You switch it on per host on the\n**Security** tab.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nimunify:\n enabled: true\n email: security@example.com\n```"} {"id":"reference/yaml/security.md#imunify-enabled","url":"https://docs.turbostack.app/reference/yaml/security/#imunify-enabled","path":"reference/yaml/security.md","title":"Security parameters","heading":"`imunify.enabled`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `false`.\n\nInstalls and activates the Web Application Firewall and malware scanning on the host. Blocks application-layer attacks that the network firewall cannot see, and finds malware in your files."} {"id":"reference/yaml/security.md#imunify-email","url":"https://docs.turbostack.app/reference/yaml/security/#imunify-email","path":"reference/yaml/security.md","title":"Security parameters","heading":"`imunify.email`","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"[!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nThe address that receives Web Application Firewall alerts, such as a malware detection. Without it you only see findings when you open the interface yourself.\n\n**Note:** only used when `imunify.enabled` is true."} {"id":"reference/yaml/security.md#related","url":"https://docs.turbostack.app/reference/yaml/security/#related","path":"reference/yaml/security.md","title":"Security parameters","heading":"Related","keywords":"turboshield yaml firewall_whitelist bot_protection country block firewall ports","text":"- YAML configuration reference\n- The Source (YAML) view\n- Publishing changes"} {"id":"reference/yaml/users-and-access.md#intro","url":"https://docs.turbostack.app/reference/yaml/users-and-access/","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"\n\n# Users and access parameters\n\nEach key below carries a label for where it belongs in the configuration.\nA [!badge variant=\"success\" text=\"GUI\"] key has a field in the interface; a\n[!badge variant=\"warning\" text=\"YAML only\"] key is set in the\nSource (YAML) view, which accepts the same configuration."} {"id":"reference/yaml/users-and-access.md#system-users","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#system-users","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"System users","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"A system user is the account that owns the files and runs the applications. Every\napplication belongs to exactly one system user.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nsystem_users:\n - username: prod\n vhosts:\n - server_name: example.com\n app_type: wordpress\n```"} {"id":"reference/yaml/users-and-access.md#system-users","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#system-users","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`system_users`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"host\"] [!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `empty`.\n\nThe list of accounts on this host, each with its own applications. Separating applications per account keeps their files, databases and processes apart."} {"id":"reference/yaml/users-and-access.md#username","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#username","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`username`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"system user\"] [!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nThe account name, which also determines the home directory and the database name. Required for every account.\n\n**Note:** lowercase letters and digits, starting with a letter, at most 24 characters. Some reserved names are refused."} {"id":"reference/yaml/users-and-access.md#file-transfer-accounts","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#file-transfer-accounts","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"File transfer accounts","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"File transfer accounts give someone access to files without giving them the system account\nitself. Prefer Secure File Transfer Protocol (SFTP) over plain FTP.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nftp_sftp: true # use encrypted SFTP (host level)\nftp_sftp_port: 222\nftp_hostname: sftp.example.com\nsystem_users:\n - username: prod\n ftp:\n - user: designer\n homedir: /var/www/prod/example.com # must be inside the user's directory\n```"} {"id":"reference/yaml/users-and-access.md#ftp","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#ftp","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`ftp`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"system user\"] [!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `empty`.\n\nExtra file-transfer accounts under this system user. Give an external designer or agency access to one folder only."} {"id":"reference/yaml/users-and-access.md#user","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#user","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`user`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"system user\"] [!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nThe login name of the file-transfer account. Required for every entry under `ftp`."} {"id":"reference/yaml/users-and-access.md#homedir","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#homedir","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`homedir`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"system user\"] [!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nThe folder this account is limited to. Restricts access to one application instead of the whole account.\n\n**Note:** must be inside the system user's own directory. The deployment fails otherwise."} {"id":"reference/yaml/users-and-access.md#ftp-sftp","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#ftp-sftp","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`ftp_sftp`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"host\"] [!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"danger\" text=\"required\"]\n\nDefault `false`.\n\nEnables encrypted file transfer over SFTP. Plain FTP sends passwords unencrypted. Use SFTP whenever you can.\n\n**Note:** required before you can add SSH keys to a file-transfer account, otherwise the deployment fails."} {"id":"reference/yaml/users-and-access.md#ftp-sftp-port","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#ftp-sftp-port","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`ftp_sftp_port`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"host\"] [!badge variant=\"info\" text=\"integer\"] [!badge variant=\"secondary\" text=\"port\"] [!badge variant=\"warning\" text=\"YAML only\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nDefault `222`.\n\nThe port SFTP listens on. Avoids a clash with regular SSH."} {"id":"reference/yaml/users-and-access.md#ftp-hostname","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#ftp-hostname","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`ftp_hostname`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"host\"] [!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"ghost\" text=\"advanced\"]\n\nThe host name shown for file-transfer connections. Give customers a branded address to connect to."} {"id":"reference/yaml/users-and-access.md#extra-database-users","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#extra-database-users","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"Extra database users","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"Extra database accounts. The `admin` role has full read/write access to all databases on the\nserver; the `readonly` role has read-only access.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nsystem_users:\n - username: prod\n db_extra_users:\n - name: reporting\n db_role: readonly # admin | readonly\n```"} {"id":"reference/yaml/users-and-access.md#db-extra-users","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#db-extra-users","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`db_extra_users`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"system user\"] [!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `empty`.\n\nAdditional database accounts alongside the automatically created one. Give a reporting tool or an external developer their own database login."} {"id":"reference/yaml/users-and-access.md#name","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#name","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`name`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"system user\"] [!badge variant=\"info\" text=\"string\"] [!badge variant=\"success\" text=\"GUI\"]\n\nThe login name of the extra database user. Required for every entry under `db_extra_users`.\n\n**Note:** lowercase letters and digits, starting with a letter, at most 24 characters, and unique."} {"id":"reference/yaml/users-and-access.md#db-role","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#db-role","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`db_role`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"system user\"] [!badge variant=\"info\" text=\"enum\"] [!badge variant=\"success\" text=\"GUI\"] [!badge variant=\"danger\" text=\"required\"]\n\nOne of `admin`, `readonly`.\n\nThe role - `admin` has full read/write access to all databases on the server, `readonly` has read-only access. A reporting tool or external analyst should almost always be `readonly`; `admin` reaches every database on the server.\n\n**Note:** required, and must be exactly one of the two values."} {"id":"reference/yaml/users-and-access.md#ssh-access","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#ssh-access","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"SSH access","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"SSH gives command-line access to the server. Keys are safer than passwords, because a key\ncannot be guessed.\n\n**Example** - every key in this section, with realistic values:\n\n```yaml\nssh_keys:\n - ssh-ed25519 AAAAC3Nza... team@example.com\nssh_passwords: false # disable password login (keys only)\nssh_port: 22 # YAML only; the firewall opens the new port for you\n```"} {"id":"reference/yaml/users-and-access.md#ssh-keys","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#ssh-keys","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`ssh_keys`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"host\"] [!badge variant=\"info\" text=\"list\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `empty`.\n\nPublic keys that get access to every account on this host. Give your whole team access in one place, without sharing passwords."} {"id":"reference/yaml/users-and-access.md#ssh-port","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#ssh-port","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`ssh_port`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"host\"] [!badge variant=\"info\" text=\"integer\"] [!badge variant=\"secondary\" text=\"port\"] [!badge variant=\"warning\" text=\"YAML only\"]\n\nDefault `22`.\n\nThe port the server listens on for SSH. A non-standard port removes most automated login attempts from your logs.\n\n> [!WARNING]\n> Set the wrong value and you lock yourself out. The firewall is opened for the new port automatically."} {"id":"reference/yaml/users-and-access.md#ssh-passwords","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#ssh-passwords","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"`ssh_passwords`","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"[!badge variant=\"secondary\" text=\"host\"] [!badge variant=\"info\" text=\"boolean\"] [!badge variant=\"success\" text=\"GUI\"]\n\nDefault `true`.\n\nWhether logging in with a password is allowed at all. Turning it off is one of the most effective hardening steps, because passwords can be guessed.\n\n**Note:** add and test your SSH key first."} {"id":"reference/yaml/users-and-access.md#related","url":"https://docs.turbostack.app/reference/yaml/users-and-access/#related","path":"reference/yaml/users-and-access.md","title":"Users and access parameters","heading":"Related","keywords":"system_users username ftp sftp db_extra_users ssh_keys ssh_port","text":"- YAML configuration reference\n- The Source (YAML) view\n- Publishing changes"} {"id":"technologies/apache/apache-behind-nginx.md#intro","url":"https://docs.turbostack.app/technologies/apache/apache-behind-nginx/","path":"technologies/apache/apache-behind-nginx.md","title":"How to run Apache behind Nginx","heading":"","keywords":"Apache behind nginx nginx Apache proxy hybrid web server Apache nginx","text":"# How to run Apache behind Nginx\n\nOn TurboStack, Apache runs as a backend behind nginx. Nginx handles the edge - Transport Layer Security (TLS), static files and\n(if enabled) the Varnish cache - and forwards dynamic requests to Apache, which runs your application\nand reads `.htaccess`. This gives you Apache's per-directory flexibility with Nginx's performance at\nthe front."} {"id":"technologies/apache/apache-behind-nginx.md#how-requests-flow","url":"https://docs.turbostack.app/technologies/apache/apache-behind-nginx/#how-requests-flow","path":"technologies/apache/apache-behind-nginx.md","title":"How to run Apache behind Nginx","heading":"How requests flow","keywords":"Apache behind nginx nginx Apache proxy hybrid web server Apache nginx","text":"1. A request arrives at Nginx (and Varnish, if enabled), which terminates HTTPS and serves cached or\n static content.\n2. Dynamic requests are proxied to Apache, which runs the application and applies any\n `.htaccess` rules."} {"id":"technologies/apache/apache-behind-nginx.md#set-it-up","url":"https://docs.turbostack.app/technologies/apache/apache-behind-nginx/#set-it-up","path":"technologies/apache/apache-behind-nginx.md","title":"How to run Apache behind Nginx","heading":"Set it up","keywords":"Apache behind nginx nginx Apache proxy hybrid web server Apache nginx","text":"Choose Apache as the host's web server by setting `webserver: apache2` - see\nConfigure Apache. TurboStack wires Nginx in front of Apache for you; there is no\nproxy configuration to write by hand."} {"id":"technologies/apache/apache-behind-nginx.md#what-you-configure-where","url":"https://docs.turbostack.app/technologies/apache/apache-behind-nginx/#what-you-configure-where","path":"technologies/apache/apache-behind-nginx.md","title":"How to run Apache behind Nginx","heading":"What you configure where","keywords":"Apache behind nginx nginx Apache proxy hybrid web server Apache nginx","text":"| Concern | Where |\n| --- | --- |\n| TLS, HTTP-to-HTTPS redirect, static files, caching (Varnish) | Nginx (managed by the platform) |\n| Per-directory rules, rewrites, access control, headers | Apache `.htaccess` in your web root |\n\n> [!IMPORTANT]\n> Because Nginx (and Varnish) sit in front, the visitor's IP reaches Apache in the `X-Forwarded-For`\n> header. IP-based rules in `.htaccess` must read that header behind Varnish - see\n> Use .htaccess overrides."} {"id":"technologies/apache/apache-behind-nginx.md#when-to-choose-this-setup","url":"https://docs.turbostack.app/technologies/apache/apache-behind-nginx/#when-to-choose-this-setup","path":"technologies/apache/apache-behind-nginx.md","title":"How to run Apache behind Nginx","heading":"When to choose this setup","keywords":"Apache behind nginx nginx Apache proxy hybrid web server Apache nginx","text":"Choose Apache when your application depends on `.htaccess` rules that it ships and maintains itself.\nIf you do not need `.htaccess`, Nginx alone (`webserver: nginx`) is the lighter default - see\nConfigure Nginx."} {"id":"technologies/apache/apache-behind-nginx.md#related","url":"https://docs.turbostack.app/technologies/apache/apache-behind-nginx/#related","path":"technologies/apache/apache-behind-nginx.md","title":"How to run Apache behind Nginx","heading":"Related","keywords":"Apache behind nginx nginx Apache proxy hybrid web server Apache nginx","text":"- Configure Apache\n- Use .htaccess overrides\n- Configure Nginx"} {"id":"technologies/apache/configure.md#intro","url":"https://docs.turbostack.app/technologies/apache/configure/","path":"technologies/apache/configure.md","title":"Configure Apache on TurboStack","heading":"","keywords":"configure Apache turbostack Apache yaml webserver apache2 Apache host configuration","text":"# Configure Apache on TurboStack\n\nSwitching a host to Apache takes a single host-level setting."} {"id":"technologies/apache/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/apache/configure/#where-to-configure-it","path":"technologies/apache/configure.md","title":"Configure Apache on TurboStack","heading":"Where to configure it","keywords":"configure Apache turbostack Apache yaml webserver apache2 Apache host configuration","text":"The web server is chosen at the **host** level, in the same selector used for\nNginx:\n\n1. Open the host.\n2. Go to the **Services** tab.\n3. Under **Webserver**, select **apache2**.\n\n\n\nThis applies to every application on the host. Only one web server runs per host."} {"id":"technologies/apache/configure.md#required","url":"https://docs.turbostack.app/technologies/apache/configure/#required","path":"technologies/apache/configure.md","title":"Configure Apache on TurboStack","heading":"Required","keywords":"configure Apache turbostack Apache yaml webserver apache2 Apache host configuration","text":"| Key | Meaning |\n|---|---|\n| `webserver` | The host's web server. Set to `apache2` to select Apache. |"} {"id":"technologies/apache/configure.md#optional","url":"https://docs.turbostack.app/technologies/apache/configure/#optional","path":"technologies/apache/configure.md","title":"Configure Apache on TurboStack","heading":"Optional","keywords":"configure Apache turbostack Apache yaml webserver apache2 Apache host configuration","text":"There are no additional Apache keys required - selecting `apache2` is enough for\nTurboStack to provision and manage the web server.\n\n```yaml\n# Host-level: select Apache as the web server\nwebserver: apache2\n```\n\n> [!WARNING]\n> Apache and Nginx cannot run side by side on the same host. Changing\n> `webserver` swaps the web server for every application on the host. Nginx is the\n> recommended default - see Configure Nginx."} {"id":"technologies/apache/configure.md#common-tasks","url":"https://docs.turbostack.app/technologies/apache/configure/#common-tasks","path":"technologies/apache/configure.md","title":"Configure Apache on TurboStack","heading":"Common tasks","keywords":"configure Apache turbostack Apache yaml webserver apache2 Apache host configuration","text":"- use .htaccess overrides\n- run Apache behind Nginx\n- restrict access with basic authentication"} {"id":"technologies/apache/configure.md#related","url":"https://docs.turbostack.app/technologies/apache/configure/#related","path":"technologies/apache/configure.md","title":"Configure Apache on TurboStack","heading":"Related","keywords":"configure Apache turbostack Apache yaml webserver apache2 Apache host configuration","text":"- What is Apache?\n- Host Services tab\n- Applications overview"} {"id":"technologies/apache/htaccess-overrides.md#intro","url":"https://docs.turbostack.app/technologies/apache/htaccess-overrides/","path":"technologies/apache/htaccess-overrides.md","title":"How to use .htaccess overrides","heading":"","keywords":"htaccess Apache overrides rewrite rules allowoverride","text":"# How to use .htaccess overrides\n\nWhen your host runs Apache, you can use per-directory `.htaccess` files in your web root for rewrites,\naccess control and headers. Apache reads them on each request, so changes take effect without a\nreload. (Apache runs as the backend behind Nginx - see Run Apache behind Nginx.)\n\n> [!NOTE]\n> For blocking abusive traffic, prefer TurboShield and the\n> Firewall. Use `.htaccess` for application-level rules."} {"id":"technologies/apache/htaccess-overrides.md#restrict-by-ip-with-basic-authentication","url":"https://docs.turbostack.app/technologies/apache/htaccess-overrides/#restrict-by-ip-with-basic-authentication","path":"technologies/apache/htaccess-overrides.md","title":"How to use .htaccess overrides","heading":"Restrict by IP with basic authentication","keywords":"htaccess Apache overrides rewrite rules allowoverride","text":"Ask visitors to log in, but let trusted IP addresses through without a prompt. Put the block at the\n**top** of your `.htaccess`. First install `htpasswd` (the `apache2-utils` package) via\n`os_extra_packages` and generate a password file.\n\nOn a host **without Varnish**:\n\n```apache\nAuthType Basic\nAuthName \"Restricted content\"\nAuthUserFile /var/www/prod/apache2/.htpasswd\nRequire ip 203.0.113.10\nRequire valid-user\n```\n\nOn a host **with Varnish**, the visitor's IP arrives in the `X-Forwarded-For` header, so match on\nthat instead (a plain `Require ip` will not match behind Varnish):\n\n```apache\nAuthType Basic\nAuthName \"Restricted content\"\nAuthUserFile /var/www/prod/apache2/.htpasswd\nSetEnvIf X-Forwarded-For 203.0.113.10 AllowIP\nRequire env AllowIP\nRequire valid-user\n```"} {"id":"technologies/apache/htaccess-overrides.md#block-an-abusive-bot","url":"https://docs.turbostack.app/technologies/apache/htaccess-overrides/#block-an-abusive-bot","path":"technologies/apache/htaccess-overrides.md","title":"How to use .htaccess overrides","heading":"Block an abusive bot","keywords":"htaccess Apache overrides rewrite rules allowoverride","text":"If a single bot drives up load (for example Bytespider), deny it by user agent:\n\n```apache\n\n RewriteEngine On\n RewriteCond %{HTTP_USER_AGENT} Bytespider [NC]\n RewriteRule .* - [F]\n\n```"} {"id":"technologies/apache/htaccess-overrides.md#verify","url":"https://docs.turbostack.app/technologies/apache/htaccess-overrides/#verify","path":"technologies/apache/htaccess-overrides.md","title":"How to use .htaccess overrides","heading":"Verify","keywords":"htaccess Apache overrides rewrite rules allowoverride","text":"Reload the affected pages and confirm the rule works - for example you are prompted to log in (or let\nthrough from a trusted IP), or the blocked bot receives `403 Forbidden`.\n\n> [!WARNING]\n> A syntax error in `.htaccess` can return `500` errors for the whole directory. Change one rule at a\n> time and test. If you are unsure, contact support."} {"id":"technologies/apache/htaccess-overrides.md#related","url":"https://docs.turbostack.app/technologies/apache/htaccess-overrides/#related","path":"technologies/apache/htaccess-overrides.md","title":"How to use .htaccess overrides","heading":"Related","keywords":"htaccess Apache overrides rewrite rules allowoverride","text":"- Run Apache behind Nginx\n- Configure Apache\n- Installing extra OS packages\n- TurboShield"} {"id":"technologies/apache/restrict-access-basic-auth.md#intro","url":"https://docs.turbostack.app/technologies/apache/restrict-access-basic-auth/","path":"technologies/apache/restrict-access-basic-auth.md","title":"Restrict access with basic authentication","heading":"","keywords":"apache basic auth htpasswd restrict access ip require valid-user require ip x-forwarded-for varnish allow ip without login setenvif whitelist ip apache bytespider block","text":"# Restrict access with basic authentication\n\nIn this article we tackle the problem of how to decide whether a visitor should or should not log in\non a server with basic authentication enabled, based on their IP address.\n\nSo what is the result we want to achieve? We want to implement an `.htpasswd` file so visitors need a\nvalid login, except when the request comes from a whitelisted IP address. In that case no login is\nasked and the visitor is taken straight to the site. Like a VIP that would skip the waiting queue for\na club.\n\nThis method is used for Apache (`apache2`).\n\n> [!NOTE]\n> The login file is a `.htpasswd` file created with the `htpasswd` tool. `htpasswd` ships in the\n> `apache2-utils` package; add it with\n> `os_extra_packages` if it is not present. For\n> example, `htpasswd -c /var/www/prod/apache2/.htpasswd admin` creates the file and adds the first\n> user (use `-c` only for the first user)."} {"id":"technologies/apache/restrict-access-basic-auth.md#method-1-server-without-varnish-enabled","url":"https://docs.turbostack.app/technologies/apache/restrict-access-basic-auth/#method-1-server-without-varnish-enabled","path":"technologies/apache/restrict-access-basic-auth.md","title":"Restrict access with basic authentication","heading":"Method 1: Server without Varnish enabled","keywords":"apache basic auth htpasswd restrict access ip require valid-user require ip x-forwarded-for varnish allow ip without login setenvif whitelist ip apache bytespider block","text":"There is a difference when a server has or does not have Varnish enabled. For now we keep it simple\nand assume there is no interruption from any service like Varnish. In that case we use the following\nsetup.\n\nFor best practice, put this code at the top of your `.htaccess` file:\n\n\n\n```apache\nAuthType Basic\nAuthName \"Restricted content\"\nAuthUserFile /var/www/prod/apache2/.htpasswd\n\n# Whitelisted IPs are granted access without a login prompt\nRequire ip 203.0.113.10\n# Only a person with valid credentials is let in\nRequire valid-user\n```\n\nApache treats the two `Require` lines as \"either one is enough\": a request from `203.0.113.10` is\nallowed without a prompt, and every other request must supply a valid login."} {"id":"technologies/apache/restrict-access-basic-auth.md#method-2-server-with-varnish-enabled","url":"https://docs.turbostack.app/technologies/apache/restrict-access-basic-auth/#method-2-server-with-varnish-enabled","path":"technologies/apache/restrict-access-basic-auth.md","title":"Restrict access with basic authentication","heading":"Method 2: Server with Varnish enabled","keywords":"apache basic auth htpasswd restrict access ip require valid-user require ip x-forwarded-for varnish allow ip without login setenvif whitelist ip apache bytespider block","text":"For a server with Varnish enabled, a different approach is needed. All requests that go through\nVarnish pass the `X-Forwarded-For` header, but it may contain some tampered information about the\nvisitor's IP. Because of this, the request for immediate access is denied and the visitor is asked to\nlog in. To make sure this does not happen, we add a variable for the header that contains the\nwhitelisted IP address.\n\nThe code below does the trick (the IP should be written between quotes):\n\n```apache\nAuthType Basic\nAuthName \"Restricted content\"\nAuthUserFile /var/www/prod/apache2/.htpasswd\n\n# Only a person with valid credentials is let in\nRequire valid-user\n# Create the variable for the header (the IP should be written between quotes)\nSetEnvIf X-Forwarded-For 203.0.113.10 AllowIP\n# Include the env variable\nRequire env AllowIP\n```\n\nA request whose `X-Forwarded-For` header contains `203.0.113.10` is let through; everyone else is\nasked to log in.\n\n> [!NOTE]\n> Not sure whether Varnish is enabled? Check the host's caching setting, or start with the Varnish\n> version above - it also works as a fallback because it does not rely on the direct client IP.\n\n> [!WARNING]\n> A syntax error in `.htaccess` can return `500 Internal Server Error` for the whole directory. Change\n> one rule at a time and test. If you are unsure, contact support."} {"id":"technologies/apache/restrict-access-basic-auth.md#block-the-infamous-bytespider-bot","url":"https://docs.turbostack.app/technologies/apache/restrict-access-basic-auth/#block-the-infamous-bytespider-bot","path":"technologies/apache/restrict-access-basic-auth.md","title":"Restrict access with basic authentication","heading":"Block the infamous Bytespider bot","keywords":"apache basic auth htpasswd restrict access ip require valid-user require ip x-forwarded-for varnish allow ip without login setenvif whitelist ip apache bytespider block","text":"Sometimes a server can go high in load due to the infamous Bytespider bot. This one can be excluded\nby adding this piece of code inside the `.htaccess`:\n\n```apache\n\n RewriteEngine On\n RewriteCond %{HTTP_USER_AGENT} Bytespider [NC]\n RewriteRule .* - [F]\n\n```\n\nFor broader protection against abusive traffic, prefer the Firewall over\nper-site rules."} {"id":"technologies/apache/restrict-access-basic-auth.md#related","url":"https://docs.turbostack.app/technologies/apache/restrict-access-basic-auth/#related","path":"technologies/apache/restrict-access-basic-auth.md","title":"Restrict access with basic authentication","heading":"Related","keywords":"apache basic auth htpasswd restrict access ip require valid-user require ip x-forwarded-for varnish allow ip without login setenvif whitelist ip apache bytespider block","text":"- Use .htaccess overrides\n- Run Apache behind Nginx\n- Configure Apache\n- Installing extra OS packages\n- Firewall"} {"id":"technologies/apache/what-is.md#intro","url":"https://docs.turbostack.app/technologies/apache/what-is/","path":"technologies/apache/what-is.md","title":"What is Apache?","heading":"","keywords":"what is Apache Apache hosting Apache turbostack apache2 web server htaccess hosting","text":"# What is Apache?\n\nApache HTTP Server (commonly `apache2`) is one of the longest-running and most\nwidely used web servers. It serves web content over HTTP/HTTPS and is known for\nits flexible module system and support for per-directory configuration through\n`.htaccess` files.\n\nApache is a good fit when an application expects Apache-specific behavior - for\nexample rewrite rules in `.htaccess`, or modules that only exist in the Apache\necosystem. For many modern workloads, Nginx is faster and lighter, but Apache\nremains the right choice when compatibility matters."} {"id":"technologies/apache/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/apache/what-is/#on-turbostack","path":"technologies/apache/what-is.md","title":"What is Apache?","heading":"On TurboStack","keywords":"what is Apache Apache hosting Apache turbostack apache2 web server htaccess hosting","text":"Apache is the **alternative web server** on TurboStack. Nginx is the default and\nis recommended for most workloads, but you can switch a host to Apache when an\napp needs it.\n\n- Each host runs **one web server**. When Apache is selected, TurboStack\n provisions and manages `apache2` for every application on that host.\n- Apache is most useful when an application relies on **`.htaccess`** files or\n **Apache-specific modules** that have no Nginx equivalent.\n- As with Nginx, you select the web server at the host level rather than editing\n raw server config by hand.\n\n> [!NOTE]\n> Apache and Nginx are mutually exclusive on a host - you choose one web server\n> per host. If your app does not need Apache features, stay on Nginx."} {"id":"technologies/apache/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/apache/what-is/#best-practices","path":"technologies/apache/what-is.md","title":"What is Apache?","heading":"Best practices","keywords":"what is Apache Apache hosting Apache turbostack apache2 web server htaccess hosting","text":"- Choose Apache only when your application genuinely needs `.htaccess` or an\n Apache-only module; otherwise prefer Nginx.\n- Where possible, move rewrite and access rules out of `.htaccess` and into\n application config for clarity and performance.\n- Keep one web server per host and decide early - switching changes how every\n application on the host is served.\n- Always terminate Transport Layer Security (TLS) at the web server for every public application."} {"id":"technologies/apache/what-is.md#related","url":"https://docs.turbostack.app/technologies/apache/what-is/#related","path":"technologies/apache/what-is.md","title":"What is Apache?","heading":"Related","keywords":"what is Apache Apache hosting Apache turbostack apache2 web server htaccess hosting","text":"- Configure Apache on TurboStack\n- Host Services tab"} {"id":"technologies/docker/configure.md#intro","url":"https://docs.turbostack.app/technologies/docker/configure/","path":"technologies/docker/configure.md","title":"Configure Docker on TurboStack","heading":"","keywords":"configure Docker turbostack Docker yaml Docker enabled containerized app turbostack","text":"# Configure Docker on TurboStack\n\nEnabling Docker for an application provisions the container engine so you can run a\ncontainerized application."} {"id":"technologies/docker/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/docker/configure/#where-to-configure-it","path":"technologies/docker/configure.md","title":"Configure Docker on TurboStack","heading":"Where to configure it","keywords":"configure Docker turbostack Docker yaml Docker enabled containerized app turbostack","text":"Docker is enabled per application:\n\n1. Open the host and select the application.\n2. Go to **Configure application > Technologies > Docker**.\n3. Enable Docker.\n\nTo publish the container, also enable the\nreverse proxy and point its upstream port at the\ncontainer's exposed port."} {"id":"technologies/docker/configure.md#required","url":"https://docs.turbostack.app/technologies/docker/configure/#required","path":"technologies/docker/configure.md","title":"Configure Docker on TurboStack","heading":"Required","keywords":"configure Docker turbostack Docker yaml Docker enabled containerized app turbostack","text":"| Key | Meaning |\n|---|---|\n| `docker_enabled` | Set to `true` to run a containerized application for this application. |"} {"id":"technologies/docker/configure.md#optional","url":"https://docs.turbostack.app/technologies/docker/configure/#optional","path":"technologies/docker/configure.md","title":"Configure Docker on TurboStack","heading":"Optional","keywords":"configure Docker turbostack Docker yaml Docker enabled containerized app turbostack","text":"There are no additional Docker keys to set. To expose the container, configure\nthe reverse proxy keys (`proxy_enabled`, `proxy_upstream_port`) - see\nConfigure Reverse Proxy.\n\n```yaml\n# Per-application: run a containerized app and proxy to it\ndocker_enabled: true\nproxy_enabled: true\nproxy_upstream_port: 3000 # the container's exposed port\n```\n\n> [!TIP]\n> Docker and the reverse proxy work together: Docker runs the container, and\n> Nginx forwards public traffic to the container's port. Configure both for a\n> publicly reachable containerized app."} {"id":"technologies/docker/configure.md#common-tasks","url":"https://docs.turbostack.app/technologies/docker/configure/#common-tasks","path":"technologies/docker/configure.md","title":"Configure Docker on TurboStack","heading":"Common tasks","keywords":"configure Docker turbostack Docker yaml Docker enabled containerized app turbostack","text":"- run a Docker container\n- use Docker Compose"} {"id":"technologies/docker/configure.md#related","url":"https://docs.turbostack.app/technologies/docker/configure/#related","path":"technologies/docker/configure.md","title":"Configure Docker on TurboStack","heading":"Related","keywords":"configure Docker turbostack Docker yaml Docker enabled containerized app turbostack","text":"- What is Docker?\n- Configure Reverse Proxy\n- Applications tab"} {"id":"technologies/docker/run-a-container.md#intro","url":"https://docs.turbostack.app/technologies/docker/run-a-container/","path":"technologies/docker/run-a-container.md","title":"How to run a Docker container","heading":"","keywords":"run Docker container Docker hosting container on server Docker run restart policy docker volume","text":"# How to run a Docker container\n\nDocker lets you run a custom, containerized application on an application. TurboStack runs the container\nand **Nginx reverse-proxies public traffic to it**, so it gets HTTPS, caching and the security layers\nlike any other site. Use it for apps that ship as a container rather than as a standard PHP or runtime\napp."} {"id":"technologies/docker/run-a-container.md#1-enable-docker-for-the-application","url":"https://docs.turbostack.app/technologies/docker/run-a-container/#1-enable-docker-for-the-application","path":"technologies/docker/run-a-container.md","title":"How to run a Docker container","heading":"1. Enable Docker for the application","keywords":"run Docker container Docker hosting container on server Docker run restart policy docker volume","text":"Turn on Docker under **Configure application > Technologies > Docker** (see\nConfigure Docker). Every system user with Docker enabled is added to the `docker`\ngroup and can run the `docker` commands over SSH."} {"id":"technologies/docker/run-a-container.md#2-run-the-container","url":"https://docs.turbostack.app/technologies/docker/run-a-container/#2-run-the-container","path":"technologies/docker/run-a-container.md","title":"How to run a Docker container","heading":"2. Run the container","keywords":"run Docker container Docker hosting container on server Docker run restart policy docker volume","text":"Connect over SSH and start your container. Bind its port to **localhost** so it is only reachable\nthrough Nginx, and set a restart policy so it comes back after a reboot:\n\n```bash\ndocker run -d \\\n --name myapp \\\n --restart unless-stopped \\\n -p 127.0.0.1:8080:80 \\\n your-image:1.2\n```\n\n- `-d` runs it in the background; `--name` gives it a stable name.\n- `-p 127.0.0.1:8080:80` publishes the container's port `80` on host port `8080`, **localhost only**.\n- `--restart unless-stopped` starts the container again automatically, for example after a reboot.\n- Pin a specific image tag (`your-image:1.2`) rather than `latest`, so deployments are reproducible."} {"id":"technologies/docker/run-a-container.md#3-publish-it-through-turbostack","url":"https://docs.turbostack.app/technologies/docker/run-a-container/#3-publish-it-through-turbostack","path":"technologies/docker/run-a-container.md","title":"How to run a Docker container","heading":"3. Publish it through TurboStack","keywords":"run Docker container Docker hosting container on server Docker run restart policy docker volume","text":"Point the reverse proxy at the port you published, so Nginx serves\nthe app on your domain with HTTPS:\n\n```yaml\ndocker_enabled: true\nproxy_enabled: true\nproxy_upstream_port: 8080 # the host port you published above\n```\n\nPublish the change to apply it."} {"id":"technologies/docker/run-a-container.md#keep-data-in-a-volume","url":"https://docs.turbostack.app/technologies/docker/run-a-container/#keep-data-in-a-volume","path":"technologies/docker/run-a-container.md","title":"How to run a Docker container","heading":"Keep data in a volume","keywords":"run Docker container Docker hosting container on server Docker run restart policy docker volume","text":"Anything written inside the container is lost when it is recreated. Store data you need to keep in a\n**named volume**, mounted into the container:\n\n```bash\ndocker run -d --name myapp -v myapp_data:/data your-image:1.2\n```"} {"id":"technologies/docker/run-a-container.md#manage-the-container","url":"https://docs.turbostack.app/technologies/docker/run-a-container/#manage-the-container","path":"technologies/docker/run-a-container.md","title":"How to run a Docker container","heading":"Manage the container","keywords":"run Docker container Docker hosting container on server Docker run restart policy docker volume","text":"```bash\ndocker ps # running containers\ndocker ps -a # all containers, including stopped ones\ndocker logs -n 100 myapp # recent logs\ndocker stop myapp # stop\ndocker start myapp # start\ndocker rm myapp # remove (stop it first)\n```\n\n> [!TIP]\n> Run one main process per container and keep images small and purpose-built. For anything TurboStack\n> manages for you - databases, cache, PHP - use the built-in technologies instead of\n> a container."} {"id":"technologies/docker/run-a-container.md#related","url":"https://docs.turbostack.app/technologies/docker/run-a-container/#related","path":"technologies/docker/run-a-container.md","title":"How to run a Docker container","heading":"Related","keywords":"run Docker container Docker hosting container on server Docker run restart policy docker volume","text":"- Configure Docker\n- Use Docker Compose\n- Configure Reverse Proxy\n- SSH access\n- What is Docker?"} {"id":"technologies/docker/use-docker-compose.md#intro","url":"https://docs.turbostack.app/technologies/docker/use-docker-compose/","path":"technologies/docker/use-docker-compose.md","title":"How to use Docker Compose","heading":"","keywords":"docker compose compose.yaml multi-container docker compose up compose turbostack","text":"# How to use Docker Compose\n\nDocker Compose lets you describe a multi-container application - for example an app plus its\ndatabase - in a single `compose.yaml` file and start it with one command. On TurboStack the modern\n**`docker compose`** (v2) is available once Docker is enabled, and TurboStack still\nreverse-proxies public traffic to your app through Nginx.\n\nUse Compose instead of a single `docker run` when your app is more than one\ncontainer, or when you want its configuration version-controlled in a file."} {"id":"technologies/docker/use-docker-compose.md#1-enable-docker-for-the-application","url":"https://docs.turbostack.app/technologies/docker/use-docker-compose/#1-enable-docker-for-the-application","path":"technologies/docker/use-docker-compose.md","title":"How to use Docker Compose","heading":"1. Enable Docker for the application","keywords":"docker compose compose.yaml multi-container docker compose up compose turbostack","text":"Turn on Docker under **Configure application > Technologies > Docker** (see\nConfigure Docker). Every system user with Docker enabled is added to the `docker`\ngroup and can run the `docker` and `docker compose` commands over\nSSH."} {"id":"technologies/docker/use-docker-compose.md#2-write-a-compose-yaml","url":"https://docs.turbostack.app/technologies/docker/use-docker-compose/#2-write-a-compose-yaml","path":"technologies/docker/use-docker-compose.md","title":"How to use Docker Compose","heading":"2. Write a `compose.yaml`","keywords":"docker compose compose.yaml multi-container docker compose up compose turbostack","text":"Create a `compose.yaml` in your application directory (for example `~/app`). Publish only the\nfront-facing port, and bind it to **localhost** so it is reachable only through Nginx; internal\nservices (such as a database) need no published ports because containers reach each other by service\nname on the Compose network.\n\n```yaml\nservices:\n web:\n image: your-image:1.2\n restart: unless-stopped\n ports:\n - \"127.0.0.1:8080:80\" # published to localhost; Nginx proxies to this\n environment:\n DATABASE_URL: \"postgres://appuser@db:5432/appdb\"\n depends_on:\n - db\n\n db:\n image: postgres:17\n restart: unless-stopped\n environment:\n POSTGRES_USER: appuser\n POSTGRES_DB: appdb\n POSTGRES_PASSWORD: change-me\n volumes:\n - db-data:/var/lib/postgresql/data\n # no ports: only reachable by other services (here, \"web\") on the Compose network\n\nvolumes:\n db-data:\n```\n\n- **Pin image tags** (`your-image:1.2`, `postgres:17`) rather than `latest`, so deployments are\n reproducible.\n- **`restart: unless-stopped`** brings a container back after a crash or a server reboot.\n- Keep data you need to survive a container rebuild in a **named volume** (`db-data` above), never in\n the container's writable layer.\n- Store secrets in an **`.env` file** next to the compose file (Compose reads it automatically) rather\n than committing them."} {"id":"technologies/docker/use-docker-compose.md#3-start-and-manage-the-stack","url":"https://docs.turbostack.app/technologies/docker/use-docker-compose/#3-start-and-manage-the-stack","path":"technologies/docker/use-docker-compose.md","title":"How to use Docker Compose","heading":"3. Start and manage the stack","keywords":"docker compose compose.yaml multi-container docker compose up compose turbostack","text":"Run these from the directory that holds `compose.yaml`:\n\n```bash\ndocker compose up -d # create and start everything, in the background\ndocker compose ps # what is running\ndocker compose logs -f # follow the logs (Ctrl+C to stop watching)\ndocker compose pull # fetch newer images...\ndocker compose up -d # ...then re-create containers with them\ndocker compose down # stop and remove the containers (keeps named volumes)\n```\n\n> [!WARNING]\n> `docker compose down --volumes` also deletes the named volumes - and the data in them. Leave off\n> `--volumes` unless you really want to wipe the data."} {"id":"technologies/docker/use-docker-compose.md#4-publish-it-through-turbostack","url":"https://docs.turbostack.app/technologies/docker/use-docker-compose/#4-publish-it-through-turbostack","path":"technologies/docker/use-docker-compose.md","title":"How to use Docker Compose","heading":"4. Publish it through TurboStack","keywords":"docker compose compose.yaml multi-container docker compose up compose turbostack","text":"Point the reverse proxy at the port you published so Nginx serves the\napp on your domain with HTTPS:\n\n```yaml\ndocker_enabled: true\nproxy_enabled: true\nproxy_upstream_port: 8080 # the host port published by the web service\n```\n\nPublish the change to apply it."} {"id":"technologies/docker/use-docker-compose.md#keep-the-stack-running","url":"https://docs.turbostack.app/technologies/docker/use-docker-compose/#keep-the-stack-running","path":"technologies/docker/use-docker-compose.md","title":"How to use Docker Compose","heading":"Keep the stack running","keywords":"docker compose compose.yaml multi-container docker compose up compose turbostack","text":"`restart: unless-stopped` already restarts your containers after a crash or reboot. To manage the\nwhole stack as one service - so it is guaranteed to launch and you can start and stop it cleanly -\nwrap it in a **user systemd service**. Create `~/.config/systemd/user/myapp.service`:\n\n```ini\n[Unit]\nDescription=My Compose app\nAfter=network-online.target\nStartLimitIntervalSec=0\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nWorkingDirectory=%h/app\nExecStart=docker compose up -d\nExecStop=docker compose down\nRestart=on-failure\nRestartSec=15s\n\n[Install]\nWantedBy=default.target\n```\n\n```bash\nsystemctl --user enable --now myapp.service\nsystemctl --user status myapp.service\n```\n\nTurboStack keeps user services running after you log out, so the stack survives reboots. For the\n`systemd --user` basics, see Run with a process manager.\n\n> [!NOTE]\n> On modern hosts the command is **`docker compose`** (v2, a space). Only very old servers have the\n> legacy **`docker-compose`** (with a hyphen); the options are otherwise the same."} {"id":"technologies/docker/use-docker-compose.md#related","url":"https://docs.turbostack.app/technologies/docker/use-docker-compose/#related","path":"technologies/docker/use-docker-compose.md","title":"How to use Docker Compose","heading":"Related","keywords":"docker compose compose.yaml multi-container docker compose up compose turbostack","text":"- Run a single Docker container\n- Configure Docker\n- Configure Reverse Proxy\n- Run with a process manager\n- SSH access\n- What is Docker?"} {"id":"technologies/docker/what-is.md#intro","url":"https://docs.turbostack.app/technologies/docker/what-is/","path":"technologies/docker/what-is.md","title":"What is Docker?","heading":"","keywords":"what is Docker Docker hosting Docker turbostack Docker container containerized application","text":"# What is Docker?\n\nDocker is a platform for packaging an application together with everything it\nneeds to run - code, runtime, libraries and configuration - into a single,\nportable unit called a container. Containers are isolated from one another and\nfrom the host, so an app behaves the same wherever it runs.\n\nContainers are a clean way to deploy custom applications and microservices: the\ncontainer holds the exact environment the app expects, and the host only needs\nto run the container engine. On TurboStack, Docker lets you run such\ncontainerized applications alongside TurboStack's managed web, Transport Layer Security (TLS) and security\nlayers."} {"id":"technologies/docker/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/docker/what-is/#on-turbostack","path":"technologies/docker/what-is.md","title":"What is Docker?","heading":"On TurboStack","keywords":"what is Docker Docker hosting Docker turbostack Docker container containerized application","text":"Docker is enabled **per application** under **Configure application > Technologies >\nDocker**.\n\n- When you enable it, TurboStack provisions Docker for the application so you can run\n a containerized application.\n- The container listens on its own port; **Nginx reverse-proxies to that port**,\n so combine Docker with the reverse proxy to\n publish the app behind TurboStack's public front door (TLS, caching,\n security).\n- This is a good fit for custom applications and microservices that ship as\n containers rather than as a standard PHP or runtime app.\n\n> [!NOTE]\n> Docker runs your container, but it does not expose it to the internet on its\n> own. Pair it with the reverse proxy so Nginx\n> forwards public traffic to the container's port."} {"id":"technologies/docker/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/docker/what-is/#best-practices","path":"technologies/docker/what-is.md","title":"What is Docker?","heading":"Best practices","keywords":"what is Docker Docker hosting Docker turbostack Docker container containerized application","text":"- Run one main process per container and keep images small and purpose-built.\n- Bind the container's published port to loopback and let Nginx proxy to it,\n rather than exposing it publicly.\n- Pin image versions (avoid relying on `latest`) so deployments are\n reproducible.\n- Configure the container to restart automatically so the upstream stays\n available behind the proxy.\n- Keep persistent data on mounted volumes, not inside the container's writable\n layer."} {"id":"technologies/docker/what-is.md#related","url":"https://docs.turbostack.app/technologies/docker/what-is/#related","path":"technologies/docker/what-is.md","title":"What is Docker?","heading":"Related","keywords":"what is Docker Docker hosting Docker turbostack Docker container containerized application","text":"- Configure Docker on TurboStack\n- Applications tab"} {"id":"technologies/dotnet/configure.md#intro","url":"https://docs.turbostack.app/technologies/dotnet/configure/","path":"technologies/dotnet/configure.md","title":"Configure .NET on TurboStack","heading":"","keywords":"configure dotnet turbostack dotnet yaml dotnet_version dotnet listen_port asp.net core hosting","text":"# Configure .NET on TurboStack\n\nEnable the .NET runtime for an application, choose a version, and let TurboStack run your app as a service behind nginx."} {"id":"technologies/dotnet/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/dotnet/configure/#where-to-configure-it","path":"technologies/dotnet/configure.md","title":"Configure .NET on TurboStack","heading":"Where to configure it","keywords":"configure dotnet turbostack dotnet yaml dotnet_version dotnet listen_port asp.net core hosting","text":".NET is configured per application. Open your host, go to an application's **Configure application > Technologies > .NET**, enable it, and select the runtime version. Saving updates the host YAML, provisions the runtime, and wires up the Nginx reverse proxy in front of your app."} {"id":"technologies/dotnet/configure.md#required","url":"https://docs.turbostack.app/technologies/dotnet/configure/#required","path":"technologies/dotnet/configure.md","title":"Configure .NET on TurboStack","heading":"Required","keywords":"configure dotnet turbostack dotnet yaml dotnet_version dotnet listen_port asp.net core hosting","text":"| Key | Meaning |\n|---|---|\n| `dotnet_version` | The .NET runtime version to install, for example `\"8.0\"` (or newer). Setting this key is what enables the .NET runtime for the application; there is no separate enable key. |"} {"id":"technologies/dotnet/configure.md#optional","url":"https://docs.turbostack.app/technologies/dotnet/configure/#optional","path":"technologies/dotnet/configure.md","title":"Configure .NET on TurboStack","heading":"Optional","keywords":"configure dotnet turbostack dotnet yaml dotnet_version dotnet listen_port asp.net core hosting","text":"| Key | Meaning |\n|---|---|\n| `dotnet_port_enabled` | Set to `true` to use a custom local listen port instead of the default. |\n| `dotnet.listen_port` | The local port your app listens on, which Nginx forwards to. Defaults to `5000`. |\n\n```yaml\ndotnet_version: \"8.0\"\n\n# Optional: run the app on a custom local port behind nginx\ndotnet_port_enabled: true\ndotnet:\n listen_port: 5000\n```\n\n> [!NOTE]\n> Your application only needs to listen on the local port. Nginx handles public HTTP/HTTPS traffic and Transport Layer Security (TLS) termination, forwarding requests to your app."} {"id":"technologies/dotnet/configure.md#related","url":"https://docs.turbostack.app/technologies/dotnet/configure/#related","path":"technologies/dotnet/configure.md","title":"Configure .NET on TurboStack","heading":"Related","keywords":"configure dotnet turbostack dotnet yaml dotnet_version dotnet listen_port asp.net core hosting","text":"- What is .NET?\n- Applications\n- Applications overview"} {"id":"technologies/dotnet/what-is.md#intro","url":"https://docs.turbostack.app/technologies/dotnet/what-is/","path":"technologies/dotnet/what-is.md","title":"What is .NET?","heading":"","keywords":"what is dotnet .net dotnet hosting dotnet turbostack c# runtime asp.net core nopcommerce","text":"# What is .NET?\n\n.NET is Microsoft's free, open-source, cross-platform development platform for building web applications, APIs, and background services. Modern .NET applications are typically written in C# and run on the .NET runtime, with ASP.NET Core as the web framework.\n\nOn Linux, a .NET web application is published as a self-contained process that listens on a local HTTP port. A web server in front of it handles public traffic, Transport Layer Security (TLS), and request forwarding, leaving your application to focus on the business logic."} {"id":"technologies/dotnet/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/dotnet/what-is/#on-turbostack","path":"technologies/dotnet/what-is.md","title":"What is .NET?","heading":"On TurboStack","keywords":"what is dotnet .net dotnet hosting dotnet turbostack c# runtime asp.net core nopcommerce","text":"TurboStack runs your .NET application as a managed background service and places an Nginx reverse proxy in front of it. Your app listens on a local port (5000 by default) and Nginx forwards public HTTP and HTTPS traffic to it, terminating TLS for you.\n\nYou enable .NET per application and pick the runtime version (for example `8.0`, or newer). TurboStack provisions the matching runtime, registers the service so it starts on boot and restarts on failure, and wires up the reverse proxy automatically. You only declare the runtime in your host YAML - the service and proxy plumbing is handled for you.\n\nA common workload is nopCommerce, the open-source ASP.NET Core e-commerce platform, which runs on this exact pattern."} {"id":"technologies/dotnet/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/dotnet/what-is/#best-practices","path":"technologies/dotnet/what-is.md","title":"What is .NET?","heading":"Best practices","keywords":"what is dotnet .net dotnet hosting dotnet turbostack c# runtime asp.net core nopcommerce","text":"- Target a current, supported .NET version (LTS releases are a safe default) and plan upgrades before a version reaches end of life.\n- Build and publish your app in `Release` configuration so it runs optimized.\n- Keep your app listening only on the local port; let Nginx handle public traffic and TLS.\n- Store secrets and connection strings in environment variables or configuration outside source control, not in `appsettings.json` committed to your repo.\n- Run database migrations as part of your deploy step, not on every application start.\n- Watch memory and CPU after deploys, since the runtime is long-lived and leaks accumulate over time."} {"id":"technologies/dotnet/what-is.md#related","url":"https://docs.turbostack.app/technologies/dotnet/what-is/#related","path":"technologies/dotnet/what-is.md","title":"What is .NET?","heading":"Related","keywords":"what is dotnet .net dotnet hosting dotnet turbostack c# runtime asp.net core nopcommerce","text":"- Configure .NET on TurboStack\n- Deploy nopCommerce"} {"id":"technologies/elasticsearch/configure.md#intro","url":"https://docs.turbostack.app/technologies/elasticsearch/configure/","path":"technologies/elasticsearch/configure.md","title":"Configure Elasticsearch on TurboStack","heading":"","keywords":"configure Elasticsearch turbostack Elasticsearch yaml elasticsearch_version elasticsearch_heap_size elasticsearch_plugins search plugins elasticsearch_kibana elasticsearch_network_host Kibana url","text":"# Configure Elasticsearch on TurboStack\n\nEnable Elasticsearch and set its version at the host level, then optionally tune the JVM heap and plugins."} {"id":"technologies/elasticsearch/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/elasticsearch/configure/#where-to-configure-it","path":"technologies/elasticsearch/configure.md","title":"Configure Elasticsearch on TurboStack","heading":"Where to configure it","keywords":"configure Elasticsearch turbostack Elasticsearch yaml elasticsearch_version elasticsearch_heap_size elasticsearch_plugins search plugins elasticsearch_kibana elasticsearch_network_host Kibana url","text":"Open the host, go to the **Services** tab, select **ElasticSearch / OpenSearch**, and choose\n**Elasticsearch**."} {"id":"technologies/elasticsearch/configure.md#required","url":"https://docs.turbostack.app/technologies/elasticsearch/configure/#required","path":"technologies/elasticsearch/configure.md","title":"Configure Elasticsearch on TurboStack","heading":"Required","keywords":"configure Elasticsearch turbostack Elasticsearch yaml elasticsearch_version elasticsearch_heap_size elasticsearch_plugins search plugins elasticsearch_kibana elasticsearch_network_host Kibana url","text":"| Key | Meaning |\n| --- | --- |\n| `elasticsearch_version` | Elasticsearch version to run (for example, `\"8.x\"`). |"} {"id":"technologies/elasticsearch/configure.md#optional","url":"https://docs.turbostack.app/technologies/elasticsearch/configure/#optional","path":"technologies/elasticsearch/configure.md","title":"Configure Elasticsearch on TurboStack","heading":"Optional","keywords":"configure Elasticsearch turbostack Elasticsearch yaml elasticsearch_version elasticsearch_heap_size elasticsearch_plugins search plugins elasticsearch_kibana elasticsearch_network_host Kibana url","text":"| Key | Meaning |\n| --- | --- |\n| `elasticsearch_heap_size` | JVM heap size (auto-sized; override only with measured evidence). |\n| `elasticsearch_plugins` | Search-engine plugins to enable. |\n| `elasticsearch_kibana` | Installs the Kibana web interface. Off by default. |\n| `elasticsearch_network_host` | Which address Elasticsearch listens on. Defaults to `localhost`. |\n\n```yaml\nelasticsearch_version: \"8.x\" # required: enable Elasticsearch on the host\n# elasticsearch_heap_size: \"2g\" # optional: only override with measured evidence\n# elasticsearch_kibana: true # optional: the Kibana web interface\n# elasticsearch_network_host: INTERNAL # optional: private network only, never public\n```"} {"id":"technologies/elasticsearch/configure.md#listening-address","url":"https://docs.turbostack.app/technologies/elasticsearch/configure/#listening-address","path":"technologies/elasticsearch/configure.md","title":"Configure Elasticsearch on TurboStack","heading":"Listening address","keywords":"configure Elasticsearch turbostack Elasticsearch yaml elasticsearch_version elasticsearch_heap_size elasticsearch_plugins search plugins elasticsearch_kibana elasticsearch_network_host Kibana url","text":"By default Elasticsearch accepts connections only from the host itself. Set\n`elasticsearch_network_host` to `INTERNAL` when another server on the private network must reach\nit: that binds the loopback addresses plus the host's private IPv4 addresses. You can also give a\nsingle specific address.\n\n> [!WARNING]\n> Never bind Elasticsearch to a public address. It has no authentication of its own, so anything\n> that can reach the port can read and change your indexes."} {"id":"technologies/elasticsearch/configure.md#kibana","url":"https://docs.turbostack.app/technologies/elasticsearch/configure/#kibana","path":"technologies/elasticsearch/configure.md","title":"Configure Elasticsearch on TurboStack","heading":"Kibana","keywords":"configure Elasticsearch turbostack Elasticsearch yaml elasticsearch_version elasticsearch_heap_size elasticsearch_plugins search plugins elasticsearch_kibana elasticsearch_network_host Kibana url","text":"`elasticsearch_kibana: true` installs Kibana, which you then reach at **`https:///kibana`**.\nThe web server proxies that path and asks for a user name and password first; use one of the\nhost's system user accounts, the same credentials you use for SSH. Kibana itself is never exposed\ndirectly."} {"id":"technologies/elasticsearch/configure.md#plugins","url":"https://docs.turbostack.app/technologies/elasticsearch/configure/#plugins","path":"technologies/elasticsearch/configure.md","title":"Configure Elasticsearch on TurboStack","heading":"Plugins","keywords":"configure Elasticsearch turbostack Elasticsearch yaml elasticsearch_version elasticsearch_heap_size elasticsearch_plugins search plugins elasticsearch_kibana elasticsearch_network_host Kibana url","text":"**Plugins** is a multi-select on the Services tab. The list you choose from is maintained by\nHosted Power and changes as engine versions come and go, so check the dropdown for what is\navailable today.\n\nTwo things happen automatically on the next deployment:\n\n- **Removing a plugin from the list uninstalls it.** Every installed plugin that is not in\n `elasticsearch_plugins` is removed, so treat the field as the complete list of what you want\n rather than a list of additions.\n- **Changing the Elasticsearch version reinstalls every plugin**, so each one is installed again\n for the new engine version.\n\n> [!TIP]\n> Choose **either** Elasticsearch **or** OpenSearch on a host - not both."} {"id":"technologies/elasticsearch/configure.md#related","url":"https://docs.turbostack.app/technologies/elasticsearch/configure/#related","path":"technologies/elasticsearch/configure.md","title":"Configure Elasticsearch on TurboStack","heading":"Related","keywords":"configure Elasticsearch turbostack Elasticsearch yaml elasticsearch_version elasticsearch_heap_size elasticsearch_plugins search plugins elasticsearch_kibana elasticsearch_network_host Kibana url","text":"- What is Elasticsearch?\n- OpenSearch\n- Services\n- Deploying Magento"} {"id":"technologies/elasticsearch/what-is.md#intro","url":"https://docs.turbostack.app/technologies/elasticsearch/what-is/","path":"technologies/elasticsearch/what-is.md","title":"What is Elasticsearch?","heading":"","keywords":"what is Elasticsearch Elasticsearch hosting Elasticsearch turbostack magento search engine full-text search","text":"# What is Elasticsearch?\n\nElasticsearch is a distributed full-text search and analytics engine. It stores documents in\nindices and answers fast, relevance-ranked queries - powering product search, filtering,\nautocomplete and faceted navigation. It runs on the JVM and scales across nodes.\n\n> [!NOTE]\n> Prefer a fully open-source engine? TurboStack also offers OpenSearch,\n> an Elasticsearch-compatible alternative."} {"id":"technologies/elasticsearch/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/elasticsearch/what-is/#on-turbostack","path":"technologies/elasticsearch/what-is.md","title":"What is Elasticsearch?","heading":"On TurboStack","keywords":"what is Elasticsearch Elasticsearch hosting Elasticsearch turbostack magento search engine full-text search","text":"Enable Elasticsearch at the host level and pick a version (`elasticsearch_version`, e.g. `\"8.x\"`).\nTurboStack auto-sizes the JVM heap; you can configure plugins. Elasticsearch is **required by Magento 2**\nand used by Akeneo for catalog/product search."} {"id":"technologies/elasticsearch/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/elasticsearch/what-is/#best-practices","path":"technologies/elasticsearch/what-is.md","title":"What is Elasticsearch?","heading":"Best practices","keywords":"what is Elasticsearch Elasticsearch hosting Elasticsearch turbostack magento search engine full-text search","text":"- Only enable it for applications that need it - Magento 2 requires it; most others don't.\n- Keep the heap auto-sized unless you measure memory pressure - see Performance tuning.\n- Match the engine version to the version your application supports.\n- Reindex after large catalog/content changes."} {"id":"technologies/elasticsearch/what-is.md#related","url":"https://docs.turbostack.app/technologies/elasticsearch/what-is/#related","path":"technologies/elasticsearch/what-is.md","title":"What is Elasticsearch?","heading":"Related","keywords":"what is Elasticsearch Elasticsearch hosting Elasticsearch turbostack magento search engine full-text search","text":"- Configure Elasticsearch\n- OpenSearch\n- Services"} {"id":"technologies/firewall/block-an-ip.md#intro","url":"https://docs.turbostack.app/technologies/firewall/block-an-ip/","path":"technologies/firewall/block-an-ip.md","title":"How to block an IP address","heading":"","keywords":"block ip firewall block ban ip address stop attacker ip tscli firewall","text":"# How to block an IP address\n\nTurboStack's firewall already blocks abusive clients automatically - for example after\nrepeated failed logins across SSH, FTP, mail and HTTP. Failed attempts are counted **collectively\nacross all of these protocols** against a single threshold, rather than per protocol, and the firewall\nreacts within seconds of the suspicious activity. You only need to block an address by hand when you\nwant to stop a specific attacker or scraper that the automatic protection has not caught yet.\n\n> [!NOTE]\n> A firewall block stops an IP at the **network level, for the whole host**. To block by request path\n> or for a single application, do it at the web server instead - see\n> Block IP addresses in Nginx."} {"id":"technologies/firewall/block-an-ip.md#block-an-ip-with-the-cli","url":"https://docs.turbostack.app/technologies/firewall/block-an-ip/#block-an-ip-with-the-cli","path":"technologies/firewall/block-an-ip.md","title":"How to block an IP address","heading":"Block an IP with the CLI","keywords":"block ip firewall block ban ip address stop attacker ip tscli firewall","text":"Connect over SSH and use `tscli firewall block`:\n\n```bash\n# Block an IP for a week, with a reason\ntscli firewall block 203.0.113.10 --time 604800 --comment \"spam\"\n\n# Block a whole range permanently\ntscli firewall block 203.0.113.0/24 --time -1\n```\n\n`--time` is in seconds (`-1` means permanent) and `--comment` records why. See the\nTurboStack CLI for the full list of options."} {"id":"technologies/firewall/block-an-ip.md#check-whether-an-ip-is-blocked","url":"https://docs.turbostack.app/technologies/firewall/block-an-ip/#check-whether-an-ip-is-blocked","path":"technologies/firewall/block-an-ip.md","title":"How to block an IP address","heading":"Check whether an IP is blocked","keywords":"block ip firewall block ban ip address stop attacker ip tscli firewall","text":"```bash\ntscli firewall check 203.0.113.10\n```\n\nThis also tells you whether the automatic protection has already blocked the address - useful when a\ncustomer reports being locked out."} {"id":"technologies/firewall/block-an-ip.md#remove-a-block","url":"https://docs.turbostack.app/technologies/firewall/block-an-ip/#remove-a-block","path":"technologies/firewall/block-an-ip.md","title":"How to block an IP address","heading":"Remove a block","keywords":"block ip firewall block ban ip address stop attacker ip tscli firewall","text":"```bash\ntscli firewall unblock 203.0.113.10\n```\n\nTo clear every automatic block at once there is `tscli firewall flush`, but read the warning on the\nTurboStack CLI page first: it also removes blocks that are protecting you from\nactive abuse."} {"id":"technologies/firewall/block-an-ip.md#related","url":"https://docs.turbostack.app/technologies/firewall/block-an-ip/#related","path":"technologies/firewall/block-an-ip.md","title":"How to block an IP address","heading":"Related","keywords":"block ip firewall block ban ip address stop attacker ip tscli firewall","text":"- Configure the firewall\n- Whitelist an IP address\n- Block IP addresses in Nginx\n- TurboStack CLI\n- Fixing 403 errors"} {"id":"technologies/firewall/configure.md#intro","url":"https://docs.turbostack.app/technologies/firewall/configure/","path":"technologies/firewall/configure.md","title":"Configure the Firewall on TurboStack","heading":"","keywords":"configure firewall turbostack firewall yaml web application firewall geoip filtering ip whitelist","text":"# Configure the Firewall on TurboStack\n\nAdd trusted IPs, optional country rules, and the Web Application Firewall for a\nhost - the firewall itself is managed for you."} {"id":"technologies/firewall/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/firewall/configure/#where-to-configure-it","path":"technologies/firewall/configure.md","title":"Configure the Firewall on TurboStack","heading":"Where to configure it","keywords":"configure firewall turbostack firewall yaml web application firewall geoip filtering ip whitelist","text":"The firewall is configured at the **host** level:\n\n1. Open the host.\n2. Go to the **Security** tab.\n3. Use **Whitelist IP Addresses** for trusted clients, **Firewall GeoIP\n Filtering** for country rules, and **Web Application Firewall** to enable the\n WAF.\n\nThese settings apply to every application on the host."} {"id":"technologies/firewall/configure.md#required","url":"https://docs.turbostack.app/technologies/firewall/configure/#required","path":"technologies/firewall/configure.md","title":"Configure the Firewall on TurboStack","heading":"Required","keywords":"configure firewall turbostack firewall yaml web application firewall geoip filtering ip whitelist","text":"There are no required firewall keys - every setting below is optional. Add only\nthe ones you need."} {"id":"technologies/firewall/configure.md#optional","url":"https://docs.turbostack.app/technologies/firewall/configure/#optional","path":"technologies/firewall/configure.md","title":"Configure the Firewall on TurboStack","heading":"Optional","keywords":"configure firewall turbostack firewall yaml web application firewall geoip filtering ip whitelist","text":"| Key | Meaning |\n|---|---|\n| `firewall_whitelist` | Trusted IP/Classless Inter-Domain Routing (CIDR) allow-list. Listed clients bypass rate-limiting and blocking. |\n| `firewall_country_allow` | GeoIP allow-list of countries permitted to reach the host. |\n| `firewall_country_block` | GeoIP block-list of countries denied access to the host. |\n\nThe **Web Application Firewall** is enabled with its toggle on the Security tab;\nit blocks common attacks such as SQL injection and XSS.\n\n```yaml\n# Host-level: trusted IPs and a country block rule\nfirewall_whitelist:\n - 203.0.113.10\n - 198.51.100.0/24\nfirewall_country_block:\n - RU\n```\n\n> [!WARNING]\n> Wide IP ranges and country blocks can have side effects - a broad CIDR trusts\n> more clients than intended, and country rules can block legitimate users or\n> third-party services. Keep entries narrow and test before relying on them.\n\n\n\n> [!NOTE]\n> On hosts that run the cPanel or DirectAdmin control panel, the firewall can also be managed from\n> the control panel's own firewall interface. See the control panel's documentation for the exact\n> steps."} {"id":"technologies/firewall/configure.md#common-tasks","url":"https://docs.turbostack.app/technologies/firewall/configure/#common-tasks","path":"technologies/firewall/configure.md","title":"Configure the Firewall on TurboStack","heading":"Common tasks","keywords":"configure firewall turbostack firewall yaml web application firewall geoip filtering ip whitelist","text":"- Block an IP address\n- Whitelist an IP address"} {"id":"technologies/firewall/configure.md#related","url":"https://docs.turbostack.app/technologies/firewall/configure/#related","path":"technologies/firewall/configure.md","title":"Configure the Firewall on TurboStack","heading":"Related","keywords":"configure firewall turbostack firewall yaml web application firewall geoip filtering ip whitelist","text":"- What is the Firewall?\n- Host Security tab\n- Security hardening\n- TurboStack CLI - block, whitelist or check an IP with `tscli firewall`"} {"id":"technologies/firewall/what-is.md#intro","url":"https://docs.turbostack.app/technologies/firewall/what-is/","path":"technologies/firewall/what-is.md","title":"What is the Firewall?","heading":"","keywords":"what is firewall firewall hosting firewall turbostack web application firewall geoip filtering","text":"# What is the Firewall?\n\nThe firewall controls **network access** to a host. It decides which clients are\nallowed through, which are blocked, and adds an application-layer filter that\ninspects web requests for common attacks.\n\nOn TurboStack the firewall is managed automatically - you do not write\nlow-level rules. Instead you provide a small amount of high-level intent: trusted\nIP addresses that should always be allowed, optional country-based rules, and a\ntoggle for a Web Application Firewall that screens incoming requests."} {"id":"technologies/firewall/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/firewall/what-is/#on-turbostack","path":"technologies/firewall/what-is.md","title":"What is the Firewall?","heading":"On TurboStack","keywords":"what is firewall firewall hosting firewall turbostack web application firewall geoip filtering","text":"The firewall is configured at the **host** level and has three parts:\n\n- **Trusted IP allow-list** - IP addresses or Classless Inter-Domain Routing (CIDR) ranges you trust. Trusted\n clients **bypass rate-limiting and blocking**, so use this for your own\n offices, monitoring, and partner integrations.\n- **GeoIP country filtering** - optional rules to allow or block traffic by\n country. Useful when your audience is concentrated in, or excluded from,\n specific regions.\n- **Web Application Firewall (WAF)** - an optional filter that blocks common web\n attacks such as SQL injection and cross-site scripting (XSS) before they reach\n your application.\n\n> [!WARNING]\n> Wide IP ranges and country blocks can have side effects. A broad CIDR can trust\n> more clients than you intend, and country rules can unexpectedly block real\n> users, CDNs, or payment providers. Keep allow-lists narrow and test country\n> rules carefully."} {"id":"technologies/firewall/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/firewall/what-is/#best-practices","path":"technologies/firewall/what-is.md","title":"What is the Firewall?","heading":"Best practices","keywords":"what is firewall firewall hosting firewall turbostack web application firewall geoip filtering","text":"- Allow-list only the specific IPs or tightest CIDR ranges you actually trust.\n- Prefer narrow, well-understood country rules over broad blocks, and verify they\n do not exclude legitimate traffic.\n- Enable the Web Application Firewall for public applications to catch common\n injection and scripting attacks.\n- Review your firewall settings periodically and remove entries you no longer\n need.\n- Combine the firewall with TurboShield rate limiting for layered protection."} {"id":"technologies/firewall/what-is.md#related","url":"https://docs.turbostack.app/technologies/firewall/what-is/#related","path":"technologies/firewall/what-is.md","title":"What is the Firewall?","heading":"Related","keywords":"what is firewall firewall hosting firewall turbostack web application firewall geoip filtering","text":"- Configure the Firewall on TurboStack\n- Host Security tab\n- Security hardening"} {"id":"technologies/firewall/whitelist-an-ip.md#intro","url":"https://docs.turbostack.app/technologies/firewall/whitelist-an-ip/","path":"technologies/firewall/whitelist-an-ip.md","title":"How to whitelist an IP address","heading":"","keywords":"whitelist ip allow ip firewall trust ip firewall allow list tscli firewall whitelist","text":"# How to whitelist an IP address\n\nAdd an IP address to the allow-list to **trust it permanently**. Trusted clients bypass rate-limiting\nand blocking, and are never caught by the automatic protection that blocks repeated failed logins. Use\nit for addresses you control - your office, a monitoring service, or a partner integration.\n\n> [!WARNING]\n> An allow-listed client skips the firewall's protections. Only add addresses you genuinely trust, and\n> keep the list as narrow as possible."} {"id":"technologies/firewall/whitelist-an-ip.md#add-a-trusted-ip-on-the-security-tab-recommended","url":"https://docs.turbostack.app/technologies/firewall/whitelist-an-ip/#add-a-trusted-ip-on-the-security-tab-recommended","path":"technologies/firewall/whitelist-an-ip.md","title":"How to whitelist an IP address","heading":"Add a trusted IP on the Security tab (recommended)","keywords":"whitelist ip allow ip firewall trust ip firewall allow list tscli firewall whitelist","text":"For lasting trust, add the address to the host configuration so it stays across deployments:\n\n1. Open the host and go to the **Security** tab.\n2. Under **Whitelist IP Addresses**, add the IP address, or the tightest range that covers it.\n3. Save and publish.\n\nThis writes the `firewall_whitelist` key for you - see Configure the firewall."} {"id":"technologies/firewall/whitelist-an-ip.md#whitelist-immediately-with-the-cli","url":"https://docs.turbostack.app/technologies/firewall/whitelist-an-ip/#whitelist-immediately-with-the-cli","path":"technologies/firewall/whitelist-an-ip.md","title":"How to whitelist an IP address","heading":"Whitelist immediately with the CLI","keywords":"whitelist ip allow ip firewall trust ip firewall allow list tscli firewall whitelist","text":"To trust an address right away - for example to restore access for someone who is locked out - connect\nover SSH:\n\n```bash\ntscli firewall whitelist 198.51.100.7\n```\n\nFor a change that must last, also add it on the Security tab as above."} {"id":"technologies/firewall/whitelist-an-ip.md#remove-from-the-allow-list","url":"https://docs.turbostack.app/technologies/firewall/whitelist-an-ip/#remove-from-the-allow-list","path":"technologies/firewall/whitelist-an-ip.md","title":"How to whitelist an IP address","heading":"Remove from the allow-list","keywords":"whitelist ip allow ip firewall trust ip firewall allow list tscli firewall whitelist","text":"```bash\ntscli firewall unlist 198.51.100.7\n```\n\nIf you added the address on the Security tab, remove it there and publish."} {"id":"technologies/firewall/whitelist-an-ip.md#related","url":"https://docs.turbostack.app/technologies/firewall/whitelist-an-ip/#related","path":"technologies/firewall/whitelist-an-ip.md","title":"How to whitelist an IP address","heading":"Related","keywords":"whitelist ip allow ip firewall trust ip firewall allow list tscli firewall whitelist","text":"- Configure the firewall\n- Block an IP address\n- Host Security tab\n- TurboStack CLI\n- Security hardening"} {"id":"technologies/index.md#intro","url":"https://docs.turbostack.app/technologies/","path":"technologies/index.md","title":"Technologies","heading":"","keywords":"turbostack technologies php mysql nginx postgresql Redis Docker Kubernetes turboshield firewall","text":"# Technologies\n\nTurboStack provisions and configures the building blocks your applications run on - web servers,\nlanguage runtimes, databases, caching, search, containers and security. This section covers\nwhat each technology is and how to configure it on TurboStack (where it lives in the\ninterface and the YAML it produces).\n\nEvery technology here is standard open-source or industry-standard software (Nginx, PHP, MySQL,\nPostgreSQL, Redis, Docker and so on). Your applications stay portable, so you are not locked into a\nproprietary platform."} {"id":"technologies/index.md#where-technologies-are-configured","url":"https://docs.turbostack.app/technologies/#where-technologies-are-configured","path":"technologies/index.md","title":"Technologies","heading":"Where technologies are configured","keywords":"turbostack technologies php mysql nginx postgresql Redis Docker Kubernetes turboshield firewall","text":"| Technology group | Where you configure it |\n|---|---|\n| Web server (Nginx/Apache), databases, Redis, search | a host's **Services** tab - see Services |\n| Runtimes (PHP, Node.js, Python, Ruby, .NET), Docker, Kubernetes, Varnish, RabbitMQ, reverse proxy | an application's **Configure application > Technologies** - see Applications |\n| TurboShield, firewall, Web Application Firewall (WAF) | a host's **Security** tab - see Security |\n| SSH access | a host's **SSH** tab - see SSH |\n\n> [!TIP]\n> Every technology page comes in two parts: **What is it** (background + how TurboStack runs it)\n> and **How to configure it on TurboStack** (the GUI location + required/optional YAML)."} {"id":"technologies/index.md#web-servers-and-runtimes","url":"https://docs.turbostack.app/technologies/#web-servers-and-runtimes","path":"technologies/index.md","title":"Technologies","heading":"Web servers and runtimes","keywords":"turbostack technologies php mysql nginx postgresql Redis Docker Kubernetes turboshield firewall","text":"| Technology | Pages |\n|---|---|\n| Nginx | What is it | Configure |\n| Apache | What is it | Configure |\n| PHP | What is it | Configure |\n| Node.js | What is it | Configure |\n| Python | What is it | Configure |\n| Ruby | What is it | Configure |\n| .NET | What is it | Configure |"} {"id":"technologies/index.md#databases-search-and-messaging","url":"https://docs.turbostack.app/technologies/#databases-search-and-messaging","path":"technologies/index.md","title":"Technologies","heading":"Databases, search and messaging","keywords":"turbostack technologies php mysql nginx postgresql Redis Docker Kubernetes turboshield firewall","text":"| Technology | Pages |\n|---|---|\n| MySQL | What is it | Configure |\n| PostgreSQL | What is it | Configure |\n| MongoDB | What is it | Configure |\n| Microsoft SQL Server | What is it | Configure |\n| Redis | What is it | Configure |\n| RabbitMQ | What is it | Configure |\n| Elasticsearch | What is it | Configure |\n| OpenSearch | What is it | Configure |"} {"id":"technologies/index.md#caching-proxy-and-containers","url":"https://docs.turbostack.app/technologies/#caching-proxy-and-containers","path":"technologies/index.md","title":"Technologies","heading":"Caching, proxy and containers","keywords":"turbostack technologies php mysql nginx postgresql Redis Docker Kubernetes turboshield firewall","text":"| Technology | Pages |\n|---|---|\n| Varnish | What is it | Configure |\n| Reverse proxy | What is it | Configure |\n| Docker | What is it | Configure |\n| Kubernetes | What is it | Configure |"} {"id":"technologies/index.md#security-and-access","url":"https://docs.turbostack.app/technologies/#security-and-access","path":"technologies/index.md","title":"Technologies","heading":"Security and access","keywords":"turbostack technologies php mysql nginx postgresql Redis Docker Kubernetes turboshield firewall","text":"| Technology | Pages |\n|---|---|\n| TurboShield | What is it | Configure |\n| Firewall | What is it | Configure |\n| SSH | What is it | Configure |\n| VPN | What is it | Configure |"} {"id":"technologies/index.md#mail","url":"https://docs.turbostack.app/technologies/#mail","path":"technologies/index.md","title":"Technologies","heading":"Mail","keywords":"turbostack technologies php mysql nginx postgresql Redis Docker Kubernetes turboshield firewall","text":"| Technology | Pages |\n|---|---|\n| Mail | What is it | Configure |"} {"id":"technologies/index.md#related","url":"https://docs.turbostack.app/technologies/#related","path":"technologies/index.md","title":"Technologies","heading":"Related","keywords":"turbostack technologies php mysql nginx postgresql Redis Docker Kubernetes turboshield firewall","text":"- Services and Applications - the host tabs.\n- Deploying applications - full per-application configurations.\n- The Source (YAML) view - edit configuration as YAML.\n- Glossary - what the terms and abbreviations mean."} {"id":"technologies/kubernetes/configure.md#intro","url":"https://docs.turbostack.app/technologies/kubernetes/configure/","path":"technologies/kubernetes/configure.md","title":"Configure Kubernetes on TurboStack","heading":"","keywords":"configure Kubernetes turbostack Kubernetes yaml k8s enabled k8s turbostack","text":"# Configure Kubernetes on TurboStack\n\nEnabling Kubernetes for an application provisions a lightweight orchestrator so you\ncan run containerized workloads."} {"id":"technologies/kubernetes/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/kubernetes/configure/#where-to-configure-it","path":"technologies/kubernetes/configure.md","title":"Configure Kubernetes on TurboStack","heading":"Where to configure it","keywords":"configure Kubernetes turbostack Kubernetes yaml k8s enabled k8s turbostack","text":"Kubernetes is enabled per application:\n\n1. Open the host and select the application.\n2. Go to **Configure application > Technologies > K8s**.\n3. Enable Kubernetes.\n\nTurboStack provisions the lightweight cluster from there; you then deploy your\nworkloads onto it."} {"id":"technologies/kubernetes/configure.md#required","url":"https://docs.turbostack.app/technologies/kubernetes/configure/#required","path":"technologies/kubernetes/configure.md","title":"Configure Kubernetes on TurboStack","heading":"Required","keywords":"configure Kubernetes turbostack Kubernetes yaml k8s enabled k8s turbostack","text":"| Key | Meaning |\n|---|---|\n| `k8s_enabled` | Set to `true` to provision a lightweight Kubernetes environment for this application. |"} {"id":"technologies/kubernetes/configure.md#optional","url":"https://docs.turbostack.app/technologies/kubernetes/configure/#optional","path":"technologies/kubernetes/configure.md","title":"Configure Kubernetes on TurboStack","heading":"Optional","keywords":"configure Kubernetes turbostack Kubernetes yaml k8s enabled k8s turbostack","text":"There are no additional Kubernetes keys to set in TurboStack - your workloads are\ndescribed by your own Kubernetes manifests.\n\n```yaml\n# Per-application: run containerized workloads on Kubernetes\nk8s_enabled: true\n```\n\n> [!TIP]\n> Kubernetes is intended for platform-grade applications such as GitLab and Advanced Database Monitoring.\n> For these, follow the application guidance in\n> Self-hosted platforms."} {"id":"technologies/kubernetes/configure.md#related","url":"https://docs.turbostack.app/technologies/kubernetes/configure/#related","path":"technologies/kubernetes/configure.md","title":"Configure Kubernetes on TurboStack","heading":"Related","keywords":"configure Kubernetes turbostack Kubernetes yaml k8s enabled k8s turbostack","text":"- What is Kubernetes?\n- Self-hosted platforms\n- Applications overview"} {"id":"technologies/kubernetes/what-is.md#intro","url":"https://docs.turbostack.app/technologies/kubernetes/what-is/","path":"technologies/kubernetes/what-is.md","title":"What is Kubernetes?","heading":"","keywords":"what is Kubernetes Kubernetes hosting Kubernetes turbostack k8s container orchestration","text":"# What is Kubernetes?\n\nKubernetes (often shortened to **k8s**) is a system for running and managing\ncontainerized workloads. It schedules containers across resources, keeps the\ndeclared number of instances running, handles restarts, and exposes services\ninside the cluster - giving applications a consistent way to deploy and scale.\n\nOn TurboStack, Kubernetes provides a lightweight orchestrator for\ncontainerized applications. It is aimed at platform-grade workloads that ship as\nKubernetes manifests, rather than at standard PHP or single-container apps."} {"id":"technologies/kubernetes/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/kubernetes/what-is/#on-turbostack","path":"technologies/kubernetes/what-is.md","title":"What is Kubernetes?","heading":"On TurboStack","keywords":"what is Kubernetes Kubernetes hosting Kubernetes turbostack k8s container orchestration","text":"Kubernetes is enabled **per application** under **Configure application >\nTechnologies > K8s**.\n\n- When you enable it, TurboStack provisions a lightweight Kubernetes environment\n on the host so you can run containerized workloads.\n- It is used by **platform-grade self-hosted applications** - for example GitLab\n and Advanced Database Monitoring - that are packaged to run on Kubernetes. See\n Self-hosted platforms.\n- TurboStack manages the cluster provisioning; you deploy your workloads onto it\n and, where needed, front them with TurboStack's web and security layers.\n\n> [!NOTE]\n> Kubernetes is the right choice for platform-grade applications that expect to\n> run on k8s. For a single custom container, Docker\n> with the reverse proxy is usually simpler."} {"id":"technologies/kubernetes/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/kubernetes/what-is/#best-practices","path":"technologies/kubernetes/what-is.md","title":"What is Kubernetes?","heading":"Best practices","keywords":"what is Kubernetes Kubernetes hosting Kubernetes turbostack k8s container orchestration","text":"- Reserve Kubernetes for workloads that genuinely benefit from orchestration;\n use Docker for simple single-container apps.\n- Declare resource requests and limits so workloads are scheduled predictably.\n- Keep manifests in version control so deployments are reproducible.\n- Pin container image versions rather than relying on `latest`.\n- Use readiness and liveness probes so unhealthy pods are restarted\n automatically."} {"id":"technologies/kubernetes/what-is.md#related","url":"https://docs.turbostack.app/technologies/kubernetes/what-is/#related","path":"technologies/kubernetes/what-is.md","title":"What is Kubernetes?","heading":"Related","keywords":"what is Kubernetes Kubernetes hosting Kubernetes turbostack k8s container orchestration","text":"- Configure Kubernetes on TurboStack\n- Self-hosted platforms"} {"id":"technologies/mail/configure.md#intro","url":"https://docs.turbostack.app/technologies/mail/configure/","path":"technologies/mail/configure.md","title":"Configure mail on TurboStack","heading":"","keywords":"configure turbostack mail dkim mailhog_install mail_devtool mailpit mail catcher tscli dkim","text":"# Configure mail on TurboStack\n\nOutbound mail is a host-level service. You configure two things: **DKIM** signing for your sending\ndomains, and an optional **development mail-catcher**. Both live under the host's\n**Advanced > Mail Settings**. For the background on how mail works, see\nWhat is mail on TurboStack?."} {"id":"technologies/mail/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/mail/configure/#where-to-configure-it","path":"technologies/mail/configure.md","title":"Configure mail on TurboStack","heading":"Where to configure it","keywords":"configure turbostack mail dkim mailhog_install mail_devtool mailpit mail catcher tscli dkim","text":"Open the host, go to the **Advanced** tab, and select **Mail Settings**. Changes are written to the\nhost's YAML and applied on the next deployment.\n\n> [!NOTE]\n> There is no on/off switch for the local mail service - it is available on the host for your\n> applications to send through. What you configure here is domain signing (DKIM) and the optional\n> development mail-catcher. High-volume or marketing mail should go through an external SMTP provider,\n> not the local service."} {"id":"technologies/mail/configure.md#set-up-dkim","url":"https://docs.turbostack.app/technologies/mail/configure/#set-up-dkim","path":"technologies/mail/configure.md","title":"Configure mail on TurboStack","heading":"Set up DKIM","keywords":"configure turbostack mail dkim mailhog_install mail_devtool mailpit mail catcher tscli dkim","text":"DomainKeys Identified Mail (DKIM) signs your outbound mail so receiving servers can confirm it\ngenuinely came from your domain. In **Mail Settings**, add one DKIM entry per sending domain:\n\n1. Enter the **FQDN** - the Fully Qualified Domain Name you send mail from (for example\n `example.com`).\n2. Enter a **selector** - this becomes the subdomain part of the DKIM DNS record. If you leave it\n empty, TurboStack uses the default selector `cloud`.\n3. Save the entry and deploy.\n4. Connect over SSH and run `tscli dkim records` to get the DKIM TXT\n record to publish.\n5. Add that record as a **TXT** record in your domain's Domain Name System (DNS) - in the\n Customer Center DNS management if Hosted Power\n manages your DNS, otherwise at your DNS provider.\n6. Back on the server, run `tscli dkim validate` to confirm the record was created correctly.\n\nYou can add multiple DKIM entries if you send from more than one domain. For Sender Policy Framework\n(SPF) and Domain-based Message Authentication, Reporting and Conformance (DMARC), which are DNS-only\nand not set here, see Mail deliverability."} {"id":"technologies/mail/configure.md#development-mail-catcher","url":"https://docs.turbostack.app/technologies/mail/configure/#development-mail-catcher","path":"technologies/mail/configure.md","title":"Configure mail on TurboStack","heading":"Development mail-catcher","keywords":"configure turbostack mail dkim mailhog_install mail_devtool mailpit mail catcher tscli dkim","text":"A mail-catcher captures outbound mail so you can inspect it in a web interface instead of delivering\nit - useful while building or testing an application. Enable it under **Mail Settings** with the\n**Enable mail capturing and mail testing** option, then choose which tool to run:\n\n- **Mailpit** - the recommended catcher.\n- **Mailhog** - the older catcher; no longer maintained.\n\nOnce enabled, PHP mail is intercepted automatically (via `php.ini`) by default, so mail your\napplication sends is captured without any code change. You can turn off auto-interception if you only\nwant the catcher available for applications that target it directly.\n\n> [!WARNING]\n> A mail-catcher intercepts mail instead of sending it. Never enable one on a production host, or real\n> mail (password resets, order confirmations) silently disappears. This is the most common reason\n> production mail \"stops sending\" - see Mail deliverability."} {"id":"technologies/mail/configure.md#yaml-configuration","url":"https://docs.turbostack.app/technologies/mail/configure/#yaml-configuration","path":"technologies/mail/configure.md","title":"Configure mail on TurboStack","heading":"YAML configuration","keywords":"configure turbostack mail dkim mailhog_install mail_devtool mailpit mail catcher tscli dkim","text":"These are the keys the Mail Settings form writes to the host YAML."} {"id":"technologies/mail/configure.md#dkim","url":"https://docs.turbostack.app/technologies/mail/configure/#dkim","path":"technologies/mail/configure.md","title":"Configure mail on TurboStack","heading":"DKIM","keywords":"configure turbostack mail dkim mailhog_install mail_devtool mailpit mail catcher tscli dkim","text":"DKIM is configured as a `dkim` object with a `keys` list. Each entry sets the `fqdn` and, optionally,\nthe `selector` (defaults to `cloud`).\n\n```yaml\ndkim:\n keys:\n - fqdn: example.com\n selector: cloud\n - fqdn: shop.example.com\n selector: cloud\n```"} {"id":"technologies/mail/configure.md#development-mail-catcher","url":"https://docs.turbostack.app/technologies/mail/configure/#development-mail-catcher","path":"technologies/mail/configure.md","title":"Configure mail on TurboStack","heading":"Development mail-catcher","keywords":"configure turbostack mail dkim mailhog_install mail_devtool mailpit mail catcher tscli dkim","text":"| Key | Meaning |\n|---|---|\n| `mail_devtool` | Which catcher to install: `mailpit` or `mailhog`. This is the key that switches the catcher on - set it and the matching catcher is installed, leave it out and neither is installed (an existing one is removed). No other value is accepted. |\n| `mailhog_install` | The **Enable mail capturing and mail testing** toggle in Mail Settings. It controls whether the catcher choice is shown in the form and is not read during deployment, so on its own it installs nothing. |\n| `mail_auto_intercept` | Whether PHP mail is auto-intercepted through `php.ini`. Defaults to `true`, so interception is on; set it to `false` to leave PHP alone and catch only the mail that applications send to the catcher directly. |\n\n\n\n```yaml\n# Installs Mailpit as the mail-catcher:\nmail_devtool: mailpit\n# Optional - auto-interception is on by default; set it to false to turn it off:\nmail_auto_intercept: false\n```\n\n> [!NOTE]\n> Only `mail_devtool` decides whether a catcher is installed. You may still see `mailhog_install: true`\n> in an existing host YAML - it is harmless, but it does not enable a catcher on its own."} {"id":"technologies/mail/configure.md#related","url":"https://docs.turbostack.app/technologies/mail/configure/#related","path":"technologies/mail/configure.md","title":"Configure mail on TurboStack","heading":"Related","keywords":"configure turbostack mail dkim mailhog_install mail_devtool mailpit mail catcher tscli dkim","text":"- What is mail on TurboStack?\n- Mail deliverability - SPF, DKIM and DMARC, and blocklists.\n- Email deliverability troubleshooting - mail not sending, reading the mail log and the mail queue.\n- SMTP error codes - decode a `5.7.x` bounce.\n- Email - Mail Settings on the host's Advanced tab.\n- Host Advanced settings.\n- Connecting your domain - where to add DNS records."} {"id":"technologies/mail/deliverability.md#intro","url":"https://docs.turbostack.app/technologies/mail/deliverability/","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"# Email Deliverability\n\nEnsuring your emails land in the recipient's inbox - and not their spam folder - requires careful attention to email delivery practices. Poor email delivery can harm your reputation, reduce engagement, and hinder communication with your audience.\n\nThis article explores best practices to improve email deliverability and provides an in-depth explanation of key email authentication protocols like SPF, DKIM, and DMARC. Implementing these strategies will help you avoid the spam folder and maintain a strong sender reputation."} {"id":"technologies/mail/deliverability.md#1-spf-sender-policy-framework","url":"https://docs.turbostack.app/technologies/mail/deliverability/#1-spf-sender-policy-framework","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"1. SPF (Sender Policy Framework)","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"SPF is an email authentication protocol designed to prevent spoofing by specifying which mail servers are authorized to send emails on behalf of your domain. When you set up an SPF record, it tells recipient mail servers, \"Here's the list of IP addresses or servers allowed to send emails for this domain.\"\n\n- **How it works:** When an email is received, the recipient's server checks the sending IP against the domain's SPF record. If the IP isn't listed, the email is more likely to be marked as spam or rejected.\n- **Best practice:** Always keep your SPF record updated to include all servers or services you use to send emails (e.g., your hosting provider, CRM, or email marketing tool).\n\n#### How to Implement SPF\n\n1. **Define Your Sending Sources:** Identify all the mail servers and third-party services you use to send emails, such as your website hosting, CRM, or marketing platforms.\n2. **Create an SPF Record:** Use your DNS manager to add a TXT record for your domain. An example SPF record might look like this:\n\n```dns\nv=spf1 a mx include:mail.example.com ip4:64.186.18.168 -all\n```\n\n- `v=spf1` indicates the version.\n- `a` includes the hostname's A record(s) in the SPF lookup.\n- `mx` includes the hostname's MX record(s) in the SPF lookup.\n- `include:` lists authorized servers.\n- `ip4:` lists authorized servers, but based on IPv4 address.\n- `ip6:` lists authorized servers, but based on IPv6 address.\n- `-all` specifies that any non-listed server should fail the SPF check.\n\n> [!IMPORTANT]\n> SPF records are limited to 10 DNS lookups per authentication check! Exceeding the 10-lookup limit results in a permanent error, causing SPF verification to fail.\n>\n> To stay within this limit, we advise the following:\n>\n> - Minimize include mechanisms by consolidating authorized senders.\n> - Avoid unnecessary use of a and mx lookups.\n> - Replace mechanisms with static IP ranges when feasible.\n> - Use SPF record flattening tools to generate a single, simplified record.\n\n3. **Test Your SPF Setup:** Tools like MXToolbox can validate your SPF record and ensure it's correctly configured."} {"id":"technologies/mail/deliverability.md#2-dkim-domainkeys-identified-mail","url":"https://docs.turbostack.app/technologies/mail/deliverability/#2-dkim-domainkeys-identified-mail","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"2. DKIM (DomainKeys Identified Mail)","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"DKIM adds a digital signature to your emails, allowing the recipient's server to verify that the message hasn't been altered in transit and that it genuinely came from your domain.\n\n- **How it works:** The sending server attaches an encrypted signature to the email's header. The recipient's server retrieves the public key from your DNS records to verify the signature's authenticity. Example:\n\n```dns\ncloud._domainkey.example.com IN TXT \"k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDmzRmJRQxLEuyYiyMg4suA2SyMwR5MGHpP9diNT1hRiwUd/mZp1ro7kIDTKS8ttkI6z6eTRW9e9dDOxzSxNuXmume60Cjbu08gOyhPG3GfWdg7QkdN6kR4V75MFlw624VY35DaXBvnlTJTgRg/EW72O1DiYVThkyCgpSYS8nmEQIDAQAB\"\n```\n\n> [!NOTE]\n> Activating DKIM on TurboStack is easily done via the TurboStack Platform! Simply navigate to your host and go to the 'Advanced' tab. Follow the instructions under 'Mail Settings' to set up DKIM."} {"id":"technologies/mail/deliverability.md#3-dmarc-domain-based-message-authentication-reporting-and-conformance","url":"https://docs.turbostack.app/technologies/mail/deliverability/#3-dmarc-domain-based-message-authentication-reporting-and-conformance","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"3. DMARC (Domain-based Message Authentication, Reporting, and Conformance)","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"DMARC ties SPF and DKIM together to provide a comprehensive email authentication framework. It tells recipient servers how to handle emails that fail SPF or DKIM checks and enables you to receive reports on failed authentication attempts.\n\n- **How it works:** DMARC policies are defined in your DNS records, specifying whether to quarantine, reject, or do nothing with emails that fail authentication.\n\n#### How to Implement DMARC\n\n1. **Draft a DMARC Policy:**\n\nDefine how to handle authentication failures using the `p` tag:\n- `p=none`: Monitor only (no enforcement).\n- `p=quarantine`: Mark failing emails as spam.\n- `p=reject`: Reject failing emails outright. (RECOMMENDED)\n\nSet up e-mail reporting using the `rua` tag:\n- e.g. `rua=mailto:dmarc-reports@example.com`\n- The `ruf` tag can be used to send forensic reports.\n- This setting is entirely optional! You can omit the tag altogether.\n\nEnforce SPF compliance with the `aspf` tag:\n- Force strict compliance with `aspf=s` (RECOMMENDED)\n- Set up relaxed compliance with `aspf=r` (*)\n\n(*) In relaxed SPF Alignment, the MailFROM domain and the Header From domain must be an exact match or a parent/child match (i.e. example.com and child.example.com). The parent/child match type allows any subdomain and parent domain pair to generate a PASS result. Also worth noting, in the parent/child match scenario either the MailFROM domain or the Header From domain can be the parent or the child domain.\n\n2. **Create a DMARC Record:** Add a TXT record to your DNS. Example:\n```dns\n_dmarc.example.com IN TXT \"v=DMARC1; p=reject; aspf=s; rua=mailto:dmarc-reports@example.com;\n```\n\nThis record will strictly reject mails that do NOT originate from an SMTP server included in the origin domain's SPF record, and send a report to dmarc-reports@example.com."} {"id":"technologies/mail/deliverability.md#4-further-optimisation","url":"https://docs.turbostack.app/technologies/mail/deliverability/#4-further-optimisation","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"4. Further optimisation","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"Properly configuring your DNS with SPF, DKIM, and DMARC is a significant step toward improving your email deliverability. However, if you're still encountering issues, additional factors might be at play. Problems could stem from the content and formatting of your HTML email, SMTP server configurations, or even being blacklisted for other reasons.\n\nTo assess your current email deliverability, we recommend running a test on Mail Tester. If your score isn't perfect, the test report will highlight areas for improvement.\n\nNeed help interpreting the results or taking the next steps? Feel free to reach out to us - we're here to assist!"} {"id":"technologies/mail/deliverability.md#blocklists-rbls-and-how-they-affect-deliverability","url":"https://docs.turbostack.app/technologies/mail/deliverability/#blocklists-rbls-and-how-they-affect-deliverability","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"Blocklists (RBLs) and How They Affect Deliverability","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"Even with SPF, DKIM, and DMARC correctly set up, your emails may still struggle to reach inboxes if your server's IP address or domain has been placed on a **blocklist** (often called an **RBL - Realtime Block List**)."} {"id":"technologies/mail/deliverability.md#what-is-a-blocklist-rbl","url":"https://docs.turbostack.app/technologies/mail/deliverability/#what-is-a-blocklist-rbl","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"What is a Blocklist / RBL?","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"A blocklist is a database of IP addresses or domains flagged for sending spam or unwanted email. Many email providers and spam filters query these RBLs to decide whether to deliver, filter, or reject incoming messages.\n\nIf your server is listed, your emails may:\n- Go straight to spam.\n- Be delayed.\n- Be rejected entirely.\n\n**Info:** Different mail services rely on different RBLs for spam filtering! Because of this, your email may reach some recipients while being blocked by others. Which RBL is consulted depends entirely on the recipient's mail provider."} {"id":"technologies/mail/deliverability.md#why-you-might-be-blocklisted","url":"https://docs.turbostack.app/technologies/mail/deliverability/#why-you-might-be-blocklisted","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"Why You Might Be Blocklisted","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"Before looking at blocklist issues, make sure your email authentication and deliverability are set up correctly as described earlier (SPF, DKIM, DMARC, and content best practices). These are the **first priority**.\n\nIf problems persist after that, common reasons for blocklisting include:\n- Your server was used to send spam (e.g., due to a hacked website or weak email account password).\n- You're sending to invalid or outdated email addresses.\n- Too many recipients marked your emails as spam.\n- Bulk email (such as newsletters) is being sent directly from your webserver instead of a proper mail delivery service.\n\n**Important:** Bulk mailing should **never** be done from your local SMTP service. Sending newsletters or large campaigns this way will almost always lead to blacklisting. Instead, always use a professional service such as SendGrid, Amazon SES, or Mailchimp for mass mailings."} {"id":"technologies/mail/deliverability.md#how-to-check-if-you-re-listed","url":"https://docs.turbostack.app/technologies/mail/deliverability/#how-to-check-if-you-re-listed","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"How to Check if You're Listed","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"You can quickly check if your domain or server IP is on a blocklist using these tools:\n- MXToolbox Blacklist Check\n- Spamhaus Blocklist Removal Center\n- MultiRBL Lookup\n\nSimply enter your server's IP address to see if it appears on any RBLs.\n\n**Tip:** If your Mail Tester score looks fine but your messages are still not being delivered, it's worth checking whether your IP or domain is listed on an RBL."} {"id":"technologies/mail/deliverability.md#what-to-do-if-you-re-blocklisted","url":"https://docs.turbostack.app/technologies/mail/deliverability/#what-to-do-if-you-re-blocklisted","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"What to Do if You're Blocklisted","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"1. **Secure your server**\n - Scan for hacked sites, malware, or compromised accounts.\n - Change email account passwords if needed.\n\n2. **Avoid bulk mailing locally**\n - Do not send newsletters or campaigns from your webserver.\n - Move all bulk mailing to a dedicated provider like SendGrid.\n\n3. **Request delisting**\n - Each RBL has a removal process (usually an online form).\n - Only request delisting once you're sure the problem is fixed, otherwise you risk being re-listed.\n\n**Tip:** After resolving the issue, monitor your IP reputation regularly. Staying off RBLs requires both secure server practices and responsible mailing practices."} {"id":"technologies/mail/deliverability.md#related","url":"https://docs.turbostack.app/technologies/mail/deliverability/#related","path":"technologies/mail/deliverability.md","title":"Mail deliverability","heading":"Related","keywords":"email deliverability spf dkim dmarc blocklist rbl spam folder sender reputation","text":"- What is mail on TurboStack?\n- Configure mail\n- SMTP error codes\n- Customer Center DNS management"} {"id":"technologies/mail/smtp-error-codes.md#introduction","url":"https://docs.turbostack.app/technologies/mail/smtp-error-codes/#introduction","path":"technologies/mail/smtp-error-codes.md","title":"SMTP error codes","heading":"Introduction","keywords":"smtp error codes 550 5.7.1 5.7.26 5.7.28 mail rejected dmarc reject spf fail dkim fail","text":"Freemail providers such as Gmail and Hotmail provide specific error codes that indicate issues with email delivery. In this article, we will learn what they mean and how we can resolve these issues.\n\nIf you've received an email from our support team with a link to this article, it means we detected an alert associated with one of the error codes listed below. This guide will help you identify the issue and find steps to resolve it.\n\nMany of these errors stem from email deliverability issues. For more information on improving your email deliverability, visit this page.\n\nThese open-source docs document these same error codes, as well as some vendor-specific information. While we make our best effort to keep our own doc up to date, checking several sources when investigating these issues is highly recommended.\n\nIf you have any questions or difficulties, don't hesitate to contact us!"} {"id":"technologies/mail/smtp-error-codes.md#error-codes","url":"https://docs.turbostack.app/technologies/mail/smtp-error-codes/#error-codes","path":"technologies/mail/smtp-error-codes.md","title":"SMTP error codes","heading":"Error codes","keywords":"smtp error codes 550 5.7.1 5.7.26 5.7.28 mail rejected dmarc reject spf fail dkim fail","text":"**550-5.7.1 (Generic)**\n\n- Meaning: This is a general status code indicating an issue with the sender's reputation, resulting in emails being blocked by the receiving mail server. It is used by many mail providers, who don't provide more specific reasons for blocking mails.\n- Solution: As the exact cause of distrust is unclear from the error message, please check all other 550-5.7.1 codes.\n\n**550-5.7.1 \"This message is likely unsolicited email\"**\n\n- Meaning: To reduce spam, the receiving mail server has blocked the message because it is likely unsolicited email.\n- Solution: Review email content and ensure compliance with the receiving mail server's anti-spam policies. Refer to their guidelines for more information.\n\n**550-5.7.1 \"This message is likely suspicious due to the very low reputation of the sending IP address\"**\n\n- Meaning: The receiving mail server blocked the message because the sending IP address has a very low reputation.\n- Solution: Improve the reputation of the sending IP by sending compliant, non-spammy emails and adhering to the receiver's email sender guidelines.\n\n**550-5.7.1 \"SPF check failed\"**\n\n- Meaning: The email's SPF record did not authorize the sending IP.\n- Solution: Verify that the sending IP is included in the domain's SPF record.\n\n**550-5.7.1 \"DKIM signature verification failed\"**\n\n- Meaning: The DKIM signature in the email did not match the public key in DNS.\n- Solution: Ensure that the correct private key is used to sign emails and the DNS entry is properly configured.\n\n**550-5.7.24 \"The SPF record of the sending domain has one or more suspicious entries\"**\n\n- Meaning: The SPF record includes entries that are potentially insecure.\n- Solution: Review and remove unnecessary or insecure entries from the SPF record.\n\n**550-5.7.25 \"The IP address sending this message does not have a PTR record setup\"**\n\n- Meaning: The sending IP lacks a reverse DNS (PTR) record or the PTR record does not match the sending IP.\n- Solution: Ensure that a valid PTR record is set up for the sending IP and that forward and reverse DNS entries match.\n\n**550-5.7.25 \"The sending IP does not match the IP address of the hostname specified in the pointer (PTR) record\"**\n\n- Meaning: There is a mismatch between the sending IP and the PTR record.\n- Solution: Correct the PTR record or ensure the sending IP aligns with it.\n\n**550-5.7.26 \"This email has been blocked because the sender is unauthenticated\"**\n\n- Meaning: The email lacks proper authentication via SPF or DKIM.\n- Solution: Authenticate with either SPF or DKIM and review setup instructions.\n\n**550-5.7.26 \"The MAIL FROM domain has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks\"**\n\n- Meaning: The SPF record specifies a hard fail, but the email failed SPF authentication.\n- Solution: Ensure that the sending IP is authorized in the SPF record.\n\n**550-5.7.26 \"Unauthenticated email from [domain-name] is not accepted due to domain's DMARC policy\"**\n\n- Meaning: The email failed DMARC authentication.\n- Solution: Align SPF and DKIM with the DMARC policy.\n\n**550-5.7.27 \"This email has been blocked because SPF does not pass\"**\n\n- Meaning: Gmail requires SPF authentication for large senders, but SPF failed.\n- Solution: Configure SPF correctly to include all sending IPs.\n\n**550-5.7.28 \"There is an unusual rate of unsolicited email originating from your IP address\"**\n\n- Meaning: The IP is sending an abnormally high rate of unsolicited emails.\n- Solution: Reduce email sending volume and adhere to the receiving mail server's bulk sender guidelines.\n\n**550-5.7.30 \"This email has been blocked because DKIM does not pass\"**\n\n- Meaning: DKIM authentication failed.\n- Solution: Set up DKIM correctly and ensure outgoing emails are signed with the proper private key."} {"id":"technologies/mail/smtp-error-codes.md#related","url":"https://docs.turbostack.app/technologies/mail/smtp-error-codes/#related","path":"technologies/mail/smtp-error-codes.md","title":"SMTP error codes","heading":"Related","keywords":"smtp error codes 550 5.7.1 5.7.26 5.7.28 mail rejected dmarc reject spf fail dkim fail","text":"- Mail deliverability\n- Configure mail"} {"id":"technologies/mail/what-is.md#intro","url":"https://docs.turbostack.app/technologies/mail/what-is/","path":"technologies/mail/what-is.md","title":"What is mail on TurboStack?","heading":"","keywords":"what is turbostack mail outbound mail transactional email dkim mail catcher smtp provider","text":"# What is mail on TurboStack?\n\nTurboStack is primarily an application-hosting platform, so mail is a supporting service rather than\nthe main product. This page explains how outbound mail works on your host, so you can decide how to\nsend mail and what to authenticate. For the steps to set it up, see\nConfigure mail on TurboStack."} {"id":"technologies/mail/what-is.md#outbound-transactional-mail","url":"https://docs.turbostack.app/technologies/mail/what-is/#outbound-transactional-mail","path":"technologies/mail/what-is.md","title":"What is mail on TurboStack?","heading":"Outbound transactional mail","keywords":"what is turbostack mail outbound mail transactional email dkim mail catcher smtp provider","text":"Your applications send outbound mail - password resets, order confirmations, notifications - through\nthe **local mail service** on the host. This is delivery from the server to the outside world; it is\nmeant for **transactional** mail, the low-volume messages your application generates as people use it.\n\nYou do not need external Simple Mail Transfer Protocol (SMTP) credentials for basic delivery. The\napplication hands the message to the local mail service, which delivers it. TurboStack does not run\nmailboxes for receiving and reading mail - it is not an inbox or webmail host."} {"id":"technologies/mail/what-is.md#domain-authentication-with-dkim","url":"https://docs.turbostack.app/technologies/mail/what-is/#domain-authentication-with-dkim","path":"technologies/mail/what-is.md","title":"What is mail on TurboStack?","heading":"Domain authentication with DKIM","keywords":"what is turbostack mail outbound mail transactional email dkim mail catcher smtp provider","text":"Receiving mail servers are strict about who is allowed to send mail for a domain. If they cannot\nconfirm a message is genuine, they file it as spam or reject it. You confirm that your mail is genuine\nby authenticating your domain with three Domain Name System (DNS) records:\n\n- **Sender Policy Framework (SPF)** lists the servers allowed to send mail for your domain.\n- **DomainKeys Identified Mail (DKIM)** adds a cryptographic signature receivers can verify.\n- **Domain-based Message Authentication, Reporting and Conformance (DMARC)** tells receivers what to\n do when SPF or DKIM fail.\n\nTurboStack generates the DKIM signing key for you. You set the sending domain and a selector under\nthe host's **Advanced > Mail Settings**, then publish the record TurboStack produces. Publishing\nthese records is the single most important thing you can do to land in inboxes rather than spam\nfolders. See Mail deliverability for the full background."} {"id":"technologies/mail/what-is.md#the-development-mail-catcher","url":"https://docs.turbostack.app/technologies/mail/what-is/#the-development-mail-catcher","path":"technologies/mail/what-is.md","title":"What is mail on TurboStack?","heading":"The development mail-catcher","keywords":"what is turbostack mail outbound mail transactional email dkim mail catcher smtp provider","text":"While you build and test an application, you often want to see the mail it sends without actually\ndelivering it to real people. TurboStack offers a **development mail-catcher** that captures outbound\nmail so you can inspect it in a web interface instead of sending it.\n\n> [!WARNING]\n> A mail-catcher is a development tool only. When it is on, outbound mail is captured, not delivered.\n> Never leave it enabled on a production host, or real mail (password resets, order confirmations)\n> silently disappears."} {"id":"technologies/mail/what-is.md#when-to-use-an-external-smtp-provider","url":"https://docs.turbostack.app/technologies/mail/what-is/#when-to-use-an-external-smtp-provider","path":"technologies/mail/what-is.md","title":"What is mail on TurboStack?","heading":"When to use an external SMTP provider","keywords":"what is turbostack mail outbound mail transactional email dkim mail catcher smtp provider","text":"The local mail service is fine for low-volume transactional mail. It is not the right tool for\n**high-volume** or **marketing/newsletter** sending. Bulk mail from a shared server IP almost always\nharms your sending reputation and gets the IP blocklisted.\n\nFor anything beyond low-volume transactional mail, send through a dedicated **email/SMTP provider**.\nYou point your application's mail settings at the provider and publish the provider's SPF, DKIM and\nDMARC records. A provider also gives you delivery analytics, bounce handling and reputation\nmanagement by default."} {"id":"technologies/mail/what-is.md#related","url":"https://docs.turbostack.app/technologies/mail/what-is/#related","path":"technologies/mail/what-is.md","title":"What is mail on TurboStack?","heading":"Related","keywords":"what is turbostack mail outbound mail transactional email dkim mail catcher smtp provider","text":"- Configure mail on TurboStack\n- Mail deliverability - authenticate your domain and fix mail landing in spam.\n- SMTP error codes - what a `5.7.x` rejection means and how to fix it.\n- Email - Mail Settings on the host's Advanced tab.\n- Connecting your domain - where to add DNS records."} {"id":"technologies/mongodb/configure.md#intro","url":"https://docs.turbostack.app/technologies/mongodb/configure/","path":"technologies/mongodb/configure.md","title":"Configure MongoDB on TurboStack","heading":"","keywords":"configure MongoDB turbostack MongoDB yaml mongodb_version enable MongoDB MongoDB bind ip","text":"# Configure MongoDB on TurboStack\n\nEnable MongoDB on the host that needs it and pin the version you want to run."} {"id":"technologies/mongodb/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/mongodb/configure/#where-to-configure-it","path":"technologies/mongodb/configure.md","title":"Configure MongoDB on TurboStack","heading":"Where to configure it","keywords":"configure MongoDB turbostack MongoDB yaml mongodb_version enable MongoDB MongoDB bind ip","text":"MongoDB is a host-level service. To reach it, open the host, go to its **Services** tab, and find\nthe **MongoDB** entry. Enable the service there and choose the version. The change is saved to the\nhost's YAML configuration and applied on the next deployment.\n\n> [!TIP]\n> MongoDB is enabled per host. Turn it on only for the hosts whose applications connect to it."} {"id":"technologies/mongodb/configure.md#required","url":"https://docs.turbostack.app/technologies/mongodb/configure/#required","path":"technologies/mongodb/configure.md","title":"Configure MongoDB on TurboStack","heading":"Required","keywords":"configure MongoDB turbostack MongoDB yaml mongodb_version enable MongoDB MongoDB bind ip","text":"| Key | Meaning |\n|---|---|\n| `mongodb_version` | The major version of Percona Server for MongoDB to run, for example `\"7.0\"` or newer. Setting this key installs and enables MongoDB on the host - there is no separate enable key. |"} {"id":"technologies/mongodb/configure.md#optional","url":"https://docs.turbostack.app/technologies/mongodb/configure/#optional","path":"technologies/mongodb/configure.md","title":"Configure MongoDB on TurboStack","heading":"Optional","keywords":"configure MongoDB turbostack MongoDB yaml mongodb_version enable MongoDB MongoDB bind ip","text":"| Key | Meaning |\n|---|---|\n| `mongodb_bindip` | The network interfaces MongoDB listens on, as a comma-separated list, or `ANY` for every interface. Security-sensitive - bind to the narrowest interface your application needs. |\n\n```yaml\nmongodb_version: \"7.0\"\n# Optional, security-sensitive:\nmongodb_bindip: \"127.0.0.1\"\n```"} {"id":"technologies/mongodb/configure.md#listening-address","url":"https://docs.turbostack.app/technologies/mongodb/configure/#listening-address","path":"technologies/mongodb/configure.md","title":"Configure MongoDB on TurboStack","heading":"Listening address","keywords":"configure MongoDB turbostack MongoDB yaml mongodb_version enable MongoDB MongoDB bind ip","text":"`mongodb_bindip` takes a comma-separated list of addresses, or the keyword **`ANY`**, which makes\nMongoDB listen on every interface the server has, over both IPv4 and IPv6.\n\n> [!WARNING]\n> `ANY` includes any public interface. A database reachable from the internet is a serious risk, so\n> prefer specific private addresses, and restrict access with the\n> firewall whatever you choose.\n\n> [!IMPORTANT]\n> On a host that runs **Kubernetes or Docker**, MongoDB listens on every interface. Unlike the other\n> databases it does so even when `mongodb_bindip` is set to `127.0.0.1`, so on such a host give a\n> specific private address if you need to keep it narrow.\n\n> [!WARNING]\n> Exposing MongoDB on a broad bind address can make the database reachable from outside the host.\n> Restrict the bind IP and pair it with firewall rules so only trusted clients can connect."} {"id":"technologies/mongodb/configure.md#related","url":"https://docs.turbostack.app/technologies/mongodb/configure/#related","path":"technologies/mongodb/configure.md","title":"Configure MongoDB on TurboStack","heading":"Related","keywords":"configure MongoDB turbostack MongoDB yaml mongodb_version enable MongoDB MongoDB bind ip","text":"- What is MongoDB?\n- Host Services\n- Applications overview"} {"id":"technologies/mongodb/what-is.md#intro","url":"https://docs.turbostack.app/technologies/mongodb/what-is/","path":"technologies/mongodb/what-is.md","title":"What is MongoDB?","heading":"","keywords":"what is MongoDB MongoDB hosting MongoDB turbostack nosql database percona server for MongoDB document database","text":"# What is MongoDB?\n\nMongoDB is a document-oriented NoSQL database. Instead of storing data in tables of rows and\ncolumns like a relational database, it stores flexible, JSON-like documents whose structure can\nvary from one record to the next. This makes it a natural fit for applications with evolving data\nmodels, semi-structured content, or rapidly changing requirements.\n\nApplications talk to MongoDB to store and query collections of documents. It is commonly used for\ncatalogs, user profiles, event and activity data, content management, and any workload where a\nschema-flexible store is more convenient than a rigid relational schema."} {"id":"technologies/mongodb/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/mongodb/what-is/#on-turbostack","path":"technologies/mongodb/what-is.md","title":"What is MongoDB?","heading":"On TurboStack","keywords":"what is MongoDB MongoDB hosting MongoDB turbostack nosql database percona server for MongoDB document database","text":"TurboStack runs **Percona Server for MongoDB**, a drop-in, performance-focused build of the\nMongoDB Community Edition. It behaves exactly like upstream MongoDB for your applications while\nadding operational improvements suited to managed hosting.\n\n- **Enabled per host.** MongoDB is not on by default. You turn it on for the specific host whose\n application needs it, from that host's **Services** tab.\n- **Version pinned.** You choose the major version explicitly (for example `7.0` or newer) so your\n database engine stays predictable across deployments and rebuilds.\n- **Managed for you.** TurboStack provisions, configures, and maintains the service; you focus on\n your collections and queries rather than the server.\n\n> [!NOTE]\n> Enable MongoDB only on the hosts that actually use it. There is no benefit to running the engine\n> on a host whose applications never connect to it."} {"id":"technologies/mongodb/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/mongodb/what-is/#best-practices","path":"technologies/mongodb/what-is.md","title":"What is MongoDB?","heading":"Best practices","keywords":"what is MongoDB MongoDB hosting MongoDB turbostack nosql database percona server for MongoDB document database","text":"- Pick an explicit major version and keep it consistent across your environments to avoid surprises\n on upgrade.\n- Design indexes for your most frequent queries - unindexed queries scan whole collections and do\n not scale.\n- Keep documents reasonably sized and avoid unbounded array growth within a single document.\n- Bind the service to the narrowest network interface that still lets your application reach it.\n- Use authenticated connections and least-privilege database users for each application.\n- Back up regularly and verify that you can restore."} {"id":"technologies/mongodb/what-is.md#related","url":"https://docs.turbostack.app/technologies/mongodb/what-is/#related","path":"technologies/mongodb/what-is.md","title":"What is MongoDB?","heading":"Related","keywords":"what is MongoDB MongoDB hosting MongoDB turbostack nosql database percona server for MongoDB document database","text":"- Configure MongoDB on TurboStack\n- Host Services"} {"id":"technologies/mssql/configure.md#intro","url":"https://docs.turbostack.app/technologies/mssql/configure/","path":"technologies/mssql/configure.md","title":"Configure Microsoft SQL Server on TurboStack","heading":"","keywords":"configure microsoft sql server turbostack mssql yaml mssql_version sql server edition dotnet database","text":"# Configure Microsoft SQL Server on TurboStack\n\nEnable SQL Server on the host that runs your .NET application and pin the version and edition."} {"id":"technologies/mssql/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/mssql/configure/#where-to-configure-it","path":"technologies/mssql/configure.md","title":"Configure Microsoft SQL Server on TurboStack","heading":"Where to configure it","keywords":"configure microsoft sql server turbostack mssql yaml mssql_version sql server edition dotnet database","text":"Microsoft SQL Server is a host-level service. Open the host, go to its **Services** tab, and find\nthe **Microsoft SQL Server** entry. Enable the service there and select the version and edition.\nThe change is written to the host's YAML and applied on the next deployment.\n\n> [!TIP]\n> Enable SQL Server on hosts running .NET applications such as\n> nopCommerce that need it."} {"id":"technologies/mssql/configure.md#required","url":"https://docs.turbostack.app/technologies/mssql/configure/#required","path":"technologies/mssql/configure.md","title":"Configure Microsoft SQL Server on TurboStack","heading":"Required","keywords":"configure microsoft sql server turbostack mssql yaml mssql_version sql server edition dotnet database","text":"| Key | Meaning |\n|---|---|\n| `mssql_version` | The Microsoft SQL Server version to run on the host, for example `\"2022\"`. |\n| `mssql_edition` | The Microsoft SQL Server edition: `Developer`, `Enterprise`, `Express` or `Standard`. Defaults to `Express`. |\n\n```yaml\nmssql_version: \"2022\"\nmssql_edition: \"Express\" # Developer, Enterprise, Express or Standard\n```\n\n> [!WARNING]\n> The version and edition affect features, resource limits, and licensing. Choose them deliberately\n> and keep them consistent across your environments."} {"id":"technologies/mssql/configure.md#related","url":"https://docs.turbostack.app/technologies/mssql/configure/#related","path":"technologies/mssql/configure.md","title":"Configure Microsoft SQL Server on TurboStack","heading":"Related","keywords":"configure microsoft sql server turbostack mssql yaml mssql_version sql server edition dotnet database","text":"- What is Microsoft SQL Server?\n- Host Services\n- Deploy nopCommerce"} {"id":"technologies/mssql/what-is.md#intro","url":"https://docs.turbostack.app/technologies/mssql/what-is/","path":"technologies/mssql/what-is.md","title":"What is Microsoft SQL Server?","heading":"","keywords":"what is microsoft sql server mssql hosting mssql turbostack sql server relational database dotnet database","text":"# What is Microsoft SQL Server?\n\nMicrosoft SQL Server is a relational database management system. It stores data in tables of rows\nand columns, enforces a defined schema, and is queried with T-SQL. It is a mature, transactional\ndatabase known for strong consistency, stored procedures, and tight integration with the Microsoft\necosystem.\n\nSQL Server is the natural data store for .NET applications. Platforms such as\nnopCommerce rely on it for their persistent data, so a\nhost that runs a .NET workload typically needs SQL Server available alongside it."} {"id":"technologies/mssql/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/mssql/what-is/#on-turbostack","path":"technologies/mssql/what-is.md","title":"What is Microsoft SQL Server?","heading":"On TurboStack","keywords":"what is microsoft sql server mssql hosting mssql turbostack sql server relational database dotnet database","text":"TurboStack provisions Microsoft SQL Server as a host-level service for .NET workloads that require\nit. You specify the version (and edition) you want, and TurboStack installs and configures the\nengine so your application can connect to it.\n\n- **Version and edition pinned.** You declare the SQL Server version and edition explicitly, so the\n engine your application targets stays predictable across deployments.\n- **For .NET workloads.** Enable it on hosts running .NET applications such as nopCommerce that\n store their data in SQL Server.\n- **Managed for you.** TurboStack handles provisioning and configuration of the service.\n\n> [!NOTE]\n> Choose the edition that matches your licensing and feature needs. Different editions differ in\n> capabilities and resource limits."} {"id":"technologies/mssql/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/mssql/what-is/#best-practices","path":"technologies/mssql/what-is.md","title":"What is Microsoft SQL Server?","heading":"Best practices","keywords":"what is microsoft sql server mssql hosting mssql turbostack sql server relational database dotnet database","text":"- Pin a specific version and edition and keep it consistent across your environments.\n- Use a dedicated, least-privilege database login for each application.\n- Index the columns your application filters and joins on most often.\n- Back up regularly and test restoring before you need to.\n- Keep the database reachable only from the application that needs it."} {"id":"technologies/mssql/what-is.md#related","url":"https://docs.turbostack.app/technologies/mssql/what-is/#related","path":"technologies/mssql/what-is.md","title":"What is Microsoft SQL Server?","heading":"Related","keywords":"what is microsoft sql server mssql hosting mssql turbostack sql server relational database dotnet database","text":"- Configure Microsoft SQL Server on TurboStack\n- Deploy nopCommerce"} {"id":"technologies/mysql/configure.md#intro","url":"https://docs.turbostack.app/technologies/mysql/configure/","path":"technologies/mysql/configure.md","title":"Configure MySQL on TurboStack","heading":"","keywords":"configure mysql turbostack mysql yaml mysql_version mysql_innodb_size mysql_bindaddress percona server","text":"# Configure MySQL on TurboStack\n\nEnable MySQL on a host, choose a version, and let TurboStack auto-tune memory and provision a database per application."} {"id":"technologies/mysql/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/mysql/configure/#where-to-configure-it","path":"technologies/mysql/configure.md","title":"Configure MySQL on TurboStack","heading":"Where to configure it","keywords":"configure mysql turbostack mysql yaml mysql_version mysql_innodb_size mysql_bindaddress percona server","text":"MySQL is a host-level service. Open the host, go to its **Services** tab, and select **MySQL**. Enable it and pick the major version. Saving updates the host YAML and provisions Percona Server for MySQL on that host."} {"id":"technologies/mysql/configure.md#required","url":"https://docs.turbostack.app/technologies/mysql/configure/#required","path":"technologies/mysql/configure.md","title":"Configure MySQL on TurboStack","heading":"Required","keywords":"configure mysql turbostack mysql yaml mysql_version mysql_innodb_size mysql_bindaddress percona server","text":"| Key | Meaning |\n|---|---|\n| `mysql_version` | The MySQL major version to install, for example `\"8.4\"` (or newer). |"} {"id":"technologies/mysql/configure.md#optional","url":"https://docs.turbostack.app/technologies/mysql/configure/#optional","path":"technologies/mysql/configure.md","title":"Configure MySQL on TurboStack","heading":"Optional","keywords":"configure mysql turbostack mysql yaml mysql_version mysql_innodb_size mysql_bindaddress percona server","text":"| Key | Meaning |\n|---|---|\n| `mysql_innodb_size` | InnoDB buffer pool size. Auto-tuned to the server by default - override only with measured evidence. |\n| `mysql_bindaddress` | The address MySQL listens on, or `ANY` for every interface. Security-sensitive: keep it on localhost unless remote access is required. |\n| `mysql_timezone` | The database server's default time zone. Uses the server's own time zone when unset. |\n| `mysql_server_only` | Makes this host a database server with no local application side. Off by default. |\n\n```yaml\nmysql_version: \"8.4\"\n\n# Optional overrides\nmysql_innodb_size: \"2G\" # leave unset to keep auto-tuning\nmysql_bindaddress: \"127.0.0.1\" # keep local unless remote access is needed\n# mysql_timezone: \"UTC\" # leave unset to follow the server's time zone\n```"} {"id":"technologies/mysql/configure.md#listening-address","url":"https://docs.turbostack.app/technologies/mysql/configure/#listening-address","path":"technologies/mysql/configure.md","title":"Configure MySQL on TurboStack","heading":"Listening address","keywords":"configure mysql turbostack mysql yaml mysql_version mysql_innodb_size mysql_bindaddress percona server","text":"`mysql_bindaddress` takes an address, or the keyword **`ANY`**, which makes MySQL listen on every\ninterface the server has.\n\n> [!WARNING]\n> `ANY` includes any public interface. A database reachable from the internet is a serious risk, so\n> prefer a specific private address, and restrict access with the\n> firewall whatever you choose.\n\n> [!IMPORTANT]\n> On a host that runs **Kubernetes or Docker**, MySQL listens on every interface unless you set\n> `mysql_bindaddress` yourself. If that is not what you want, set the address explicitly."} {"id":"technologies/mysql/configure.md#time-zone","url":"https://docs.turbostack.app/technologies/mysql/configure/#time-zone","path":"technologies/mysql/configure.md","title":"Configure MySQL on TurboStack","heading":"Time zone","keywords":"configure mysql turbostack mysql yaml mysql_version mysql_innodb_size mysql_bindaddress percona server","text":"`mysql_timezone` sets the database server's default time zone, which decides how `NOW()`,\n`CURDATE()` and `TIMESTAMP` columns are interpreted. Leave it out and MySQL follows the server's\nown time zone. Accepted values are what MySQL accepts: `UTC`, or an offset such as `+02:00`.\n\n> [!WARNING]\n> Changing the time zone on a database that already holds data shifts how existing `TIMESTAMP`\n> values are read back. Decide this when you set the host up, not afterwards."} {"id":"technologies/mysql/configure.md#database-server-only-hosts","url":"https://docs.turbostack.app/technologies/mysql/configure/#database-server-only-hosts","path":"technologies/mysql/configure.md","title":"Configure MySQL on TurboStack","heading":"Database-server-only hosts","keywords":"configure mysql turbostack mysql yaml mysql_version mysql_innodb_size mysql_bindaddress percona server","text":"`mysql_server_only: true` turns the host into a dedicated database server: the database engine is\ninstalled, but not the local application-side setup. This is the other half of\nclient-only mode - one host runs the database,\none or more others run the applications.\n\n> [!WARNING]\n> A `mysql_server_only` host binds MySQL to every interface, because the application servers have\n> to reach it. Restrict access with the firewall so that only your own\n> servers can connect, and never place such a host on the public internet unprotected.\n\n> [!NOTE]\n> MySQL can also run in **client-only mode** when a host needs the MySQL client tools but not a local server - for example to connect to a database on another host.\n\n> [!WARNING]\n> Changing `mysql_version` to a higher major version is supported, but **downgrades are not**. Back up first and test the upgrade."} {"id":"technologies/mysql/configure.md#common-tasks","url":"https://docs.turbostack.app/technologies/mysql/configure/#common-tasks","path":"technologies/mysql/configure.md","title":"Configure MySQL on TurboStack","heading":"Common tasks","keywords":"configure mysql turbostack mysql yaml mysql_version mysql_innodb_size mysql_bindaddress percona server","text":"- import and export a MySQL database\n- connect to your MySQL database remotely\n- create and manage database users\n- use phpMyAdmin"} {"id":"technologies/mysql/configure.md#related","url":"https://docs.turbostack.app/technologies/mysql/configure/#related","path":"technologies/mysql/configure.md","title":"Configure MySQL on TurboStack","heading":"Related","keywords":"configure mysql turbostack mysql yaml mysql_version mysql_innodb_size mysql_bindaddress percona server","text":"- What is MySQL?\n- Services\n- Applications overview"} {"id":"technologies/mysql/connect-remotely.md#intro","url":"https://docs.turbostack.app/technologies/mysql/connect-remotely/","path":"technologies/mysql/connect-remotely.md","title":"How to connect to your MySQL database remotely","heading":"","keywords":"remote database connection mysql ssh tunnel connect database client heidisql tableplus","text":"# How to connect to your MySQL database remotely\n\nConnect a database client on your own computer (for example TablePlus, DBeaver or HeidiSQL) to a\nMySQL database on your host. The recommended, secure way is an SSH tunnel."} {"id":"technologies/mysql/connect-remotely.md#why-the-database-port-is-not-open-by-default","url":"https://docs.turbostack.app/technologies/mysql/connect-remotely/#why-the-database-port-is-not-open-by-default","path":"technologies/mysql/connect-remotely.md","title":"How to connect to your MySQL database remotely","heading":"Why the database port is not open by default","keywords":"remote database connection mysql ssh tunnel connect database client heidisql tableplus","text":"For security, MySQL listens on `localhost` only (`mysql_bindaddress: \"127.0.0.1\"`), so the database\nport is not reachable from the internet. Rather than exposing it, you forward it over your existing\nSSH access - the connection is encrypted and uses your SSH key."} {"id":"technologies/mysql/connect-remotely.md#connect-over-an-ssh-tunnel-recommended","url":"https://docs.turbostack.app/technologies/mysql/connect-remotely/#connect-over-an-ssh-tunnel-recommended","path":"technologies/mysql/connect-remotely.md","title":"How to connect to your MySQL database remotely","heading":"Connect over an SSH tunnel (recommended)","keywords":"remote database connection mysql ssh tunnel connect database client heidisql tableplus","text":"1. Open a tunnel from a local port (here `3307`) to the database on the host:\n ```bash\n ssh -L 3307:127.0.0.1:3306 prod@web1.example.com\n ```\n Leave this session open while you work.\n2. Point your client at the local end of the tunnel:\n\n | Setting | Value |\n | --- | --- |\n | Host | `127.0.0.1` |\n | Port | `3307` |\n | User | your database user (from Credentials) |\n | Password | the database user's password |\n | Database | your database name, for example `prod_db` |\n\nMany clients (TablePlus, DBeaver, HeidiSQL) can also create the SSH tunnel for you - choose \"SSH\" or\n\"connect over SSH\" and give your SSH host and key; then set the database host to `127.0.0.1`."} {"id":"technologies/mysql/connect-remotely.md#opening-the-port-instead-advanced","url":"https://docs.turbostack.app/technologies/mysql/connect-remotely/#opening-the-port-instead-advanced","path":"technologies/mysql/connect-remotely.md","title":"How to connect to your MySQL database remotely","heading":"Opening the port instead (advanced)","keywords":"remote database connection mysql ssh tunnel connect database client heidisql tableplus","text":"If a tool genuinely cannot tunnel, you can widen the bind address and allow specific source IPs - but\nthis exposes the database, so prefer the tunnel.\n\n- Set `mysql_bindaddress` to a non-local address in the host configuration (see\n Configure MySQL).\n- Allow only the exact source IP addresses on the host's **Security** tab\n (Security). Adding an IP to the allow-list there also opens the otherwise\n blocked database port to it.\n- Connect with a least-privilege user, never the application's main user.\n\n> [!WARNING]\n> Never open the database to `0.0.0.0` or a broad range. Expose it only to specific, trusted IP\n> addresses, and use a dedicated read-only or limited user."} {"id":"technologies/mysql/connect-remotely.md#troubleshooting","url":"https://docs.turbostack.app/technologies/mysql/connect-remotely/#troubleshooting","path":"technologies/mysql/connect-remotely.md","title":"How to connect to your MySQL database remotely","heading":"Troubleshooting","keywords":"remote database connection mysql ssh tunnel connect database client heidisql tableplus","text":"- **Connection refused** - the tunnel is not open, or the client is pointing at the host instead of\n `127.0.0.1`.\n- **Access denied** - wrong user/password, or the user is not allowed from your host (see\n Create and manage database users).\n- **Times out when opening the port directly** - the source IP is not on the allow-list, or\n `mysql_bindaddress` is still local. See Database problems."} {"id":"technologies/mysql/connect-remotely.md#related","url":"https://docs.turbostack.app/technologies/mysql/connect-remotely/#related","path":"technologies/mysql/connect-remotely.md","title":"How to connect to your MySQL database remotely","heading":"Related","keywords":"remote database connection mysql ssh tunnel connect database client heidisql tableplus","text":"- Configure MySQL\n- Create and manage database users\n- Import and export a database\n- SSH access\n- Host Security tab"} {"id":"technologies/mysql/fix-charset-and-collation.md#intro","url":"https://docs.turbostack.app/technologies/mysql/fix-charset-and-collation/","path":"technologies/mysql/fix-charset-and-collation.md","title":"Fix database character set and collation","heading":"","keywords":"mysql charset collation utf8mb4 utf8mb4_unicode_ci garbled characters convert database charset","text":"# Fix database character set and collation\n\nIf text shows up garbled after an import or migration - accented letters turning into stray symbols,\nor emoji disappearing - the database is usually in an older character set such as `latin1` or\nthree-byte `utf8`. Converting it to **`utf8mb4`** (full Unicode, including emoji) fixes this.\n\n> [!WARNING]\n> Run this against a copy or a fresh backup first, and during a\n> quiet window: the `ALTER TABLE` statements rewrite every table and lock it while they run."} {"id":"technologies/mysql/fix-charset-and-collation.md#convert-a-database-and-all-its-tables","url":"https://docs.turbostack.app/technologies/mysql/fix-charset-and-collation/#convert-a-database-and-all-its-tables","path":"technologies/mysql/fix-charset-and-collation.md","title":"Fix database character set and collation","heading":"Convert a database and all its tables","keywords":"mysql charset collation utf8mb4 utf8mb4_unicode_ci garbled characters convert database charset","text":"Connect over SSH and convert in two parts - the database default,\nthen each table. This small script does both for one database:\n\n```bash\nDB=\"prod_db\"\nCHARSET=\"utf8mb4\"\nCOLLATION=\"utf8mb4_unicode_ci\"\n\nmysql -e \"ALTER DATABASE \\`$DB\\` CHARACTER SET $CHARSET COLLATE $COLLATION;\"\nmysql -N -s -e \"SHOW TABLES\" \"$DB\" | while read TABLE; do\n echo \"Converting $DB.$TABLE\"\n mysql \"$DB\" -e \"ALTER TABLE \\`$TABLE\\` CONVERT TO CHARACTER SET $CHARSET COLLATE $COLLATION;\"\ndone\n```\n\n`utf8mb4_unicode_ci` is a good general-purpose collation. Some applications expect a specific one\n(for example `utf8mb4_general_ci` or `utf8mb4_0900_ai_ci`) - match what your application's\ndocumentation asks for."} {"id":"technologies/mysql/fix-charset-and-collation.md#verify","url":"https://docs.turbostack.app/technologies/mysql/fix-charset-and-collation/#verify","path":"technologies/mysql/fix-charset-and-collation.md","title":"Fix database character set and collation","heading":"Verify","keywords":"mysql charset collation utf8mb4 utf8mb4_unicode_ci garbled characters convert database charset","text":"Check that the database reports the new character set:\n\n```bash\nmysql -e \"SELECT default_character_set_name FROM information_schema.SCHEMATA WHERE schema_name='prod_db';\"\n```\n\nThen reload the site and confirm the previously garbled text now displays correctly."} {"id":"technologies/mysql/fix-charset-and-collation.md#related","url":"https://docs.turbostack.app/technologies/mysql/fix-charset-and-collation/#related","path":"technologies/mysql/fix-charset-and-collation.md","title":"Fix database character set and collation","heading":"Related","keywords":"mysql charset collation utf8mb4 utf8mb4_unicode_ci garbled characters convert database charset","text":"- Import and export a MySQL database\n- Configure MySQL\n- Database problems\n- Backups and restore"} {"id":"technologies/mysql/import-export-database.md#intro","url":"https://docs.turbostack.app/technologies/mysql/import-export-database/","path":"technologies/mysql/import-export-database.md","title":"How to import and export a MySQL database","heading":"","keywords":"import database export database mysqldump restore database backup database gzip scp DEFINER ROW_FORMAT","text":"# How to import and export a MySQL database\n\nWe always recommend to dump and import through the command line, if possible. This documentation will\nexplain how to do this securely."} {"id":"technologies/mysql/import-export-database.md#mysql-export","url":"https://docs.turbostack.app/technologies/mysql/import-export-database/#mysql-export","path":"technologies/mysql/import-export-database.md","title":"How to import and export a MySQL database","heading":"MySQL export","keywords":"import database export database mysqldump restore database backup database gzip scp DEFINER ROW_FORMAT","text":"\n\nFor most databases (only a couple of gigabytes big), you can dump the database with this command:\n\n```bash\nmysqldump --single-transaction --triggers --routines --events DBNAME > DBNAME.sql\n```\n\nFor larger databases (tens of gigabytes or bigger), compress the database to conserve disk space and\nspeed up transfer:\n\n```bash\nmysqldump --single-transaction --triggers --routines --events DBNAME | gzip -3 -v > DBNAME.gz\n```"} {"id":"technologies/mysql/import-export-database.md#transferring-the-database","url":"https://docs.turbostack.app/technologies/mysql/import-export-database/#transferring-the-database","path":"technologies/mysql/import-export-database.md","title":"How to import and export a MySQL database","heading":"Transferring the database","keywords":"import database export database mysqldump restore database backup database gzip scp DEFINER ROW_FORMAT","text":"Use `scp` to transfer the file:\n\n```bash\nscp FileName user@HostnameOrIP:Path/To/Folder\n```\n\n> [!NOTE]\n> To place the file in the user's home directory, remove everything after the colon."} {"id":"technologies/mysql/import-export-database.md#importing-the-database","url":"https://docs.turbostack.app/technologies/mysql/import-export-database/#importing-the-database","path":"technologies/mysql/import-export-database.md","title":"How to import and export a MySQL database","heading":"Importing the database","keywords":"import database export database mysqldump restore database backup database gzip scp DEFINER ROW_FORMAT","text":"```bash\nmysql DBNAME < DBNAME.sql\n```\n\nOr, if compressed:\n\n```bash\ngunzip -c DBNAME.gz | mysql DBNAME\n```\n\n> [!NOTE]\n> Large databases can take time to import, especially on high-load servers."} {"id":"technologies/mysql/import-export-database.md#nohup","url":"https://docs.turbostack.app/technologies/mysql/import-export-database/#nohup","path":"technologies/mysql/import-export-database.md","title":"How to import and export a MySQL database","heading":"Nohup","keywords":"import database export database mysqldump restore database backup database gzip scp DEFINER ROW_FORMAT","text":"Use `nohup` to ensure the dump or import continues if the connection is lost."} {"id":"technologies/mysql/import-export-database.md#screen","url":"https://docs.turbostack.app/technologies/mysql/import-export-database/#screen","path":"technologies/mysql/import-export-database.md","title":"How to import and export a MySQL database","heading":"Screen","keywords":"import database export database mysqldump restore database backup database gzip scp DEFINER ROW_FORMAT","text":"Use `screen` to allow session sharing or recovery:\n\n- Create a session:\n\n ```bash\n screen -S \n ```\n\n- Disconnect (keep running):\n\n ```\n Ctrl + A, then D\n ```\n\n- Reattach or take over session:\n\n ```bash\n screen -dr \n ```\n\n- List sessions:\n\n ```bash\n screen -ls\n ```"} {"id":"technologies/mysql/import-export-database.md#ssh-key","url":"https://docs.turbostack.app/technologies/mysql/import-export-database/#ssh-key","path":"technologies/mysql/import-export-database.md","title":"How to import and export a MySQL database","heading":"SSH key","keywords":"import database export database mysqldump restore database backup database gzip scp DEFINER ROW_FORMAT","text":"Avoid password prompts by setting up SSH key authentication."} {"id":"technologies/mysql/import-export-database.md#mysql-error-1227-42000","url":"https://docs.turbostack.app/technologies/mysql/import-export-database/#mysql-error-1227-42000","path":"technologies/mysql/import-export-database.md","title":"How to import and export a MySQL database","heading":"MySQL ERROR 1227 (42000)","keywords":"import database export database mysqldump restore database backup database gzip scp DEFINER ROW_FORMAT","text":"> *Access denied; you need (at least one of) the SUPER privilege(s) for this operation*\n\nThis is caused by `routines`, `views`, or `triggers` defined with a definer the user cannot access.\n\n**Solution:** Strip the definer using `sed`:\n\n```bash\nmysqldump --single-transaction --triggers --routines --events DBNAME | sed -e 's/DEFINER=[^*]*\\*/\\*/g' > DBNAME.sql\n```\n\n**Or with compression:**\n\n```bash\nmysqldump --single-transaction --triggers --routines --events DBNAME | sed -e 's/DEFINER=[^*]*\\*/\\*/g' | gzip -3 -v > DBNAME.gz\n```\n\n**If you already have the file:**\n\n```bash\ncat DBNAME.sql | sed -e 's/DEFINER=[^*]*\\*/\\*/g' | mysql DBNAME\n```\n\n**Compressed file:**\n\n```bash\ngunzip -c DBNAME.gz | sed -e 's/DEFINER=[^*]*\\*/\\*/g' | mysql DBNAME\n```"} {"id":"technologies/mysql/import-export-database.md#mysql-error-1118-42000","url":"https://docs.turbostack.app/technologies/mysql/import-export-database/#mysql-error-1118-42000","path":"technologies/mysql/import-export-database.md","title":"How to import and export a MySQL database","heading":"MySQL ERROR 1118 (42000)","keywords":"import database export database mysqldump restore database backup database gzip scp DEFINER ROW_FORMAT","text":"> *Row size too large (> 8126). Changing some columns to TEXT or BLOB or using ROW_FORMAT=DYNAMIC or ROW_FORMAT=COMPRESSED may help.*\n\nCaused by limits on row size when using `ROW_FORMAT=COMPACT`.\n\n**Fix during import:**\n\n```bash\ncat DBNAME.sql | sed -e 's/ROW_FORMAT=COMPACT/ROW_FORMAT=DYNAMIC/g' | mysql DBNAME\n```\n\n**Compressed file:**\n\n```bash\ngunzip -c DBNAME.gz | sed -e 's/ROW_FORMAT=COMPACT/ROW_FORMAT=DYNAMIC/g' | mysql DBNAME\n```"} {"id":"technologies/mysql/import-export-database.md#related","url":"https://docs.turbostack.app/technologies/mysql/import-export-database/#related","path":"technologies/mysql/import-export-database.md","title":"How to import and export a MySQL database","heading":"Related","keywords":"import database export database mysqldump restore database backup database gzip scp DEFINER ROW_FORMAT","text":"- Configure MySQL\n- Create and manage database users\n- Fix character set and collation\n- Backups and restore\n- SSH access\n- Database problems"} {"id":"technologies/mysql/manage-database-users.md#intro","url":"https://docs.turbostack.app/technologies/mysql/manage-database-users/","path":"technologies/mysql/manage-database-users.md","title":"How to create and manage database users","heading":"","keywords":"create database user grant privileges database permissions least privilege db user","text":"# How to create and manage database users\n\nCreate additional MySQL users with only the access they need - for example a read-only user\nfor reporting, or a separate user per application. Your application already has a main database user;\nadd extra users rather than sharing it."} {"id":"technologies/mysql/manage-database-users.md#the-turbostack-way-extra-database-users","url":"https://docs.turbostack.app/technologies/mysql/manage-database-users/#the-turbostack-way-extra-database-users","path":"technologies/mysql/manage-database-users.md","title":"How to create and manage database users","heading":"The TurboStack way: extra database users","keywords":"create database user grant privileges database permissions least privilege db user","text":"The simplest option is to let TurboStack manage the user for you:\n\n1. Open the application's **Configure application** dialog and go to the **Database Info** tab\n (Applications).\n2. Add an **extra database user** and choose its role - **read-only** or **admin**.\n3. Publish the host. TurboStack creates the user and shows its credentials on the\n Credentials tab.\n\nUse this for the common cases; it keeps the user in your configuration and recreates it consistently."} {"id":"technologies/mysql/manage-database-users.md#create-a-user-by-hand-sql","url":"https://docs.turbostack.app/technologies/mysql/manage-database-users/#create-a-user-by-hand-sql","path":"technologies/mysql/manage-database-users.md","title":"How to create and manage database users","heading":"Create a user by hand (SQL)","keywords":"create database user grant privileges database permissions least privilege db user","text":"For finer-grained grants, connect over SSH as your system user and run\nSQL with the `mysql` command-line client (`mysql` is the client command, not a user name). Grant only\nwhat the user needs.\n\nA read-only user on one database:\n\n```sql\nCREATE USER 'prod_readonly'@'localhost' IDENTIFIED BY 'a-strong-password';\nGRANT SELECT ON prod_db.* TO 'prod_readonly'@'localhost';\nFLUSH PRIVILEGES;\n```\n\nA user with full access to a single application database:\n\n```sql\nCREATE USER 'prod_app'@'localhost' IDENTIFIED BY 'a-strong-password';\nGRANT ALL PRIVILEGES ON prod_db.* TO 'prod_app'@'localhost';\nFLUSH PRIVILEGES;\n```\n\n> [!TIP]\n> Grant per database (`prod_db.*`), not globally (`*.*`). Never grant `ALL PRIVILEGES ON *.*` or\n> `WITH GRANT OPTION` to an application user."} {"id":"technologies/mysql/manage-database-users.md#rotate-a-password","url":"https://docs.turbostack.app/technologies/mysql/manage-database-users/#rotate-a-password","path":"technologies/mysql/manage-database-users.md","title":"How to create and manage database users","heading":"Rotate a password","keywords":"create database user grant privileges database permissions least privilege db user","text":"```sql\nALTER USER 'prod_readonly'@'localhost' IDENTIFIED BY 'a-new-strong-password';\nFLUSH PRIVILEGES;\n```\n\nUpdate the password wherever the user is configured (the application, or your client) at the same time."} {"id":"technologies/mysql/manage-database-users.md#verify-access","url":"https://docs.turbostack.app/technologies/mysql/manage-database-users/#verify-access","path":"technologies/mysql/manage-database-users.md","title":"How to create and manage database users","heading":"Verify access","keywords":"create database user grant privileges database permissions least privilege db user","text":"```sql\nSHOW GRANTS FOR 'prod_readonly'@'localhost';\n```\n\nThen connect as that user and confirm it can do what it should - and nothing more."} {"id":"technologies/mysql/manage-database-users.md#related","url":"https://docs.turbostack.app/technologies/mysql/manage-database-users/#related","path":"technologies/mysql/manage-database-users.md","title":"How to create and manage database users","heading":"Related","keywords":"create database user grant privileges database permissions least privilege db user","text":"- Configure MySQL\n- Import and export a MySQL database\n- Connect to your database remotely\n- Credentials\n- Applications\n"} {"id":"technologies/mysql/phpmyadmin.md#intro","url":"https://docs.turbostack.app/technologies/mysql/phpmyadmin/","path":"technologies/mysql/phpmyadmin.md","title":"How to use phpMyAdmin","heading":"","keywords":"phpmyadmin manage mysql database gui run sql phpadm","text":"# How to use phpMyAdmin\n\nphpMyAdmin is a web-based tool for managing MySQL databases - create and edit tables,\nrun SQL queries, manage users, and import or export data. On TurboStack hosts with MySQL enabled it\nis **pre-installed**, so there is nothing to set up."} {"id":"technologies/mysql/phpmyadmin.md#open-phpmyadmin","url":"https://docs.turbostack.app/technologies/mysql/phpmyadmin/#open-phpmyadmin","path":"technologies/mysql/phpmyadmin.md","title":"How to use phpMyAdmin","heading":"Open phpMyAdmin","keywords":"phpmyadmin manage mysql database gui run sql phpadm","text":"You need your SSH and database credentials from the host's\nCredentials tab.\n\n**From the platform:** open the application's **Configure application** dialog, go to the **Database\nInfo** tab (Applications), and select **Go to\nphpMyAdmin**.\n\n**By URL:** if that link is not available, browse to your domain with the `/phpadm` path, for example\n`https://www.example.com/phpadm`.\n\nEither way you are first prompted for your **SSH user** (account name and password), then for your\n**database credentials** at the phpMyAdmin login screen."} {"id":"technologies/mysql/phpmyadmin.md#use-it","url":"https://docs.turbostack.app/technologies/mysql/phpmyadmin/#use-it","path":"technologies/mysql/phpmyadmin.md","title":"How to use phpMyAdmin","heading":"Use it","keywords":"phpmyadmin manage mysql database gui run sql phpadm","text":"Once logged in you can browse and edit databases and tables, run SQL from the **SQL** tab, manage\ndatabase users, and import or export data (for large databases, prefer\nthe command line - see Import and export a database).\n\n> [!WARNING]\n> phpMyAdmin writes directly to your live database. Take a backup\n> before bulk edits or running an `UPDATE`/`DELETE` you are unsure about."} {"id":"technologies/mysql/phpmyadmin.md#related","url":"https://docs.turbostack.app/technologies/mysql/phpmyadmin/#related","path":"technologies/mysql/phpmyadmin.md","title":"How to use phpMyAdmin","heading":"Related","keywords":"phpmyadmin manage mysql database gui run sql phpadm","text":"- Configure MySQL\n- Create and manage database users\n- Import and export a database\n- Credentials"} {"id":"technologies/mysql/what-is.md#intro","url":"https://docs.turbostack.app/technologies/mysql/what-is/","path":"technologies/mysql/what-is.md","title":"What is MySQL?","heading":"","keywords":"what is mysql mysql hosting mysql turbostack percona server relational database wordpress database magento database","text":"# What is MySQL?\n\nMySQL is a widely used open-source relational database. It stores data in tables with rows and columns and is queried with SQL, making it a reliable backend for content management systems, e-commerce platforms, and custom web applications.\n\nIt is used by many common applications including WordPress, Magento, Shopware, and Drupal."} {"id":"technologies/mysql/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/mysql/what-is/#on-turbostack","path":"technologies/mysql/what-is.md","title":"What is MySQL?","heading":"On TurboStack","keywords":"what is mysql mysql hosting mysql turbostack percona server relational database wordpress database magento database","text":"TurboStack runs **Percona Server for MySQL**, a drop-in, performance-focused build of MySQL, as a host-level service. You enable it on a host and pick the major version (for example `8.4`).\n\nWhen you create an application, TurboStack automatically provisions a dedicated database and database user for it, so each site has its own isolated credentials. The **InnoDB buffer pool** is the memory MySQL uses to cache data and indexes. It is auto-tuned to the server's resources, so you rarely need to adjust it manually.\n\n> [!WARNING]\n> Major-version upgrades are supported, but downgrades are not. Plan and test a version change before applying it in production, and take a backup first."} {"id":"technologies/mysql/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/mysql/what-is/#best-practices","path":"technologies/mysql/what-is.md","title":"What is MySQL?","heading":"Best practices","keywords":"what is mysql mysql hosting mysql turbostack percona server relational database wordpress database magento database","text":"- Stay on a current, supported major version and plan upgrades deliberately - you cannot downgrade.\n- Leave the InnoDB buffer pool auto-tuned unless you have measured evidence that a different size helps.\n- Use the per-application database and user that TurboStack creates rather than sharing one database across sites.\n- Keep the database bound to localhost; only expose it to other hosts when you genuinely need remote access, and restrict access when you do.\n- Take regular backups and verify you can restore them, especially before version changes.\n- Add indexes for your common query patterns and review slow queries periodically."} {"id":"technologies/mysql/what-is.md#related","url":"https://docs.turbostack.app/technologies/mysql/what-is/#related","path":"technologies/mysql/what-is.md","title":"What is MySQL?","heading":"Related","keywords":"what is mysql mysql hosting mysql turbostack percona server relational database wordpress database magento database","text":"- Configure MySQL on TurboStack\n- Services"} {"id":"technologies/nginx/block-ip-addresses.md#intro","url":"https://docs.turbostack.app/technologies/nginx/block-ip-addresses/","path":"technologies/nginx/block-ip-addresses.md","title":"How to block or allow IP addresses","heading":"","keywords":"block ip nginx allow ip deny ip address ip whitelist","text":"# How to block or allow IP addresses\n\nYou can allow or deny specific IP addresses for your applications with a small piece of custom Nginx\nconfiguration. This applies at the web-server level, to the applications of one system user.\n\n> [!NOTE]\n> For blocking abusive or malicious traffic, prefer the platform features: TurboShield\n> (rate limiting and bot control) and the Firewall. Use the Nginx rules\n> below for application-level cases, such as locking a site to your office during development."} {"id":"technologies/nginx/block-ip-addresses.md#before-you-start","url":"https://docs.turbostack.app/technologies/nginx/block-ip-addresses/#before-you-start","path":"technologies/nginx/block-ip-addresses.md","title":"How to block or allow IP addresses","heading":"Before you start","keywords":"block ip nginx allow ip deny ip address ip whitelist","text":"- **SSH access to the host** - see SSH access.\n- Familiarity with how custom Nginx configuration loads\n from the `~/nginx` directory."} {"id":"technologies/nginx/block-ip-addresses.md#allow-only-certain-ips-deny-the-rest","url":"https://docs.turbostack.app/technologies/nginx/block-ip-addresses/#allow-only-certain-ips-deny-the-rest","path":"technologies/nginx/block-ip-addresses.md","title":"How to block or allow IP addresses","heading":"Allow only certain IPs (deny the rest)","keywords":"block ip nginx allow ip deny ip address ip whitelist","text":"Create a file `~/nginx/10auth.conf` (the low prefix loads it early) and list the allowed addresses:\n\n```nginx\nallow 203.0.113.10; # office VPN\nallow 203.0.113.20;\ndeny all;\n```\n\nThis protects every application of that system user. It applies only to that user's websites - an\napplication under a different system user on the same host is not affected.\n\nTo protect only part of a site, put the rules inside the relevant `location` block in\n`~/nginx/50main.conf` instead - for example `location /` for the whole site, or `location /private/`\nfor one path:\n\n```nginx\nlocation / {\n try_files $uri $uri/ /index.php$is_args$args;\n\n allow 203.0.113.10;\n allow 203.0.113.20;\n deny all;\n}\n```\n\nTo allow listed IPs while still serving everyone else (no blocking), combine with `satisfy any` when\nyou also use authentication - see Restrict admin access."} {"id":"technologies/nginx/block-ip-addresses.md#block-before-varnish","url":"https://docs.turbostack.app/technologies/nginx/block-ip-addresses/#block-before-varnish","path":"technologies/nginx/block-ip-addresses.md","title":"How to block or allow IP addresses","heading":"Block before Varnish","keywords":"block ip nginx allow ip deny ip address ip whitelist","text":"If Varnish is enabled and you want to block at the edge (before the cache), place the rules in\n`~/nginx/outside/main/10whitelist.conf` instead. See\ncustom Nginx configuration."} {"id":"technologies/nginx/block-ip-addresses.md#apply-and-verify","url":"https://docs.turbostack.app/technologies/nginx/block-ip-addresses/#apply-and-verify","path":"technologies/nginx/block-ip-addresses.md","title":"How to block or allow IP addresses","heading":"Apply and verify","keywords":"block ip nginx allow ip deny ip address ip whitelist","text":"```bash\ntscli nginx reload\n```\n\nFrom a blocked address the site returns **403 Forbidden**; from an allowed address it loads normally.\n\n> [!WARNING]\n> A wrong rule can lock you (and everyone) out. Keep your own IP in the allow list, and remember\n> `tscli nginx reload` reports config errors. If you are unsure, contact support."} {"id":"technologies/nginx/block-ip-addresses.md#related","url":"https://docs.turbostack.app/technologies/nginx/block-ip-addresses/#related","path":"technologies/nginx/block-ip-addresses.md","title":"How to block or allow IP addresses","heading":"Related","keywords":"block ip nginx allow ip deny ip address ip whitelist","text":"- Configure Nginx\n- Restrict admin access\n- TurboShield\n- Firewall\n"} {"id":"technologies/nginx/change-docroot.md#intro","url":"https://docs.turbostack.app/technologies/nginx/change-docroot/","path":"technologies/nginx/change-docroot.md","title":"Change your Nginx docroot","heading":"","keywords":"nginx docroot change document root change document root public_html symlink 50main.conf root deployer current releases","text":"# Change your Nginx docroot\n\nSome applications may require you to use a different document root (docroot) than the typical\ndirectory of `~/public_html`. The docroot is the directory Nginx serves a site's files from. Other\ntimes, your own application deploy flow may require you to change Nginx's docroot, for example to\npoint it to `~/current`. In this guide, we'll quickly go over some common\nsituations and ways to set this up.\n\n> [!NOTE]\n> This is mostly applicable for general applications. Many CMSes and frameworks have a custom docroot\n> path, that we configure by default in Nginx if you set up your application with the correct\n> application type. Be sure to check your current settings before making any changes!"} {"id":"technologies/nginx/change-docroot.md#using-symlinks","url":"https://docs.turbostack.app/technologies/nginx/change-docroot/#using-symlinks","path":"technologies/nginx/change-docroot.md","title":"Change your Nginx docroot","heading":"Using symlinks","keywords":"nginx docroot change document root change document root public_html symlink 50main.conf root deployer current releases","text":"The easiest way to make sure Nginx reads application files in the correct directory, is simply by\nturning the default directory into a symlink, pointing to the desired directory. Consider the\nfollowing default directory setup:\n\n```\nsander@web1:~$ ls -l\n<...>\ndrwxr-xr-x 2 sander sander 4096 Apr 13 00:00 logs\ndrwxr-xr-x 2 sander sander 4096 Jan 13 09:24 nginx\nlrwxrwxrwx 1 sander sander 4096 Apr 14 11:53 public_html\n<...>\n```\n\nLet's say your app typically deploys with a directory `releases/`, which contains the actual\ndifferent releases and a symlink `current`, linking to the most recent release. This is the default\nDeployer setup. In that case, you can simply remove the existing, empty public_html directory and\nreplace it with a symlink:\n\n```\nsander@web1:~$ rmdir public_html\nsander@web1:~$ ln -s current public_html\nsander@web1:~$ ls -l\n<...>\nlrwxrwxrwx 1 sander sander 11 Apr 14 11:53 current -> releases/56\ndrwxr-xr-x 2 sander sander 4096 Jan 13 09:24 nginx\nlrwxrwxrwx 1 sander sander 7 Apr 14 11:53 public_html -> current\n<...>\n```"} {"id":"technologies/nginx/change-docroot.md#using-the-nginx-docroot","url":"https://docs.turbostack.app/technologies/nginx/change-docroot/#using-the-nginx-docroot","path":"technologies/nginx/change-docroot.md","title":"Change your Nginx docroot","heading":"Using the Nginx docroot","keywords":"nginx docroot change document root change document root public_html symlink 50main.conf root deployer current releases","text":"Alternatively, you could change the actual path Nginx looks for. In your home directory you'll find\nthe `~/nginx` config directory, containing the `50main.conf` file. Here, you'll find your main\napplication Nginx config, including the docroot. Depending on your configured app type, the exact\ncontents of this file will change. However, you can edit this file as desired. An example of how the\ndocroot is defined in this file is below:\n\n```\nroot /var/www/sander/public_html;\n```\n\nHere you could change the `public_html` part to any path as required by your application. After\nediting, apply the change by reloading Nginx with the TurboStack CLI:\n\n```bash\ntscli nginx reload\n```\n\n> [!WARNING]\n> Editing `50main.conf` needs Nginx knowledge - a mistake can take the site offline.\n> `tscli nginx reload` validates the configuration and reports the error if there is one."} {"id":"technologies/nginx/change-docroot.md#letting-the-platform-manage-it","url":"https://docs.turbostack.app/technologies/nginx/change-docroot/#letting-the-platform-manage-it","path":"technologies/nginx/change-docroot.md","title":"Change your Nginx docroot","heading":"Letting the platform manage it","keywords":"nginx docroot change document root change document root public_html symlink 50main.conf root deployer current releases","text":"The two methods above are yours to maintain. There is also a platform-native override that changes\nthe served folder and keeps the generated configuration in sync, so it survives platform updates\nwithout you editing `50main.conf` by hand. That is the cleanest option when a framework serves from\na fixed subfolder such as `public` or `web`, and it is the one to ask\nSupport for if the symlink does not suit your deployment."} {"id":"technologies/nginx/change-docroot.md#related","url":"https://docs.turbostack.app/technologies/nginx/change-docroot/#related","path":"technologies/nginx/change-docroot.md","title":"Change your Nginx docroot","heading":"Related","keywords":"nginx docroot change document root change document root public_html symlink 50main.conf root deployer current releases","text":"- Configure Nginx\n- What is Nginx?\n- TurboStack CLI - reload Nginx with `tscli nginx reload`"} {"id":"technologies/nginx/configure.md#intro","url":"https://docs.turbostack.app/technologies/nginx/configure/","path":"technologies/nginx/configure.md","title":"Configure Nginx on TurboStack","heading":"","keywords":"configure nginx turbostack nginx yaml webserver nginx nginx host configuration","text":"# Configure Nginx on TurboStack\n\nSelecting Nginx as the web server for a host takes a single setting; TurboStack\ngenerates the per-application configuration from there."} {"id":"technologies/nginx/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/nginx/configure/#where-to-configure-it","path":"technologies/nginx/configure.md","title":"Configure Nginx on TurboStack","heading":"Where to configure it","keywords":"configure nginx turbostack nginx yaml webserver nginx nginx host configuration","text":"The web server is chosen at the **host** level:\n\n1. Open the host.\n2. Go to the **Services** tab.\n3. Under **Webserver**, select **nginx**.\n\n\n\nThis applies to every application on the host. The per-application vhost (caching\nheaders, static-asset expiry, security denies and the PHP-FPM backend) is\ngenerated automatically - there is no raw config to write by hand."} {"id":"technologies/nginx/configure.md#required","url":"https://docs.turbostack.app/technologies/nginx/configure/#required","path":"technologies/nginx/configure.md","title":"Configure Nginx on TurboStack","heading":"Required","keywords":"configure nginx turbostack nginx yaml webserver nginx nginx host configuration","text":"| Key | Meaning |\n|---|---|\n| `webserver` | The host's web server. Set to `nginx` to select Nginx. |"} {"id":"technologies/nginx/configure.md#optional","url":"https://docs.turbostack.app/technologies/nginx/configure/#optional","path":"technologies/nginx/configure.md","title":"Configure Nginx on TurboStack","heading":"Optional","keywords":"configure nginx turbostack nginx yaml webserver nginx nginx host configuration","text":"Per-application virtual host tuning (caching, static-asset expiry, security denies\nand the PHP-FPM backend) is **generated for you** by TurboStack - there are no\nextra Nginx keys you need to set.\n\n```yaml\n# Host-level: select Nginx as the web server\nwebserver: nginx\n```\n\n> [!TIP]\n> Only one web server runs per host. To switch to Apache, change `webserver` to\n> `apache2` - see Configure Apache."} {"id":"technologies/nginx/configure.md#custom-nginx-configuration","url":"https://docs.turbostack.app/technologies/nginx/configure/#custom-nginx-configuration","path":"technologies/nginx/configure.md","title":"Configure Nginx on TurboStack","heading":"Custom Nginx configuration","keywords":"configure nginx turbostack nginx yaml webserver nginx nginx host configuration","text":"The generated vhost covers most needs, but you can add your own Nginx configuration per system user\nin the `~/nginx` directory (over SSH). Files load in **alphabetical\norder**, so the numeric prefix sets the priority. Two files are present by default:\n\n- `20rewrites.conf` - your redirects and rewrites.\n- `50main.conf` - the main server block. A file with a prefix above `50` loads after it; below `50`,\n before it.\n\nWhen Varnish is enabled it sits in front of Nginx, and the location decides when your rules run:\n\n- Files in `~/nginx/` load **after** Varnish - app-level rewrites, headers and security rules.\n- Files in `~/nginx/outside/main/` load **before** Varnish - edge rules and pre-cache allow-lists.\n\nCustom config applies only to that system user's applications. Besides `.conf`, the `.runmaps` (Magento\nrouting) and `.http` (for example `backend.http`) file types are also supported.\n\nApply changes with the TurboStack CLI:\n\n```bash\ntscli nginx reload\n```\n\n> [!WARNING]\n> Editing `50main.conf` needs Nginx knowledge - a mistake can take the site offline. `tscli nginx\n> reload` validates the config and points to the error. If you are unsure, contact\n> support first."} {"id":"technologies/nginx/configure.md#common-tasks","url":"https://docs.turbostack.app/technologies/nginx/configure/#common-tasks","path":"technologies/nginx/configure.md","title":"Configure Nginx on TurboStack","heading":"Common tasks","keywords":"configure nginx turbostack nginx yaml webserver nginx nginx host configuration","text":"- Force HTTPS\n- Redirect to/from www\n- Block or allow IP addresses\n- Add custom HTTP headers\n- Restrict admin access\n- Change the Nginx docroot"} {"id":"technologies/nginx/configure.md#related","url":"https://docs.turbostack.app/technologies/nginx/configure/#related","path":"technologies/nginx/configure.md","title":"Configure Nginx on TurboStack","heading":"Related","keywords":"configure nginx turbostack nginx yaml webserver nginx nginx host configuration","text":"- What is Nginx?\n- Host Services tab\n- Applications overview\n- TurboStack CLI - reload or restart Nginx with `tscli nginx reload`"} {"id":"technologies/nginx/custom-http-headers.md#intro","url":"https://docs.turbostack.app/technologies/nginx/custom-http-headers/","path":"technologies/nginx/custom-http-headers.md","title":"How to add custom HTTP headers","heading":"","keywords":"custom http headers security headers add header nginx hsts header","text":"# How to add custom HTTP headers\n\nAdd your own HTTP response headers - most often security headers - with a small piece of custom\nNginx configuration."} {"id":"technologies/nginx/custom-http-headers.md#before-you-start","url":"https://docs.turbostack.app/technologies/nginx/custom-http-headers/#before-you-start","path":"technologies/nginx/custom-http-headers.md","title":"How to add custom HTTP headers","heading":"Before you start","keywords":"custom http headers security headers add header nginx hsts header","text":"- **SSH access to the host** - see SSH access.\n- Add the headers in `~/nginx/50main.conf` - see custom Nginx configuration."} {"id":"technologies/nginx/custom-http-headers.md#add-security-headers","url":"https://docs.turbostack.app/technologies/nginx/custom-http-headers/#add-security-headers","path":"technologies/nginx/custom-http-headers.md","title":"How to add custom HTTP headers","heading":"Add security headers","keywords":"custom http headers security headers add header nginx hsts header","text":"In the server block (or a `location`), use `add_header` with the `always` flag so the header is sent\non error responses too:\n\n```nginx\nadd_header X-Frame-Options \"SAMEORIGIN\" always;\nadd_header X-Content-Type-Options \"nosniff\" always;\nadd_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\n```\n\n> [!IMPORTANT]\n> If you add `add_header` inside a `location`, Nginx stops inheriting the headers set higher up - you\n> must repeat the ones you still want in that location."} {"id":"technologies/nginx/custom-http-headers.md#restrict-access-to-text-and-log-files","url":"https://docs.turbostack.app/technologies/nginx/custom-http-headers/#restrict-access-to-text-and-log-files","path":"technologies/nginx/custom-http-headers.md","title":"How to add custom HTTP headers","heading":"Restrict access to text and log files","keywords":"custom http headers security headers add header nginx hsts header","text":"A common hardening rule: allow `robots.txt`, but deny other `.txt` and `.log` files.\n\n```nginx\nlocation = /robots.txt {\n allow all;\n log_not_found off;\n access_log off;\n}\nlocation ~* \\.(txt|log)$ {\n deny all;\n}\n```"} {"id":"technologies/nginx/custom-http-headers.md#apply-and-verify","url":"https://docs.turbostack.app/technologies/nginx/custom-http-headers/#apply-and-verify","path":"technologies/nginx/custom-http-headers.md","title":"How to add custom HTTP headers","heading":"Apply and verify","keywords":"custom http headers security headers add header nginx hsts header","text":"```bash\ntscli nginx reload\n```\n\nCheck the headers with:\n\n```bash\ncurl -I https://example.com\n```\n\n> [!TIP]\n> To make browsers always use HTTPS, add the `Strict-Transport-Security` (HSTS) header - but only\n> once HTTPS works everywhere, because it is hard to undo. See Force HTTPS."} {"id":"technologies/nginx/custom-http-headers.md#related","url":"https://docs.turbostack.app/technologies/nginx/custom-http-headers/#related","path":"technologies/nginx/custom-http-headers.md","title":"How to add custom HTTP headers","heading":"Related","keywords":"custom http headers security headers add header nginx hsts header","text":"- Configure Nginx\n- Force HTTPS\n- Security hardening"} {"id":"technologies/nginx/force-https.md#intro","url":"https://docs.turbostack.app/technologies/nginx/force-https/","path":"technologies/nginx/force-https.md","title":"How to force HTTPS","heading":"","keywords":"force https redirect http to https https only ssl redirect","text":"# How to force HTTPS\n\nOn TurboStack you do not need to write a redirect to force HTTPS - it is handled for you. Once a\napplication has an active certificate, the platform serves it over HTTPS and redirects HTTP to HTTPS\nautomatically."} {"id":"technologies/nginx/force-https.md#make-sure-https-is-active","url":"https://docs.turbostack.app/technologies/nginx/force-https/#make-sure-https-is-active","path":"technologies/nginx/force-https.md","title":"How to force HTTPS","heading":"Make sure HTTPS is active","keywords":"force https redirect http to https https only ssl redirect","text":"Give the application a certificate by setting `cert_type: letsencrypt` (the default for most\napplications) and publishing - see\nTLS certificates. Once the certificate is\nissued, HTTP requests are redirected to HTTPS.\n\n> [!NOTE]\n> Because the redirect is done at the web-server layer, you do not need an application plugin for it\n> (for example, remove the redundant `really-simple-ssl` plugin on WordPress). Do not add your own HTTP-to-HTTPS redirect\n> in custom Nginx config - it would duplicate the platform's and can cause redirect loops."} {"id":"technologies/nginx/force-https.md#point-your-application-at-https","url":"https://docs.turbostack.app/technologies/nginx/force-https/#point-your-application-at-https","path":"technologies/nginx/force-https.md","title":"How to force HTTPS","heading":"Point your application at HTTPS","keywords":"force https redirect http to https https only ssl redirect","text":"So your app generates `https://` links and avoids mixed-content warnings, set its site or base URL to\nthe `https://` address (for example the WordPress Site Address, or the framework's `APP_URL`)."} {"id":"technologies/nginx/force-https.md#optional-enforce-https-in-the-browser-with-hsts","url":"https://docs.turbostack.app/technologies/nginx/force-https/#optional-enforce-https-in-the-browser-with-hsts","path":"technologies/nginx/force-https.md","title":"How to force HTTPS","heading":"Optional: enforce HTTPS in the browser with HSTS","keywords":"force https redirect http to https https only ssl redirect","text":"To tell browsers to always use HTTPS for your domain, add the `Strict-Transport-Security` header -\nsee Add custom HTTP headers:\n\n```nginx\nadd_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;\n```\n\n> [!WARNING]\n> Enable HSTS only when HTTPS works on the domain and its subdomains. It is cached by browsers for a\n> long time and is hard to undo."} {"id":"technologies/nginx/force-https.md#verify","url":"https://docs.turbostack.app/technologies/nginx/force-https/#verify","path":"technologies/nginx/force-https.md","title":"How to force HTTPS","heading":"Verify","keywords":"force https redirect http to https https only ssl redirect","text":"An HTTP request should answer with a `301` redirect to the `https://` URL:\n\n```bash\ncurl -I http://example.com\n```"} {"id":"technologies/nginx/force-https.md#related","url":"https://docs.turbostack.app/technologies/nginx/force-https/#related","path":"technologies/nginx/force-https.md","title":"How to force HTTPS","heading":"Related","keywords":"force https redirect http to https https only ssl redirect","text":"- TLS certificates\n- Add custom HTTP headers\n- TLS certificate problems"} {"id":"technologies/nginx/redirect-www.md#intro","url":"https://docs.turbostack.app/technologies/nginx/redirect-www/","path":"technologies/nginx/redirect-www.md","title":"How to redirect to or from www","heading":"","keywords":"redirect www non-www canonical domain www redirect","text":"# How to redirect to or from www\n\nPick one canonical form of your domain - either `www.example.com` or `example.com` - and redirect the\nother to it. This avoids duplicate content and keeps links and analytics consistent."} {"id":"technologies/nginx/redirect-www.md#before-you-start","url":"https://docs.turbostack.app/technologies/nginx/redirect-www/#before-you-start","path":"technologies/nginx/redirect-www.md","title":"How to redirect to or from www","heading":"Before you start","keywords":"redirect www non-www canonical domain www redirect","text":"- **SSH access to the host** - see SSH access.\n- Both forms should point to your server and have a certificate (`cert_type: letsencrypt`) so HTTPS\n works after the redirect - see TLS certificates.\n- Add the rule to `~/nginx/20rewrites.conf` - see custom Nginx configuration."} {"id":"technologies/nginx/redirect-www.md#redirect-non-www-to-www","url":"https://docs.turbostack.app/technologies/nginx/redirect-www/#redirect-non-www-to-www","path":"technologies/nginx/redirect-www.md","title":"How to redirect to or from www","heading":"Redirect non-www to www","keywords":"redirect www non-www canonical domain www redirect","text":"```nginx\nif ($host ~ ^(?!www\\.)(?.+)$) {\n return 301 $scheme://www.$domain$request_uri;\n}\n```"} {"id":"technologies/nginx/redirect-www.md#redirect-www-to-non-www","url":"https://docs.turbostack.app/technologies/nginx/redirect-www/#redirect-www-to-non-www","path":"technologies/nginx/redirect-www.md","title":"How to redirect to or from www","heading":"Redirect www to non-www","keywords":"redirect www non-www canonical domain www redirect","text":"```nginx\nif ($host ~* ^www\\.(?.+)$) {\n return 301 $scheme://$domain$request_uri;\n}\n```"} {"id":"technologies/nginx/redirect-www.md#redirect-extra-domains-to-your-main-domain-keeping-the-path","url":"https://docs.turbostack.app/technologies/nginx/redirect-www/#redirect-extra-domains-to-your-main-domain-keeping-the-path","path":"technologies/nginx/redirect-www.md","title":"How to redirect to or from www","heading":"Redirect extra domains to your main domain (keeping the path)","keywords":"redirect www non-www canonical domain www redirect","text":"```nginx\nif ($http_host ~* \"(old-one\\.example\\.net|old-two\\.example\\.org)$\") {\n return 301 $scheme://www.example.com$request_uri;\n}\n```"} {"id":"technologies/nginx/redirect-www.md#add-a-trailing-slash-to-a-path","url":"https://docs.turbostack.app/technologies/nginx/redirect-www/#add-a-trailing-slash-to-a-path","path":"technologies/nginx/redirect-www.md","title":"How to redirect to or from www","heading":"Add a trailing slash to a path","keywords":"redirect www non-www canonical domain www redirect","text":"Redirect a path without a trailing slash to its slashed form, so a single canonical URL\nis served:\n\n```nginx\nlocation /blog {\n rewrite ^/blog$ /blog/ permanent;\n}\n```"} {"id":"technologies/nginx/redirect-www.md#redirect-a-domain-to-a-specific-page","url":"https://docs.turbostack.app/technologies/nginx/redirect-www/#redirect-a-domain-to-a-specific-page","path":"technologies/nginx/redirect-www.md","title":"How to redirect to or from www","heading":"Redirect a domain to a specific page","keywords":"redirect www non-www canonical domain www redirect","text":"Send every request for one domain to a fixed page on another, rather than keeping the\nrequested path:\n\n```nginx\nif ($http_host ~* \"^.*your-domain\\.be$\") {\n rewrite ^/$ https://your-domain/page/ redirect;\n}\n```"} {"id":"technologies/nginx/redirect-www.md#apply-and-verify","url":"https://docs.turbostack.app/technologies/nginx/redirect-www/#apply-and-verify","path":"technologies/nginx/redirect-www.md","title":"How to redirect to or from www","heading":"Apply and verify","keywords":"redirect www non-www canonical domain www redirect","text":"```bash\ntscli nginx reload\n```\n\nCheck the redirect (look for `301` and the `Location` header):\n\n```bash\ncurl -I https://example.com\n```"} {"id":"technologies/nginx/redirect-www.md#related","url":"https://docs.turbostack.app/technologies/nginx/redirect-www/#related","path":"technologies/nginx/redirect-www.md","title":"How to redirect to or from www","heading":"Related","keywords":"redirect www non-www canonical domain www redirect","text":"- Configure Nginx\n- TLS certificates\n- Connecting your domain"} {"id":"technologies/nginx/restrict-admin-access.md#intro","url":"https://docs.turbostack.app/technologies/nginx/restrict-admin-access/","path":"technologies/nginx/restrict-admin-access.md","title":"How to restrict access to your admin area","heading":"","keywords":"restrict admin access protect admin basic auth password protect ip restrict admin","text":"# How to restrict access to your admin area\n\nLock an admin area (for example `/wp-admin`) or a whole staging site so only you can reach it. There\nare two approaches, which you can combine: an **IP allow-list**, and **HTTP basic authentication**."} {"id":"technologies/nginx/restrict-admin-access.md#before-you-start","url":"https://docs.turbostack.app/technologies/nginx/restrict-admin-access/#before-you-start","path":"technologies/nginx/restrict-admin-access.md","title":"How to restrict access to your admin area","heading":"Before you start","keywords":"restrict admin access protect admin basic auth password protect ip restrict admin","text":"- **SSH access to the host** - see SSH access.\n- See custom Nginx configuration for how `~/nginx` works."} {"id":"technologies/nginx/restrict-admin-access.md#option-1-ip-allow-list","url":"https://docs.turbostack.app/technologies/nginx/restrict-admin-access/#option-1-ip-allow-list","path":"technologies/nginx/restrict-admin-access.md","title":"How to restrict access to your admin area","heading":"Option 1: IP allow-list","keywords":"restrict admin access protect admin basic auth password protect ip restrict admin","text":"Restrict a path to known addresses in `~/nginx/50main.conf`:\n\n```nginx\nlocation /admin/ {\n allow 203.0.113.10;\n deny all;\n}\n```\n\nFor allow/deny rules that cover a whole site rather than one path, see\nBlock or allow IP addresses."} {"id":"technologies/nginx/restrict-admin-access.md#option-2-http-basic-authentication","url":"https://docs.turbostack.app/technologies/nginx/restrict-admin-access/#option-2-http-basic-authentication","path":"technologies/nginx/restrict-admin-access.md","title":"How to restrict access to your admin area","heading":"Option 2: HTTP basic authentication","keywords":"restrict admin access protect admin basic auth password protect ip restrict admin","text":"Ask for a username and password, optionally letting trusted IPs skip the prompt.\n\n1. Install the `apache2-utils` package (it provides `htpasswd`) by adding it to\n `os_extra_packages` and publishing:\n ```yaml\n os_extra_packages:\n - apache2-utils\n ```\n2. Generate a password file over SSH:\n ```bash\n htpasswd -c /var/www/prod/.secrets/htpasswd prod\n ```\n You are prompted for a password - use a long, complex one.\n3. Enable it on a location in `~/nginx/50main.conf`:\n ```nginx\n location / {\n auth_basic \"Restricted area\";\n auth_basic_user_file /var/www/prod/.secrets/htpasswd;\n\n # optional: trusted IPs skip the login prompt\n allow 203.0.113.10;\n satisfy any;\n }\n ```"} {"id":"technologies/nginx/restrict-admin-access.md#apply-and-verify","url":"https://docs.turbostack.app/technologies/nginx/restrict-admin-access/#apply-and-verify","path":"technologies/nginx/restrict-admin-access.md","title":"How to restrict access to your admin area","heading":"Apply and verify","keywords":"restrict admin access protect admin basic auth password protect ip restrict admin","text":"```bash\ntscli nginx reload\n```\n\nVisit the protected path: you should be asked to log in (or be allowed straight through from a\ntrusted IP), and blocked otherwise.\n\n> [!WARNING]\n> Editing `50main.conf` can take the site offline if a rule is wrong. `tscli nginx reload` validates\n> the config and reports the error. If you are unsure, contact support."} {"id":"technologies/nginx/restrict-admin-access.md#related","url":"https://docs.turbostack.app/technologies/nginx/restrict-admin-access/#related","path":"technologies/nginx/restrict-admin-access.md","title":"How to restrict access to your admin area","heading":"Related","keywords":"restrict admin access protect admin basic auth password protect ip restrict admin","text":"- Configure Nginx\n- Block or allow IP addresses\n- Installing extra OS packages\n- Security hardening\n"} {"id":"technologies/nginx/what-is.md#intro","url":"https://docs.turbostack.app/technologies/nginx/what-is/","path":"technologies/nginx/what-is.md","title":"What is Nginx?","heading":"","keywords":"what is nginx nginx hosting nginx turbostack nginx web server nginx reverse proxy","text":"# What is Nginx?\n\nNginx is a web server and reverse proxy that handles many simultaneous\nconnections with low memory and CPU usage. It serves static files (images,\nCSS, JavaScript) directly, and forwards dynamic requests to an application\nbackend such as PHP-FPM.\n\nIts event-driven design suits high-traffic sites, caching, and routing\nHTTP/HTTPS requests to the correct backend. It is the most widely deployed\nweb server for modern PHP applications."} {"id":"technologies/nginx/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/nginx/what-is/#on-turbostack","path":"technologies/nginx/what-is.md","title":"What is Nginx?","heading":"On TurboStack","keywords":"what is nginx nginx hosting nginx turbostack nginx web server nginx reverse proxy","text":"Nginx is the **default web server** on TurboStack and is recommended for most\nworkloads.\n\n- Each host runs **one web server**. When Nginx is selected, TurboStack\n provisions and manages it for every application on that host.\n- TurboStack **generates the per-application virtual host (vhost)** for you. The\n generated config includes sensible caching headers, static-asset expiry rules,\n security denies (blocking access to sensitive paths), and the correct\n **PHP-FPM backend** for each application's PHP version.\n- You do not edit raw Nginx config files. You enable Nginx at the host level and,\n where needed, adjust per-application behavior through the supported settings -\n TurboStack renders and reloads the configuration safely.\n\n> [!NOTE]\n> Nginx and Apache are mutually exclusive on a host - you choose one web server\n> per host. Nginx is the default and the recommended choice unless your\n> application specifically needs Apache features."} {"id":"technologies/nginx/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/nginx/what-is/#best-practices","path":"technologies/nginx/what-is.md","title":"What is Nginx?","heading":"Best practices","keywords":"what is nginx nginx hosting nginx turbostack nginx web server nginx reverse proxy","text":"- Keep Nginx as your web server unless an app genuinely requires `.htaccess` or\n Apache-only modules.\n- Let TurboStack generate the vhost rather than hand-rolling config, so caching,\n expiry and security rules stay consistent.\n- Serve static assets through Nginx and reserve PHP-FPM for dynamic requests to\n keep response times low.\n- Pair Nginx with a caching layer (such as Varnish or Redis) for read-heavy,\n high-traffic sites.\n- Always front Nginx with Transport Layer Security (TLS) - terminate HTTPS at the web server for every\n public application."} {"id":"technologies/nginx/what-is.md#related","url":"https://docs.turbostack.app/technologies/nginx/what-is/#related","path":"technologies/nginx/what-is.md","title":"What is Nginx?","heading":"Related","keywords":"what is nginx nginx hosting nginx turbostack nginx web server nginx reverse proxy","text":"- Configure Nginx on TurboStack\n- Host Services tab"} {"id":"technologies/nodejs/configure.md#intro","url":"https://docs.turbostack.app/technologies/nodejs/configure/","path":"technologies/nodejs/configure.md","title":"Configure Node.js on TurboStack","heading":"","keywords":"configure node.js turbostack node.js yaml nodejs_version proxy_enabled reverse proxy","text":"# Configure Node.js on TurboStack\n\nEnable the Node.js runtime on an application and proxy public traffic to it with Nginx."} {"id":"technologies/nodejs/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/nodejs/configure/#where-to-configure-it","path":"technologies/nodejs/configure.md","title":"Configure Node.js on TurboStack","heading":"Where to configure it","keywords":"configure node.js turbostack node.js yaml nodejs_version proxy_enabled reverse proxy","text":"The Node.js runtime is configured per application. In the TurboStack Platform, open an application and go to **Configure application > Technologies > NodeJS**, then choose the version your application should use.\n\nTo publish the application, you also enable the reverse proxy so Nginx forwards public traffic to the local port your Node.js process listens on. See Configure the reverse proxy for that side of the setup."} {"id":"technologies/nodejs/configure.md#required","url":"https://docs.turbostack.app/technologies/nodejs/configure/#required","path":"technologies/nodejs/configure.md","title":"Configure Node.js on TurboStack","heading":"Required","keywords":"configure node.js turbostack node.js yaml nodejs_version proxy_enabled reverse proxy","text":"| Key | Meaning |\n| --- | --- |\n| `nodejs_version` | The Node.js major version to install, for example `\"24\"` (or newer). Setting this enables the Node.js runtime for the application. |\n\n> [!NOTE]\n> There is no separate \"enable\" key. Node.js is installed for an application as soon as you set\n> `nodejs_version` on it, and is left out when you omit the key."} {"id":"technologies/nodejs/configure.md#optional","url":"https://docs.turbostack.app/technologies/nodejs/configure/#optional","path":"technologies/nodejs/configure.md","title":"Configure Node.js on TurboStack","heading":"Optional","keywords":"configure node.js turbostack node.js yaml nodejs_version proxy_enabled reverse proxy","text":"These keys are typically added together with the reverse proxy so public traffic reaches your app.\n\n| Key | Meaning |\n| --- | --- |\n| `proxy_enabled` | Enables the Nginx reverse proxy for the application. |\n| `proxy_upstream_port` | The local port your Node.js application listens on. |\n\n```yaml\nnodejs_version: \"24\"\n\n# Publish the app via the nginx reverse proxy\nproxy_enabled: true\nproxy_upstream_port: 3000 # the port your Node.js process listens on\n```"} {"id":"technologies/nodejs/configure.md#permissions","url":"https://docs.turbostack.app/technologies/nodejs/configure/#permissions","path":"technologies/nodejs/configure.md","title":"Configure Node.js on TurboStack","heading":"Permissions","keywords":"configure node.js turbostack node.js yaml nodejs_version proxy_enabled reverse proxy","text":"Harden the files and directories in your application so files are readable but not writable by the group, and directories stay traversable. Run these from the parent of your application's directory (replace `~/app` with wherever your Node.js application lives):\n\n```bash\nfind ~/app -type f -exec chmod 644 {} \\;\nfind ~/app -type d -exec chmod 755 {} \\;\n```\n\nThis sets files to `644` (owner read/write, others read-only) and directories to `755` (owner read/write/traverse, others read/traverse)."} {"id":"technologies/nodejs/configure.md#common-tasks","url":"https://docs.turbostack.app/technologies/nodejs/configure/#common-tasks","path":"technologies/nodejs/configure.md","title":"Configure Node.js on TurboStack","heading":"Common tasks","keywords":"configure node.js turbostack node.js yaml nodejs_version proxy_enabled reverse proxy","text":"- set the Node.js version\n- keep a Node.js app running"} {"id":"technologies/nodejs/configure.md#related","url":"https://docs.turbostack.app/technologies/nodejs/configure/#related","path":"technologies/nodejs/configure.md","title":"Configure Node.js on TurboStack","heading":"Related","keywords":"configure node.js turbostack node.js yaml nodejs_version proxy_enabled reverse proxy","text":"- What is Node.js?\n- Keep a Node.js app running\n- Configure the reverse proxy\n- TurboStack CLI - `tscli app backends` shows the configured process manager.\n- Applications overview"} {"id":"technologies/nodejs/run-with-process-manager.md#intro","url":"https://docs.turbostack.app/technologies/nodejs/run-with-process-manager/","path":"technologies/nodejs/run-with-process-manager.md","title":"How to keep a Node.js app running","heading":"","keywords":"keep node running node process manager node service restart node app supervisor node pm2","text":"# How to keep a Node.js app running\n\nA Node.js application is a long-lived process. If it crashes, or the server reboots, it must start\nagain on its own - otherwise Nginx has nothing to forward to and returns a 502 error. On TurboStack\nyou keep it running with the **pm2** process manager (a systemd service is the alternative).\n\npm2 keeps the app running with auto-restarts, manages several apps at once, and gives you monitoring\nand log viewing in one place."} {"id":"technologies/nodejs/run-with-process-manager.md#before-you-start","url":"https://docs.turbostack.app/technologies/nodejs/run-with-process-manager/#before-you-start","path":"technologies/nodejs/run-with-process-manager.md","title":"How to keep a Node.js app running","heading":"Before you start","keywords":"keep node running node process manager node service restart node app supervisor node pm2","text":"- **SSH access to the host** - see SSH access. Run these commands as\n your system user.\n- **The Node.js runtime enabled** on the application, and your app listening on the local port set\n as `proxy_upstream_port` so Nginx can proxy to it - see Configure Node.js and the\n reverse proxy. When you enable the Node.js runtime, pm2 is\n installed for you by the node package manager, so there is nothing extra to install."} {"id":"technologies/nodejs/run-with-process-manager.md#deploy-and-start-your-app-under-pm2","url":"https://docs.turbostack.app/technologies/nodejs/run-with-process-manager/#deploy-and-start-your-app-under-pm2","path":"technologies/nodejs/run-with-process-manager.md","title":"How to keep a Node.js app running","heading":"Deploy and start your app under pm2","keywords":"keep node running node process manager node service restart node app supervisor node pm2","text":"If you migrated from another environment, reinstall dependencies cleanly first so no incompatible or\ncorrupted modules are left behind:\n\n```bash\ncd ~/app\nrm -rf node_modules # only when migrating or dependencies changed\nnpm install # rebuild node_modules\nnpm run build # build the app (for example a Next.js build)\n```\n\nThen start it under pm2 and give it a name:\n\n```bash\npm2 start npm --name app -- start # runs \"npm start\"\n# or run a file directly:\npm2 start server.js --name app\n```\n\nCheck that it is running:\n\n```bash\npm2 ls\n```"} {"id":"technologies/nodejs/run-with-process-manager.md#make-it-survive-reboots","url":"https://docs.turbostack.app/technologies/nodejs/run-with-process-manager/#make-it-survive-reboots","path":"technologies/nodejs/run-with-process-manager.md","title":"How to keep a Node.js app running","heading":"Make it survive reboots","keywords":"keep node running node process manager node service restart node app supervisor node pm2","text":"TurboStack already provisions a platform-managed `pm2-` system service that starts pm2 and\nyour saved processes at boot, so you do not run `pm2 startup` yourself (as a non-root user it only\nprints a `sudo` line and cannot complete). What you must do is save the current process list so the\nplatform service brings the right apps back:\n\n```bash\npm2 save # save the current process list - run this again after every change\n```\n\n> [!IMPORTANT]\n> Run `pm2 save` **every time** you add, rename or remove a process. Without it, pm2 restores an old\n> list (or nothing) after a reboot, and your app stays down."} {"id":"technologies/nodejs/run-with-process-manager.md#monitor-and-read-logs","url":"https://docs.turbostack.app/technologies/nodejs/run-with-process-manager/#monitor-and-read-logs","path":"technologies/nodejs/run-with-process-manager.md","title":"How to keep a Node.js app running","heading":"Monitor and read logs","keywords":"keep node running node process manager node service restart node app supervisor node pm2","text":"```bash\npm2 ls # list processes with status, CPU, memory and restart count\npm2 show app # details for one process\npm2 logs app # live logs (use --lines 200, --err or --out to narrow)\npm2 monit # live dashboard: CPU/memory per app, status, restarts, real-time logs\n```"} {"id":"technologies/nodejs/run-with-process-manager.md#restart-after-a-change-or-deploy","url":"https://docs.turbostack.app/technologies/nodejs/run-with-process-manager/#restart-after-a-change-or-deploy","path":"technologies/nodejs/run-with-process-manager.md","title":"How to keep a Node.js app running","heading":"Restart after a change or deploy","keywords":"keep node running node process manager node service restart node app supervisor node pm2","text":"```bash\npm2 restart app # full restart\npm2 reload app # zero-downtime reload (for cluster-mode apps)\n```\n\nWhen you change dependencies or move the app from another environment, reinstall cleanly first to\navoid incompatible modules:\n\n```bash\nrm -rf node_modules\nnpm install\npm2 restart app\n```"} {"id":"technologies/nodejs/run-with-process-manager.md#check-which-process-manager-is-configured","url":"https://docs.turbostack.app/technologies/nodejs/run-with-process-manager/#check-which-process-manager-is-configured","path":"technologies/nodejs/run-with-process-manager.md","title":"How to keep a Node.js app running","heading":"Check which process manager is configured","keywords":"keep node running node process manager node service restart node app supervisor node pm2","text":"To see which manager each application user runs under, use the\nTurboStack CLI:\n\n```bash\ntscli app backends\n```"} {"id":"technologies/nodejs/run-with-process-manager.md#alternative-a-systemd-user-service","url":"https://docs.turbostack.app/technologies/nodejs/run-with-process-manager/#alternative-a-systemd-user-service","path":"technologies/nodejs/run-with-process-manager.md","title":"How to keep a Node.js app running","heading":"Alternative: a systemd user service","keywords":"keep node running node process manager node service restart node app supervisor node pm2","text":"Instead of pm2 you can run any long-lived app (Node.js, Python, a custom worker) as a **systemd user\nservice**. It needs no root, integrates with `journalctl` for logs, and restarts on crash and on\nboot. Use pm2 when you want its process dashboard and zero-downtime reloads; use a systemd service\nwhen you prefer one consistent way to run every background process on the host.\n\nFor the unit file and the `systemctl --user` commands, see\nHow to manage user system services."} {"id":"technologies/nodejs/run-with-process-manager.md#related","url":"https://docs.turbostack.app/technologies/nodejs/run-with-process-manager/#related","path":"technologies/nodejs/run-with-process-manager.md","title":"How to keep a Node.js app running","heading":"Related","keywords":"keep node running node process manager node service restart node app supervisor node pm2","text":"- Configure Node.js\n- What is Node.js?\n- Set the Node.js version\n- Configure the reverse proxy\n- How to manage user system services\n- Deploy Medusa"} {"id":"technologies/nodejs/set-node-version.md#intro","url":"https://docs.turbostack.app/technologies/nodejs/set-node-version/","path":"technologies/nodejs/set-node-version.md","title":"How to set the Node.js version","heading":"","keywords":"set node version nodejs_version change node version node.js 24 select node version node runtime turbostack","text":"# How to set the Node.js version\n\nEach application chooses its own **Node.js major version**. Set it when you deploy an app, or when\nyou move an existing app to a newer runtime."} {"id":"technologies/nodejs/set-node-version.md#set-it-in-the-gui","url":"https://docs.turbostack.app/technologies/nodejs/set-node-version/#set-it-in-the-gui","path":"technologies/nodejs/set-node-version.md","title":"How to set the Node.js version","heading":"Set it in the GUI","keywords":"set node version nodejs_version change node version node.js 24 select node version node runtime turbostack","text":"1. Open the host and select the application.\n2. Go to **Configure application > Technologies > NodeJS**.\n3. Choose the version."} {"id":"technologies/nodejs/set-node-version.md#set-it-in-yaml","url":"https://docs.turbostack.app/technologies/nodejs/set-node-version/#set-it-in-yaml","path":"technologies/nodejs/set-node-version.md","title":"How to set the Node.js version","heading":"Set it in YAML","keywords":"set node version nodejs_version change node version node.js 24 select node version node runtime turbostack","text":"Set `nodejs_version` on the application (vhost) to the major version, as a quoted string. This key\non its own installs the runtime. See Configure Node.js for the full set of keys.\n\n```yaml\nnodejs_version: \"24\"\n```\n\nPublish the change to apply it."} {"id":"technologies/nodejs/set-node-version.md#verify-and-restart","url":"https://docs.turbostack.app/technologies/nodejs/set-node-version/#verify-and-restart","path":"technologies/nodejs/set-node-version.md","title":"How to set the Node.js version","heading":"Verify and restart","keywords":"set node version nodejs_version change node version node.js 24 select node version node runtime turbostack","text":"Over SSH, confirm the runtime:\n\n```bash\nnode -v\n```\n\nThen **restart your application** so it runs on the new version - see\nKeep a Node.js app running. Long-running Node processes keep using the\nold runtime until they are restarted.\n\n> [!TIP]\n> Match the version to your app's `engines` field in `package.json`, and test on a staging copy before\n> switching a production site."} {"id":"technologies/nodejs/set-node-version.md#related","url":"https://docs.turbostack.app/technologies/nodejs/set-node-version/#related","path":"technologies/nodejs/set-node-version.md","title":"How to set the Node.js version","heading":"Related","keywords":"set node version nodejs_version change node version node.js 24 select node version node runtime turbostack","text":"- Configure Node.js\n- Keep a Node.js app running\n- Publishing changes\n- What is Node.js?\n- Deploy Medusa"} {"id":"technologies/nodejs/what-is.md#intro","url":"https://docs.turbostack.app/technologies/nodejs/what-is/","path":"technologies/nodejs/what-is.md","title":"What is Node.js?","heading":"","keywords":"what is node.js node.js hosting node.js turbostack javascript runtime reverse proxy medusa","text":"# What is Node.js?\n\nNode.js is a server-side runtime that executes JavaScript outside the browser. It is built around an event-driven, non-blocking I/O model, which makes it well suited to network applications such as APIs, real-time services, and modern commerce platforms.\n\nOn a hosting platform, a Node.js application runs as a long-lived process that listens on a local port. A web server accepts public HTTPS traffic and forwards requests to that port. Your application code does not handle Transport Layer Security (TLS) or public networking directly."} {"id":"technologies/nodejs/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/nodejs/what-is/#on-turbostack","path":"technologies/nodejs/what-is.md","title":"What is Node.js?","heading":"On TurboStack","keywords":"what is node.js node.js hosting node.js turbostack javascript runtime reverse proxy medusa","text":"TurboStack runs Node.js as a per-application runtime. You enable it on an application and pick the major version you want, for example version `24` (or newer). Multiple applications on the same host can run different Node.js versions side by side.\n\nNode.js applications are not exposed to the internet directly. Instead, your app listens on a local port and Nginx acts as a reverse proxy in front of it, terminating TLS and forwarding traffic to your process. This is the same pattern used to run platforms such as Medusa. The Node.js service runs as its own process and Nginx proxies requests to the port it listens on.\n\nBecause there is no dedicated `app_type` for generic Node.js apps, you combine the Node.js runtime with the reverse proxy to publish your application."} {"id":"technologies/nodejs/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/nodejs/what-is/#best-practices","path":"technologies/nodejs/what-is.md","title":"What is Node.js?","heading":"Best practices","keywords":"what is node.js node.js hosting node.js turbostack javascript runtime reverse proxy medusa","text":"- Pin a specific major Node.js version so deployments stay reproducible, and plan upgrades when a version approaches end of life.\n- Run your app under a process manager - on TurboStack that is **pm2** (a systemd service is the alternative) - so it restarts on crash and on reboot. See Keep a Node.js app running.\n- Have your app listen on a local port only and let Nginx handle public TLS traffic.\n- Keep dependencies up to date and audit them regularly for security advisories.\n- Use environment variables for secrets and configuration rather than committing them to your repository."} {"id":"technologies/nodejs/what-is.md#related","url":"https://docs.turbostack.app/technologies/nodejs/what-is/#related","path":"technologies/nodejs/what-is.md","title":"What is Node.js?","heading":"Related","keywords":"what is node.js node.js hosting node.js turbostack javascript runtime reverse proxy medusa","text":"- Configure Node.js on TurboStack\n- Keep a Node.js app running\n- Deploy Medusa"} {"id":"technologies/opensearch/configure.md#intro","url":"https://docs.turbostack.app/technologies/opensearch/configure/","path":"technologies/opensearch/configure.md","title":"Configure OpenSearch on TurboStack","heading":"","keywords":"configure OpenSearch turbostack OpenSearch yaml opensearch_version OpenSearch snapshots opensearch_plugins search plugins opensearch_dashboards OpenSearch Dashboards url","text":"# Configure OpenSearch on TurboStack\n\nEnable OpenSearch and set its version at the host level, then optionally tune the JVM heap and plugins."} {"id":"technologies/opensearch/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/opensearch/configure/#where-to-configure-it","path":"technologies/opensearch/configure.md","title":"Configure OpenSearch on TurboStack","heading":"Where to configure it","keywords":"configure OpenSearch turbostack OpenSearch yaml opensearch_version OpenSearch snapshots opensearch_plugins search plugins opensearch_dashboards OpenSearch Dashboards url","text":"Open the host, go to the **Services** tab, select **ElasticSearch / OpenSearch**, and choose\n**OpenSearch**."} {"id":"technologies/opensearch/configure.md#required","url":"https://docs.turbostack.app/technologies/opensearch/configure/#required","path":"technologies/opensearch/configure.md","title":"Configure OpenSearch on TurboStack","heading":"Required","keywords":"configure OpenSearch turbostack OpenSearch yaml opensearch_version OpenSearch snapshots opensearch_plugins search plugins opensearch_dashboards OpenSearch Dashboards url","text":"| Key | Meaning |\n| --- | --- |\n| `opensearch_version` | OpenSearch version to run (for example, `\"2.x\"` or `\"3.x\"`). |"} {"id":"technologies/opensearch/configure.md#optional","url":"https://docs.turbostack.app/technologies/opensearch/configure/#optional","path":"technologies/opensearch/configure.md","title":"Configure OpenSearch on TurboStack","heading":"Optional","keywords":"configure OpenSearch turbostack OpenSearch yaml opensearch_version OpenSearch snapshots opensearch_plugins search plugins opensearch_dashboards OpenSearch Dashboards url","text":"| Key | Meaning |\n| --- | --- |\n| `opensearch_heap_size` | JVM heap size (auto-sized to the host; override only with measured evidence). |\n| `opensearch_plugins` | Search-engine plugins to enable. |\n| `opensearch_dashboards` | Installs the OpenSearch Dashboards web interface. Off by default. |\n| `opensearch_dashboards_usermanagement` | Turns on OpenSearch's own user accounts for the dashboards. |\n\n```yaml\nopensearch_version: \"2.x\" # required: enable OpenSearch on the host\n# opensearch_dashboards: true # optional: the web interface\n```"} {"id":"technologies/opensearch/configure.md#listening-address","url":"https://docs.turbostack.app/technologies/opensearch/configure/#listening-address","path":"technologies/opensearch/configure.md","title":"Configure OpenSearch on TurboStack","heading":"Listening address","keywords":"configure OpenSearch turbostack OpenSearch yaml opensearch_version OpenSearch snapshots opensearch_plugins search plugins opensearch_dashboards OpenSearch Dashboards url","text":"OpenSearch accepts connections only from the host itself, which is what a single-server setup needs.\nIf an application on another server has to reach the search engine, ask\nSupport to open it up to your private network.\n\n> [!WARNING]\n> A search engine has no authentication of its own, so anything that can reach the port can read and\n> change your indexes. It must never be reachable from the internet."} {"id":"technologies/opensearch/configure.md#dashboards","url":"https://docs.turbostack.app/technologies/opensearch/configure/#dashboards","path":"technologies/opensearch/configure.md","title":"Configure OpenSearch on TurboStack","heading":"Dashboards","keywords":"configure OpenSearch turbostack OpenSearch yaml opensearch_version OpenSearch snapshots opensearch_plugins search plugins opensearch_dashboards OpenSearch Dashboards url","text":"`opensearch_dashboards: true` installs the interface, which you then reach at\n**`https:///dashboards`**. The web server proxies that path and asks for a user name and\npassword first; use one of the host's system user accounts, the same credentials you use for SSH.\n\nThat login belongs to the web server, not to OpenSearch. Turn on\n`opensearch_dashboards_usermanagement` when you need per-user accounts inside the dashboards\ninstead of one shared door. It is available only in the\nSource (YAML) view."} {"id":"technologies/opensearch/configure.md#plugins","url":"https://docs.turbostack.app/technologies/opensearch/configure/#plugins","path":"technologies/opensearch/configure.md","title":"Configure OpenSearch on TurboStack","heading":"Plugins","keywords":"configure OpenSearch turbostack OpenSearch yaml opensearch_version OpenSearch snapshots opensearch_plugins search plugins opensearch_dashboards OpenSearch Dashboards url","text":"**Plugins** is a multi-select on the Services tab. The list you choose from is maintained by\nHosted Power and changes as engine versions come and go, so check the dropdown for what is\navailable today.\n\nTwo things happen automatically on the next deployment:\n\n- **Removing a plugin from the list uninstalls it.** TurboStack keeps track of the plugins it\n installed and removes only those, so the plugins that ship with OpenSearch itself are left alone.\n- **Changing the OpenSearch version reinstalls every plugin**, so each one is installed again for\n the new engine version.\n\n> [!TIP]\n> Choose **either** OpenSearch **or** Elasticsearch on a host - not\n> both. OpenSearch indices are backed up via nightly snapshots."} {"id":"technologies/opensearch/configure.md#related","url":"https://docs.turbostack.app/technologies/opensearch/configure/#related","path":"technologies/opensearch/configure.md","title":"Configure OpenSearch on TurboStack","heading":"Related","keywords":"configure OpenSearch turbostack OpenSearch yaml opensearch_version OpenSearch snapshots opensearch_plugins search plugins opensearch_dashboards OpenSearch Dashboards url","text":"- What is OpenSearch?\n- Elasticsearch\n- Services"} {"id":"technologies/opensearch/what-is.md#intro","url":"https://docs.turbostack.app/technologies/opensearch/what-is/","path":"technologies/opensearch/what-is.md","title":"What is OpenSearch?","heading":"","keywords":"what is OpenSearch OpenSearch hosting OpenSearch turbostack Elasticsearch alternative open source search","text":"# What is OpenSearch?\n\nOpenSearch is an open-source search and analytics engine - a community-driven fork of\nElasticsearch with a compatible API. It powers the same use cases (full-text product search,\nfiltering, autocomplete, faceted navigation) and scales across nodes on the JVM.\n\n> [!NOTE]\n> OpenSearch and Elasticsearch are alternatives - enable one per host."} {"id":"technologies/opensearch/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/opensearch/what-is/#on-turbostack","path":"technologies/opensearch/what-is.md","title":"What is OpenSearch?","heading":"On TurboStack","keywords":"what is OpenSearch OpenSearch hosting OpenSearch turbostack Elasticsearch alternative open source search","text":"Enable OpenSearch at the host level and pick a version (`opensearch_version`, e.g. `\"2.x\"` or `\"3.x\"`).\nTurboStack auto-sizes the JVM heap; you can configure plugins. TurboStack takes **nightly snapshots** of\nOpenSearch indices for backup and recovery. Choose OpenSearch when you want a fully open-source\nengine."} {"id":"technologies/opensearch/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/opensearch/what-is/#best-practices","path":"technologies/opensearch/what-is.md","title":"What is OpenSearch?","heading":"Best practices","keywords":"what is OpenSearch OpenSearch hosting OpenSearch turbostack Elasticsearch alternative open source search","text":"- Pick OpenSearch or Elasticsearch based on your application's compatibility.\n- Keep the heap auto-sized unless you measure memory pressure - see Performance tuning.\n- Rely on the nightly snapshots for index recovery; reindex after large data changes."} {"id":"technologies/opensearch/what-is.md#related","url":"https://docs.turbostack.app/technologies/opensearch/what-is/#related","path":"technologies/opensearch/what-is.md","title":"What is OpenSearch?","heading":"Related","keywords":"what is OpenSearch OpenSearch hosting OpenSearch turbostack Elasticsearch alternative open source search","text":"- Configure OpenSearch\n- Elasticsearch\n- Services"} {"id":"technologies/php/configure.md#intro","url":"https://docs.turbostack.app/technologies/php/configure/","path":"technologies/php/configure.md","title":"Configure PHP on TurboStack","heading":"","keywords":"configure php turbostack php yaml php_version php-fpm tuning opcache turbostack","text":"# Configure PHP on TurboStack\n\nEach application chooses its own PHP version and, optionally, its PHP-FPM and\nOPcache tuning."} {"id":"technologies/php/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/php/configure/#where-to-configure-it","path":"technologies/php/configure.md","title":"Configure PHP on TurboStack","heading":"Where to configure it","keywords":"configure php turbostack php yaml php_version php-fpm tuning opcache turbostack","text":"PHP is configured per application:\n\n1. Open the application.\n2. Go to **Configure application > Technologies > PHP**.\n3. Select the PHP version (and adjust advanced settings if needed).\n\nInstalled versions and the host default come from the host-level `php_versions`\nand `php_main_version` settings."} {"id":"technologies/php/configure.md#required","url":"https://docs.turbostack.app/technologies/php/configure/#required","path":"technologies/php/configure.md","title":"Configure PHP on TurboStack","heading":"Required","keywords":"configure php turbostack php yaml php_version php-fpm tuning opcache turbostack","text":"| Key | Meaning |\n|---|---|\n| `php_version` | PHP version for this application/vhost, e.g. `\"8.4\"`. |"} {"id":"technologies/php/configure.md#optional","url":"https://docs.turbostack.app/technologies/php/configure/#optional","path":"technologies/php/configure.md","title":"Configure PHP on TurboStack","heading":"Optional","keywords":"configure php turbostack php yaml php_version php-fpm tuning opcache turbostack","text":"A PHP-FPM worker is one PHP process that handles one request at a time, so the number of workers\nsets how many PHP requests the application can serve at once.\n\n| Key | Meaning |\n|---|---|\n| `php_fpm_pm_start_servers` | Number of PHP-FPM worker processes started initially. |\n| `php_fpm_pm_min_spare_servers` | Minimum number of idle PHP-FPM workers kept ready. |\n| `php_fpm_pm_max_spare_servers` | Maximum number of idle PHP-FPM workers kept ready. |\n| `php_fpm_pm_max_children` | The ceiling on workers this application may run at once. Inherited from the host unless you set it here. |\n| `php_fpm_pm_max_requests` | How many requests a worker handles before it is restarted. Inherited from the host (`500`) unless you set it here. |\n| `php_user_tmp_dir` | Gives the application its own temporary folder instead of the shared one. Off by default. |\n| `php_enhance` | Enable OPcache performance enhancements for the site. |\n| `php_opcache_preload_script` | Path to a script preloaded into OPcache at startup. |\n| `php_ioncube_enabled` | Enable the ionCube loader (for ionCube-encoded apps). |\n| `php_versions` | Host-level: PHP versions installed on the host. |\n| `php_main_version` | Host-level: default PHP version for the host. |\n\n```yaml\n# Per-application\nphp_version: \"8.4\"\n\n# Optional PHP-FPM tuning\nphp_fpm_pm_start_servers: 5\nphp_fpm_pm_min_spare_servers: 3\nphp_fpm_pm_max_spare_servers: 6\n# php_fpm_pm_max_children: 40 # ceiling on concurrent workers\n# php_fpm_pm_max_requests: 500 # restart a worker after this many requests\n# php_user_tmp_dir: true # a private tmp folder for this application\n\n# Optional OPcache + ionCube\nphp_enhance: true\nphp_opcache_preload_script: \"/var/www/prod/preload.php\"\nphp_ioncube_enabled: false\n\n# Host-level\nphp_versions:\n - \"8.3\"\n - \"8.4\"\nphp_main_version: \"8.4\"\n```\n\n> [!NOTE]\n> Each application runs in its own PHP-FPM pool, so `php_version` and the PHP-FPM tuning\n> keys apply independently per site. Set `php_versions` at the host before a\n> application can select that version."} {"id":"technologies/php/configure.md#worker-ceiling-and-recycling","url":"https://docs.turbostack.app/technologies/php/configure/#worker-ceiling-and-recycling","path":"technologies/php/configure.md","title":"Configure PHP on TurboStack","heading":"Worker ceiling and recycling","keywords":"configure php turbostack php yaml php_version php-fpm tuning opcache turbostack","text":"`php_fpm_pm_max_children` is the hard limit on how many requests this application can process at\nthe same time. Every worker holds its own memory, so the ceiling multiplied by the memory a request\nuses is the worst case for this application. Set it too high and a traffic peak pushes the host out\nof memory; set it too low and requests queue and time out. See\nOut of memory and\nPerformance tuning.\n\n`php_fpm_pm_max_requests` restarts a worker after that many requests. Restarting reclaims whatever\nthe process leaked, which keeps a slowly growing application stable without a scheduled restart.\n\nBoth are inherited from the host when you leave them out, so set them per application only when\none site needs to differ from the rest."} {"id":"technologies/php/configure.md#a-private-temporary-folder","url":"https://docs.turbostack.app/technologies/php/configure/#a-private-temporary-folder","path":"technologies/php/configure.md","title":"Configure PHP on TurboStack","heading":"A private temporary folder","keywords":"configure php turbostack php yaml php_version php-fpm tuning opcache turbostack","text":"With `php_user_tmp_dir: true` the application gets its own `tmp` folder under its home directory,\nowned by its own user, and PHP's `sys_temp_dir` points at it. Without it, applications share the\nsystem temporary folder. Turn it on when several applications run on one host and you do not want\nuploads, sessions or generated files landing in a place another application can read."} {"id":"technologies/php/configure.md#common-tasks","url":"https://docs.turbostack.app/technologies/php/configure/#common-tasks","path":"technologies/php/configure.md","title":"Configure PHP on TurboStack","heading":"Common tasks","keywords":"configure php turbostack php yaml php_version php-fpm tuning opcache turbostack","text":"- Switch PHP version\n- Override PHP settings\n- Flush the OPcache"} {"id":"technologies/php/configure.md#related","url":"https://docs.turbostack.app/technologies/php/configure/#related","path":"technologies/php/configure.md","title":"Configure PHP on TurboStack","heading":"Related","keywords":"configure php turbostack php yaml php_version php-fpm tuning opcache turbostack","text":"- What is PHP?\n- Applications: Technologies\n- Applications overview\n- TurboStack CLI - clear OPcache (`tscli opcache clear`) and manage Blackfire"} {"id":"technologies/php/flush-opcache.md#intro","url":"https://docs.turbostack.app/technologies/php/flush-opcache/","path":"technologies/php/flush-opcache.md","title":"How to flush the PHP OPcache","heading":"","keywords":"flush opcache clear opcache tscli opcache clear php opcache reset recompile php deploy php code validate_timestamps opcache preload","text":"# How to flush the PHP OPcache\n\nPHP's **OPcache** stores compiled PHP as bytecode in memory so it does not recompile your code on\nevery request. That speeds up the site, but it also means that after you change PHP files the cache\ncan keep serving the **old** code until it is refreshed."} {"id":"technologies/php/flush-opcache.md#flush-it-with-the-turbostack-cli","url":"https://docs.turbostack.app/technologies/php/flush-opcache/#flush-it-with-the-turbostack-cli","path":"technologies/php/flush-opcache.md","title":"How to flush the PHP OPcache","heading":"Flush it with the TurboStack CLI","keywords":"flush opcache clear opcache tscli opcache clear php opcache reset recompile php deploy php code validate_timestamps opcache preload","text":"Connect over SSH and run:\n\n```bash\ntscli opcache clear\n```\n\nThis resets the OPcache for the site's PHP-FPM, so the next requests recompile from your current\nfiles."} {"id":"technologies/php/flush-opcache.md#when-you-need-it","url":"https://docs.turbostack.app/technologies/php/flush-opcache/#when-you-need-it","path":"technologies/php/flush-opcache.md","title":"How to flush the PHP OPcache","heading":"When you need it","keywords":"flush opcache clear opcache tscli opcache clear php opcache reset recompile php deploy php code validate_timestamps opcache preload","text":"- After deploying or editing PHP files **outside** the normal publish flow, when your changes do not\n show up.\n- On sites tuned for production, where OPcache does not re-check file timestamps on every request\n (`validate_timestamps` off) for maximum performance - there, a flush is required to pick up new\n code.\n\n> [!NOTE]\n> Right after a flush the first requests are a little slower while PHP recompiles; this settles within\n> moments. If you use OPcache **preloading** (`php_opcache_preload_script`), changing the preloaded\n> code needs a PHP-FPM reload, not just a cache flush - see Configure PHP."} {"id":"technologies/php/flush-opcache.md#related","url":"https://docs.turbostack.app/technologies/php/flush-opcache/#related","path":"technologies/php/flush-opcache.md","title":"How to flush the PHP OPcache","heading":"Related","keywords":"flush opcache clear opcache tscli opcache clear php opcache reset recompile php deploy php code validate_timestamps opcache preload","text":"- Configure PHP\n- Switch PHP version\n- Override PHP settings\n- Why is my site slow?\n- TurboStack CLI - `tscli opcache clear`"} {"id":"technologies/php/override-php-settings.md#intro","url":"https://docs.turbostack.app/technologies/php/override-php-settings/","path":"technologies/php/override-php-settings.md","title":"How to override PHP settings","heading":"","keywords":"override php settings php.ini user.ini memory_limit upload_max_filesize max_execution_time","text":"# How to override PHP settings\n\nYou can override most runtime `php.ini` values - such as `memory_limit`, `max_execution_time` and\nthe upload size limits - per application, without root access. To choose the PHP **version** or tune\nPHP-FPM, see Configure PHP instead."} {"id":"technologies/php/override-php-settings.md#override-per-application-with-a-user-ini-file","url":"https://docs.turbostack.app/technologies/php/override-php-settings/#override-per-application-with-a-user-ini-file","path":"technologies/php/override-php-settings.md","title":"How to override PHP settings","heading":"Override per application with a `.user.ini` file","keywords":"override php settings php.ini user.ini memory_limit upload_max_filesize max_execution_time","text":"Create a `.user.ini` file in your application's document root (for example `public_html`) and add one\nsetting per line:\n\n```ini\nmemory_limit = 512M\nmax_execution_time = 300\npost_max_size = 600M\nupload_max_filesize = 512M\n```\n\nMost settings that PHP allows to be changed at the directory level can be overridden this way.\n\n> [!NOTE]\n> PHP re-reads `.user.ini` only periodically - by default about every **5 minutes** - so a change is\n> not always instant. Allow a few minutes before you test the result."} {"id":"technologies/php/override-php-settings.md#override-for-the-command-line","url":"https://docs.turbostack.app/technologies/php/override-php-settings/#override-for-the-command-line","path":"technologies/php/override-php-settings.md","title":"How to override PHP settings","heading":"Override for the command line","keywords":"override php settings php.ini user.ini memory_limit upload_max_filesize max_execution_time","text":"A `.user.ini` file applies to web requests only. For a one-off command-line run, pass the value with\n`-d`:\n\n```bash\nphp -d memory_limit=512M your-script.php\n```"} {"id":"technologies/php/override-php-settings.md#application-specific-exceptions","url":"https://docs.turbostack.app/technologies/php/override-php-settings/#application-specific-exceptions","path":"technologies/php/override-php-settings.md","title":"How to override PHP settings","heading":"Application-specific exceptions","keywords":"override php settings php.ini user.ini memory_limit upload_max_filesize max_execution_time","text":"Some applications set their own PHP values that take precedence over `.user.ini` for web requests.\nMagento, for example, enforces limits through a `PHP_VALUE` line in its generated `50main.conf`\n(see Custom Nginx configuration):\n\n```nginx\nfastcgi_param PHP_VALUE \"memory_limit=2048M \\n max_execution_time=18000\";\n```\n\nIf a `.user.ini` change has no effect on such a site, look for an override like this first."} {"id":"technologies/php/override-php-settings.md#verify","url":"https://docs.turbostack.app/technologies/php/override-php-settings/#verify","path":"technologies/php/override-php-settings.md","title":"How to override PHP settings","heading":"Verify","keywords":"override php settings php.ini user.ini memory_limit upload_max_filesize max_execution_time","text":"Confirm the value actually applied with a temporary `phpinfo()` page:\n\n```php\n Technologies > PHP**.\n3. Choose the version and save."} {"id":"technologies/php/switch-php-version.md#switch-it-in-yaml","url":"https://docs.turbostack.app/technologies/php/switch-php-version/#switch-it-in-yaml","path":"technologies/php/switch-php-version.md","title":"How to switch PHP version","heading":"Switch it in YAML","keywords":"switch php version change php version php_version php 8.4 select php version php versions turbostack php-fpm pool","text":"Set `php_version` on the application (vhost). The version must be installed on the host - it is listed in\nthe host-level `php_versions`, with `php_main_version` as the host default. See\nThe Source (YAML) view.\n\n```yaml\nphp_version: \"8.4\"\n```\n\nPublish the change to apply it."} {"id":"technologies/php/switch-php-version.md#verify-the-active-version","url":"https://docs.turbostack.app/technologies/php/switch-php-version/#verify-the-active-version","path":"technologies/php/switch-php-version.md","title":"How to switch PHP version","heading":"Verify the active version","keywords":"switch php version change php version php_version php 8.4 select php version php versions turbostack php-fpm pool","text":"- **Web:** open a temporary `phpinfo()` page (see Override PHP settings)\n and check the version at the top, then delete the file.\n- **Command line:** each installed version also has its own binary at `/usr/bin/php`\n (for example `/usr/bin/php8.4 -v`). The default `php` on the command line may differ from\n the application's version.\n\n> [!WARNING]\n> Test your application against the new version on a staging copy before switching a production site -\n> a major PHP jump can break incompatible code or extensions."} {"id":"technologies/php/switch-php-version.md#related","url":"https://docs.turbostack.app/technologies/php/switch-php-version/#related","path":"technologies/php/switch-php-version.md","title":"How to switch PHP version","heading":"Related","keywords":"switch php version change php version php_version php 8.4 select php version php versions turbostack php-fpm pool","text":"- Configure PHP\n- Override PHP settings\n- Flush the PHP OPcache\n- Publishing changes\n- Applications"} {"id":"technologies/php/what-is.md#intro","url":"https://docs.turbostack.app/technologies/php/what-is/","path":"technologies/php/what-is.md","title":"What is PHP?","heading":"","keywords":"what is php php hosting php turbostack php-fpm php version hosting","text":"# What is PHP?\n\nPHP is a server-side scripting language used by platforms such as WordPress,\nMagento, Drupal, Laravel and Symfony. It runs on the server to generate the\npages and API responses your visitors receive.\n\nOn a modern stack, PHP runs through **PHP-FPM** (FastCGI Process Manager), a pool\nof worker processes that the web server hands dynamic requests to. The PHP\nversion and pool tuning directly affect both compatibility with your app and the\nperformance under load."} {"id":"technologies/php/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/php/what-is/#on-turbostack","path":"technologies/php/what-is.md","title":"What is PHP?","heading":"On TurboStack","keywords":"what is php php hosting php turbostack php-fpm php version hosting","text":"TurboStack runs PHP as a per-application runtime. Multiple PHP versions can run\nside by side on the same host.\n\n- Each application picks its own PHP version via `php_version` (for example\n `\"8.4\"`), so different sites on one host can run different versions.\n- Each application runs in its own PHP-FPM pool, isolating its workers, tuning\n and resource usage from other sites.\n- At the host level, `php_versions` lists the PHP versions installed and\n `php_main_version` sets the default.\n- Optional per-application tuning covers **PHP-FPM process management**, **OPcache**\n (including preloading) and **ionCube** support - see\n Configure PHP.\n\n> [!TIP]\n> We recommend **PHP 8.4** (or newer), or the highest version your application\n> officially supports. Newer PHP versions are faster and receive security\n> updates for longer."} {"id":"technologies/php/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/php/what-is/#best-practices","path":"technologies/php/what-is.md","title":"What is PHP?","heading":"Best practices","keywords":"what is php php hosting php turbostack php-fpm php version hosting","text":"- Run the newest PHP version your application supports; keep an upgrade path in\n mind for older sites.\n- Set `php_version` explicitly per application rather than relying on the host\n default, so upgrades are deliberate.\n- Enable OPcache for production sites, and consider OPcache preloading for\n frameworks that benefit from it.\n- Tune PHP-FPM process manager values to match each site's traffic instead of\n using one profile for everything.\n- Test version upgrades on a copy of the site before changing production."} {"id":"technologies/php/what-is.md#related","url":"https://docs.turbostack.app/technologies/php/what-is/#related","path":"technologies/php/what-is.md","title":"What is PHP?","heading":"Related","keywords":"what is php php hosting php turbostack php-fpm php version hosting","text":"- Configure PHP on TurboStack\n- Applications: Technologies"} {"id":"technologies/postgresql/configure.md#intro","url":"https://docs.turbostack.app/technologies/postgresql/configure/","path":"technologies/postgresql/configure.md","title":"Configure PostgreSQL on TurboStack","heading":"","keywords":"configure postgresql turbostack postgresql yaml postgresql_version postgresql_shared_buffers postgresql_listen_addresses percona postgresql","text":"# Configure PostgreSQL on TurboStack\n\nEnable PostgreSQL on a host, choose a version, and let TurboStack auto-tune sizing for apps like Odoo and Medusa."} {"id":"technologies/postgresql/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/postgresql/configure/#where-to-configure-it","path":"technologies/postgresql/configure.md","title":"Configure PostgreSQL on TurboStack","heading":"Where to configure it","keywords":"configure postgresql turbostack postgresql yaml postgresql_version postgresql_shared_buffers postgresql_listen_addresses percona postgresql","text":"PostgreSQL is a host-level service. Open the host, go to its **Services** tab, and select **PostgreSQL**. Enable it and pick the major version. Saving updates the host YAML and provisions Percona PostgreSQL on that host."} {"id":"technologies/postgresql/configure.md#required","url":"https://docs.turbostack.app/technologies/postgresql/configure/#required","path":"technologies/postgresql/configure.md","title":"Configure PostgreSQL on TurboStack","heading":"Required","keywords":"configure postgresql turbostack postgresql yaml postgresql_version postgresql_shared_buffers postgresql_listen_addresses percona postgresql","text":"| Key | Meaning |\n|---|---|\n| `postgresql_version` | The PostgreSQL major version to install, for example `\"17\"` (or newer). |"} {"id":"technologies/postgresql/configure.md#optional","url":"https://docs.turbostack.app/technologies/postgresql/configure/#optional","path":"technologies/postgresql/configure.md","title":"Configure PostgreSQL on TurboStack","heading":"Optional","keywords":"configure postgresql turbostack postgresql yaml postgresql_version postgresql_shared_buffers postgresql_listen_addresses percona postgresql","text":"| Key | Meaning |\n|---|---|\n| `postgresql_shared_buffers` | Memory used for caching. Auto-tuned to the server by default - override only with measured evidence. |\n| `postgresql_listen_addresses` | The addresses PostgreSQL listens on, or `ANY` for every interface. Security-sensitive: keep it on localhost unless remote access is required. |\n| `postgresql_extra_access` | A list of host-based access rules for specific networks or hosts. Each entry is a mapping with `type` (for example `host`), `database`, `user`, `address` (a network range or host) and `auth_method` (for example `scram-sha-256`). |\n| `postgresql_extensions` | Extra extensions to install. Only `vector`, `postgis`, `timescaledb` and `pg_stat_statements` are accepted; any other name stops the deployment. |\n\n```yaml\npostgresql_version: \"17\"\n\n# Optional overrides\npostgresql_shared_buffers: \"2GB\" # leave unset to keep auto-tuning\npostgresql_listen_addresses: \"localhost\" # widen only when needed\npostgresql_extra_access:\n - type: host\n database: all\n user: gitlab_db\n address: 10.0.0.0/8\n auth_method: scram-sha-256\n```"} {"id":"technologies/postgresql/configure.md#listening-address","url":"https://docs.turbostack.app/technologies/postgresql/configure/#listening-address","path":"technologies/postgresql/configure.md","title":"Configure PostgreSQL on TurboStack","heading":"Listening address","keywords":"configure postgresql turbostack postgresql yaml postgresql_version postgresql_shared_buffers postgresql_listen_addresses percona postgresql","text":"`postgresql_listen_addresses` takes an address, or the keyword **`ANY`**, which makes PostgreSQL\nlisten on every interface the server has.\n\n> [!WARNING]\n> `ANY` includes any public interface. A database reachable from the internet is a serious risk, so\n> prefer a specific private address, and restrict access with the\n> firewall whatever you choose. Widening the listen address is only half\n> the job: a client also needs a matching rule in `postgresql_extra_access`.\n\n> [!IMPORTANT]\n> On a host that runs **Kubernetes or Docker**, PostgreSQL listens on every interface unless you set\n> `postgresql_listen_addresses` yourself. If that is not what you want, set the address explicitly.\n\n> [!WARNING]\n> A major-version change requires a migration and is not a simple in-place switch. Back up first and test before applying it in production."} {"id":"technologies/postgresql/configure.md#common-tasks","url":"https://docs.turbostack.app/technologies/postgresql/configure/#common-tasks","path":"technologies/postgresql/configure.md","title":"Configure PostgreSQL on TurboStack","heading":"Common tasks","keywords":"configure postgresql turbostack postgresql yaml postgresql_version postgresql_shared_buffers postgresql_listen_addresses percona postgresql","text":"- import and export a PostgreSQL database\n- connect to your PostgreSQL database remotely\n- create and manage PostgreSQL users"} {"id":"technologies/postgresql/configure.md#related","url":"https://docs.turbostack.app/technologies/postgresql/configure/#related","path":"technologies/postgresql/configure.md","title":"Configure PostgreSQL on TurboStack","heading":"Related","keywords":"configure postgresql turbostack postgresql yaml postgresql_version postgresql_shared_buffers postgresql_listen_addresses percona postgresql","text":"- What is PostgreSQL?\n- Services\n- Deploy Odoo"} {"id":"technologies/postgresql/connect-remotely.md#intro","url":"https://docs.turbostack.app/technologies/postgresql/connect-remotely/","path":"technologies/postgresql/connect-remotely.md","title":"How to connect to your PostgreSQL database remotely","heading":"","keywords":"remote postgresql postgres ssh tunnel connect postgres client pgadmin","text":"# How to connect to your PostgreSQL database remotely\n\nConnect a database client on your own computer (for example pgAdmin, DBeaver or `psql`) to a\nPostgreSQL database on your host. The recommended, secure way is an SSH tunnel."} {"id":"technologies/postgresql/connect-remotely.md#why-the-database-port-is-not-open-by-default","url":"https://docs.turbostack.app/technologies/postgresql/connect-remotely/#why-the-database-port-is-not-open-by-default","path":"technologies/postgresql/connect-remotely.md","title":"How to connect to your PostgreSQL database remotely","heading":"Why the database port is not open by default","keywords":"remote postgresql postgres ssh tunnel connect postgres client pgadmin","text":"For security, PostgreSQL listens on `localhost` only (`postgresql_listen_addresses: \"localhost\"`), so\nthe database port is not reachable from the internet. Rather than exposing it, you forward it over\nyour existing SSH access - the connection is encrypted and uses your SSH key."} {"id":"technologies/postgresql/connect-remotely.md#connect-over-an-ssh-tunnel-recommended","url":"https://docs.turbostack.app/technologies/postgresql/connect-remotely/#connect-over-an-ssh-tunnel-recommended","path":"technologies/postgresql/connect-remotely.md","title":"How to connect to your PostgreSQL database remotely","heading":"Connect over an SSH tunnel (recommended)","keywords":"remote postgresql postgres ssh tunnel connect postgres client pgadmin","text":"1. Open a tunnel from a local port (here `5433`) to the database on the host:\n ```bash\n ssh -L 5433:127.0.0.1:5432 prod@web1.example.com\n ```\n Leave this session open while you work.\n2. Point your client at the local end of the tunnel:\n\n | Setting | Value |\n | --- | --- |\n | Host | `127.0.0.1` |\n | Port | `5433` |\n | User (role) | your database role (from Credentials) |\n | Password | the role's password |\n | Database | your database name, for example `prod_db` |\n\npgAdmin and DBeaver can also create the SSH tunnel for you - set the SSH host and key, then set the\ndatabase host to `127.0.0.1`."} {"id":"technologies/postgresql/connect-remotely.md#opening-the-port-instead-advanced","url":"https://docs.turbostack.app/technologies/postgresql/connect-remotely/#opening-the-port-instead-advanced","path":"technologies/postgresql/connect-remotely.md","title":"How to connect to your PostgreSQL database remotely","heading":"Opening the port instead (advanced)","keywords":"remote postgresql postgres ssh tunnel connect postgres client pgadmin","text":"If a tool genuinely cannot tunnel, you can widen access - but this exposes the database, so prefer the\ntunnel.\n\n- Widen `postgresql_listen_addresses` and add host-based rules with `postgresql_extra_access` for the\n specific networks or hosts that need it (see Configure PostgreSQL).\n- Also allow the exact source IP addresses on the host's **Security** tab\n (Security).\n- Connect with a least-privilege role, never the application's main role.\n\n> [!WARNING]\n> Never open the database broadly. Grant access only to specific, trusted hosts, and use a dedicated\n> limited role."} {"id":"technologies/postgresql/connect-remotely.md#troubleshooting","url":"https://docs.turbostack.app/technologies/postgresql/connect-remotely/#troubleshooting","path":"technologies/postgresql/connect-remotely.md","title":"How to connect to your PostgreSQL database remotely","heading":"Troubleshooting","keywords":"remote postgresql postgres ssh tunnel connect postgres client pgadmin","text":"- **Connection refused** - the tunnel is not open, or the client is pointing at the host instead of\n `127.0.0.1`.\n- **Authentication failed** - wrong role/password, or no matching host-based access rule (see\n Create and manage PostgreSQL users).\n- **Times out when opening access directly** - the source host is not allowed, or\n `postgresql_listen_addresses` is still local. See\n Database problems."} {"id":"technologies/postgresql/connect-remotely.md#related","url":"https://docs.turbostack.app/technologies/postgresql/connect-remotely/#related","path":"technologies/postgresql/connect-remotely.md","title":"How to connect to your PostgreSQL database remotely","heading":"Related","keywords":"remote postgresql postgres ssh tunnel connect postgres client pgadmin","text":"- Configure PostgreSQL\n- Create and manage PostgreSQL users\n- Import and export a database\n- SSH access\n- Host Security tab"} {"id":"technologies/postgresql/import-export-database.md#intro","url":"https://docs.turbostack.app/technologies/postgresql/import-export-database/","path":"technologies/postgresql/import-export-database.md","title":"How to import and export a PostgreSQL database","heading":"","keywords":"import postgresql export postgresql pg_dump psql pg_restore backup postgres gzip scp","text":"# How to import and export a PostgreSQL database\n\nWe always recommend to dump and import through the command line, if possible. This documentation will\nexplain how to do this securely."} {"id":"technologies/postgresql/import-export-database.md#postgresql-export","url":"https://docs.turbostack.app/technologies/postgresql/import-export-database/#postgresql-export","path":"technologies/postgresql/import-export-database.md","title":"How to import and export a PostgreSQL database","heading":"PostgreSQL export","keywords":"import postgresql export postgresql pg_dump psql pg_restore backup postgres gzip scp","text":"For most databases (only a couple of gigabytes big), you can dump the database with this command:\n\n```bash\npg_dump -U DBUsername DatabaseName > DBNAME.sql\n```\n\nFor larger databases (tens of gigabytes or bigger), compress the database to conserve disk space and\nspeed up transfer:\n\n```bash\npg_dump -U DBUsername DatabaseName | gzip -3 -v > test.gz\n```\n\n> [!NOTE]\n> As an alternative, you can dump to the compressed custom format instead of piping through `gzip`.\n> A custom-format dump restores faster and lets you restore selectively with `pg_restore`:\n>\n> ```bash\n> pg_dump -U DBUsername -Fc DatabaseName > DBNAME.dump\n> ```"} {"id":"technologies/postgresql/import-export-database.md#transferring-the-database","url":"https://docs.turbostack.app/technologies/postgresql/import-export-database/#transferring-the-database","path":"technologies/postgresql/import-export-database.md","title":"How to import and export a PostgreSQL database","heading":"Transferring the database","keywords":"import postgresql export postgresql pg_dump psql pg_restore backup postgres gzip scp","text":"Use `scp` to transfer the file:\n\n```bash\nscp FileName user@HostnameOrIP:Path/To/Folder\n```\n\n> [!NOTE]\n> To place the file in the user's home directory, remove everything after the colon."} {"id":"technologies/postgresql/import-export-database.md#importing-the-database","url":"https://docs.turbostack.app/technologies/postgresql/import-export-database/#importing-the-database","path":"technologies/postgresql/import-export-database.md","title":"How to import and export a PostgreSQL database","heading":"Importing the database","keywords":"import postgresql export postgresql pg_dump psql pg_restore backup postgres gzip scp","text":"```bash\npsql -U DBUsername DatabaseName < dbname\n```\n\nOr, if compressed:\n\n```bash\ngunzip -c dbname.gz | psql -U DBUsername DatabaseName\n```\n\n> [!NOTE]\n> If you dumped to the custom format, restore it with `pg_restore` instead:\n>\n> ```bash\n> pg_restore -U DBUsername -d DatabaseName DBNAME.dump\n> ```\n\n> [!NOTE]\n> Large databases can take time to import, especially on high-load servers."} {"id":"technologies/postgresql/import-export-database.md#nohup","url":"https://docs.turbostack.app/technologies/postgresql/import-export-database/#nohup","path":"technologies/postgresql/import-export-database.md","title":"How to import and export a PostgreSQL database","heading":"Nohup","keywords":"import postgresql export postgresql pg_dump psql pg_restore backup postgres gzip scp","text":"Use `nohup` to ensure the dump or import continues if the connection is lost."} {"id":"technologies/postgresql/import-export-database.md#screen","url":"https://docs.turbostack.app/technologies/postgresql/import-export-database/#screen","path":"technologies/postgresql/import-export-database.md","title":"How to import and export a PostgreSQL database","heading":"Screen","keywords":"import postgresql export postgresql pg_dump psql pg_restore backup postgres gzip scp","text":"Use `screen` to allow session sharing or recovery:\n\n- Create a session:\n\n ```bash\n screen -S \n ```\n\n- Disconnect (keep running):\n\n ```\n Ctrl + A, then D\n ```\n\n- Reattach or take over session:\n\n ```bash\n screen -dr \n ```\n\n- List sessions:\n\n ```bash\n screen -ls\n ```"} {"id":"technologies/postgresql/import-export-database.md#ssh-key","url":"https://docs.turbostack.app/technologies/postgresql/import-export-database/#ssh-key","path":"technologies/postgresql/import-export-database.md","title":"How to import and export a PostgreSQL database","heading":"SSH key","keywords":"import postgresql export postgresql pg_dump psql pg_restore backup postgres gzip scp","text":"Avoid password prompts by setting up SSH key authentication."} {"id":"technologies/postgresql/import-export-database.md#related","url":"https://docs.turbostack.app/technologies/postgresql/import-export-database/#related","path":"technologies/postgresql/import-export-database.md","title":"How to import and export a PostgreSQL database","heading":"Related","keywords":"import postgresql export postgresql pg_dump psql pg_restore backup postgres gzip scp","text":"- Configure PostgreSQL\n- Create and manage PostgreSQL users\n- Backups and restore\n- SSH access\n- Database problems"} {"id":"technologies/postgresql/manage-database-users.md#intro","url":"https://docs.turbostack.app/technologies/postgresql/manage-database-users/","path":"technologies/postgresql/manage-database-users.md","title":"How to create and manage PostgreSQL users","heading":"","keywords":"create postgresql user postgresql role grant privileges database permissions least privilege","text":"# How to create and manage PostgreSQL users\n\nCreate additional PostgreSQL users (called **roles**) with only the access they need - for example a\nread-only role for reporting, or a separate role per application. Your application already has a main\nrole; add extra roles rather than sharing it."} {"id":"technologies/postgresql/manage-database-users.md#the-turbostack-way-extra-database-users","url":"https://docs.turbostack.app/technologies/postgresql/manage-database-users/#the-turbostack-way-extra-database-users","path":"technologies/postgresql/manage-database-users.md","title":"How to create and manage PostgreSQL users","heading":"The TurboStack way: extra database users","keywords":"create postgresql user postgresql role grant privileges database permissions least privilege","text":"The simplest option is to let TurboStack manage the user for you:\n\n1. Open the application's **Configure application** dialog and go to the **Database Info** tab\n (Applications).\n2. Add an **extra database user** and choose its role - **read-only** or **admin**.\n3. Publish the host. TurboStack creates the role and shows its credentials on the\n Credentials tab.\n\nUse this for the common cases; it keeps the role in your configuration and recreates it consistently."} {"id":"technologies/postgresql/manage-database-users.md#create-a-role-by-hand-sql","url":"https://docs.turbostack.app/technologies/postgresql/manage-database-users/#create-a-role-by-hand-sql","path":"technologies/postgresql/manage-database-users.md","title":"How to create and manage PostgreSQL users","heading":"Create a role by hand (SQL)","keywords":"create postgresql user postgresql role grant privileges database permissions least privilege","text":"For finer-grained grants, connect over SSH and run SQL with `psql`.\nGrant only what the role needs.\n\nA read-only role on one database:\n\n```sql\nCREATE ROLE prod_readonly LOGIN PASSWORD 'a-strong-password';\nGRANT CONNECT ON DATABASE prod_db TO prod_readonly;\n\\c prod_db\nGRANT USAGE ON SCHEMA public TO prod_readonly;\nGRANT SELECT ON ALL TABLES IN SCHEMA public TO prod_readonly;\n-- also cover tables created later:\nALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO prod_readonly;\n```\n\nA role with full access to a single application database:\n\n```sql\nCREATE ROLE prod_app LOGIN PASSWORD 'a-strong-password';\nGRANT ALL PRIVILEGES ON DATABASE prod_db TO prod_app;\n```\n\n> [!TIP]\n> Grant on the specific database and schema, not cluster-wide. Do not make application roles\n> `SUPERUSER` or give them `CREATEROLE`.\n\nFor a role to connect remotely, it also needs a host-based access rule - see `postgresql_extra_access`\nin Configure PostgreSQL and Connect remotely."} {"id":"technologies/postgresql/manage-database-users.md#rotate-a-password","url":"https://docs.turbostack.app/technologies/postgresql/manage-database-users/#rotate-a-password","path":"technologies/postgresql/manage-database-users.md","title":"How to create and manage PostgreSQL users","heading":"Rotate a password","keywords":"create postgresql user postgresql role grant privileges database permissions least privilege","text":"```sql\nALTER ROLE prod_readonly PASSWORD 'a-new-strong-password';\n```\n\nUpdate the password wherever the role is configured (the application, or your client) at the same time."} {"id":"technologies/postgresql/manage-database-users.md#verify-access","url":"https://docs.turbostack.app/technologies/postgresql/manage-database-users/#verify-access","path":"technologies/postgresql/manage-database-users.md","title":"How to create and manage PostgreSQL users","heading":"Verify access","keywords":"create postgresql user postgresql role grant privileges database permissions least privilege","text":"```sql\n\\du prod_readonly\n```\n\nThen connect as that role and confirm it can do what it should - and nothing more."} {"id":"technologies/postgresql/manage-database-users.md#related","url":"https://docs.turbostack.app/technologies/postgresql/manage-database-users/#related","path":"technologies/postgresql/manage-database-users.md","title":"How to create and manage PostgreSQL users","heading":"Related","keywords":"create postgresql user postgresql role grant privileges database permissions least privilege","text":"- Configure PostgreSQL\n- Import and export a PostgreSQL database\n- Connect to your database remotely\n- Credentials\n- Applications\n"} {"id":"technologies/postgresql/what-is.md#intro","url":"https://docs.turbostack.app/technologies/postgresql/what-is/","path":"technologies/postgresql/what-is.md","title":"What is PostgreSQL?","heading":"","keywords":"what is postgresql postgresql hosting postgresql turbostack percona postgresql relational database odoo database medusa database","text":"# What is PostgreSQL?\n\nPostgreSQL is a standards-compliant open-source relational database known for reliability, data integrity, and a broad feature set. It stores data in tables queried with SQL and supports rich data types, transactions, and extensions.\n\nIt is the preferred database for applications such as Odoo and Medusa, where transactional correctness and advanced querying matter."} {"id":"technologies/postgresql/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/postgresql/what-is/#on-turbostack","path":"technologies/postgresql/what-is.md","title":"What is PostgreSQL?","heading":"On TurboStack","keywords":"what is postgresql postgresql hosting postgresql turbostack percona postgresql relational database odoo database medusa database","text":"TurboStack runs **Percona PostgreSQL**, a drop-in, performance-focused build of PostgreSQL, as a host-level service. You enable it on a host and pick the major version (for example `17`).\n\nMemory sizing is auto-tuned to the server's resources. In particular, the `shared_buffers` setting, which controls how much memory PostgreSQL uses for caching, is set automatically. You generally do not need to tune it manually. Applications that need PostgreSQL, such as Odoo, connect to the managed instance on the host."} {"id":"technologies/postgresql/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/postgresql/what-is/#best-practices","path":"technologies/postgresql/what-is.md","title":"What is PostgreSQL?","heading":"Best practices","keywords":"what is postgresql postgresql hosting postgresql turbostack percona postgresql relational database odoo database medusa database","text":"- Stay on a current, supported major version and plan major upgrades, which require a migration step.\n- Leave `shared_buffers` and other sizing auto-tuned unless you have measured evidence to change it.\n- Keep the database listening on localhost; only widen access when an application or host genuinely needs it.\n- Use the extra-access mechanism to grant specific networks or hosts rather than opening the database broadly.\n- Take regular backups and verify restores, especially before a major-version upgrade.\n- Add indexes for frequent queries and run `VACUUM`/`ANALYZE` (autovacuum handles most of this) to keep performance healthy."} {"id":"technologies/postgresql/what-is.md#related","url":"https://docs.turbostack.app/technologies/postgresql/what-is/#related","path":"technologies/postgresql/what-is.md","title":"What is PostgreSQL?","heading":"Related","keywords":"what is postgresql postgresql hosting postgresql turbostack percona postgresql relational database odoo database medusa database","text":"- Configure PostgreSQL on TurboStack\n- Services"} {"id":"technologies/python/configure.md#intro","url":"https://docs.turbostack.app/technologies/python/configure/","path":"technologies/python/configure.md","title":"Configure Python on TurboStack","heading":"","keywords":"configure python turbostack python yaml python_version reverse proxy odoo","text":"# Configure Python on TurboStack\n\nEnable the Python runtime on an application and choose the version your application needs."} {"id":"technologies/python/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/python/configure/#where-to-configure-it","path":"technologies/python/configure.md","title":"Configure Python on TurboStack","heading":"Where to configure it","keywords":"configure python turbostack python yaml python_version reverse proxy odoo","text":"The Python runtime is configured per application. In the TurboStack Platform, open an application and go to **Configure application > Technologies > Python**. From there you enable Python and select the version.\n\nPython applications are usually published with the Nginx reverse proxy: your app listens on a local port and Nginx forwards public traffic to it. See Configure the reverse proxy for that part. If you are running Odoo, provision it through its dedicated app type instead - see Deploy Odoo."} {"id":"technologies/python/configure.md#required","url":"https://docs.turbostack.app/technologies/python/configure/#required","path":"technologies/python/configure.md","title":"Configure Python on TurboStack","heading":"Required","keywords":"configure python turbostack python yaml python_version reverse proxy odoo","text":"| Key | Meaning |\n| --- | --- |\n| `python_version` | The Python major version to install, for example `\"3.12\"` (or newer). Setting this key is what enables the Python runtime for the application; there is no separate enable key. |\n\n```yaml\npython_version: \"3.12\"\n```"} {"id":"technologies/python/configure.md#related","url":"https://docs.turbostack.app/technologies/python/configure/#related","path":"technologies/python/configure.md","title":"Configure Python on TurboStack","heading":"Related","keywords":"configure python turbostack python yaml python_version reverse proxy odoo","text":"- What is Python?\n- Configure the reverse proxy\n- Applications overview"} {"id":"technologies/python/what-is.md#intro","url":"https://docs.turbostack.app/technologies/python/what-is/","path":"technologies/python/what-is.md","title":"What is Python?","heading":"","keywords":"what is python python hosting python turbostack python runtime odoo reverse proxy","text":"# What is Python?\n\nPython is a popular, general-purpose programming language known for its readable syntax and large ecosystem. It is widely used for web applications, APIs, data processing, automation, and business platforms.\n\nOn a hosting platform, a Python web application typically runs as a long-lived process served by an application server. A web server in front of it accepts public HTTPS traffic and forwards requests to that process. Your code does not deal with Transport Layer Security (TLS) or public networking directly."} {"id":"technologies/python/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/python/what-is/#on-turbostack","path":"technologies/python/what-is.md","title":"What is Python?","heading":"On TurboStack","keywords":"what is python python hosting python turbostack python runtime odoo reverse proxy","text":"TurboStack provides Python as a per-application runtime. You enable it on an application and select the version your application needs. Different applications on the same host can run different Python versions independently.\n\nMost Python applications run as their own process and are published through Nginx acting as a reverse proxy. Your app listens on a local port and Nginx terminates TLS and forwards traffic to it.\n\nOdoo is a special case. It is a Python-based ERP and business suite provisioned through its dedicated `app_type: odoo`. The platform manages its runtime and services, so you do not use the generic reverse-proxy pattern."} {"id":"technologies/python/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/python/what-is/#best-practices","path":"technologies/python/what-is.md","title":"What is Python?","heading":"Best practices","keywords":"what is python python hosting python turbostack python runtime odoo reverse proxy","text":"- Pin a specific Python version so deployments are reproducible, and plan upgrades before a version reaches end of life.\n- Run your application inside a virtual environment to isolate its dependencies.\n- Serve your app with a production application server and let Nginx handle public TLS traffic.\n- Manage the process with a service manager so it restarts on failure and after reboots.\n- Store secrets and configuration in environment variables rather than in your codebase."} {"id":"technologies/python/what-is.md#related","url":"https://docs.turbostack.app/technologies/python/what-is/#related","path":"technologies/python/what-is.md","title":"What is Python?","heading":"Related","keywords":"what is python python hosting python turbostack python runtime odoo reverse proxy","text":"- Configure Python on TurboStack\n- Deploy Odoo"} {"id":"technologies/rabbitmq/configure.md#intro","url":"https://docs.turbostack.app/technologies/rabbitmq/configure/","path":"technologies/rabbitmq/configure.md","title":"Configure RabbitMQ on TurboStack","heading":"","keywords":"configure RabbitMQ turbostack RabbitMQ yaml rabbitmq_enabled RabbitMQ version RabbitMQ plugins","text":"# Configure RabbitMQ on TurboStack\n\nEnable RabbitMQ for an application and, where needed, tune the broker version and\nplugins at the host level."} {"id":"technologies/rabbitmq/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/rabbitmq/configure/#where-to-configure-it","path":"technologies/rabbitmq/configure.md","title":"Configure RabbitMQ on TurboStack","heading":"Where to configure it","keywords":"configure RabbitMQ turbostack RabbitMQ yaml rabbitmq_enabled RabbitMQ version RabbitMQ plugins","text":"RabbitMQ is enabled per application. Open the application, go to **Configure\napplication > Technologies > RabbitMQ**, and turn it on.\n\nBroker-level options live with the host. Open the host and go to the **Advanced >\nRabbitMQ Options** tab to set any plugins. The RabbitMQ version (`rabbitmq_version`)\nis not a field there - set it via the **Source (YAML)** view."} {"id":"technologies/rabbitmq/configure.md#required","url":"https://docs.turbostack.app/technologies/rabbitmq/configure/#required","path":"technologies/rabbitmq/configure.md","title":"Configure RabbitMQ on TurboStack","heading":"Required","keywords":"configure RabbitMQ turbostack RabbitMQ yaml rabbitmq_enabled RabbitMQ version RabbitMQ plugins","text":"| Key | Meaning |\n| --- | --- |\n| `rabbitmq_enabled` | Enables RabbitMQ for the application (`true`). |"} {"id":"technologies/rabbitmq/configure.md#optional","url":"https://docs.turbostack.app/technologies/rabbitmq/configure/#optional","path":"technologies/rabbitmq/configure.md","title":"Configure RabbitMQ on TurboStack","heading":"Optional","keywords":"configure RabbitMQ turbostack RabbitMQ yaml rabbitmq_enabled RabbitMQ version RabbitMQ plugins","text":"There are no optional YAML keys for the application. RabbitMQ **plugins** (`rabbitmq_plugins`) are selected in the GUI under host **Advanced > RabbitMQ Options**; the **version** (`rabbitmq_version`) is set via the host's **Source (YAML)** view.\n\nThe management interface is always enabled, so you never have to add it to the list yourself. Removing a plugin from the list disables it again on the next deployment.\n\n```yaml\n# Per-application application configuration\nrabbitmq_enabled: true\n```\n\n> [!TIP]\n> The version and plugins are host-level advanced settings shared by the\n> applications on that host. Only enable the plugins your application needs."} {"id":"technologies/rabbitmq/configure.md#related","url":"https://docs.turbostack.app/technologies/rabbitmq/configure/#related","path":"technologies/rabbitmq/configure.md","title":"Configure RabbitMQ on TurboStack","heading":"Related","keywords":"configure RabbitMQ turbostack RabbitMQ yaml rabbitmq_enabled RabbitMQ version RabbitMQ plugins","text":"- What is RabbitMQ?\n- Host Advanced tab\n- Applications overview"} {"id":"technologies/rabbitmq/what-is.md#intro","url":"https://docs.turbostack.app/technologies/rabbitmq/what-is/","path":"technologies/rabbitmq/what-is.md","title":"What is RabbitMQ?","heading":"","keywords":"what is RabbitMQ RabbitMQ hosting RabbitMQ turbostack amqp message broker RabbitMQ message queue","text":"# What is RabbitMQ?\n\nRabbitMQ is a message broker that lets parts of an application communicate\nasynchronously. Instead of doing slow work inside a web request, an application\npublishes a message to a queue and a separate worker process consumes it later.\nThis keeps the user-facing site responsive while heavier jobs run in the\nbackground.\n\nRabbitMQ speaks the AMQP (Advanced Message Queuing Protocol) standard. It is\nwidely used for offloading tasks such as sending emails, processing imports,\nrebuilding indexes, and any other work that should not block the main\napplication. Producers, queues, and consumers are decoupled, so each side can\nscale and fail independently."} {"id":"technologies/rabbitmq/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/rabbitmq/what-is/#on-turbostack","path":"technologies/rabbitmq/what-is.md","title":"What is RabbitMQ?","heading":"On TurboStack","keywords":"what is RabbitMQ RabbitMQ hosting RabbitMQ turbostack amqp message broker RabbitMQ message queue","text":"RabbitMQ is provided as an application technology that you enable per application,\nwith broker-level options managed at the host.\n\n- You turn RabbitMQ on for an application by enabling it in the application\n configuration. TurboStack then provisions and manages the broker for you.\n- The RabbitMQ version and any plugins are set as host-level advanced\n options, so the broker is kept consistent for the applications that use it.\n- RabbitMQ is the message queue behind OroCommerce, which relies on a message\n queue to process background jobs. When you deploy OroCommerce, enable RabbitMQ\n so its consumers have a broker to connect to.\n\n> [!NOTE]\n> RabbitMQ runs background work. You still need a worker or consumer process\n> (for example, OroCommerce's message-queue consumers) actually draining the\n> queues, otherwise messages simply accumulate."} {"id":"technologies/rabbitmq/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/rabbitmq/what-is/#best-practices","path":"technologies/rabbitmq/what-is.md","title":"What is RabbitMQ?","heading":"Best practices","keywords":"what is RabbitMQ RabbitMQ hosting RabbitMQ turbostack amqp message broker RabbitMQ message queue","text":"- Enable RabbitMQ only for applications that genuinely use a message queue, to avoid\n running an idle broker.\n- Keep consumers running and monitored so queues are drained continuously rather\n than backing up.\n- Watch queue depth - a growing backlog usually means too few consumers or a\n stuck worker.\n- Make message handlers idempotent, meaning handling the same message twice has the\n same result as handling it once, so a redelivered message does not cause\n duplicate side effects.\n- Pin a known-good RabbitMQ version per host and only add the plugins your\n application actually needs."} {"id":"technologies/rabbitmq/what-is.md#related","url":"https://docs.turbostack.app/technologies/rabbitmq/what-is/#related","path":"technologies/rabbitmq/what-is.md","title":"What is RabbitMQ?","heading":"Related","keywords":"what is RabbitMQ RabbitMQ hosting RabbitMQ turbostack amqp message broker RabbitMQ message queue","text":"- Configure RabbitMQ on TurboStack\n- Deploy OroCommerce"} {"id":"technologies/redis/clear-the-cache.md#intro","url":"https://docs.turbostack.app/technologies/redis/clear-the-cache/","path":"technologies/redis/clear-the-cache.md","title":"How to clear the Redis cache","heading":"","keywords":"clear Redis cache flush Redis redis-cli flushall reset cache redis flushdb","text":"# How to clear the Redis cache\n\nClear the Redis cache when cached data has gone stale - for example after a deploy, a configuration\nchange, or while troubleshooting. TurboStack runs two Redis instances, so it\nmatters which one you clear: the **cache** instance (`6379`) holds throwaway data, while the\n**persistent** instance (`6378`) holds sessions and queues you do not want to lose."} {"id":"technologies/redis/clear-the-cache.md#clear-the-cache-with-the-turbostack-cli","url":"https://docs.turbostack.app/technologies/redis/clear-the-cache/#clear-the-cache-with-the-turbostack-cli","path":"technologies/redis/clear-the-cache.md","title":"How to clear the Redis cache","heading":"Clear the cache with the TurboStack CLI","keywords":"clear Redis cache flush Redis redis-cli flushall reset cache redis flushdb","text":"`tscli redis clear` is the usual way. It runs `redis-cli flushall` against the **cache instance\n(6379)**, clearing all of its databases. The **persistent instance (6378) is left untouched**, so\nsessions and queued jobs survive.\n\n```bash\ntscli redis clear\n```\n\nExpect a short performance dip while the cache fills again.\n\n> [!NOTE]\n> This flushes *all* databases on the cache instance, so every application that caches on `6379` has its\n> cache cleared - not just one. To clear a single site, use a targeted command below or your\n> application's own cache flush."} {"id":"technologies/redis/clear-the-cache.md#clear-a-single-database-or-the-persistent-instance","url":"https://docs.turbostack.app/technologies/redis/clear-the-cache/#clear-a-single-database-or-the-persistent-instance","path":"technologies/redis/clear-the-cache.md","title":"How to clear the Redis cache","heading":"Clear a single database or the persistent instance","keywords":"clear Redis cache flush Redis redis-cli flushall reset cache redis flushdb","text":"For finer control, use `redis-cli` directly (it connects to the cache instance on `6379` by default):\n\n```bash\nredis-cli -n 1 FLUSHDB # clear only database 1 on the cache instance (6379)\nredis-cli -p 6378 flushall # clear the persistent instance - drops sessions and queues\n```\n\n> [!WARNING]\n> The persistent instance (`6378`) holds sessions and queues. Clearing it logs users out and drops\n> queued jobs - only do this deliberately."} {"id":"technologies/redis/clear-the-cache.md#prefer-your-application-s-own-flush","url":"https://docs.turbostack.app/technologies/redis/clear-the-cache/#prefer-your-application-s-own-flush","path":"technologies/redis/clear-the-cache.md","title":"How to clear the Redis cache","heading":"Prefer your application's own flush","keywords":"clear Redis cache flush Redis redis-cli flushall reset cache redis flushdb","text":"When you only need to clear one application's cache, its own command is safest because it touches\njust that application's keys. For example, Magento:\n\n```bash\nphp bin/magento cache:flush\n```"} {"id":"technologies/redis/clear-the-cache.md#after-clearing","url":"https://docs.turbostack.app/technologies/redis/clear-the-cache/#after-clearing","path":"technologies/redis/clear-the-cache.md","title":"How to clear the Redis cache","heading":"After clearing","keywords":"clear Redis cache flush Redis redis-cli flushall reset cache redis flushdb","text":"The cache rebuilds on the next requests, so the first hits are slower and load is briefly higher.\nWarm the important pages by visiting them, or let your sitemap or a crawler do it, before judging the\nresult."} {"id":"technologies/redis/clear-the-cache.md#related","url":"https://docs.turbostack.app/technologies/redis/clear-the-cache/#related","path":"technologies/redis/clear-the-cache.md","title":"How to clear the Redis cache","heading":"Related","keywords":"clear Redis cache flush Redis redis-cli flushall reset cache redis flushdb","text":"- Use Redis for sessions and cache\n- Configure Redis\n- Inspect Redis with Redis Insight\n- TurboStack CLI\n- Performance tuning"} {"id":"technologies/redis/configure.md#intro","url":"https://docs.turbostack.app/technologies/redis/configure/","path":"technologies/redis/configure.md","title":"Configure Redis on TurboStack","heading":"","keywords":"configure Redis turbostack Redis yaml redis_enabled redis_memory Redis cache port","text":"# Configure Redis on TurboStack\n\nRedis is enabled by default; you can confirm it and, if needed, adjust its memory per host."} {"id":"technologies/redis/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/redis/configure/#where-to-configure-it","path":"technologies/redis/configure.md","title":"Configure Redis on TurboStack","heading":"Where to configure it","keywords":"configure Redis turbostack Redis yaml redis_enabled redis_memory Redis cache port","text":"Redis is a host-level service. Open the host, go to its **Services** tab, and find the **Redis**\nentry. From there you can confirm it is enabled and adjust its settings. Changes are written to the\nhost's YAML and applied on the next deployment.\n\nBy convention TurboStack runs two instances on the host: port `6379` for transient cache data and\nport `6378` for persistent data such as sessions and queues.\n\n> [!TIP]\n> Memory is auto-sized to the host. Only set a value when you have a measured reason to override it."} {"id":"technologies/redis/configure.md#required","url":"https://docs.turbostack.app/technologies/redis/configure/#required","path":"technologies/redis/configure.md","title":"Configure Redis on TurboStack","heading":"Required","keywords":"configure Redis turbostack Redis yaml redis_enabled redis_memory Redis cache port","text":"| Key | Meaning |\n|---|---|\n| `redis_enabled` | Whether Redis runs on the host. Enabled (`true`) by default. |"} {"id":"technologies/redis/configure.md#optional","url":"https://docs.turbostack.app/technologies/redis/configure/#optional","path":"technologies/redis/configure.md","title":"Configure Redis on TurboStack","heading":"Optional","keywords":"configure Redis turbostack Redis yaml redis_enabled redis_memory Redis cache port","text":"| Key | Meaning |\n|---|---|\n| `redis_memory` | Maximum memory for the cache instance (port `6379`). Auto-sized by default; set only to override. |\n| `redis_persistent_memory` | Maximum memory for the persistent instance (port `6378`), the one that keeps its data on disk. Auto-sized by default. |\n| `redis_listen_addresses` | Which addresses Redis accepts connections on. Local only unless you set it. |\n\n```yaml\nredis_enabled: true\n# Optional - overrides the automatic memory sizing:\nredis_memory: \"512mb\"\n# Optional - reachable from the private network instead of localhost only:\n# redis_listen_addresses: internal\n```"} {"id":"technologies/redis/configure.md#listening-address","url":"https://docs.turbostack.app/technologies/redis/configure/#listening-address","path":"technologies/redis/configure.md","title":"Configure Redis on TurboStack","heading":"Listening address","keywords":"configure Redis turbostack Redis yaml redis_enabled redis_memory Redis cache port","text":"Leave `redis_listen_addresses` unset and Redis stays on localhost. Set it to `internal` when\nanother server on the private network must reach the cache: that binds the loopback addresses plus\nthe host's private IPv4 addresses. `internal` is the **only** accepted value - anything else,\nincluding `any`, stops the deployment with an error.\n\n> [!WARNING]\n> Setting `internal` also turns off the Redis protected mode. Redis has no password by default, so\n> anything that can reach the port can read and delete your data. Only use it on a trusted private\n> network, never with a public address.\n\n> [!IMPORTANT]\n> On a host that runs **Kubernetes or Docker**, Redis uses `internal` unless you set\n> `redis_listen_addresses` yourself, and protected mode is off on such a host either way.\n\n> [!NOTE]\n> The two-instance split (6379 cache, 6378 persistent) is a TurboStack convention. Make sure your\n> application connects transient cache traffic to 6379 and durable data to 6378. For the local socket\n> paths and how to give each application its own database, see\n> Use Redis for sessions and cache."} {"id":"technologies/redis/configure.md#common-tasks","url":"https://docs.turbostack.app/technologies/redis/configure/#common-tasks","path":"technologies/redis/configure.md","title":"Configure Redis on TurboStack","heading":"Common tasks","keywords":"configure Redis turbostack Redis yaml redis_enabled redis_memory Redis cache port","text":"- clear the Redis cache\n- use Redis for sessions and cache\n- inspect Redis with Redis Insight"} {"id":"technologies/redis/configure.md#related","url":"https://docs.turbostack.app/technologies/redis/configure/#related","path":"technologies/redis/configure.md","title":"Configure Redis on TurboStack","heading":"Related","keywords":"configure Redis turbostack Redis yaml redis_enabled redis_memory Redis cache port","text":"- What is Redis?\n- Host Services\n- Performance tuning\n- TurboStack CLI - clear the cache with `tscli redis clear`"} {"id":"technologies/redis/inspect-with-redis-insight.md#intro","url":"https://docs.turbostack.app/technologies/redis/inspect-with-redis-insight/","path":"technologies/redis/inspect-with-redis-insight.md","title":"How to inspect Redis with Redis Insight","heading":"","keywords":"redis insight redis memory analyze redis redis gui redis keyspace","text":"# How to inspect Redis with Redis Insight\n\nRedis Insight is a free desktop tool for browsing Redis and analyzing what uses memory - useful when\na cache is large or you are chasing memory pressure. You\nconnect to your host's Redis over a secure Secure Shell (SSH) tunnel."} {"id":"technologies/redis/inspect-with-redis-insight.md#before-you-start","url":"https://docs.turbostack.app/technologies/redis/inspect-with-redis-insight/#before-you-start","path":"technologies/redis/inspect-with-redis-insight.md","title":"How to inspect Redis with Redis Insight","heading":"Before you start","keywords":"redis insight redis memory analyze redis redis gui redis keyspace","text":"- **SSH access** and your system-user credentials from the host's\n Credentials tab.\n- No Redis password is needed. Access is secured by the SSH tunnel and by Redis binding to\n localhost, so leave the password field empty."} {"id":"technologies/redis/inspect-with-redis-insight.md#connect","url":"https://docs.turbostack.app/technologies/redis/inspect-with-redis-insight/#connect","path":"technologies/redis/inspect-with-redis-insight.md","title":"How to inspect Redis with Redis Insight","heading":"Connect","keywords":"redis insight redis memory analyze redis redis gui redis keyspace","text":"1. In Redis Insight, select **Add Redis Database**.\n2. Enter the connection details:\n - **Host:** `127.0.0.1` and **Port:** `6379` (the cache instance) or `6378` (the persistent\n instance).\n - Under **Security**, enable **Use SSH Tunnel**: SSH host = your server, **port 22**, and your\n system-user name and password.\n3. Open the database. Pick the logical database to analyze (the default is `0`); you can list them\n over SSH with:\n ```bash\n redis-cli info keyspace\n ```"} {"id":"technologies/redis/inspect-with-redis-insight.md#which-instance-and-database","url":"https://docs.turbostack.app/technologies/redis/inspect-with-redis-insight/#which-instance-and-database","path":"technologies/redis/inspect-with-redis-insight.md","title":"How to inspect Redis with Redis Insight","heading":"Which instance and database","keywords":"redis insight redis memory analyze redis redis gui redis keyspace","text":"TurboStack runs two Redis instances. Connect to the one that holds the data you want to inspect:\n\n| Instance | Port | Holds |\n| --- | --- | --- |\n| Cache | `6379` | Temporary cache; cleared by `tscli redis clear` |\n| Persistent | `6378` | Sessions and data that must survive a restart |\n\nEach instance has 16 logical databases, numbered `0` to `15`. When a host runs several sites, each\nsite often uses its own database. Use the keyspace list above to find the database with the keys you\nwant."} {"id":"technologies/redis/inspect-with-redis-insight.md#analyze-memory-use","url":"https://docs.turbostack.app/technologies/redis/inspect-with-redis-insight/#analyze-memory-use","path":"technologies/redis/inspect-with-redis-insight.md","title":"How to inspect Redis with Redis Insight","heading":"Analyze memory use","keywords":"redis insight redis memory analyze redis redis gui redis keyspace","text":"Browse keys to see their types and time-to-live (TTL), then use the **Analysis** tool in the left\nmenu to generate a report. The report shows:\n\n- Total memory used and the total number of keys.\n- The largest keys, sortable by TTL, so you can see what is worth caching differently.\n- The most used key types and how much memory each type takes.\n- The memory split between expiring and non-expiring keys.\n\nUse this to decide what to cache differently, or whether to raise `redis_memory` - see\nPerformance tuning."} {"id":"technologies/redis/inspect-with-redis-insight.md#related","url":"https://docs.turbostack.app/technologies/redis/inspect-with-redis-insight/#related","path":"technologies/redis/inspect-with-redis-insight.md","title":"How to inspect Redis with Redis Insight","heading":"Related","keywords":"redis insight redis memory analyze redis redis gui redis keyspace","text":"- What is Redis?\n- Configure Redis\n- Out of memory\n- Performance tuning"} {"id":"technologies/redis/sessions-and-cache.md#intro","url":"https://docs.turbostack.app/technologies/redis/sessions-and-cache/","path":"technologies/redis/sessions-and-cache.md","title":"How to use Redis for sessions and cache","heading":"","keywords":"Redis sessions Redis cache session storage Redis databases persistent Redis","text":"# How to use Redis for sessions and cache\n\nTurboStack runs **two Redis instances** on each host so you can keep throwaway cache data apart from\ndata you cannot afford to lose, such as logged-in sessions and queued jobs. Pointing each kind of\ndata at the right instance keeps your site fast and avoids logging users out when the cache is\ncleared."} {"id":"technologies/redis/sessions-and-cache.md#the-two-instances","url":"https://docs.turbostack.app/technologies/redis/sessions-and-cache/#the-two-instances","path":"technologies/redis/sessions-and-cache.md","title":"How to use Redis for sessions and cache","heading":"The two instances","keywords":"Redis sessions Redis cache session storage Redis databases persistent Redis","text":"| Instance | Port | Local socket | Use it for | Safe to clear? |\n| --- | --- | --- | --- | --- |\n| Cache | `6379` | `/var/run/redis/redis.sock` | Page, object and other transient cache | Yes - it is rebuilt on demand |\n| Persistent | `6378` | `/var/run/redis-persistent/redis.sock` | Sessions, queues and other durable data | No - clearing it logs users out and drops queued jobs |\n\nSend transient cache traffic to **6379** and durable data to **6378**. Most application types on\nTurboStack are already wired up this way; only change it if you configure Redis by hand."} {"id":"technologies/redis/sessions-and-cache.md#connect-over-the-local-socket","url":"https://docs.turbostack.app/technologies/redis/sessions-and-cache/#connect-over-the-local-socket","path":"technologies/redis/sessions-and-cache.md","title":"How to use Redis for sessions and cache","heading":"Connect over the local socket","keywords":"Redis sessions Redis cache session storage Redis databases persistent Redis","text":"When your application runs on the same host as Redis, connect over the **Unix socket** instead of\n`127.0.0.1:`. A socket has less overhead than a network connection, which lowers latency and\nprocessor use under load. Use the socket paths from the table above."} {"id":"technologies/redis/sessions-and-cache.md#give-each-application-its-own-database","url":"https://docs.turbostack.app/technologies/redis/sessions-and-cache/#give-each-application-its-own-database","path":"technologies/redis/sessions-and-cache.md","title":"How to use Redis for sessions and cache","heading":"Give each application its own database","keywords":"Redis sessions Redis cache session storage Redis databases persistent Redis","text":"Redis provides **16 logical databases**, numbered `0` to `15`. When several applications share a host,\ngive each one its own database number (for example application A on `1`, application B on `2`) so they never\nread or overwrite each other's keys."} {"id":"technologies/redis/sessions-and-cache.md#don-t-clear-the-persistent-store-casually","url":"https://docs.turbostack.app/technologies/redis/sessions-and-cache/#don-t-clear-the-persistent-store-casually","path":"technologies/redis/sessions-and-cache.md","title":"How to use Redis for sessions and cache","heading":"Don't clear the persistent store casually","keywords":"Redis sessions Redis cache session storage Redis databases persistent Redis","text":"Clearing the **6379** cache is harmless - it simply rebuilds. Clearing the **6378** persistent\ninstance is not: it drops sessions (logging everyone out) and any queued jobs. The standard\nclear the cache command (`tscli redis clear`) already targets the cache\ninstance (6379), so it is safe; only reach for the persistent instance deliberately."} {"id":"technologies/redis/sessions-and-cache.md#set-a-ttl-and-expiry","url":"https://docs.turbostack.app/technologies/redis/sessions-and-cache/#set-a-ttl-and-expiry","path":"technologies/redis/sessions-and-cache.md","title":"How to use Redis for sessions and cache","heading":"Set a TTL and expiry","keywords":"Redis sessions Redis cache session storage Redis databases persistent Redis","text":"By default Redis does not assign a Time-To-Live (TTL) to a key unless you set one. Giving\ntransient keys an expiry keeps memory usage in check and stops the cache from filling up.\n\nSet a TTL when you write a key - for example one hour:\n\n```bash\nSET key value EX 3600\n```\n\nAs a general guide:\n\n- **Cache keys** - set a TTL matching how long the data stays fresh (for example API\n responses or HTML fragments).\n- **Sessions** - use a longer TTL, around **24 hours**.\n- **Critical data** - do **not** set a TTL for data that must persist."} {"id":"technologies/redis/sessions-and-cache.md#verify-data-is-being-cached","url":"https://docs.turbostack.app/technologies/redis/sessions-and-cache/#verify-data-is-being-cached","path":"technologies/redis/sessions-and-cache.md","title":"How to use Redis for sessions and cache","heading":"Verify data is being cached","keywords":"Redis sessions Redis cache session storage Redis databases persistent Redis","text":"After wiring up Redis, check that keys are actually being written. Connect with `redis-cli`\nand list the keys:\n\n```bash\nredis-cli\n127.0.0.1:6379> keys *\n(empty array)\n```\n\nAn empty array means nothing has been cached yet - expected right after a clear. Click\naround your site, then run `keys *` again. If it stays empty, the application is not writing\nto Redis and the integration needs checking."} {"id":"technologies/redis/sessions-and-cache.md#related","url":"https://docs.turbostack.app/technologies/redis/sessions-and-cache/#related","path":"technologies/redis/sessions-and-cache.md","title":"How to use Redis for sessions and cache","heading":"Related","keywords":"Redis sessions Redis cache session storage Redis databases persistent Redis","text":"- Configure Redis\n- Clear the Redis cache\n- Inspect Redis with Redis Insight\n- Performance tuning"} {"id":"technologies/redis/what-is.md#intro","url":"https://docs.turbostack.app/technologies/redis/what-is/","path":"technologies/redis/what-is.md","title":"What is Redis?","heading":"","keywords":"what is Redis Redis hosting Redis turbostack in-memory cache Redis sessions","text":"# What is Redis?\n\nRedis is an in-memory data store. Because it keeps data in RAM, it answers reads and writes\nwith very low latency, which makes it well suited to caching, session storage, rate limiting, and\nlightweight message queues. It supports rich data types - strings, hashes, lists, sets, and more -\nso applications use it for far more than simple key/value caching.\n\nCaches are transient by nature: data in a cache can be regenerated from the source of truth, so it\nis safe to clear. Other Redis uses, such as user sessions or job queues, need their data to survive\nrestarts. TurboStack handles both needs by running two separate instances."} {"id":"technologies/redis/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/redis/what-is/#on-turbostack","path":"technologies/redis/what-is.md","title":"What is Redis?","heading":"On TurboStack","keywords":"what is Redis Redis hosting Redis turbostack in-memory cache Redis sessions","text":"TurboStack runs Redis by convention as two instances on each host so that disposable cache\ndata and durable data never share the same store:\n\n- **Port 6379 - cache.** Transient data only. Safe to clear at any time; nothing important is lost.\n- **Port 6378 - persistent.** Durable data such as sessions and queues, intended to survive\n restarts.\n\nRedis is enabled by default. Its maximum memory is auto-sized to the host, so you normally\ndo not need to tune it. See Performance tuning for\nguidance on sizing.\n\n> [!TIP]\n> Point throwaway cache traffic at port **6379** and anything you must not lose at port **6378**."} {"id":"technologies/redis/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/redis/what-is/#best-practices","path":"technologies/redis/what-is.md","title":"What is Redis?","heading":"Best practices","keywords":"what is Redis Redis hosting Redis turbostack in-memory cache Redis sessions","text":"- Send only regenerable cache data to the 6379 instance; never store data there you cannot rebuild.\n- Use the persistent 6378 instance for sessions, queues, and other durable state.\n- Let memory auto-sizing do its job; only override it for a measured, specific need.\n- Set sensible key expirations so the cache stays within its memory budget.\n- Restrict access so only the applications on the host can reach the instances."} {"id":"technologies/redis/what-is.md#related","url":"https://docs.turbostack.app/technologies/redis/what-is/#related","path":"technologies/redis/what-is.md","title":"What is Redis?","heading":"Related","keywords":"what is Redis Redis hosting Redis turbostack in-memory cache Redis sessions","text":"- Configure Redis on TurboStack\n- Performance tuning"} {"id":"technologies/reverse-proxy/configure.md#intro","url":"https://docs.turbostack.app/technologies/reverse-proxy/configure/","path":"technologies/reverse-proxy/configure.md","title":"Configure the reverse proxy on TurboStack","heading":"","keywords":"configure reverse proxy turbostack reverse proxy yaml proxy upstream port nginx proxy turbostack","text":"# Configure the reverse proxy on TurboStack\n\nEnabling the reverse proxy tells Nginx to forward an application's requests to your\napplication's upstream port instead of serving PHP or static files."} {"id":"technologies/reverse-proxy/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/reverse-proxy/configure/#where-to-configure-it","path":"technologies/reverse-proxy/configure.md","title":"Configure the reverse proxy on TurboStack","heading":"Where to configure it","keywords":"configure reverse proxy turbostack reverse proxy yaml proxy upstream port nginx proxy turbostack","text":"The reverse proxy is enabled per application:\n\n1. Open the host and select the application.\n2. Go to **Configure application > Technologies > Reverse Proxy**.\n3. Enable the reverse proxy and set the **upstream port** your application\n listens on.\n\nTurboStack generates the Nginx vhost from there - there is no raw proxy config\nto write by hand."} {"id":"technologies/reverse-proxy/configure.md#required","url":"https://docs.turbostack.app/technologies/reverse-proxy/configure/#required","path":"technologies/reverse-proxy/configure.md","title":"Configure the reverse proxy on TurboStack","heading":"Required","keywords":"configure reverse proxy turbostack reverse proxy yaml proxy upstream port nginx proxy turbostack","text":"| Key | Meaning |\n|---|---|\n| `proxy_enabled` | Set to `true` to forward this application's requests to a backend upstream. |\n| `proxy_upstream_port` | The port your application listens on, where Nginx forwards requests. |"} {"id":"technologies/reverse-proxy/configure.md#optional","url":"https://docs.turbostack.app/technologies/reverse-proxy/configure/#optional","path":"technologies/reverse-proxy/configure.md","title":"Configure the reverse proxy on TurboStack","heading":"Optional","keywords":"configure reverse proxy turbostack reverse proxy yaml proxy upstream port nginx proxy turbostack","text":"| Key | Meaning |\n|---|---|\n| `proxy_upstream_host` | The host Nginx forwards to. Defaults to `127.0.0.1` (loopback). |\n\n```yaml\n# Per-application: forward requests to a backend app on port 3000\nproxy_enabled: true\nproxy_upstream_port: 3000\nproxy_upstream_host: 127.0.0.1 # optional, this is the default\n```\n\n> [!TIP]\n> Keep `proxy_upstream_host` at `127.0.0.1` so your application is reachable only\n> through Nginx. For containerized apps, combine this with\n> Docker and point the upstream port at the\n> container's exposed port."} {"id":"technologies/reverse-proxy/configure.md#related","url":"https://docs.turbostack.app/technologies/reverse-proxy/configure/#related","path":"technologies/reverse-proxy/configure.md","title":"Configure the reverse proxy on TurboStack","heading":"Related","keywords":"configure reverse proxy turbostack reverse proxy yaml proxy upstream port nginx proxy turbostack","text":"- What is a reverse proxy?\n- Applications tab\n- Applications overview"} {"id":"technologies/reverse-proxy/what-is.md#intro","url":"https://docs.turbostack.app/technologies/reverse-proxy/what-is/","path":"technologies/reverse-proxy/what-is.md","title":"What is a reverse proxy?","heading":"","keywords":"what is reverse proxy reverse proxy hosting reverse proxy turbostack nginx reverse proxy proxy upstream","text":"# What is a reverse proxy?\n\nA reverse proxy is a web server that sits in front of one or more backend\napplications and forwards incoming requests to them. Instead of handling a\nrequest itself, the proxy passes it on to an upstream process - typically an\napplication listening on a local port - and relays the response back to the\nvisitor.\n\nOn TurboStack this means Nginx accepts the public HTTP/HTTPS traffic for a\napplication and forwards it to your own application or container, rather than serving\nPHP-FPM or static files. It is the standard way to publish long-running\napplication servers, such as Node.js apps, and containerized workloads, behind\nTurboStack's Transport Layer Security (TLS), caching and security front door."} {"id":"technologies/reverse-proxy/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/reverse-proxy/what-is/#on-turbostack","path":"technologies/reverse-proxy/what-is.md","title":"What is a reverse proxy?","heading":"On TurboStack","keywords":"what is reverse proxy reverse proxy hosting reverse proxy turbostack nginx reverse proxy proxy upstream","text":"The reverse proxy is enabled **per application** under **Configure application >\nTechnologies > Reverse Proxy**.\n\n- When you enable it, TurboStack generates the Nginx vhost so that requests are\n forwarded to your application's upstream - by default `127.0.0.1` on the port\n you choose.\n- Your application keeps running on its own port (for example a Node.js process\n or a Docker container), while Nginx remains the public entry point handling\n TLS termination and request routing.\n- It is the recommended pattern for **Node.js applications** such as\n Medusa and for **Docker/containerized\n apps** - pair it with Docker so Nginx proxies to the\n container's exposed port.\n- You do not edit raw Nginx config; you enable the proxy and set the upstream\n port (and optionally the host), and TurboStack renders and reloads the\n configuration for you.\n\n> [!NOTE]\n> The reverse proxy forwards to a backend you run; it does not serve PHP. Use it\n> when your application is its own server (Node.js, a container, a microservice),\n> not for standard PHP sites."} {"id":"technologies/reverse-proxy/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/reverse-proxy/what-is/#best-practices","path":"technologies/reverse-proxy/what-is.md","title":"What is a reverse proxy?","heading":"Best practices","keywords":"what is reverse proxy reverse proxy hosting reverse proxy turbostack nginx reverse proxy proxy upstream","text":"- Bind your application to `127.0.0.1` (loopback) so only Nginx can reach it,\n never directly from the public internet.\n- Keep your app on a fixed, predictable port that matches the configured\n upstream port.\n- Let TurboStack terminate TLS at Nginx and proxy plain HTTP to the upstream,\n rather than running TLS inside the app.\n- Make sure your application starts on boot and restarts on failure, so the\n upstream is always available behind the proxy.\n- For containerized apps, expose a single port and proxy to it; keep one\n responsibility per container."} {"id":"technologies/reverse-proxy/what-is.md#related","url":"https://docs.turbostack.app/technologies/reverse-proxy/what-is/#related","path":"technologies/reverse-proxy/what-is.md","title":"What is a reverse proxy?","heading":"Related","keywords":"what is reverse proxy reverse proxy hosting reverse proxy turbostack nginx reverse proxy proxy upstream","text":"- Configure the reverse proxy on TurboStack\n- Applications tab"} {"id":"technologies/ruby/configure.md#intro","url":"https://docs.turbostack.app/technologies/ruby/configure/","path":"technologies/ruby/configure.md","title":"Configure Ruby on TurboStack","heading":"","keywords":"configure ruby turbostack ruby yaml ruby_version ruby_sidekiq ruby_start_cmd","text":"# Configure Ruby on TurboStack\n\nEnable the Ruby runtime on an application, choose its version, and optionally add a startup command and Sidekiq background workers."} {"id":"technologies/ruby/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/ruby/configure/#where-to-configure-it","path":"technologies/ruby/configure.md","title":"Configure Ruby on TurboStack","heading":"Where to configure it","keywords":"configure ruby turbostack ruby yaml ruby_version ruby_sidekiq ruby_start_cmd","text":"The Ruby runtime is configured per application. In the TurboStack Platform, open an application and go to **Configure application > Technologies > Ruby**. From there you enable Ruby, select the version, and set how the application starts.\n\nRuby applications are published with the Nginx reverse proxy: your app listens on a local port and Nginx forwards public traffic to it. See Configure the reverse proxy for that part."} {"id":"technologies/ruby/configure.md#required","url":"https://docs.turbostack.app/technologies/ruby/configure/#required","path":"technologies/ruby/configure.md","title":"Configure Ruby on TurboStack","heading":"Required","keywords":"configure ruby turbostack ruby yaml ruby_version ruby_sidekiq ruby_start_cmd","text":"| Key | Meaning |\n| --- | --- |\n| `ruby_version` | The Ruby major version to install, for example `\"3.3\"` (or newer). Setting this key is what enables the Ruby runtime for the application; there is no separate enable key. |"} {"id":"technologies/ruby/configure.md#optional","url":"https://docs.turbostack.app/technologies/ruby/configure/#optional","path":"technologies/ruby/configure.md","title":"Configure Ruby on TurboStack","heading":"Optional","keywords":"configure ruby turbostack ruby yaml ruby_version ruby_sidekiq ruby_start_cmd","text":"| Key | Meaning |\n| --- | --- |\n| `ruby_start_cmd` | The command used to start your Ruby application. |\n| `ruby_sidekiq` | Enables a Sidekiq background-job worker alongside your app. |\n| `ruby_sidekiq_cmd` | The command used to start the Sidekiq worker. |\n\n```yaml\nruby_version: \"3.3\"\nruby_start_cmd: \"bundle exec puma -p 3000\"\n\n# Optional background-job processing\nruby_sidekiq: true\nruby_sidekiq_cmd: \"bundle exec sidekiq\"\n```"} {"id":"technologies/ruby/configure.md#related","url":"https://docs.turbostack.app/technologies/ruby/configure/#related","path":"technologies/ruby/configure.md","title":"Configure Ruby on TurboStack","heading":"Related","keywords":"configure ruby turbostack ruby yaml ruby_version ruby_sidekiq ruby_start_cmd","text":"- What is Ruby?\n- Configure the reverse proxy\n- Applications overview"} {"id":"technologies/ruby/what-is.md#intro","url":"https://docs.turbostack.app/technologies/ruby/what-is/","path":"technologies/ruby/what-is.md","title":"What is Ruby?","heading":"","keywords":"what is ruby ruby hosting ruby turbostack ruby runtime sidekiq reverse proxy","text":"# What is Ruby?\n\nRuby is a dynamic, object-oriented programming language designed for developer productivity and readable code. It is widely used for web applications, especially through frameworks such as Ruby on Rails, as well as for tooling and automation.\n\nOn a hosting platform, a Ruby web application runs as a long-lived process served by an application server. A web server accepts public HTTPS traffic and forwards requests to that process. Your code does not handle Transport Layer Security (TLS) or public networking directly."} {"id":"technologies/ruby/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/ruby/what-is/#on-turbostack","path":"technologies/ruby/what-is.md","title":"What is Ruby?","heading":"On TurboStack","keywords":"what is ruby ruby hosting ruby turbostack ruby runtime sidekiq reverse proxy","text":"TurboStack provides Ruby as a per-application runtime, isolated per system user. You enable it on an application and select the version your application needs, so each user's Ruby installation stays independent from the others on the same host.\n\nRuby applications run behind Nginx acting as a reverse proxy: your app listens on a local port and Nginx terminates TLS and forwards traffic to it. You can define the command that starts your application, and you can optionally run Sidekiq alongside it to process background jobs."} {"id":"technologies/ruby/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/ruby/what-is/#best-practices","path":"technologies/ruby/what-is.md","title":"What is Ruby?","heading":"Best practices","keywords":"what is ruby ruby hosting ruby turbostack ruby runtime sidekiq reverse proxy","text":"- Pin a specific Ruby version so deployments are reproducible, and plan upgrades before a version reaches end of life.\n- Use a defined startup command so the platform always launches your application the same way.\n- Offload long-running or scheduled work to Sidekiq background jobs instead of handling them in web requests.\n- Serve your app with a production application server and let Nginx handle public TLS traffic.\n- Keep gems up to date and audit them regularly for security advisories."} {"id":"technologies/ruby/what-is.md#related","url":"https://docs.turbostack.app/technologies/ruby/what-is/#related","path":"technologies/ruby/what-is.md","title":"What is Ruby?","heading":"Related","keywords":"what is ruby ruby hosting ruby turbostack ruby runtime sidekiq reverse proxy","text":"- Configure Ruby on TurboStack\n- Configure the reverse proxy"} {"id":"technologies/ssh/add-an-ssh-key.md#intro","url":"https://docs.turbostack.app/technologies/ssh/add-an-ssh-key/","path":"technologies/ssh/add-an-ssh-key.md","title":"Add an SSH key","heading":"","keywords":"add ssh key ssh-keygen ed25519 authorize public key puttygen ssh access turbostack","text":"# Add an SSH key\n\nTo open a shell or transfer files over SSH File Transfer Protocol (SFTP), you authorize an SSH key on\nyour host. TurboStack uses public-key authentication: you keep a private key, and you add the matching\npublic key to the host. This page shows how to create a keypair (if you do not have one) and how to\nauthorize it.\n\nWe recommend the **ed25519** key type. It is secure and fast, and it is the default across the\nplatform. Any OpenSSH-compatible key type also works."} {"id":"technologies/ssh/add-an-ssh-key.md#step-1-generate-a-keypair","url":"https://docs.turbostack.app/technologies/ssh/add-an-ssh-key/#step-1-generate-a-keypair","path":"technologies/ssh/add-an-ssh-key.md","title":"Add an SSH key","heading":"Step 1: Generate a keypair","keywords":"add ssh key ssh-keygen ed25519 authorize public key puttygen ssh access turbostack","text":"If you already have a public key you want to use, skip to Step 2.\nOtherwise choose one of the methods below."} {"id":"technologies/ssh/add-an-ssh-key.md#mac-linux-or-windows-subsystem-for-linux-recommended","url":"https://docs.turbostack.app/technologies/ssh/add-an-ssh-key/#mac-linux-or-windows-subsystem-for-linux-recommended","path":"technologies/ssh/add-an-ssh-key.md","title":"Add an SSH key","heading":"Mac, Linux, or Windows Subsystem for Linux (recommended)","keywords":"add ssh key ssh-keygen ed25519 authorize public key puttygen ssh access turbostack","text":"Run `ssh-keygen` in a terminal:\n\n```bash\nssh-keygen -t ed25519 -C \"user@example.com\"\n```\n\n- `-t ed25519` selects the ed25519 algorithm.\n- `-C \"user@example.com\"` adds a comment so you can identify the key later.\n\nYou are prompted to:\n\n- Choose where to save the key. Press `Enter` to accept the default `~/.ssh/id_ed25519`.\n- Set a passphrase. This is optional but recommended - it protects the private key if it is stolen.\n\nYou now have two files:\n\n- `id_ed25519` - your private key. Never share it.\n- `id_ed25519.pub` - your public key. This is the one you add to the host.\n\nPrint the public key so you can copy it:\n\n```bash\ncat ~/.ssh/id_ed25519.pub\n```"} {"id":"technologies/ssh/add-an-ssh-key.md#windows-with-putty","url":"https://docs.turbostack.app/technologies/ssh/add-an-ssh-key/#windows-with-putty","path":"technologies/ssh/add-an-ssh-key.md","title":"Add an SSH key","heading":"Windows with PuTTY","keywords":"add ssh key ssh-keygen ed25519 authorize public key puttygen ssh access turbostack","text":"If you use PuTTY, generate the key with PuTTYgen:\n\n1. Download PuTTY from the official source if you do not have it.\n2. Open **PuTTYgen** (`puttygen.exe`).\n3. Under **Parameters**, select **EdDSA**, the Edwards-curve Digital Signature Algorithm (Ed25519 is\n the default curve).\n4. Click **Generate** and move your mouse over the blank area to add randomness.\n5. Copy the **public key** shown at the top of the window.\n6. Click **Save private key** to store the private key (set a passphrase if you want).\n\n> [!NOTE]\n> If a tool needs the private key in OpenSSH format, use **Conversions > Export OpenSSH key** in\n> PuTTYgen and save it."} {"id":"technologies/ssh/add-an-ssh-key.md#step-2-add-your-key-to-the-host","url":"https://docs.turbostack.app/technologies/ssh/add-an-ssh-key/#step-2-add-your-key-to-the-host","path":"technologies/ssh/add-an-ssh-key.md","title":"Add an SSH key","heading":"Step 2: Add your key to the host","keywords":"add ssh key ssh-keygen ed25519 authorize public key puttygen ssh access turbostack","text":"Authorize the public key in the TurboStack interface:\n\n1. Open your host.\n2. Go to the **SSH** tab.\n3. Paste your **public key** into the keys field.\n4. Click **Save & Publish**.\n\nTurboStack writes the authorized key for you - there is no need to edit any file on the server by\nhand. Once published, you can connect over SSH with your private key.\n\n> [!TIP]\n> To grant the same key on many hosts at once, add it at the **group** level instead. Member hosts\n> inherit group keys automatically. See Configure SSH for the `ssh_keys` setting and\n> group inheritance."} {"id":"technologies/ssh/add-an-ssh-key.md#on-cpanel-and-directadmin-hosts","url":"https://docs.turbostack.app/technologies/ssh/add-an-ssh-key/#on-cpanel-and-directadmin-hosts","path":"technologies/ssh/add-an-ssh-key.md","title":"Add an SSH key","heading":"On cPanel and DirectAdmin hosts","keywords":"add ssh key ssh-keygen ed25519 authorize public key puttygen ssh access turbostack","text":"The flow above covers the default TurboStack host. If your host runs the cPanel or DirectAdmin\ncontrol panel, add the key through the panel's own SSH-key manager instead:\n\n- **cPanel:** go to **Security > SSH Access > Manage SSH Keys**, import your public key, then\n authorize it.\n- **DirectAdmin:** open the **SSH Keys** menu, add your public key, and make sure it is enabled."} {"id":"technologies/ssh/add-an-ssh-key.md#related","url":"https://docs.turbostack.app/technologies/ssh/add-an-ssh-key/#related","path":"technologies/ssh/add-an-ssh-key.md","title":"Add an SSH key","heading":"Related","keywords":"add ssh key ssh-keygen ed25519 authorize public key puttygen ssh access turbostack","text":"- Configure SSH\n- What is SSH?\n- Host SSH tab\n- Security hardening"} {"id":"technologies/ssh/configure.md#intro","url":"https://docs.turbostack.app/technologies/ssh/configure/","path":"technologies/ssh/configure.md","title":"Configure SSH on TurboStack","heading":"","keywords":"configure ssh turbostack ssh yaml ssh keys ssh port password authentication","text":"# Configure SSH on TurboStack\n\nAuthorize keys and set the SSH options for a host so your team can open shell and\nSSH File Transfer Protocol (SFTP) sessions securely."} {"id":"technologies/ssh/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/ssh/configure/#where-to-configure-it","path":"technologies/ssh/configure.md","title":"Configure SSH on TurboStack","heading":"Where to configure it","keywords":"configure ssh turbostack ssh yaml ssh keys ssh port password authentication","text":"SSH is configured at the **host** level:\n\n1. Open the host.\n2. Go to the **SSH** tab.\n3. Add authorized public keys and adjust the port and password-authentication\n options.\n\nKeys set at the group level are inherited by member hosts."} {"id":"technologies/ssh/configure.md#required","url":"https://docs.turbostack.app/technologies/ssh/configure/#required","path":"technologies/ssh/configure.md","title":"Configure SSH on TurboStack","heading":"Required","keywords":"configure ssh turbostack ssh yaml ssh keys ssh port password authentication","text":"| Key | Meaning |\n|---|---|\n| `ssh_keys` | List of authorized public keys allowed to open SSH/SFTP sessions on the host. |"} {"id":"technologies/ssh/configure.md#optional","url":"https://docs.turbostack.app/technologies/ssh/configure/#optional","path":"technologies/ssh/configure.md","title":"Configure SSH on TurboStack","heading":"Optional","keywords":"configure ssh turbostack ssh yaml ssh keys ssh port password authentication","text":"| Key | Meaning |\n|---|---|\n| `ssh_port` | The TCP port SSH listens on. |\n| `ssh_passwords` | Whether to allow password authentication. Recommended: keep disabled (`false`). |\n\n```yaml\n# Host-level: authorized keys, custom port, key-only auth\nssh_keys:\n - \"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... alice@example.com\"\nssh_port: 22\nssh_passwords: false\n```\n\n> [!TIP]\n> Keep `ssh_passwords` set to `false` and rely on `ssh_keys` for authentication.\n> Shared keys can be defined once at the group level and inherited by every host."} {"id":"technologies/ssh/configure.md#related","url":"https://docs.turbostack.app/technologies/ssh/configure/#related","path":"technologies/ssh/configure.md","title":"Configure SSH on TurboStack","heading":"Related","keywords":"configure ssh turbostack ssh yaml ssh keys ssh port password authentication","text":"- What is SSH?\n- Host SSH tab\n- Security hardening"} {"id":"technologies/ssh/what-is.md#intro","url":"https://docs.turbostack.app/technologies/ssh/what-is/","path":"technologies/ssh/what-is.md","title":"What is SSH?","heading":"","keywords":"what is ssh ssh hosting ssh turbostack secure shell sftp access","text":"# What is SSH?\n\nSSH (Secure Shell) is the standard protocol for secure, encrypted access to a\nserver. On TurboStack it gives you a **shell** for running commands on a host and\n**SSH File Transfer Protocol (SFTP)** for transferring files, all over an encrypted connection.\n\nAccess is granted with **public-key authentication**: you upload your public key,\nkeep the matching private key safe, and SSH verifies you without ever sending a\npassword. This is both more convenient and far more secure than password logins."} {"id":"technologies/ssh/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/ssh/what-is/#on-turbostack","path":"technologies/ssh/what-is.md","title":"What is SSH?","heading":"On TurboStack","keywords":"what is ssh ssh hosting ssh turbostack secure shell sftp access","text":"SSH access is configured at the **host** level, with optional inheritance from\nthe group.\n\n- You authorize access by adding **public keys** to a host. Each authorized key\n can open a shell or SFTP session.\n- SSH keys can also be set at the group level and are inherited by member\n hosts, so you can grant a team access across many hosts in one place.\n- You can change the **SSH listening port** and choose whether to allow\n **password authentication** - which we recommend keeping disabled in favor\n of keys.\n\n> [!TIP]\n> Set common keys at the group level so every host in the group inherits them,\n> and reserve per-host keys for access that should not apply group-wide."} {"id":"technologies/ssh/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/ssh/what-is/#best-practices","path":"technologies/ssh/what-is.md","title":"What is SSH?","heading":"Best practices","keywords":"what is ssh ssh hosting ssh turbostack secure shell sftp access","text":"- Use **key-based authentication** and keep password authentication disabled.\n- Protect your private keys with a passphrase and never share them.\n- Grant access per person with their own key, so you can revoke individuals\n cleanly.\n- Manage shared team access at the group level and let hosts inherit it.\n- Remove keys promptly when someone no longer needs access."} {"id":"technologies/ssh/what-is.md#related","url":"https://docs.turbostack.app/technologies/ssh/what-is/#related","path":"technologies/ssh/what-is.md","title":"What is SSH?","heading":"Related","keywords":"what is ssh ssh hosting ssh turbostack secure shell sftp access","text":"- Configure SSH on TurboStack\n- Host SSH tab\n- Security hardening"} {"id":"technologies/system-services/manage-user-services.md#intro","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"# How to manage user system services\n\nThis page shows how to run a long-lived process as a systemd user service under your system user.\nYou will create the service, start and stop it, keep it running after you log out, and read its\nlogs. For what these services are and which applications use them, see\nWhat are user system services?.\n\nsystemd is a native alternative to tools like supervisord or PM2. It integrates with the system, gives\nyou full logs through `journalctl`, and needs no root access when you run it as a user service."} {"id":"technologies/system-services/manage-user-services.md#before-you-start","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/#before-you-start","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"Before you start","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"- **Secure Shell (SSH) access to the host** - see SSH access. Run\n every command below as your system user; no root access is needed.\n- The command your service should run (for example a worker or consumer command from your\n application)."} {"id":"technologies/system-services/manage-user-services.md#create-a-service","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/#create-a-service","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"Create a service","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"Create a unit file at `~/.config/systemd/user/.service`, where `~` is your system user's home\ndirectory. This example runs a worker and restarts it if it stops:\n\n```ini\n[Unit]\nDescription=My worker\nAfter=network-online.target\nStartLimitIntervalSec=0\n\n[Service]\nType=simple\nWorkingDirectory=%h/public_html\nExecStart=%h/public_html/bin/worker\nRestart=always\nRestartSec=10s\n\n[Install]\nWantedBy=default.target\n```\n\n- `%h` is your home directory, so the same unit works for any system user.\n- `Restart=always` with `RestartSec=10s` restarts the process 10 seconds after it stops.\n\n> [!TIP]\n> `StartLimitIntervalSec=0` lets systemd keep retrying every `RestartSec` instead of giving up after\n> repeated fast failures."} {"id":"technologies/system-services/manage-user-services.md#start-enable-and-check-it","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/#start-enable-and-check-it","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"Start, enable and check it","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"After creating or changing a unit file, reload systemd, then enable and start the service:\n\n```bash\nsystemctl --user daemon-reload\nsystemctl --user enable --now my-worker.service # enable at login + start now\nsystemctl --user status my-worker.service # check it is active\n```"} {"id":"technologies/system-services/manage-user-services.md#keep-it-running-after-you-log-out","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/#keep-it-running-after-you-log-out","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"Keep it running after you log out","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"By default, user services stop when your last session ends. Enable lingering once so they keep\nrunning after you close SSH and start again after a reboot:\n\n```bash\nloginctl enable-linger\n```"} {"id":"technologies/system-services/manage-user-services.md#read-the-logs","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/#read-the-logs","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"Read the logs","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"Each service logs to the systemd journal. Read or follow it with:\n\n```bash\njournalctl --user -u my-worker.service # recent logs\njournalctl --user -u my-worker.service -f # follow live\njournalctl --user -u my-worker.service --since \"5 minutes ago\"\n```\n\nTo scan a template unit's instances for fatal errors, match the service name with a wildcard and\nfilter the output:\n\n```bash\njournalctl --user -u \"my-worker@*\" --no-pager -n 1000 | grep -i FATAL\n```"} {"id":"technologies/system-services/manage-user-services.md#stop-restart-or-remove-a-service","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/#stop-restart-or-remove-a-service","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"Stop, restart or remove a service","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"```bash\nsystemctl --user restart my-worker.service # after a code change\nsystemctl --user stop my-worker.service # stop, keep it enabled\nsystemctl --user disable --now my-worker.service # stop and disable at login\n```"} {"id":"technologies/system-services/manage-user-services.md#run-many-instances-from-one-template","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/#run-many-instances-from-one-template","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"Run many instances from one template","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"When you need several copies of the same service (for example one message-queue consumer per queue),\nuse a template unit. Add an `@` to the file name and use `%i` for the instance value:\n\n```ini\n# ~/.config/systemd/user/my-worker@.service\nExecStart=%h/public_html/bin/worker %i\n```\n\nEnable one service per instance; the value after `@` is passed as `%i`:\n\n```bash\nsystemctl --user enable --now my-worker@queue1.service\nsystemctl --user enable --now my-worker@queue2.service\n```"} {"id":"technologies/system-services/manage-user-services.md#scale-throughput-with-more-instances","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/#scale-throughput-with-more-instances","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"Scale throughput with more instances","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"A single worker processes one message at a time. Running several in parallel drains a queue faster.\nThis helps when a backlog builds up, for example during a large import or a sales campaign.\n\nThere are two ways to add capacity:\n\n- **More instances:** run the same worker two, four or more times in parallel, one service per\n instance.\n- **More threads:** some workers take a thread or process count flag instead (for example\n `--threads=4`). The same total limit below applies.\n\nAdd capacity by enabling more instances:\n\n```bash\nsystemctl --user enable --now my-worker@1.service\nsystemctl --user enable --now my-worker@2.service\n```\n\nRemove capacity by disabling the extra services when the backlog is gone, to free processor time for\nthe site:\n\n```bash\nsystemctl --user disable --now my-worker@2.service\n```\n\n> [!WARNING]\n> Never run more parallel workers than the host has processor cores, and keep a safe margin below\n> that number. Background workers compete with PHP, the web server and the database for the same\n> cores. Too many workers cause high load and can make the whole server slow or unresponsive.\n\nCheck how many cores the host has:\n\n```bash\nnproc\n```\n\nStart with one or two workers. Measure how fast the queue drains and watch the host load on the\nHealth tab, then add one worker at a time. On a 4-core host, keep\nthe total at or below 2 to 3 background workers so the site keeps enough processor time. If the queue\nstill cannot keep up with a safe number of workers, scale up the host instead of adding more."} {"id":"technologies/system-services/manage-user-services.md#application-examples","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/#application-examples","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"Application examples","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"The examples below are template units (note the `@` in the file name and `%i`/`%I` for the instance\nvalue). Adjust `WorkingDirectory` and the PHP binary version to match your setup.\n\n> [!NOTE]\n> On TurboStack, PHP binaries are at `/usr/bin/php` - for example `/usr/bin/php8.0` or\n> `/usr/bin/php8.3`. The default `php` command also points at the host's main version. There is no\n> `/usr/local/phpNN` path.\n\n**Laravel queue worker** - `~/.config/systemd/user/laravel-queue@.service`:\n\n```ini\n[Unit]\nDescription=Laravel queue worker (#%i)\nAfter=network-online.target\nStartLimitIntervalSec=0\n\n[Service]\nType=simple\nWorkingDirectory=%h/public_html\nExecStart=/usr/bin/php8.3 %h/public_html/artisan queue:work --env=prod\nRestart=always\nRestartSec=10s\n\n[Install]\nWantedBy=default.target\n```\n\n**CraftCMS queue runner** - `~/.config/systemd/user/craftcms-queue@.service`:\n\n```ini\n[Unit]\nDescription=CraftCMS queue runner (#%i)\nAfter=network-online.target\nStartLimitIntervalSec=0\n\n[Service]\nType=simple\nWorkingDirectory=%h/public_html\nExecStart=/usr/bin/php8.3 %h/public_html/craft queue/listen\nExecReload=/bin/kill -SIGABRT $MAINPID\nRestart=always\nRestartSec=10s\n\n[Install]\nWantedBy=default.target\n```\n\nFor CraftCMS, also disable `runQueueAutomatically` in the general config so the queue is not run\ninside web requests.\n\n**Magento message-queue consumer** - `~/.config/systemd/user/magento-consumer@.service`:\n\n```ini\n[Unit]\nDescription=Magento consumer (%i)\nAfter=network-online.target\nStartLimitIntervalSec=0\n\n[Service]\nType=simple\nWorkingDirectory=%h/public_html\nExecStart=/usr/bin/php8.3 %h/public_html/bin/magento queue:consumers:start %I --single-thread --max-messages=10000\nRestart=always\nRestartSec=10s\n\n[Install]\nWantedBy=default.target\n```\n\nHere `%I` is the consumer name, so one template serves every queue. `--single-thread` runs one\nthread per process and `--max-messages=10000` restarts the process periodically to keep memory in\ncheck. Enable one service per consumer:\n\n```bash\nsystemctl --user enable --now magento-consumer@product_action_attribute.update.service\nsystemctl --user status magento-consumer@sales.rule.update.coupon.usage.service\n```\n\nFor a worked example, see the Magento message-queue consumers in\nMagento best practices."} {"id":"technologies/system-services/manage-user-services.md#related","url":"https://docs.turbostack.app/technologies/system-services/manage-user-services/#related","path":"technologies/system-services/manage-user-services.md","title":"How to manage user system services","heading":"Related","keywords":"systemctl --user systemd unit file enable-linger journalctl restart service template unit background worker","text":"- What are user system services?\n- Application file layout and permissions\n- How to keep a Node.js app running\n- SSH access"} {"id":"technologies/system-services/what-is.md#intro","url":"https://docs.turbostack.app/technologies/system-services/what-is/","path":"technologies/system-services/what-is.md","title":"What are user system services?","heading":"","keywords":"systemd user service systemctl background process queue worker message queue consumer enable-linger","text":"# What are user system services?\n\nA user system service is a long-lived process that TurboStack runs for you under your own system user, managed by systemd (the Linux service manager). It starts on its own, restarts if it crashes, and can keep running after you log out - without any root access.\n\nMany applications need a process that stays running in the background: a message-queue consumer, a queue worker, a scheduled-job runner, or the application server itself. If that process stops, work stops piling up or the site returns a 502 error. A user system service keeps it running and restarts it automatically."} {"id":"technologies/system-services/what-is.md#how-it-works-on-turbostack","url":"https://docs.turbostack.app/technologies/system-services/what-is/#how-it-works-on-turbostack","path":"technologies/system-services/what-is.md","title":"What are user system services?","heading":"How it works on TurboStack","keywords":"systemd user service systemctl background process queue worker message queue consumer enable-linger","text":"- Each service is described by a unit file under `~/.config/systemd/user/`, where `~` is your system user's home directory (for example `/var/www/prod/`).\n- You manage services with `systemctl --user` over Secure Shell (SSH). No root access is needed, because the services run as your system user.\n- Logs go to the systemd journal, which you read with `journalctl --user`.\n- `loginctl enable-linger` lets your services keep running after you close your SSH session and start again after a reboot.\n\nFor the exact commands to create, start, stop and inspect a service, see How to manage user system services."} {"id":"technologies/system-services/what-is.md#which-applications-use-them","url":"https://docs.turbostack.app/technologies/system-services/what-is/#which-applications-use-them","path":"technologies/system-services/what-is.md","title":"What are user system services?","heading":"Which applications use them","keywords":"systemd user service systemctl background process queue worker message queue consumer enable-linger","text":"Background processing differs per application. These are the common cases on TurboStack:\n\n| Application | What runs as a user service |\n| --- | --- |\n| Magento | Message-queue consumers (indexing, emails, order processing) |\n| Shopware | Message-queue consumers and the scheduled-task runner |\n| Odoo | The Odoo application server itself |\n| Akeneo | Job-queue consumers (imports, exports, maintenance) |\n| Laravel | Queue workers |\n| Craft CMS | The queue listener |\n| OroCommerce | Message-queue consumers |\n| Medusa | The Node.js application process (or run it under pm2) |\n| nopCommerce | The .NET application service |\n\n> [!NOTE]\n> A dedicated Node.js process is often run under the pm2 process manager instead. See How to keep a Node.js app running for when to pick pm2 over a systemd service."} {"id":"technologies/system-services/what-is.md#related","url":"https://docs.turbostack.app/technologies/system-services/what-is/#related","path":"technologies/system-services/what-is.md","title":"What are user system services?","heading":"Related","keywords":"systemd user service systemctl background process queue worker message queue consumer enable-linger","text":"- How to manage user system services\n- SSH access\n- Application file layout and permissions\n- How to keep a Node.js app running"} {"id":"technologies/turboshield/configure.md#intro","url":"https://docs.turbostack.app/technologies/turboshield/configure/","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"# Configure TurboShield on TurboStack\n\nTurboShield is enabled by default with sensible settings. This page describes every setting, so you\ncan adjust it when the defaults do not fit your traffic. For what each mechanism actually does, see\nWhat is TurboShield?."} {"id":"technologies/turboshield/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/turboshield/configure/#where-to-configure-it","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"Where to configure it","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"TurboShield is configured at the **host** level and applies to every application on that host:\n\n1. Open the host.\n2. Go to the **Security** tab.\n3. Find the **TurboShield** section, then enable it and choose a protection level.\n\nThe GUI exposes the settings you need most often. The remaining settings are available in the\nSource (YAML) view, grouped under the `turboshield` key.\n\n> [!TIP]\n> Change one setting at a time and check your logs afterwards. Rate limits interact, so a large\n> change in several settings at once makes it hard to see which one caused an effect."} {"id":"technologies/turboshield/configure.md#basic-settings","url":"https://docs.turbostack.app/technologies/turboshield/configure/#basic-settings","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"Basic settings","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"| Key | Default | Values | What it does |\n|---|---|---|---|\n| `turboshield.enabled` | `true` | `true` / `false` | Turns TurboShield on for the host. Setting it to `false` removes the protection completely. |\n| `turboshield.level` | `medium` | `low`, `medium`, `high`, `attack` | The protection level. Tunes all limits at once and unlocks the attack-only mechanisms. |\n\n```yaml\nturboshield:\n enabled: true\n level: medium\n```"} {"id":"technologies/turboshield/configure.md#what-each-level-actually-does","url":"https://docs.turbostack.app/technologies/turboshield/configure/#what-each-level-actually-does","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"What each level actually does","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"The level is a single dial over several limits. Use this table when you need to know what you are\nchanging, rather than guessing between `medium` and `high`.\n\n| | `low` | `medium` (default) | `high` | `attack` |\n|---|---|---|---|---|\n| Strictly-limited bots | 6 req/s | 2 req/s | 1 req/s | 1 req/s |\n| Any single visitor | 60 req/s | 40 req/s | 30 req/s | 20 req/s |\n| Burst allowance | 800 | 600 | 400 | 250 |\n| Simultaneous connections per visitor | 160 | 120 | 80 | 60 |\n| Excess requests | queued, then refused | refused immediately | refused immediately | refused immediately |\n| Distributed-attack detection | - | - | - | active |\n| Disguised-browser blocking | - | - | - | active |\n| Outdated-browser blocking | - | - | - | active |\n| Ban duration | standard | standard | standard | longer |\n\n> [!NOTE]\n> The per-visitor limits look high compared to the bot limits on purpose. A real browser opens\n> many connections and requests dozens of files for a single page view, so the general limit must\n> allow that while the bot limits stay strict."} {"id":"technologies/turboshield/configure.md#bot-lists","url":"https://docs.turbostack.app/technologies/turboshield/configure/#bot-lists","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"Bot lists","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"TurboShield ships with a curated classification of hundreds of known bots, and merges in a large\ncommunity-maintained list of known bad bots on top of it. Two lists let you override that\nclassification for individual bots. Each entry is a piece of the bot's name, in lowercase.\n\n| Key | Effect | When to use it |\n|---|---|---|\n| `turboshield.allow_bots` | Never throttled | A crawler your business depends on, such as a price-comparison or marketplace feed |\n| `turboshield.limit_bots` | Strictly throttled | A crawler that is costing you capacity, such as an AI training or scraping bot |\n\n```yaml\nturboshield:\n allow_bots: [channable]\n limit_bots: [bytespider, gptbot]\n```\n\nBoth lists are editable in the GUI: **Allowed Bots** and **Extra limited bots**, on the host's\n**Security** tab, in the **TurboShield** section under **Advanced Settings**. Each list is a table\nof names:\n\n1. Click **Add Allow Bots** or **Add Limit Bots** to add a row.\n2. Type the name, or the part of the name you want to match, and click **Save**.\n3. Use **Edit** to change an existing entry and **Delete** to remove it.\n\n> [!TIP]\n> Rate-limiting a bot with `limit_bots` is especially helpful when it ignores the\n> `crawl-delay` directive in your `robots.txt` and keeps hammering the site regardless.\n\n> [!NOTE]\n> An entry you add always wins over the built-in classification, and allowing beats limiting. So a\n> bot you put in **Allowed Bots** keeps running even when the built-in lists would have throttled\n> it.\n\nNeed a bot treated somewhere between these two, or blocked outright? Ask\nSupport - there are finer gradations available than the two lists\nabove."} {"id":"technologies/turboshield/configure.md#trusted-clients","url":"https://docs.turbostack.app/technologies/turboshield/configure/#trusted-clients","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"Trusted clients","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"This is the most important list on the page. Addresses on it bypass **every** TurboShield check,\nare never rate-limited or challenged, and can never be banned automatically. The same list is also\napplied at the network firewall.\n\n| Key | Values | What it does |\n|---|---|---|\n| `firewall_whitelist` | List of addresses or ranges | Marks sources as fully trusted, across TurboShield and the Firewall |\n\n```yaml\nfirewall_whitelist:\n - 203.0.113.10 # office\n - 198.51.100.0/24 # partner integration\n```\n\nUse it for:\n\n- **Your own office or virtual private network (VPN)**, so your team is never affected by\n protection meant for strangers.\n- **Partner and supplier integrations** that poll frequently, such as an ERP, PIM or feed exporter.\n- **External monitoring** and uptime checks, which by nature look like a repetitive bot.\n- **Load and security testing** you run yourself, which otherwise looks exactly like an attack.\n\n> [!WARNING]\n> A trusted address skips all protection. Only add addresses you control or genuinely trust, and\n> keep the list short. Never add a broad public range.\n\nHosted Power's own monitoring addresses are always trusted automatically, and you do not need to\nadd them."} {"id":"technologies/turboshield/configure.md#bot-challenge","url":"https://docs.turbostack.app/technologies/turboshield/configure/#bot-challenge","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"Bot challenge","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"The bot challenge asks suspicious visitors to complete an automatic browser check before they reach\nyour site. It is off by default. See what it does.\n\n| Key | Default | Values | What it does |\n|---|---|---|---|\n| `turboshield.bot_protection` | `false` | `true` / `false` | Turns the bot challenge on. Requires Nginx. |\n\n```yaml\nturboshield:\n bot_protection: true\n```\n\nSome clients cannot solve a browser check at all, so **whole categories of requests are never\nchallenged**: APIs, webhooks, payment callbacks, health checks and the standard endpoints of the\ncommon applications are excluded automatically.\n\nThe challenge also weighs *how* a page is being requested. Filtering, searching and sorting are the\nexpensive operations that scrapers abuse, so a request that carries one of those counts as more\nsuspicious. TurboShield already recognises the parameter names the common shop platforms use for\nthis.\n\n> [!TIP]\n> Turning the challenge on and finding that one of your own integrations now gets a page it cannot\n> pass? Or a filter page that is not being scored the way you expect because your theme uses its\n> own parameter names? Both are fixable - send Support the exact URL\n> and they will add the exception for your environment."} {"id":"technologies/turboshield/configure.md#when-a-level-does-not-fit-your-traffic","url":"https://docs.turbostack.app/technologies/turboshield/configure/#when-a-level-does-not-fit-your-traffic","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"When a level does not fit your traffic","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"Pick a different `level` first - that is the intended way to change how strict TurboShield is, and\nit is what almost every environment uses.\n\nIf the ladder genuinely does not fit, there are lower-level overrides for the individual rates,\nbursts and connection limits. They are not documented here because getting them wrong either\nremoves your protection or blocks real visitors. Contact Support with\nwhat you are seeing, and they will set the right value for your environment.\n\n> [!TIP]\n> When the problem is one specific client - your own integration, a monitoring service, an agency\n> IP - add it to `firewall_whitelist` instead. That solves the case without loosening the limits\n> for everyone."} {"id":"technologies/turboshield/configure.md#which-lists-matter-most","url":"https://docs.turbostack.app/technologies/turboshield/configure/#which-lists-matter-most","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"Which lists matter most","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"If you only maintain one thing, maintain the first row.\n\n| List | Why it matters |\n|---|---|\n| `firewall_whitelist` | Prevents your own team, integrations and monitoring from ever being blocked. The single most common cause of a \"we are locked out\" support ticket. |\n| `turboshield.limit_bots` | Your lever against crawlers that consume capacity without bringing customers. |\n| `turboshield.allow_bots` | Protects the crawlers your revenue depends on, such as marketplace and comparison feeds. |"} {"id":"technologies/turboshield/configure.md#full-example","url":"https://docs.turbostack.app/technologies/turboshield/configure/#full-example","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"Full example","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"```yaml\n# Host-level security configuration\nfirewall_whitelist:\n - 203.0.113.10 # office\n - 198.51.100.0/24 # partner integration\n\nturboshield:\n enabled: true\n level: medium\n\n # Bot policy\n allow_bots: [channable]\n limit_bots: [bytespider, gptbot]\n\n # Bot challenge, for a site under scraping pressure\n bot_protection: true\n```\n\nPublish the host to apply the change."} {"id":"technologies/turboshield/configure.md#related","url":"https://docs.turbostack.app/technologies/turboshield/configure/#related","path":"technologies/turboshield/configure.md","title":"Configure TurboShield on TurboStack","heading":"Related","keywords":"configure turboshield turbostack turboshield yaml rate limiting bot protection http 429 allow list trusted clients bot challenge","text":"- What is TurboShield?\n- Host Security tab\n- Firewall - ports, networks and country rules\n- Security overview\n- Block an IP address"} {"id":"technologies/turboshield/what-is.md#intro","url":"https://docs.turbostack.app/technologies/turboshield/what-is/","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"# What is TurboShield?\n\nTurboShield is TurboStack's built-in protection layer for web traffic. It sits in front of every\napplication on a host and inspects each request before your application code sees it. It decides\nwhether a visitor is a normal user, a useful bot, an unwanted crawler, or an attacker, and responds\naccordingly - from letting the request through untouched, to slowing it down, to blocking the\nsource for a while.\n\nTurboShield is enabled by default and runs at the **host** level, so it protects every application\non that host."} {"id":"technologies/turboshield/what-is.md#why-it-exists","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#why-it-exists","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"Why it exists","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"A public application is visited by far more than customers. It is also crawled by search engines,\nscraped by price-comparison and AI training bots, probed by automated vulnerability scanners, and\noccasionally targeted by a real attack. Handling all of that inside your application is slow and\nexpensive: every request that reaches your code costs processor time, database queries and memory.\n\nTurboShield filters that traffic at the edge, so your server spends its capacity on real visitors."} {"id":"technologies/turboshield/what-is.md#how-turboshield-protects-your-site","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#how-turboshield-protects-your-site","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"How TurboShield protects your site","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"TurboShield is not one filter but several independent mechanisms. They all run together, and each\none catches something the others cannot."} {"id":"technologies/turboshield/what-is.md#1-rate-limiting","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#1-rate-limiting","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"1. Rate limiting","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"TurboShield counts how many requests and how many simultaneous connections each visitor makes. A\nvisitor who asks for far more than a human possibly could is slowed down, and beyond a hard ceiling\ntheir excess requests are refused with an **HTTP 429 (\"Too Many Requests\")**.\n\nThis runs continuously, not only during an attack. It is the always-on floor of protection that\nstops one visitor, or one badly written bot, from consuming all your server capacity.\n\n> [!IMPORTANT]\n> Being rate-limited is **not** the same as being banned. A 429 is temporary and recovers by\n> itself as soon as the visitor slows down. Rate limiting never escalates into a block. Only\n> unmistakable attack behavior leads to a ban, so a busy but legitimate visitor is never locked out."} {"id":"technologies/turboshield/what-is.md#2-bot-classification","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#2-bot-classification","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"2. Bot classification","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"Every request states who it is (its user agent). TurboShield sorts that claim into four classes,\neach with its own limits:\n\n| Class | Treatment | Typical examples |\n|---|---|---|\n| **Allowed** | Never throttled | Search engines, uptime monitors |\n| **Friendly** | Lightly throttled | Useful but non-essential crawlers |\n| **Limited** | Strictly throttled | Scraping, SEO and AI training crawlers |\n| **Blocked** | Denied, at the strictest level | Crawlers you never want |\n\nThis lets search engines index your site at full speed while crawlers that only cost you capacity\nare held back. Human visitors are unaffected."} {"id":"technologies/turboshield/what-is.md#3-search-engine-verification","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#3-search-engine-verification","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"3. Search-engine verification","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"Scrapers routinely claim to be a search engine to escape bot limits. TurboShield only believes that\nclaim when the request also comes from that search engine's officially published address ranges,\nwhich it keeps up to date automatically.\n\nReal search engines keep their fast lane. A scraper pretending to be one does not, and at the\nstrictest protection level is refused outright."} {"id":"technologies/turboshield/what-is.md#4-trusted-clients","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#4-trusted-clients","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"4. Trusted clients","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"Addresses you mark as trusted skip every TurboShield check. This is the one setting to use for your\nown office, a partner integration, or an external monitoring service that must never be slowed down\nor blocked. See trusted clients.\n\nTurboShield also recognizes a number of well-known integrations by their request pattern, so common\nplatform connectors keep working without configuration."} {"id":"technologies/turboshield/what-is.md#5-known-exploit-blocking","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#5-known-exploit-blocking","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"5. Known-exploit blocking","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"When a vulnerability becomes publicly known, attackers begin scanning for it within hours - often\nlong before every site has installed the fix. TurboShield recognizes the specific request shapes\nthat exploit such vulnerabilities and refuses them before they reach your application.\n\nThis acts as a temporary patch at the network edge. It protects you during the window between a\nvulnerability becoming public and your application being updated. It does not replace updating your\napplication."} {"id":"technologies/turboshield/what-is.md#6-attack-detection-and-temporary-bans","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#6-attack-detection-and-temporary-bans","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"6. Attack detection and temporary bans","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"This is the layer that recognizes attack *behavior* rather than volume. TurboShield continuously\nreads your server's access logs and looks for patterns that a single request never reveals:\n\n- Probing for injection and cross-site-scripting weaknesses.\n- Scanning for sensitive files such as configuration files, backups or version-control data.\n- Hunting for known vulnerabilities and previously planted backdoors.\n- Repeated failed logins against administration panels, SSH and FTP.\n\nWhen a source shows this behavior, TurboShield bans it temporarily. The ban applies both at the web\nserver and at the network firewall, so the source is cut off from every service, not just the\napplication. Confirmed exploit attempts get a long ban; weaker behavioral signals get a short one.\n\nTwo properties matter here:\n\n- The ban uses the **real visitor address**, so it still works correctly when your site sits behind\n a content delivery network.\n- **Every ban expires automatically.** Repeat offenders are banned for longer, but nothing is ever\n blocked permanently by automated detection alone. A false positive is always time-limited."} {"id":"technologies/turboshield/what-is.md#7-shared-reputation","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#7-shared-reputation","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"7. Shared reputation","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"Besides what it observes on your own server, TurboShield checks incoming addresses against\ncontinuously updated lists of sources already known to be malicious elsewhere. An attacker that has\nbeen active against other sites is blocked on their very first request to yours."} {"id":"technologies/turboshield/what-is.md#8-bot-challenge-optional","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#8-bot-challenge-optional","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"8. Bot challenge (optional)","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"For sites that suffer from scraping or credential stuffing spread across many addresses, you can\nswitch on the **bot challenge**. Suspicious visitors first receive a short automatic browser check,\nsimilar to the \"checking your browser\" page you may know from large networks. A real browser solves\nit in a fraction of a second and is then remembered for a few hours. A script pays a real\ncomputational cost on every single request, which makes large-scale automated abuse uneconomical.\n\nThe challenge is deliberately independent of the protection level. It activates based on the actual\nload on your server combined with how suspicious each request looks, so a quiet site under attack is\nstill protected and a busy healthy site is not bothered with needless checks.\n\nInterfaces that cannot solve a browser check - APIs, webhooks, payment callbacks and health checks -\nare excluded automatically, and you can add your own exceptions. See\nbot challenge.\n\n> [!NOTE]\n> The bot challenge is off by default and only applies to hosts running Nginx. Turn it on when you\n> actually have a bot problem that rate limiting alone does not solve."} {"id":"technologies/turboshield/what-is.md#9-distributed-attack-detection-strictest-level-only","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#9-distributed-attack-detection-strictest-level-only","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"9. Distributed attack detection (strictest level only)","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"A modern scraping attack spreads across hundreds of addresses that each send only a handful of\nrequests, so no single address ever reaches a rate limit. At the `attack` level TurboShield also\ngroups traffic by its technical fingerprint rather than by address, which reveals such a swarm and\nthrottles it as a whole.\n\nAt the same level TurboShield also detects clients that claim to be a normal browser but contradict\nthemselves technically, which is a reliable sign of disguised automation.\n\nNormal browsing within your site is explicitly excluded from these checks, so adding to a cart or\ncompleting a checkout is never affected."} {"id":"technologies/turboshield/what-is.md#protection-levels","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#protection-levels","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"Protection levels","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"One setting, the **protection level**, tunes how aggressive the limits are. The default is\n`medium`. The mechanisms above run at every level - the level changes their thresholds, and unlocks\nthe two attack-only mechanisms.\n\n| Level | Use it for | Effect |\n|---|---|---|\n| `low` | Sites with heavy legitimate automation | Most permissive; excess requests are queued rather than refused |\n| `medium` (default) | Normal production traffic | Balanced; suits almost every site |\n| `high` | Sustained bot pressure | Noticeably stricter limits |\n| `attack` | An attack happening right now | Strictest limits, plus distributed-attack and disguised-browser detection, and longer bans |\n\n> [!TIP]\n> Stay on `medium` unless you have a reason not to. Raise the level while an incident is running\n> and lower it again afterwards. Running permanently at `attack` can affect legitimate visitors and\n> API clients."} {"id":"technologies/turboshield/what-is.md#how-turboshield-relates-to-the-other-security-features","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#how-turboshield-relates-to-the-other-security-features","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"How TurboShield relates to the other security features","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"| Feature | What it does |\n|---|---|\n| **TurboShield** | Inspects and filters web traffic, and blocks attacking sources |\n| **Firewall** | Controls which ports and networks can reach the server at all, including country rules |\n| **TurboRadar** | Finds and reports problems (intrusions, vulnerable dependencies, malware) rather than blocking them |\n\nTurboShield and the Firewall work together: the trusted-client list is shared between them, and\nTurboShield enforces its bans through the same firewall."} {"id":"technologies/turboshield/what-is.md#related","url":"https://docs.turbostack.app/technologies/turboshield/what-is/#related","path":"technologies/turboshield/what-is.md","title":"What is TurboShield?","heading":"Related","keywords":"what is turboshield turboshield hosting turboshield turbostack rate limiting bot protection attack detection web application protection","text":"- Configure TurboShield - all settings and lists\n- Host Security tab\n- Security overview\n- Firewall"} {"id":"technologies/varnish/clear-the-cache.md#intro","url":"https://docs.turbostack.app/technologies/varnish/clear-the-cache/","path":"technologies/varnish/clear-the-cache.md","title":"How to clear the Varnish cache","heading":"","keywords":"clear Varnish cache purge Varnish flush full page cache tscli varnish clear varnish reload stale pages magento cache","text":"# How to clear the Varnish cache\n\nVarnish serves a full-page cache of rendered HTML. Clear it when visitors could be\nseeing stale pages - for example right after a deploy or a content change that the application did not\npurge on its own."} {"id":"technologies/varnish/clear-the-cache.md#clear-the-cache-with-the-turbostack-cli","url":"https://docs.turbostack.app/technologies/varnish/clear-the-cache/#clear-the-cache-with-the-turbostack-cli","path":"technologies/varnish/clear-the-cache.md","title":"How to clear the Varnish cache","heading":"Clear the cache with the TurboStack CLI","keywords":"clear Varnish cache purge Varnish flush full page cache tscli varnish clear varnish reload stale pages magento cache","text":"Connect over SSH and run:\n\n```bash\ntscli varnish clear\n```\n\nThis empties the **entire** full-page cache for the host. The next requests are served from your\napplication until the cache refills, so expect a short performance dip.\n\n> [!NOTE]\n> `tscli varnish clear` empties the cache; `tscli varnish reload` is different - it validates and\n> reloads the Varnish Configuration Language (VCL) after you change a rule (see\n> Exclude pages from the cache)."} {"id":"technologies/varnish/clear-the-cache.md#prefer-your-application-s-own-purge","url":"https://docs.turbostack.app/technologies/varnish/clear-the-cache/#prefer-your-application-s-own-purge","path":"technologies/varnish/clear-the-cache.md","title":"How to clear the Varnish cache","heading":"Prefer your application's own purge","keywords":"clear Varnish cache purge Varnish flush full page cache tscli varnish clear varnish reload stale pages magento cache","text":"A full clear is a blunt instrument. Applications that integrate with Varnish (for example Magento)\npurge only the pages that changed when you update content, which is far less disruptive than emptying\neverything. Use `tscli varnish clear` when you need a clean slate, or when the application cannot\npurge on its own."} {"id":"technologies/varnish/clear-the-cache.md#after-clearing","url":"https://docs.turbostack.app/technologies/varnish/clear-the-cache/#after-clearing","path":"technologies/varnish/clear-the-cache.md","title":"How to clear the Varnish cache","heading":"After clearing","keywords":"clear Varnish cache purge Varnish flush full page cache tscli varnish clear varnish reload stale pages magento cache","text":"The first hits are slower while Varnish rebuilds the cache. Warm the important pages by visiting them,\nor let your sitemap or a crawler do it, before judging performance."} {"id":"technologies/varnish/clear-the-cache.md#related","url":"https://docs.turbostack.app/technologies/varnish/clear-the-cache/#related","path":"technologies/varnish/clear-the-cache.md","title":"How to clear the Varnish cache","heading":"Related","keywords":"clear Varnish cache purge Varnish flush full page cache tscli varnish clear varnish reload stale pages magento cache","text":"- Configure Varnish\n- Exclude pages from the Varnish cache\n- What is Varnish?\n- Clear the Redis cache\n- Why is my site slow?\n- TurboStack CLI - `tscli varnish clear` and `tscli varnish reload`"} {"id":"technologies/varnish/configure.md#intro","url":"https://docs.turbostack.app/technologies/varnish/configure/","path":"technologies/varnish/configure.md","title":"Configure Varnish on TurboStack","heading":"","keywords":"configure Varnish turbostack Varnish yaml varnish_enabled varnish_cache_size varnish_customvcl","text":"# Configure Varnish on TurboStack\n\nEnable Varnish full-page caching for an application and, where needed, tune the cache\nsize, custom VCL, and Varnish type at the host level."} {"id":"technologies/varnish/configure.md#where-to-configure-it","url":"https://docs.turbostack.app/technologies/varnish/configure/#where-to-configure-it","path":"technologies/varnish/configure.md","title":"Configure Varnish on TurboStack","heading":"Where to configure it","keywords":"configure Varnish turbostack Varnish yaml varnish_enabled varnish_cache_size varnish_customvcl","text":"Varnish is enabled per application. Open the application, go to **Configure application >\nTechnologies > Varnish**, and turn it on.\n\nHost-level tuning lives with the host. Open the host and go to the **Advanced >\nVarnish Options** tab to adjust the cache size, custom VCL, and Varnish type."} {"id":"technologies/varnish/configure.md#required","url":"https://docs.turbostack.app/technologies/varnish/configure/#required","path":"technologies/varnish/configure.md","title":"Configure Varnish on TurboStack","heading":"Required","keywords":"configure Varnish turbostack Varnish yaml varnish_enabled varnish_cache_size varnish_customvcl","text":"| Key | Meaning |\n| --- | --- |\n| `varnish_enabled` | Enables Varnish full-page caching for the application (`true`). |"} {"id":"technologies/varnish/configure.md#optional","url":"https://docs.turbostack.app/technologies/varnish/configure/#optional","path":"technologies/varnish/configure.md","title":"Configure Varnish on TurboStack","heading":"Optional","keywords":"configure Varnish turbostack Varnish yaml varnish_enabled varnish_cache_size varnish_customvcl","text":"| Key | Meaning |\n| --- | --- |\n| `varnish_cache_size` | Cache memory size. Auto-sized by default (host advanced option). |\n| `varnish_customvcl` | Custom VCL for expert use cases (host advanced option). |\n| `varnish_version` | Pins the version. You almost never set this: enabling Varnish on an application installs it, and the platform picks the version. Setting it is overridden as soon as any application has `varnish_enabled`. |\n| `varnish_type` | `opensource` (the default) or `enterprise`. |\n| `varnish_modules` | Installs the extra module set alongside open-source Varnish. On by default. |\n| `varnish_backend_host` | Sends cache misses to another server instead of the local application. |\n| `varnish_backend_port` | The port on that server. Required together with `varnish_backend_host`. |\n\n```yaml\n# Per-application application configuration\nvarnish_enabled: true\n# Host advanced options (override only if needed):\n# varnish_cache_size is auto-sized\n# varnish_customvcl: |\n# # expert-only custom VCL\n# varnish_type: enterprise # needs a license token\n# varnish_backend_host: 10.0.0.7 # both keys or neither\n# varnish_backend_port: \"8080\"\n```"} {"id":"technologies/varnish/configure.md#open-source-or-enterprise","url":"https://docs.turbostack.app/technologies/varnish/configure/#open-source-or-enterprise","path":"technologies/varnish/configure.md","title":"Configure Varnish on TurboStack","heading":"Open source or Enterprise","keywords":"configure Varnish turbostack Varnish yaml varnish_enabled varnish_cache_size varnish_customvcl","text":"`varnish_type` selects the edition, and the two are not interchangeable underneath: the\nopen-source build keeps the cache in memory (`malloc`), while Enterprise uses its own storage\nengine. **Enterprise needs a license token**; without one the deployment stops with an error.\n\n> [!WARNING]\n> Switching `varnish_type` on a host that already runs Varnish uninstalls the current edition\n> before installing the other one. The cache is empty afterwards, so expect a period of slower\n> responses while it fills up again. Plan the switch outside peak hours.\n\n`varnish_modules` installs a set of extra VMODs, and is on unless you turn it off. It applies to\nthe open-source edition only - Enterprise ships its own modules and ignores the key. Leave it on if\nyour custom VCL calls anything beyond the built-in functions."} {"id":"technologies/varnish/configure.md#sending-misses-to-another-backend","url":"https://docs.turbostack.app/technologies/varnish/configure/#sending-misses-to-another-backend","path":"technologies/varnish/configure.md","title":"Configure Varnish on TurboStack","heading":"Sending misses to another backend","keywords":"configure Varnish turbostack Varnish yaml varnish_enabled varnish_cache_size varnish_customvcl","text":"By default Varnish forwards a cache miss to the application on the same host. Set\n`varnish_backend_host` **and** `varnish_backend_port` together to point it somewhere else, for\nexample at an application server in a split setup. Setting only one of the two changes nothing:\nboth must be filled in before the custom backend is written.\n\n> [!WARNING]\n> `varnish_customvcl` is for experts only - a mistake can cache the wrong content\n> or break the storefront. Leave `varnish_cache_size` auto-sized unless you have\n> a specific reason to change it."} {"id":"technologies/varnish/configure.md#the-default-vcl-structure","url":"https://docs.turbostack.app/technologies/varnish/configure/#the-default-vcl-structure","path":"technologies/varnish/configure.md","title":"Configure Varnish on TurboStack","heading":"The default VCL structure","keywords":"configure Varnish turbostack Varnish yaml varnish_enabled varnish_cache_size varnish_customvcl","text":"TurboStack loads a top-level `default.vcl` that pulls in the backend definition, the\naccess-control list, and any additional VCL files. It also declares the standard Varnish\nsubroutines - `vcl_recv`, `vcl_backend_response` and `vcl_deliver` - where request and\nresponse handling happens:\n\n```vcl\nvcl 4.1;\nimport std;\n\ninclude \"/etc/varnish/backend.vcl\";\ninclude \"/etc/varnish/acl.vcl\";\n\ninclude +glob \"/etc/varnish/conf.d/*.vcl\";\n\nsub vcl_recv {\n # Happens before we check if we have this in cache already.\n #\n # Typically you clean up the request here, removing cookies you don't need,\n # rewriting the request, etc.\n}\n\nsub vcl_backend_response {\n # Happens after we have read the response headers from the backend.\n #\n # Here you clean the response headers, removing silly Set-Cookie headers\n # and other mistakes your backend does.\n}\n\nsub vcl_deliver {\n # Happens when we have all the pieces we need, and are about to send the\n # response to the client.\n #\n # You can do accounting or modifying the final object here.\n}\n```\n\nEvery `.vcl` file under `/etc/varnish/conf.d` is loaded in alphabetical order, so custom\nfiles are prefixed with an index to control their load order (lower indexes load first)."} {"id":"technologies/varnish/configure.md#common-tasks","url":"https://docs.turbostack.app/technologies/varnish/configure/#common-tasks","path":"technologies/varnish/configure.md","title":"Configure Varnish on TurboStack","heading":"Common tasks","keywords":"configure Varnish turbostack Varnish yaml varnish_enabled varnish_cache_size varnish_customvcl","text":"- clear the Varnish cache\n- exclude pages from the Varnish cache"} {"id":"technologies/varnish/configure.md#related","url":"https://docs.turbostack.app/technologies/varnish/configure/#related","path":"technologies/varnish/configure.md","title":"Configure Varnish on TurboStack","heading":"Related","keywords":"configure Varnish turbostack Varnish yaml varnish_enabled varnish_cache_size varnish_customvcl","text":"- What is Varnish?\n- Host Advanced tab\n- Performance tuning\n- TurboStack CLI - clear the cache with `tscli varnish clear`"} {"id":"technologies/varnish/exclude-pages-from-cache.md#intro","url":"https://docs.turbostack.app/technologies/varnish/exclude-pages-from-cache/","path":"technologies/varnish/exclude-pages-from-cache.md","title":"How to exclude pages from the Varnish cache","heading":"","keywords":"exclude Varnish bypass full page cache no cache checkout Varnish exclusions vcl_recv return pass","text":"# How to exclude pages from the Varnish cache\n\nSome pages must never be served from a shared full-page cache - the cart, checkout, customer account\nand admin - because they are personalized or change on every request. Caching them would risk showing\none visitor another visitor's page."} {"id":"technologies/varnish/exclude-pages-from-cache.md#what-varnish-already-skips","url":"https://docs.turbostack.app/technologies/varnish/exclude-pages-from-cache/#what-varnish-already-skips","path":"technologies/varnish/exclude-pages-from-cache.md","title":"How to exclude pages from the Varnish cache","heading":"What Varnish already skips","keywords":"exclude Varnish bypass full page cache no cache checkout Varnish exclusions vcl_recv return pass","text":"You usually do not need to configure anything:\n\n- Varnish only caches **GET** and **HEAD** requests, and by default does **not** cache requests that\n carry cookies - so logged-in and checkout traffic already bypasses the cache.\n- TurboStack ships an app-aware Varnish Configuration Language (VCL) for supported\n storefronts (Magento, Shopware) that already bypasses the admin, cart and checkout.\n\nAdd your own rule only for a custom path the built-in configuration does not cover."} {"id":"technologies/varnish/exclude-pages-from-cache.md#add-a-custom-exclusion","url":"https://docs.turbostack.app/technologies/varnish/exclude-pages-from-cache/#add-a-custom-exclusion","path":"technologies/varnish/exclude-pages-from-cache.md","title":"How to exclude pages from the Varnish cache","heading":"Add a custom exclusion","keywords":"exclude Varnish bypass full page cache no cache checkout Varnish exclusions vcl_recv return pass","text":"The supported way to add your own rule is the `varnish_customvcl` key (a host advanced option, set in\nthe GUI under **Advanced > Varnish Options** or in the YAML view). Put\nyour `vcl_recv` rule in it:\n\n```yaml\nvarnish_customvcl: |\n sub vcl_recv {\n # Never cache these paths - send them straight to the backend\n if (req.url ~ \"^/(my-account|api/live)\") {\n return (pass);\n }\n }\n```\n\n`return (pass)` tells Varnish to skip the cache and go straight to your application for matching\nrequests. Publish the change to apply it. See\nConfigure Varnish for the full list of Varnish keys.\n\n> [!WARNING]\n> Custom VCL is for expert use - a wrong rule can cache the wrong content or break the storefront.\n> Match paths precisely and test before relying on it.\n\n> [!NOTE]\n> Behind the scenes, VCL loads from `/etc/varnish/conf.d/` in alphabetical order (the platform's own\n> rules load from a `50`-prefixed file). When `varnish_customvcl` is set, the platform renders an\n> editable `50_main.vcl.sample` on the host for reference. Do not create files there by hand over SSH:\n> route your rule through `varnish_customvcl` so it survives a redeploy."} {"id":"technologies/varnish/exclude-pages-from-cache.md#verify-a-page-is-not-cached","url":"https://docs.turbostack.app/technologies/varnish/exclude-pages-from-cache/#verify-a-page-is-not-cached","path":"technologies/varnish/exclude-pages-from-cache.md","title":"How to exclude pages from the Varnish cache","heading":"Verify a page is not cached","keywords":"exclude Varnish bypass full page cache no cache checkout Varnish exclusions vcl_recv return pass","text":"Request the page twice and look at the `Age` response header. A cached response shows a non-zero `Age`\nthat grows on repeat requests; an excluded page stays at `Age: 0` every time:\n\n```bash\ncurl -sI https://www.example.com/my-account | grep -i age\n```"} {"id":"technologies/varnish/exclude-pages-from-cache.md#related","url":"https://docs.turbostack.app/technologies/varnish/exclude-pages-from-cache/#related","path":"technologies/varnish/exclude-pages-from-cache.md","title":"How to exclude pages from the Varnish cache","heading":"Related","keywords":"exclude Varnish bypass full page cache no cache checkout Varnish exclusions vcl_recv return pass","text":"- Configure Varnish\n- Clear the Varnish cache\n- What is Varnish?\n- Performance tuning"} {"id":"technologies/varnish/what-is.md#intro","url":"https://docs.turbostack.app/technologies/varnish/what-is/","path":"technologies/varnish/what-is.md","title":"What is Varnish?","heading":"","keywords":"what is Varnish Varnish hosting Varnish turbostack full page cache Varnish magento","text":"# What is Varnish?\n\nVarnish is an HTTP reverse proxy that sits in front of your web server and\nserves a full-page cache. When a page can be cached, Varnish stores the\nrendered HTML in memory and serves subsequent requests directly - without ever\ntouching PHP or the database. This reduces response times and server load on\nread-heavy sites.\n\nFor storefronts such as Magento, Shopware and WooCommerce, this keeps the site fast under heavy\ntraffic, which matters most during campaigns and sales peaks.\n\nBecause Varnish caches whole pages, it is most effective for storefronts where\nmany visitors see the same anonymous pages (product and category listings, the\nhome page). It uses a configuration language called VCL to decide what to cache,\nwhat to bypass, and when to purge."} {"id":"technologies/varnish/what-is.md#on-turbostack","url":"https://docs.turbostack.app/technologies/varnish/what-is/#on-turbostack","path":"technologies/varnish/what-is.md","title":"What is Varnish?","heading":"On TurboStack","keywords":"what is Varnish Varnish hosting Varnish turbostack full page cache Varnish magento","text":"Varnish is provided as a per-application technology with broker-level tuning at the\nhost.\n\n- You enable Varnish for an application in the application configuration. TurboStack\n then provisions and manages it for that site.\n- Varnish listens on port **6081** by default. Requests reach Varnish first, and it\n serves them from cache or forwards them to the web server behind it.\n- TurboStack ships an **app-aware VCL** tuned for PHP storefronts: it\n bypasses the admin and cart, keeps logged-in and checkout traffic dynamic,\n and supports cache purging from the application.\n- It is intended for PHP storefronts - primarily Magento and Shopware, and\n optionally WordPress.\n- Host-level tuning lives under **Advanced > Varnish Options**, where you can set\n the cache size (auto-sized), provide custom VCL, and choose the Varnish type\n (OpenSource or Enterprise).\n\n> [!WARNING]\n> Do not put Varnish in front of Node.js applications or Odoo. Its full-page\n> caching is built for PHP storefronts and will break apps that expect every\n> request to reach the backend."} {"id":"technologies/varnish/what-is.md#best-practices","url":"https://docs.turbostack.app/technologies/varnish/what-is/#best-practices","path":"technologies/varnish/what-is.md","title":"What is Varnish?","heading":"Best practices","keywords":"what is Varnish Varnish hosting Varnish turbostack full page cache Varnish magento","text":"- Use Varnish for high-traffic, read-heavy PHP storefronts where anonymous\n visitors see the same pages.\n- Rely on the TurboStack app-aware VCL rather than hand-writing rules - it\n already bypasses admin and cart and supports purging.\n- Make sure your application issues cache purges on content changes so visitors\n do not see stale pages.\n- Leave the cache size auto-sized unless you have a clear reason to override it.\n- Only reach for custom VCL when you have an expert use case; mistakes there can\n cache the wrong content."} {"id":"technologies/varnish/what-is.md#related","url":"https://docs.turbostack.app/technologies/varnish/what-is/#related","path":"technologies/varnish/what-is.md","title":"What is Varnish?","heading":"Related","keywords":"what is Varnish Varnish hosting Varnish turbostack full page cache Varnish magento","text":"- Configure Varnish on TurboStack\n- Performance tuning"} {"id":"technologies/vpn/configure.md#intro","url":"https://docs.turbostack.app/technologies/vpn/configure/","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"# Configure VPN\n\nBoth Virtual Private Network (VPN) types are configured in the host's YAML configuration. For the\ndifference between them and how to choose, see What is a VPN on TurboStack?.\n\n> [!IMPORTANT]\n> VPN settings are only available in the **Source (YAML)** view of the host - there are no fields for\n> them in the platform interface yet. Open the host, switch to the Source view, add the configuration\n> below, then **Save and publish** to apply it. Plan the change with\n> Support: the settings must match what the remote side uses, and a\n> wrong value leaves the tunnel down."} {"id":"technologies/vpn/configure.md#ipsec-vpn-site-to-site","url":"https://docs.turbostack.app/technologies/vpn/configure/#ipsec-vpn-site-to-site","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"IPsec VPN (site-to-site)","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"An IPsec tunnel is defined as a list under `ipsecvpn_connections`. Each entry is one tunnel to one\nremote gateway, and each tunnel carries one or more subnet pairs.\n\n```yaml\nipsecvpn_connections:\n - name: cloud-to-office\n keyexchange: ikev2\n local_gw: 94.237.45.100 # public IP of this TurboStack host\n remote_gw: 84.198.149.130 # public IP of the remote gateway\n psk: \"\"\n phase1_proposal: \"aes256-sha1-modp1536!\"\n phase1_lifetime: 86400s\n phase2_proposal: \"aes256-sha1\"\n phase2_lifetime: 3600s\n dpd: hold\n dpd_delay: 30s\n dpd_timeout: 120s\n pfs: \"no\"\n subnets:\n - local: 192.168.205.0/24\n remote: 192.168.1.0/24\n```"} {"id":"technologies/vpn/configure.md#connection-fields","url":"https://docs.turbostack.app/technologies/vpn/configure/#connection-fields","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"Connection fields","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"| Field | Required | What it does |\n| --- | --- | --- |\n| `name` | yes | A short name for the tunnel. It identifies the connection in the configuration and in logs. |\n| `keyexchange` | yes | The key-exchange protocol. Use `ikev2` unless the remote side only supports the older `ikev1`. |\n| `local_gw` | yes | The public IP address of this host - the local end of the tunnel. |\n| `remote_gw` | yes | The public IP address of the gateway at the other side. |\n| `subnets` | yes | The subnet pairs allowed through the tunnel. Each entry has a `local` and a `remote` network in Classless Inter-Domain Routing (CIDR) notation. |\n| `psk` | yes in practice | The pre-shared key: the shared secret both sides authenticate with. It must be identical on both ends. |\n| `phase1_proposal` | yes in practice | The encryption, integrity and Diffie-Hellman group for the key exchange, for example `aes256-sha1-modp1536!`. A trailing `!` means \"only this proposal, do not negotiate anything weaker\". |\n| `phase2_proposal` | yes in practice | The encryption and integrity for the data itself, for example `aes256-sha1`. |\n| `phase1_lifetime` | yes in practice | How long the key-exchange session stays valid before it is renegotiated, for example `86400s` (24 hours). |\n| `phase2_lifetime` | yes in practice | How long the data keys stay valid, for example `3600s` (1 hour). |\n| `dpd` | no | Dead Peer Detection: what to do when the other side stops answering. `hold` keeps the tunnel definition and re-establishes on the next matching traffic. Leave it out, or use `none`, to switch the check off. |\n| `dpd_delay` | with `dpd` | How often to check that the peer is still alive, for example `30s`. |\n| `dpd_timeout` | with `dpd` | How long to wait before the peer counts as gone, for example `120s`. |\n| `pfs` | no | Perfect Forward Secrecy. With `\"yes\"` the keys are renegotiated from scratch on rekey, so a compromised key cannot expose earlier traffic. Use `\"yes\"` when the remote side supports it. |\n| `monitoring_endpoints` | no | A list of IP addresses at the remote side that TurboStack Monitoring checks through the tunnel, so you are alerted when the far end becomes unreachable. |\n\n> [!WARNING]\n> The `psk` is a shared secret. Treat it like a password: agree on it over a secure channel and do not\n> reuse it between tunnels. Ask Support if you prefer not to place it in\n> the host configuration yourself."} {"id":"technologies/vpn/configure.md#matching-both-sides","url":"https://docs.turbostack.app/technologies/vpn/configure/#matching-both-sides","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"Matching both sides","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"An IPsec tunnel only comes up when both gateways propose the same parameters. `keyexchange`,\n`phase1_proposal`, `phase2_proposal`, the lifetimes, `pfs` and the `psk` must be agreed with whoever\nmanages the remote gateway. The subnet pairs must mirror each other: what is `local` here is `remote`\nthere.\n\nThe tunnel is established on demand: as soon as traffic matches one of the configured subnet pairs,\nthe connection is set up. Only the listed subnet pairs are routed through the tunnel - traffic to any\nother destination keeps its normal route."} {"id":"technologies/vpn/configure.md#several-subnets-or-several-tunnels","url":"https://docs.turbostack.app/technologies/vpn/configure/#several-subnets-or-several-tunnels","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"Several subnets or several tunnels","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"Add more entries under `subnets` to reach more networks over the same tunnel, and more entries under\n`ipsecvpn_connections` to build tunnels to more locations:\n\n```yaml\nipsecvpn_connections:\n - name: cloud-to-office\n keyexchange: ikev2\n local_gw: 94.237.45.100\n remote_gw: 84.198.149.130\n psk: \"\"\n phase1_proposal: \"aes256-sha256-modp2048!\"\n phase1_lifetime: 28800s\n phase2_proposal: \"aes256-sha256-ecp521!\"\n phase2_lifetime: 3600s\n dpd: hold\n dpd_delay: 30s\n dpd_timeout: 120s\n pfs: \"yes\"\n subnets:\n - local: 192.168.205.0/24\n remote: 192.168.1.0/24\n - local: 192.168.205.0/24\n remote: 192.168.254.0/24\n - name: cloud-to-datacenter\n keyexchange: ikev2\n local_gw: 94.237.45.100\n remote_gw: 203.0.113.10\n psk: \"\"\n phase1_proposal: \"aes256-sha1-modp1536!\"\n phase1_lifetime: 86400s\n phase2_proposal: \"aes256-sha1\"\n phase2_lifetime: 3600s\n dpd: hold\n dpd_delay: 30s\n dpd_timeout: 120s\n pfs: \"no\"\n subnets:\n - local: 192.168.205.0/24\n remote: 10.20.0.0/16\n```"} {"id":"technologies/vpn/configure.md#ssl-vpn-remote-access","url":"https://docs.turbostack.app/technologies/vpn/configure/#ssl-vpn-remote-access","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"SSL VPN (remote access)","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"The Secure Sockets Layer (SSL) VPN is configured as a single `sslvpn` block. Only the values you set are overridden; the\nrest keeps its platform default. A working setup needs three things: switch it on, give it a hostname,\nand list the users.\n\n```yaml\nsslvpn:\n enabled: true\n hostname: vpn.example.com # FQDN that points to this host\n users:\n - alice\n - bob\n```\n\n| Field | Required | What it does |\n| --- | --- | --- |\n| `enabled` | yes | Switches the SSL VPN service on. |\n| `hostname` | yes | The Fully Qualified Domain Name (FQDN) users connect to. It is also the name on the Transport Layer Security (TLS) certificate, so it must resolve to this host before you publish. |\n| `users` | yes | The list of user names that may connect. Each user gets a personal password, which Hosted Power stores in the platform's secret store - ask Support to set or reset one. |\n| `tcp_port` / `udp_port` | no | The port the service listens on. Both default to `4443`. The client uses the faster datagram path when possible and falls back to the TCP port when the network blocks it. |\n| `dns_servers` | no | The name servers pushed to connected clients. Defaults to `8.8.8.8` and `1.1.1.1`. |\n| `default_domain` | no | The search domain pushed to clients, so short names resolve. |\n| `ipv4_network` / `ipv4_netmask` / `ipv4_network_cidr` | no | The address pool that connected clients receive an address from. Defaults to `172.30.30.0/24`. Change it when it overlaps with a network you route. |\n| `max_clients` | no | Maximum number of connected clients. Defaults to `128`. |\n| `max_same_clients` | no | How many sessions one user may have at the same time. `0` means no limit. |\n| `predictable_ips` | no | Gives a user the same VPN address each time, which is useful when you allow-list those addresses somewhere. |"} {"id":"technologies/vpn/configure.md#split-tunnel-or-full-tunnel","url":"https://docs.turbostack.app/technologies/vpn/configure/#split-tunnel-or-full-tunnel","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"Split tunnel or full tunnel","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"This is the most important choice for an SSL VPN: **which of the user's traffic goes through the\ntunnel**. It is controlled by `split_tunnel` together with `networks`.\n\n**Split tunnel** (`split_tunnel: true`) sends only the networks you list through the VPN. Everything\nelse - the user's browsing, video calls, cloud tools - keeps going out over their own internet\nconnection.\n\n```yaml\nsslvpn:\n enabled: true\n hostname: vpn.example.com\n users: [alice, bob]\n split_tunnel: true\n networks:\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n```\n\nThe `networks` list is pushed to the client as routes, and it is also what the host allows between\nthe VPN pool and those networks. The default list covers the private address ranges, which is a safe\nstarting point; narrow it to the subnets you actually want reachable.\n\n**Full tunnel** (`split_tunnel: false`) sends *all* of the user's traffic through the VPN, including\ntheir normal internet traffic. The host then also needs an outbound interface for that traffic, which\nis set with `nat_interface` (the platform fills in the host's main interface when you leave it empty).\n\n```yaml\nsslvpn:\n enabled: true\n hostname: vpn.example.com\n users: [alice, bob]\n split_tunnel: false\n```\n\nHow to choose:\n\n| | Split tunnel | Full tunnel |\n| --- | --- | --- |\n| **Traffic through the VPN** | Only the listed networks | Everything the user sends |\n| **Speed and bandwidth** | Better - normal internet traffic takes the direct route | All traffic makes a detour over the host |\n| **The user's public IP** | Their own internet connection | The host's IP address |\n| **IP allow-listing** | Does not help - the user keeps their own changing IP | Works - everyone leaves from the same known IP |\n| **Privacy for the user** | Their private browsing stays off your network | Their full internet traffic passes your server |\n| **Best for** | Reaching a few internal services with the least impact | Enforcing that people leave from one trusted address |\n\n> [!TIP]\n> The usual reason to pick a full tunnel is IP allow-listing: everyone connected leaves the internet\n> from the host's address, so you can allow that single address on the\n> Firewall or in a third-party service, instead of chasing the changing\n> home addresses of every user. If you do not need that, a split tunnel is lighter and faster.\n\n> [!WARNING]\n> With a full tunnel, all of the user's internet traffic runs over your server. Check that this is\n> acceptable for your users and that the host has the bandwidth for it, and be aware that a VPN\n> outage then takes the user fully offline instead of only losing access to internal services."} {"id":"technologies/vpn/configure.md#timeouts-limits-and-protection","url":"https://docs.turbostack.app/technologies/vpn/configure/#timeouts-limits-and-protection","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"Timeouts, limits and protection","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"These have sensible defaults. Change them only for a specific reason.\n\n| Field | Default | What it does |\n| --- | --- | --- |\n| `keepalive` | `300` | Seconds between keepalive messages that hold the session open. |\n| `dpd` / `mobile_dpd` | `60` / `300` | Seconds before an unresponsive client is considered gone. Mobile clients get more time because they change networks. |\n| `idle_timeout` / `mobile_idle_timeout` | `1200` / `1800` | Seconds of inactivity before a session is closed. |\n| `auth_timeout` | `240` | Seconds a user has to finish logging in. |\n| `min_reauth_time` | `300` | Seconds a user must wait before retrying after a failed login. |\n| `max_ban_score` / `ban_reset_time` | `80` / `300` | Brute-force protection: failed attempts add to a score, and the source is blocked when it passes the maximum. The score resets after the reset time. |\n| `cookie_timeout` | `300` | Seconds a session may be resumed after a short network interruption. |\n| `deny_roaming` | `false` | When `true`, a session may not continue from a different IP address. |\n| `rekey_time` | `172800` | Seconds before the session keys are renewed. |"} {"id":"technologies/vpn/configure.md#certificate","url":"https://docs.turbostack.app/technologies/vpn/configure/#certificate","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"Certificate","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"By default the platform requests and renews a Let's Encrypt certificate for `hostname`\n(`tls_manage: true`). For this to work, `hostname` must point to the host and a web server must be\nrunning on it, because the certificate is validated over HTTP.\n\nTo use your own certificate instead, switch off the automatic handling and point to the files:\n\n```yaml\nsslvpn:\n enabled: true\n hostname: vpn.example.com\n users: [alice]\n tls_manage: false\n server_cert: /etc/ssl/certs/vpn.example.com.crt\n server_key: /etc/ssl/private/vpn.example.com.key\n```"} {"id":"technologies/vpn/configure.md#connecting","url":"https://docs.turbostack.app/technologies/vpn/configure/#connecting","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"Connecting","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"Users connect to `https://:4443` with a VPN client that supports the OpenConnect protocol,\nusing their user name and the password Hosted Power set for them. Clients are available for Windows,\nmacOS, Linux, Android and iOS."} {"id":"technologies/vpn/configure.md#apply-the-changes","url":"https://docs.turbostack.app/technologies/vpn/configure/#apply-the-changes","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"Apply the changes","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"VPN settings are applied when the host is published. Save the YAML, then **Save and publish** the\nhost - see Publishing. Ask\nSupport to confirm the tunnel is up, or to check the far side when it\nis not."} {"id":"technologies/vpn/configure.md#related","url":"https://docs.turbostack.app/technologies/vpn/configure/#related","path":"technologies/vpn/configure.md","title":"Configure VPN","heading":"Related","keywords":"ipsecvpn_connections sslvpn split_tunnel ipsec configuration ssl vpn users vpn yaml site-to-site remote access","text":"- What is a VPN on TurboStack?\n- Firewall\n- SSH access\n- Networking\n- Publishing\n- Support"} {"id":"technologies/vpn/what-is.md#intro","url":"https://docs.turbostack.app/technologies/vpn/what-is/","path":"technologies/vpn/what-is.md","title":"What is a VPN on TurboStack?","heading":"","keywords":"vpn ipsec vpn ssl vpn site-to-site remote access split tunnel tunnel private network","text":"# What is a VPN on TurboStack?\n\nA Virtual Private Network (VPN) creates an encrypted tunnel over the public internet, so traffic that\ntravels through it is private and the two ends can reach each other as if they were on the same\nnetwork. TurboStack supports two kinds of VPN - an Internet Protocol Security (IPsec) VPN and a\nSecure Sockets Layer (SSL) VPN - and they solve different problems:\n\n| | IPsec VPN | SSL VPN |\n| --- | --- | --- |\n| **Connects** | One network to another network | One person to your network |\n| **Also called** | Site-to-site | Remote access, client-to-site |\n| **Who connects** | The servers themselves, permanently | An individual user, when they need it |\n| **Client software** | None - the tunnel is built between the two gateways | A VPN client on the laptop or phone |\n| **Identity** | A shared secret between the two sites | A personal user account per person |\n| **Typical use** | Reach a database or an application in your office or data center | Let a developer or supplier reach a private service |"} {"id":"technologies/vpn/what-is.md#ipsec-vpn-site-to-site","url":"https://docs.turbostack.app/technologies/vpn/what-is/#ipsec-vpn-site-to-site","path":"technologies/vpn/what-is.md","title":"What is a VPN on TurboStack?","heading":"IPsec VPN (site-to-site)","keywords":"vpn ipsec vpn ssl vpn site-to-site remote access split tunnel tunnel private network","text":"An IPsec VPN is a permanent tunnel between two gateways: your TurboStack host on one side, and the\nfirewall or router of another location on the other side (for example your office, a data center, or\na partner). Once it is up, the machines on both sides reach each other over their internal addresses.\n\nYou define which subnets may talk to each other. Only traffic between those subnets goes through the\ntunnel. Nobody has to log in and no software is installed on individual machines: the two gateways\nkeep the tunnel available, and it carries traffic as soon as a connection matches one of the\nconfigured subnet pairs.\n\nUse it when a **system** needs a permanent, unattended connection - for example your application on\nTurboStack must query a database that stays in your own data center."} {"id":"technologies/vpn/what-is.md#ssl-vpn-remote-access","url":"https://docs.turbostack.app/technologies/vpn/what-is/#ssl-vpn-remote-access","path":"technologies/vpn/what-is.md","title":"What is a VPN on TurboStack?","heading":"SSL VPN (remote access)","keywords":"vpn ipsec vpn ssl vpn site-to-site remote access split tunnel tunnel private network","text":"An SSL VPN gives **people** a way in. Each user gets a personal account and connects from a laptop or\nphone with a VPN client, over an encrypted Transport Layer Security (TLS) connection. When they are\nconnected, they can reach the private networks you allow, and they disconnect when they are done.\n\nBecause the connection is per user, you can add and remove access per person, and you always know\nwho was connected. The connection runs over a single hostname and port, which works from most\nnetworks, including guest Wi-Fi and mobile networks.\n\nUse it when a **person** needs occasional access - for example an external developer who must reach a\nprivate administration interface that is not published on the internet."} {"id":"technologies/vpn/what-is.md#which-one-do-you-need","url":"https://docs.turbostack.app/technologies/vpn/what-is/#which-one-do-you-need","path":"technologies/vpn/what-is.md","title":"What is a VPN on TurboStack?","heading":"Which one do you need?","keywords":"vpn ipsec vpn ssl vpn site-to-site remote access split tunnel tunnel private network","text":"- **A system must always be reachable, on both sides, without anyone logging in** - use an IPsec VPN.\n- **A person needs to reach something private, now and then** - use an SSL VPN.\n- **Both** - that is fine, they are independent. A common combination is an IPsec tunnel to the office\n for application traffic, plus an SSL VPN so staff can also connect from home.\n\n> [!NOTE]\n> A VPN is not the only way to reach a private service. For a single administrator on a single\n> server, SSH access is usually simpler. To restrict who may reach a public\n> service, the Firewall allow-list is often enough. A VPN is the right tool\n> when whole networks or several private services must be reachable."} {"id":"technologies/vpn/what-is.md#how-it-is-set-up","url":"https://docs.turbostack.app/technologies/vpn/what-is/#how-it-is-set-up","path":"technologies/vpn/what-is.md","title":"What is a VPN on TurboStack?","heading":"How it is set up","keywords":"vpn ipsec vpn ssl vpn site-to-site remote access split tunnel tunnel private network","text":"Both VPN types are configured in the host's YAML configuration - see\nConfigure VPN. There are no fields for this in the platform interface yet, so the\nsettings are written in the Source (YAML) view of the host.\n\nThe values on both ends must match, and the remote side is usually managed by someone else (your own\nnetwork team, or the party you connect to). Plan a VPN together with\nSupport: they can confirm the parameters your counterpart proposes and\nhelp you get the tunnel up."} {"id":"technologies/vpn/what-is.md#related","url":"https://docs.turbostack.app/technologies/vpn/what-is/#related","path":"technologies/vpn/what-is.md","title":"What is a VPN on TurboStack?","heading":"Related","keywords":"vpn ipsec vpn ssl vpn site-to-site remote access split tunnel tunnel private network","text":"- Configure VPN\n- SSH access\n- Firewall\n- Networking\n- Support"} {"id":"troubleshooting/database-issues.md#intro","url":"https://docs.turbostack.app/troubleshooting/database-issues/","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"# Database connection and performance problems\n\nDatabase trouble shows up in two main ways: the application cannot connect, or queries are slow.\nThis page covers both, plus a database service that fails to start, and how to size database memory\nsafely. It applies to both **MySQL/MariaDB** (Percona Server) and **PostgreSQL** on TurboStack."} {"id":"troubleshooting/database-issues.md#symptoms","url":"https://docs.turbostack.app/troubleshooting/database-issues/#symptoms","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Symptoms","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"- The app shows \"connection refused\", \"too many connections\", or authentication errors.\n- Pages that read or write the database are slow while the rest of the site is fine.\n- The database service is down and the host's Health check for it is\n Critical.\n- The database fails to start after a deploy, a version change, or a full disk."} {"id":"troubleshooting/database-issues.md#diagnose-it-on-turbostack","url":"https://docs.turbostack.app/troubleshooting/database-issues/#diagnose-it-on-turbostack","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Diagnose it on TurboStack","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"1. Open the host's Health tab. Check the **Services** list for the\n database check (status and latest output) and the **Host Monitoring** cards for **RAM**, **Memory\n swap**, and **Disk** - a full disk or memory pressure is a common root cause of database\n failures.\n2. Review **Top Issues** for any ranked database problem and its recommended fix.\n3. For query-level insight, enable **Advanced Database Monitoring** and review its\n query-performance dashboards - see Monitoring (concepts).\n4. Check **History** (Revisions / Deploys) - a recent publish that changed the database version,\n sizing, or bind address is a likely trigger, and you can roll it back.\n5. For anything deeper, connect over SSH to read logs and run client\n commands (below)."} {"id":"troubleshooting/database-issues.md#connection-refused-or-too-many-connections","url":"https://docs.turbostack.app/troubleshooting/database-issues/#connection-refused-or-too-many-connections","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Connection refused or \"too many connections\"","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"These are connection-layer problems, not query problems."} {"id":"troubleshooting/database-issues.md#connection-refused-cannot-reach-the-database","url":"https://docs.turbostack.app/troubleshooting/database-issues/#connection-refused-cannot-reach-the-database","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Connection refused / cannot reach the database","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"- **The service is down.** Check the database service on the Health tab. If it is not running, see\n Database service won't start below.\n- **You are connecting from off-host.** TurboStack does **not** expose a public database port. To\n reach the database from your machine, use an SSH tunnel - see\n Connect to MySQL remotely and\n Connect to PostgreSQL remotely.\n- **Bind address / listen address.** If the app is on another host, the database must listen on the\n right interface. These keys are security-sensitive - keep them as tight as possible. See\n `mysql_bindaddress` in Configure MySQL and\n `postgresql_listen_addresses` / `postgresql_extra_access` in\n Configure PostgreSQL.\n- **Credentials.** A wrong user, password, or database name returns an authentication error rather\n than \"refused\". Confirm the app's configured credentials."} {"id":"troubleshooting/database-issues.md#too-many-connections","url":"https://docs.turbostack.app/troubleshooting/database-issues/#too-many-connections","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Too many connections","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"The database has a maximum number of simultaneous connections; once it is reached, new connections\nare rejected. This is almost always caused by the application opening more connections than it\ncloses - for example too many PHP-FPM workers, a connection leak, or a missing connection pool -\nrather than the limit being too low.\n\n- Check how many PHP-FPM workers can run; each busy worker can hold a database connection. See\n Performance tuning for PHP-FPM worker sizing.\n- Look for long-running or stuck queries holding connections open (see below) and for code paths\n that open connections without closing them.\n- Raising the connection limit only masks a leak and costs memory. Fix the cause first; if you have\n evidence the limit is genuinely too low for legitimate concurrency, contact Support."} {"id":"troubleshooting/database-issues.md#slow-queries-and-how-to-spot-them","url":"https://docs.turbostack.app/troubleshooting/database-issues/#slow-queries-and-how-to-spot-them","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Slow queries and how to spot them","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"When database-backed pages are slow but the server has CPU and RAM headroom, the cause is usually a\nspecific query - often unindexed, or scanning far more rows than it returns.\n\n- **Advanced Database Monitoring** gives you a query analytics view that ranks the slowest and most frequent queries; this\n is the easiest starting point. See Monitoring (concepts).\n- **MySQL/MariaDB:** inspect live activity with `SHOW FULL PROCESSLIST;` to catch queries that are\n running long right now. The slow query log records queries that exceed a time threshold.\n- **PostgreSQL:** inspect live activity with `SELECT * FROM pg_stat_activity;`. The\n `pg_stat_statements` extension aggregates query timings, and slow statements can be logged.\n- Once you have identified a slow query, examine its plan (`EXPLAIN` / `EXPLAIN ANALYZE`) and add or\n fix indexes in the application's schema/migrations.\n\nA slow query in the admin or at checkout often points to a single missing index - fix that before\nconsidering more memory or a bigger server."} {"id":"troubleshooting/database-issues.md#database-service-won-t-start","url":"https://docs.turbostack.app/troubleshooting/database-issues/#database-service-won-t-start","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Database service won't start","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"If the database does not come up, work through the most common causes in order:\n\n- **Out of disk.** A database cannot start (or stay up) when the volume holding its data or logs is\n full. Check the Disk card on the Health tab and free space - see Disk space.\n- **Out of memory.** If the host is under memory pressure or the kernel OOM-killer stopped the\n process, the service can fail to start or get killed shortly after. See\n Out of memory. An InnoDB buffer pool or `shared_buffers` set too large for the\n host is a frequent cause of startup OOM (see sizing below).\n- **A recent version change.** A major-version change is a migration, not an in-place switch, and an\n incomplete or untested one can leave the service unable to start. Check History and the configure\n pages: Configure MySQL,\n Configure PostgreSQL. Downgrades are not supported.\n- **Corruption.** After a crash or a full disk, data files can be inconsistent and the service\n refuses to start cleanly. Recovery is risky to attempt blind - capture the startup error from the\n logs and contact Support; you may need to restore from the host **Backups** tab.\n\nThe exact reason is almost always in the database error log (below) - read it before taking action."} {"id":"troubleshooting/database-issues.md#buffer-pool-and-memory-sizing","url":"https://docs.turbostack.app/troubleshooting/database-issues/#buffer-pool-and-memory-sizing","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Buffer pool and memory sizing","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"The single most important database performance setting is how much memory it uses to cache data and\nindexes. When this is too small, the database constantly reads from disk; when it is too large for\nthe host, the database (or another service) is starved and may be OOM-killed.\n\n| Engine | Sizing key | What it controls |\n|---|---|---|\n| MySQL/MariaDB | `mysql_innodb_size` | InnoDB buffer pool - cached table and index data |\n| PostgreSQL | `postgresql_shared_buffers` | Shared memory used for caching data |\n\nTurboStack **auto-tunes** both keys to the size of the server. Override them only with **measured\nevidence** - for example Advanced Database Monitoring showing a low buffer-pool / cache hit ratio together with spare RAM on\nthe Health tab. Guessing larger values commonly causes memory pressure and swapping, which makes\nthe whole host slower. See Performance tuning, then set the\noverride on the Configure MySQL or\nConfigure PostgreSQL page and publish."} {"id":"troubleshooting/database-issues.md#where-to-find-the-database-logs","url":"https://docs.turbostack.app/troubleshooting/database-issues/#where-to-find-the-database-logs","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Where to find the database logs","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"The database error log is where startup failures, crashes, and corruption messages appear. The\nquickest way to read it is the TurboStack CLI over SSH,\nwhich finds the right log for you:\n\n```bash\ntscli logs mysql error # recent MySQL/MariaDB error log\ntscli logs mysql find error from 2 hours ago # scope the search by time\n```\n\nUse the matching service name for your database. The latest check output on the Health **Services**\nentry also points you at the current problem, and Advanced Database Monitoring dashboards complement the logs with\nquery-level history."} {"id":"troubleshooting/database-issues.md#prevent-it","url":"https://docs.turbostack.app/troubleshooting/database-issues/#prevent-it","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Prevent it","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"- Leave memory sizing auto-tuned unless Advanced Database Monitoring and the Health graphs give you a clear reason to change\n it; change one thing at a time and re-measure.\n- Index the queries your application runs most; review Advanced Database Monitoring regularly.\n- Keep the database bind/listen address restricted and connect remotely over an SSH tunnel.\n- Keep disk headroom so logs and data files never fill the volume (see Disk space).\n- Back up before any major version change, and make permanent changes in the TurboStack Platform and a publish."} {"id":"troubleshooting/database-issues.md#when-to-contact-support","url":"https://docs.turbostack.app/troubleshooting/database-issues/#when-to-contact-support","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"When to contact support","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"If the database will not start, you suspect corruption, or you need to restore from a backup, open a\nticket at Support. Include the host and database engine/version, what\nchanged (and when), the Health status, and the exact error from the database log."} {"id":"troubleshooting/database-issues.md#related","url":"https://docs.turbostack.app/troubleshooting/database-issues/#related","path":"troubleshooting/database-issues.md","title":"Database connection and performance problems","heading":"Related","keywords":"database connection error too many connections slow query mysql won't start database down innodb buffer pool shared buffers postgresql MariaDB","text":"- Configure MySQL\n- Configure PostgreSQL\n- Connect to MySQL remotely\n- Connect to PostgreSQL remotely\n- Fix MySQL character set and collation\n- Performance tuning\n- TurboStack CLI\n- Out of memory\n- Disk space\n- Why is my site slow?"} {"id":"troubleshooting/disk-space.md#intro","url":"https://docs.turbostack.app/troubleshooting/disk-space/","path":"troubleshooting/disk-space.md","title":"Disk full and freeing up space","heading":"","keywords":"disk full no space left on device free disk space reclaim space log rotation var cache sessions","text":"# Disk full and freeing up space\n\nA full disk breaks things quietly: writes fail, sessions cannot be saved, and deploys stop\npart-way. In the worst case a service crashes mid-write and corrupts data that then needs a restore.\nTurboStack shows you disk usage at a glance, and most space can be reclaimed safely from logs and\ncaches without touching application data."} {"id":"troubleshooting/disk-space.md#symptoms","url":"https://docs.turbostack.app/troubleshooting/disk-space/#symptoms","path":"troubleshooting/disk-space.md","title":"Disk full and freeing up space","heading":"Symptoms","keywords":"disk full no space left on device free disk space reclaim space log rotation var cache sessions","text":"- Errors containing **`No space left on device`** in application or service logs.\n- Writes failing - uploads, session saves, cache writes, or database writes erroring out.\n- **Deploys or publishes failing** because there is no room to unpack or build.\n- The site throws `5xx` errors once a critical service can no longer write (see\n Fixing 502, 503 and 504 errors)."} {"id":"troubleshooting/disk-space.md#diagnose-it-on-turbostack","url":"https://docs.turbostack.app/troubleshooting/disk-space/#diagnose-it-on-turbostack","path":"troubleshooting/disk-space.md","title":"Disk full and freeing up space","heading":"Diagnose it on TurboStack","keywords":"disk full no space left on device free disk space reclaim space log rotation var cache sessions","text":"On the host's Health tab, the **Disk** card shows current usage with\nan OK/Warning/Critical status and a graph. Use the **1H / 8H / 1D / 7D** range buttons to see\nwhether the disk filled gradually (growth to plan for) or suddenly (a runaway log or a one-off\nevent). Check **Top Issues** for a related STABILITY issue.\n\nTo find *what* is using the space, connect over SSH (host SSH tab) and\ninspect directory sizes from your home directory downward, drilling into the largest directories\nfirst:\n\n```bash\ndf -h # overall disk usage per filesystem\ndu -sh * | sort -rh | head # largest items in the current directory\ndu -sh .[!.]* 2>/dev/null # include hidden files/folders\n```\n\nThe root disk (usually `/dev/vda2`, mounted on `/`) is the one sized in your TurboStack plan; your\nhome directory and site files live on it, so that is the filesystem to watch.\n\nRun `du` again inside the largest directory to drill down. If `ncdu` is available, `ncdu ~` gives an\ninteractive view: press **Enter** to open a directory and move down the tree until you find what is\nconsuming space. `ncdu` can also delete: pressing **d** removes the selected file or directory\n**permanently** after a confirmation, so only use it once you are sure."} {"id":"troubleshooting/disk-space.md#where-the-space-usually-goes","url":"https://docs.turbostack.app/troubleshooting/disk-space/#where-the-space-usually-goes","path":"troubleshooting/disk-space.md","title":"Disk full and freeing up space","heading":"Where the space usually goes","keywords":"disk full no space left on device free disk space reclaim space log rotation var cache sessions","text":"- **Logs** - application, web server, and service logs grow over time, and a single error loop can\n fill a disk fast.\n- **`var/cache` and generated files** - framework cache, compiled assets, and generated code (for\n example a Magento `var/` directory) can grow large.\n- **Sessions** - accumulated session files or session data.\n- **Media and uploads** - user-uploaded images and files that simply keep growing.\n- **Old database dumps and exports** - manual `.sql` dumps left in the home directory.\n- **Old restore data** - files left in the `~/hprestore` recovery folder after a restore."} {"id":"troubleshooting/disk-space.md#safe-cleanup","url":"https://docs.turbostack.app/troubleshooting/disk-space/#safe-cleanup","path":"troubleshooting/disk-space.md","title":"Disk full and freeing up space","heading":"Safe cleanup","keywords":"disk full no space left on device free disk space reclaim space log rotation var cache sessions","text":"Reclaim the easy space first, and verify what you are removing.\n\n- **Truncate or remove old log files** once you have noted any errors you need. Rotated/archived\n logs (`.gz`, `.1`, etc.) are usually safe to delete.\n- **Clear regenerable caches** - framework `var/cache` and compiled artifacts will be rebuilt.\n- **Delete old database dumps and finished `~/hprestore` data** you no longer need.\n\nYou can also clear the in-memory caches via the TurboStack CLI over SSH:\n\n```bash\ntscli varnish clear\ntscli opcache clear\n```\n\n> [!NOTE]\n> `tscli redis clear` runs `redis-cli flushall` on the **cache instance (6379)** only. It clears all\n> cached data there but leaves the **persistent instance (6378)** - sessions and queues - intact, so\n> users stay logged in. Expect a brief performance dip while the cache warms up.\n>\n> ```bash\n> tscli redis clear\n> ```\n\n> [!IMPORTANT]\n> **Do not delete** application code, media you cannot regenerate, database data directories, or\n> the persistent Redis data (port `6378`). If you are unsure whether a file is safe to remove,\n> leave it and ask your development team or Support.\n\nIf you need to recover something you removed, restore it from the host's\nBackups tab."} {"id":"troubleshooting/disk-space.md#prevent-it","url":"https://docs.turbostack.app/troubleshooting/disk-space/#prevent-it","path":"troubleshooting/disk-space.md","title":"Disk full and freeing up space","heading":"Prevent it","keywords":"disk full no space left on device free disk space reclaim space log rotation var cache sessions","text":"- Keep **log rotation and retention** in place so logs cannot grow without bound; investigate any\n log that fills the disk repeatedly, since that usually points to an error loop.\n- Prune old database dumps, exports, and `~/hprestore` data once you are done with them.\n- **Skip redundant manual backups.** TurboStack already takes daily backups of your environment to a\n separate server (see Backups and restore), so stacking your own\n daily dumps on the host mostly wastes disk. A one-off dump before a risky release is fine - remove\n it afterwards.\n- Watch the **Disk** card on Health and the fleet\n Monitoring dashboard, and act on a rising trend early.\n- If the disk is full of legitimate, growing data (media, database), the host needs more storage.\n Upgrade the plan from the\n Customer Center, or\n talk to sales."} {"id":"troubleshooting/disk-space.md#when-to-contact-support","url":"https://docs.turbostack.app/troubleshooting/disk-space/#when-to-contact-support","path":"troubleshooting/disk-space.md","title":"Disk full and freeing up space","heading":"When to contact support","keywords":"disk full no space left on device free disk space reclaim space log rotation var cache sessions","text":"Contact Support if the disk is full of data you cannot safely remove, if\nyou need more storage, or if you are unsure what is safe to delete. Include the host, the affected\ndomain, and what the largest directories are."} {"id":"troubleshooting/disk-space.md#related","url":"https://docs.turbostack.app/troubleshooting/disk-space/#related","path":"troubleshooting/disk-space.md","title":"Disk full and freeing up space","heading":"Related","keywords":"disk full no space left on device free disk space reclaim space log rotation var cache sessions","text":"- Health\n- TurboStack CLI\n- Backups and restore\n- Fixing 502, 503 and 504 errors\n- Performance tuning\n- Monitoring"} {"id":"troubleshooting/email-deliverability.md#intro","url":"https://docs.turbostack.app/troubleshooting/email-deliverability/","path":"troubleshooting/email-deliverability.md","title":"Email delivery and deliverability issues","heading":"","keywords":"email not sending email in spam mail queue mail log mailq development mail-catcher smtp error","text":"# Email delivery and deliverability issues\n\nOutbound (transactional) mail on TurboStack is handled by the **local mail service** on your host.\nEmail problems fall into two very different categories - and it's important to know which one you\nhave before you start fixing things:\n\n- **Mail that never sends** (send errors, or recipients never receive it) - diagnosed below.\n- **Mail that sends but lands in spam** - fix by authenticating your domain. See\n Mail deliverability for the full SPF, DKIM and DMARC\n and blocklist guide, and SMTP error codes for a\n `5.7.x` bounce our support team may link you to."} {"id":"troubleshooting/email-deliverability.md#symptoms","url":"https://docs.turbostack.app/troubleshooting/email-deliverability/#symptoms","path":"troubleshooting/email-deliverability.md","title":"Email delivery and deliverability issues","heading":"Symptoms","keywords":"email not sending email in spam mail queue mail log mailq development mail-catcher smtp error","text":"- The application reports a send error, or users never receive expected mail (password resets,\n order confirmations).\n- Mail is delivered but consistently lands in recipients' spam/junk folders.\n- Some providers (for example large mailbox providers) accept your mail while others bounce it."} {"id":"troubleshooting/email-deliverability.md#diagnose-it-on-turbostack","url":"https://docs.turbostack.app/troubleshooting/email-deliverability/#diagnose-it-on-turbostack","path":"troubleshooting/email-deliverability.md","title":"Email delivery and deliverability issues","heading":"Diagnose it on TurboStack","keywords":"email not sending email in spam mail queue mail log mailq development mail-catcher smtp error","text":"1. **Rule out a development mail-catcher.** In the host's **Advanced > Mail Settings**, check that\n mail capturing/testing (**Mailpit** or **Mailhog**) is **off**. When it is on, outbound mail is\n *captured, not delivered* - it is a development tool and must never be left on in production\n (Configure mail).\n2. **Inspect the mail log and queue over SSH.** Connect to the host\n (SSH) and check the mail log and queue (see below).\n3. **Test from the receiver's side.** Send to a few different providers and look at whether mail is\n rejected, accepted-to-inbox, or accepted-to-spam - that tells you which category you're in."} {"id":"troubleshooting/email-deliverability.md#checking-mail-logs-and-the-queue-over-ssh","url":"https://docs.turbostack.app/troubleshooting/email-deliverability/#checking-mail-logs-and-the-queue-over-ssh","path":"troubleshooting/email-deliverability.md","title":"Email delivery and deliverability issues","heading":"Checking mail logs and the queue over SSH","keywords":"email not sending email in spam mail queue mail log mailq development mail-catcher smtp error","text":"The mail log records every delivery attempt with the result and any remote error message -\nthis is the single most useful diagnostic for \"not sending\":\n\n```bash\n# Recent mail activity (Debian/Ubuntu)\ntail -n 100 /var/log/mail.log\n\n# On AlmaLinux/RHEL the log is usually:\ntail -n 100 /var/log/maillog\n\n# Inspect the outbound queue (stuck or deferred messages)\nmailq\n```\n\nLook for `status=sent` (delivered), `status=deferred` (will retry - note the reason), or\n`status=bounced` (rejected - the remote server's reason follows). The remote reason often names the\nexact problem: a missing PTR/SPF record, a blocklist, or an authentication failure."} {"id":"troubleshooting/email-deliverability.md#mail-intercepted-by-a-development-catcher","url":"https://docs.turbostack.app/troubleshooting/email-deliverability/#mail-intercepted-by-a-development-catcher","path":"troubleshooting/email-deliverability.md","title":"Email delivery and deliverability issues","heading":"Mail intercepted by a development catcher","keywords":"email not sending email in spam mail queue mail log mailq development mail-catcher smtp error","text":"The most common cause is a development mail-catcher (**Mailpit** or **Mailhog**) capturing outbound\nmail instead of sending it. Turn off mail capturing in **Advanced > Mail Settings** on production -\nsee Configure mail."} {"id":"troubleshooting/email-deliverability.md#application-mail-misconfiguration","url":"https://docs.turbostack.app/troubleshooting/email-deliverability/#application-mail-misconfiguration","path":"troubleshooting/email-deliverability.md","title":"Email delivery and deliverability issues","heading":"Application mail misconfiguration","keywords":"email not sending email in spam mail queue mail log mailq development mail-catcher smtp error","text":"If the server can send but the app can't, the application's mail settings are usually wrong:\n\n- **Wrong From address** - many receivers reject mail whose `From` domain doesn't match an\n authorised sending domain. Use a `From` address on a domain you control and have authenticated.\n- **SMTP settings pointing nowhere** - if the app is configured for an external SMTP server with the\n wrong host, port, or credentials, sends fail or hang. For local delivery, point the app at the\n local mail service rather than a remote SMTP server.\n- **Sender/return-path mismatch** - a return-path that doesn't align with your SPF record causes\n failures at strict receivers.\n\nFix these in your application's own mail configuration, then resend and re-check the mail log."} {"id":"troubleshooting/email-deliverability.md#messages-stuck-in-the-queue","url":"https://docs.turbostack.app/troubleshooting/email-deliverability/#messages-stuck-in-the-queue","path":"troubleshooting/email-deliverability.md","title":"Email delivery and deliverability issues","heading":"Messages stuck in the queue","keywords":"email not sending email in spam mail queue mail log mailq development mail-catcher smtp error","text":"If `mailq` shows messages piling up as `deferred`, check the log to find out why. Common reasons: the\nremote server is temporarily unavailable, the connection is blocked, or your IP/domain is on a\nblocklist. Address the underlying reason; the mail service retries deferred mail automatically."} {"id":"troubleshooting/email-deliverability.md#mail-landing-in-spam","url":"https://docs.turbostack.app/troubleshooting/email-deliverability/#mail-landing-in-spam","path":"troubleshooting/email-deliverability.md","title":"Email delivery and deliverability issues","heading":"Mail landing in spam","keywords":"email not sending email in spam mail queue mail log mailq development mail-catcher smtp error","text":"Delivered-but-flagged mail is almost always missing or incorrect **domain authentication** (SPF,\nDKIM, DMARC), or a blocklisted sending IP. The full guide - the DNS records, the SPF 10-lookup\nlimit, DMARC alignment, blocklists (RBLs) and when to move to an external SMTP provider - is on\nMail deliverability."} {"id":"troubleshooting/email-deliverability.md#when-to-contact-support","url":"https://docs.turbostack.app/troubleshooting/email-deliverability/#when-to-contact-support","path":"troubleshooting/email-deliverability.md","title":"Email delivery and deliverability issues","heading":"When to contact support","keywords":"email not sending email in spam mail queue mail log mailq development mail-catcher smtp error","text":"If mail still won't send after the mail-catcher is off and the app is configured correctly, or if a\nPTR/reverse-DNS or IP-reputation issue is involved, contact support.\nInclude the **host**, the **sending domain and From address**, the recipient that failed, the\nrelevant **mail-log lines**, and what changed recently."} {"id":"troubleshooting/email-deliverability.md#related","url":"https://docs.turbostack.app/troubleshooting/email-deliverability/#related","path":"troubleshooting/email-deliverability.md","title":"Email delivery and deliverability issues","heading":"Related","keywords":"email not sending email in spam mail queue mail log mailq development mail-catcher smtp error","text":"- Mail deliverability - authenticate your domain (SPF, DKIM, DMARC) and handle blocklists.\n- SMTP error codes - decode a `5.7.x` bounce.\n- Configure mail - DKIM and the development mail-catcher.\n- What is mail on TurboStack?\n- Troubleshooting overview"} {"id":"troubleshooting/finding-logs.md#intro","url":"https://docs.turbostack.app/troubleshooting/finding-logs/","path":"troubleshooting/finding-logs.md","title":"Finding and reading logs","heading":"","keywords":"logs where are the logs nginx log apache log php log error log access log log rotation log analysis","text":"# Finding and reading logs\n\nWhen something goes wrong, the log usually tells you why. This page shows where TurboStack keeps\nthe main logs, how to open them over Secure Shell (SSH), and a few commands for reading and\nanalyzing them.\n\nLogs are grouped by service, one directory per service under `/var/log/`. Depending on your\naccess, you see the logs for the services running under your own account.\n\n> [!TIP]\n> For a quick visual overview of resource use (CPU, memory, disk) without opening logs, use the\n> host Health tab. Open the logs when you need the exact error."} {"id":"troubleshooting/finding-logs.md#where-the-logs-are","url":"https://docs.turbostack.app/troubleshooting/finding-logs/#where-the-logs-are","path":"troubleshooting/finding-logs.md","title":"Finding and reading logs","heading":"Where the logs are","keywords":"logs where are the logs nginx log apache log php log error log access log log rotation log analysis","text":"Connect to the host over SSH first (see the host SSH tab), then read\nthe files below. Each of your websites (vhosts) has its own log file named after your system user\nand, if set, the application name.\n\n| Service | Location |\n| --- | --- |\n| Nginx access (per website) | `/var/log/nginx/_.log` |\n| Nginx errors | `/var/log/nginx/error.log` |\n| Apache access (per website) | `/var/log/apache2/_.log` |\n| PHP / PHP-FPM errors | `/var/log/php/_.log` |\n| MySQL error log | `/var/log/mysql/error.log` |\n| Application logs | inside the application, for example a framework's own `var/log/` or `storage/logs/` directory |\n\nNotes on reading the table:\n\n- `` is your system user (the operating system account), and `` is the application\n name if the website has one. A website without an application name uses just `.log`.\n- The **access log** records every request. The **error log** records problems, and is where a\n `502` or `504` is explained (look for `connect() failed` or `upstream prematurely closed`).\n- On some older or RedHat-based hosts, Apache logs live under `/var/log/httpd/` instead of\n `/var/log/apache2/`. The file names follow the same pattern.\n- The MySQL error-log path above (`/var/log/mysql/error.log`) is the standard Debian host path. On\n cPanel/DirectAdmin (RedHat-based) hosts the MySQL error log is at `/var/lib/mysql/error.log`\n instead.\n- Application frameworks keep their own logs inside the application directory. For example,\n Magento writes to `var/log/`, and Laravel writes to `storage/logs/laravel.log`. Check the\n application-specific troubleshooting page for the exact path."} {"id":"troubleshooting/finding-logs.md#on-cpanel-and-directadmin-hosts","url":"https://docs.turbostack.app/troubleshooting/finding-logs/#on-cpanel-and-directadmin-hosts","path":"troubleshooting/finding-logs.md","title":"Finding and reading logs","heading":"On cPanel and DirectAdmin hosts","keywords":"logs where are the logs nginx log apache log php log error log access log log rotation log analysis","text":"The paths above are for the default TurboStack (customstack) host. Hosts running the cPanel or\nDirectAdmin control panel expose the same logs through the panel's own web interface, so you can\nread them in the browser instead of over SSH.\n\nOn DirectAdmin:\n\n- **Admin Tools > Log Viewer** shows the general service logs (Apache, Nginx, Exim, system\n messages).\n- **User Tools > Site Summary / Statistics / Logs** shows the Apache logs for the current day, with\n older, compressed logs under **Backed up Web Logs**.\n\nOn cPanel (these are reached from the user account, not the admin):\n\n- **Metrics > Errors** shows the most recent error-log entries for your domain - useful for PHP\n errors, missing files and permission issues.\n- **Metrics > Raw Access** lets you download the raw access logs, both today's and the aggregated\n per-month `.gz` files.\n- **Metrics > Awstats** (or Webalizer) gives a graphical view of traffic, referrers, bots and\n bandwidth.\n- **Email > Track Delivery** shows mail delivery attempts, successes and failures."} {"id":"troubleshooting/finding-logs.md#log-rotation","url":"https://docs.turbostack.app/troubleshooting/finding-logs/#log-rotation","path":"troubleshooting/finding-logs.md","title":"Finding and reading logs","heading":"Log rotation","keywords":"logs where are the logs nginx log apache log php log error log access log log rotation log analysis","text":"TurboStack rotates logs automatically with `logrotate` (via `/etc/logrotate.d/*`) so they cannot\nfill the disk. Rotation runs daily at 00:00 server time. Today's and yesterday's logs stay\nuncompressed as plain `.log` files, so you can read them directly with `cat`. Logs older than two\ndays are compressed to save space and get a `.gz` extension (for example `access.log.2.gz`); read\nthose with `zcat`.\n\nLogs are kept for 30 days by default. Some services deviate from the 30-day policy to conserve disk\nspace.\n\nTo read them:\n\n- Read a current, uncompressed log with `cat`, `less`, or `tail -f` to follow it live:\n\n ```bash\n tail -f /var/log/nginx/_.log\n ```\n\n- Read a compressed, rotated log with `zcat`, `zless`, or `zgrep` (no need to unpack it first):\n\n ```bash\n zcat /var/log/nginx/_.log.1.gz | less\n ```"} {"id":"troubleshooting/finding-logs.md#reading-logs-efficiently","url":"https://docs.turbostack.app/troubleshooting/finding-logs/#reading-logs-efficiently","path":"troubleshooting/finding-logs.md","title":"Finding and reading logs","heading":"Reading logs efficiently","keywords":"logs where are the logs nginx log apache log php log error log access log log rotation log analysis","text":"Access logs share a common format, so a few `awk` and `grep` one-liners answer most questions.\nReplace `` with the path from the table above.\n\nShow the five IP addresses making the most requests:\n\n```bash\nawk '{print $1}' | sort | uniq -c | sort -nr | head -5\n```\n\nShow the five most-requested paths:\n\n```bash\nawk '{print $7}' | sort | uniq -c | sort -nr | head -5\n```\n\nShow the total requests per HTTP status code:\n\n```bash\nawk '{print $9}' | sort | uniq -c | sort -nr\n```\n\nShow the five most common user agents:\n\n```bash\nawk -F\\\" '{print $6}' | sort | uniq -c | sort -nr | head -5\n```"} {"id":"troubleshooting/finding-logs.md#combining-the-two","url":"https://docs.turbostack.app/troubleshooting/finding-logs/#combining-the-two","path":"troubleshooting/finding-logs.md","title":"Finding and reading logs","heading":"Combining the two","keywords":"logs where are the logs nginx log apache log php log error log access log log rotation log analysis","text":"A burst of `403` responses can mean scraping or someone probing for a way in. Find the IP\naddresses causing the most of them:\n\n```bash\ngrep \" 403 \" | awk '{print $1}' | sort | uniq -c | sort -nr | head -5\n```\n\nIf a small set of IP addresses is responsible for abusive traffic, you can add them to your\nfirewall block list. TurboStack also blocks many of these sources automatically; see the\nSecurity overview."} {"id":"troubleshooting/finding-logs.md#related","url":"https://docs.turbostack.app/troubleshooting/finding-logs/#related","path":"troubleshooting/finding-logs.md","title":"Finding and reading logs","heading":"Related","keywords":"logs where are the logs nginx log apache log php log error log access log log rotation log analysis","text":"- Host SSH tab\n- Health\n- Fixing 502, 503 and 504 errors\n- Fixing 403, 413 and 429 errors\n- Disk full and freeing up space\n- Security overview"} {"id":"troubleshooting/high-cpu-and-load.md#intro","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"# High CPU usage and server load\n\nHigh CPU usage and a high load average make every request slower and can tip a busy host into\nerrors. TurboStack lets you see the pressure as it happens, identify which process is responsible,\nand either optimize the workload or scale the host."} {"id":"troubleshooting/high-cpu-and-load.md#symptoms","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#symptoms","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"Symptoms","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"- The **CPU** card on Health sits at Warning or Critical for extended periods.\n- Pages are slow across the whole site, not just one URL (see\n Why is my site slow?).\n- Load spikes coincide with a recurring event - a cron run, a deploy, a traffic surge, or a crawl."} {"id":"troubleshooting/high-cpu-and-load.md#diagnose-it-on-turbostack","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#diagnose-it-on-turbostack","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"Diagnose it on TurboStack","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"On the host's Health tab, the **CPU** card shows current usage with\nan OK/Warning/Critical status and a graph. Use the **1H / 8H / 1D / 7D** range buttons to tell a\nshort spike apart from sustained load, and the fleet Monitoring\ndashboard to see trends and alerts across hosts.\n\nCheck **Top Issues** for a ranked PERFORMANCE or STABILITY issue. Open **History** (Revisions /\nDeploys) to see whether a recent publish coincided with the spike - if it did, you can roll back."} {"id":"troubleshooting/high-cpu-and-load.md#identify-the-heavy-process","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#identify-the-heavy-process","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"Identify the heavy process","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"Connect over SSH (host SSH tab) and look at which process is consuming\nCPU, for example with `top` (press `P` to sort by CPU use) or:\n\n```bash\nps aux --sort=-%cpu | head # top processes by CPU use\nuptime # load averages over 1, 5 and 15 minutes\n```\n\nThe most common causes:\n\n- **PHP-FPM** - heavy or uncached page rendering, or a runaway script.\n- **Database** (MySQL/PostgreSQL) - expensive or unindexed queries; see\n Database issues.\n- **Cron / queue workers** - scheduled jobs or a backlog of queued work running flat out.\n- **Search indexer** (Elasticsearch) - a full reindex consuming CPU while it runs.\n\nTo find slow PHP specifically, enable the profiler temporarily:\n\n```bash\ntscli blackfire enable\n# ... reproduce the slow request and profile it ...\ntscli blackfire disable\n```"} {"id":"troubleshooting/high-cpu-and-load.md#bots-and-crawlers-driving-load","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#bots-and-crawlers-driving-load","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"Bots and crawlers driving load","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"Aggressive crawlers, scrapers, and bot traffic can generate far more requests than real users,\npushing CPU up for no business value. **TurboShield** can throttle abusive request rates for you;\nraising its level (`low` / `medium` / `high` / `attack`) tightens the limits. When a client exceeds\na limit it receives a soft `429` response rather than a firewall ban - see\nHTTP 4xx errors. Learn what TurboShield does and how to tune it in\nWhat is TurboShield? and\nConfigure TurboShield.\n\nYou can also reduce load from well-behaved crawlers at the source with a `robots.txt` file in your web root. Block a specific crawler entirely with a `Disallow` rule:\n\n```text\nUser-agent: Amazonbot\nDisallow: /\n```\n\nSome crawlers honor a `Crawl-delay` directive that spaces out their requests: Bingbot does, Googlebot does not. Set Google's crawl rate in Google Search Console instead. `Crawl-delay` is not part of the official robots.txt standard, so crawlers that do not support it ignore the line. TurboShield still handles crawlers that ignore `robots.txt` entirely."} {"id":"troubleshooting/high-cpu-and-load.md#not-enough-caching","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#not-enough-caching","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"Not enough caching","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"If PHP is recomputing pages that could be served from cache, CPU climbs under load. Make sure your\ncaching layers are working correctly:\n\n- Varnish full-page cache for storefront pages.\n- Redis object cache and OPcache for PHP.\n\nSee Performance tuning. After a deploy or content change, a\nstale cache can also cause churn - clear it from the running server with the\nTurboStack CLI:\n\n```bash\ntscli varnish clear\ntscli opcache clear\n```"} {"id":"troubleshooting/high-cpu-and-load.md#cron-or-queue-jobs-piling-up","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#cron-or-queue-jobs-piling-up","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"Cron or queue jobs piling up","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"A backlog of queued jobs, or overlapping cron runs, can keep CPU pinned. Confirm on the **Health**\ngraph whether load is periodic, and review your job schedule and worker concurrency so jobs do not\nstack up faster than they complete."} {"id":"troubleshooting/high-cpu-and-load.md#inefficient-database-queries","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#inefficient-database-queries","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"Inefficient database queries","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"Slow or unindexed queries burn CPU on the database. Identify them, add indexes, and cache results\nwhere possible - see Database issues and\nPerformance tuning."} {"id":"troubleshooting/high-cpu-and-load.md#the-host-has-genuinely-outgrown-its-plan","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#the-host-has-genuinely-outgrown-its-plan","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"The host has genuinely outgrown its plan","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"When the workload is legitimate and already optimized, the host needs more CPU. Upgrade the plan from the Customer Center, or talk to sales to choose the right size."} {"id":"troubleshooting/high-cpu-and-load.md#prevent-it","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#prevent-it","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"Prevent it","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"- Keep caching effective and measure before tuning - see\n Performance tuning.\n- Set an appropriate TurboShield level so bot traffic\n cannot dominate CPU.\n- Watch CPU trends on Health and\n Monitoring so you act on a rising trend before it becomes an outage."} {"id":"troubleshooting/high-cpu-and-load.md#when-to-contact-support","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#when-to-contact-support","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"When to contact support","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"Contact Support if CPU stays high after optimizing and you need to scale\nthe host, or if you cannot identify the process responsible. Include the host, the affected domain,\nthe time window, and what changed recently."} {"id":"troubleshooting/high-cpu-and-load.md#related","url":"https://docs.turbostack.app/troubleshooting/high-cpu-and-load/#related","path":"troubleshooting/high-cpu-and-load.md","title":"High CPU usage and server load","heading":"Related","keywords":"high cpu server load overloaded server cpu usage load average bots crawlers queue workers","text":"- Why is my site slow?\n- Out of memory (OOM) and memory pressure\n- Database issues\n- Performance tuning\n- What is TurboShield?\n- Monitoring\n- TurboStack CLI"} {"id":"troubleshooting/http-4xx-errors.md#intro","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"# Fixing 403, 413 and 429 errors\n\nA 4xx status code means the request was rejected before your application could\nserve it. The three you will see most on TurboStack each have a clear cause and a\nmanaged fix - a firewall block, a request that is too large, or rate limiting."} {"id":"troubleshooting/http-4xx-errors.md#what-each-code-means","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/#what-each-code-means","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"What each code means","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"| Code | Name | What it usually means |\n|---|---|---|\n| **403** | Forbidden | Access is **denied**. On TurboStack this is typically a Firewall block, an allow-list miss on a restricted area, or file permissions. |\n| **413** | Request Entity Too Large | The request body (usually a file upload) **exceeds the configured size limit** in PHP and/or the web server. |\n| **429** | Too Many Requests | The client sent **too many requests too quickly** and was throttled by **TurboShield** rate limiting. |"} {"id":"troubleshooting/http-4xx-errors.md#symptoms","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/#symptoms","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"Symptoms","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"- A specific visitor (or you) sees \"403 Forbidden\" while others are fine - a sign\n of an IP-level block or a restricted area.\n- Uploads fail with \"413 Request Entity Too Large\" once a file passes a certain\n size.\n- A client (or crawler/API) hits \"429 Too Many Requests\" during bursts of\n traffic, then recovers when it slows down."} {"id":"troubleshooting/http-4xx-errors.md#403-forbidden-access-denied","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/#403-forbidden-access-denied","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"403 Forbidden - access denied","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"Most 403s on TurboStack come from one of three places:"} {"id":"troubleshooting/http-4xx-errors.md#a-firewall-block","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/#a-firewall-block","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"A Firewall block","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"If a whole IP address is blocked, every request from it returns 403. Check, then\nfix, over SSH:\n\n```bash\n# Is this address blocked?\ntscli firewall check 203.0.113.10\n\n# Restore access for a trusted address (office, monitoring, partner API)\ntscli firewall whitelist 198.51.100.7\n\n# Remove a block you no longer want\ntscli firewall unblock 203.0.113.10\n```\n\nTo make trust permanent, add the address to the host allow-list and publish - see\nWhitelist an IP address and\nConfigure the Firewall. To block an\nabusive client, see Block an IP address.\n\n> [!TIP]\n> GeoIP country rules can also produce 403s for legitimate visitors on VPNs or\n> mobile networks. If a region is unexpectedly blocked, review the country rules\n> on the host Security tab."} {"id":"troubleshooting/http-4xx-errors.md#a-restricted-area-or-file-permissions","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/#a-restricted-area-or-file-permissions","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"A restricted area or file permissions","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"A 403 limited to one path (for example an admin URL) is usually an intentional\nrestriction - see\nRestrict admin access. A 403\nacross a whole site can instead be incorrect file or directory permissions for\nthe web user; check the affected document root over SSH."} {"id":"troubleshooting/http-4xx-errors.md#413-request-entity-too-large-upload-body-size-limit","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/#413-request-entity-too-large-upload-body-size-limit","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"413 Request Entity Too Large - upload/body size limit","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"A 413 means the uploaded data is larger than the configured maximum. Two limits\napply, and **both** must be large enough:\n\n1. **PHP** - `upload_max_filesize` and `post_max_size`. Raise these through the\n PHP advanced options and publish; see\n Override PHP settings. Keep\n `post_max_size` at least as large as `upload_max_filesize` (it covers the whole\n request body, not just the file).\n2. **Web server** - the web server also caps the request body size. On TurboStack\n the per-application vhost is generated for you (see\n Configure Nginx); if the web-server limit\n is the bottleneck after raising the PHP values, contact Support to adjust it.\n\n> [!TIP]\n> Set the limits to the largest file you genuinely need to accept - not far\n> beyond it. Very large bodies tie up workers and memory."} {"id":"troubleshooting/http-4xx-errors.md#429-too-many-requests-turboshield-rate-limiting","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/#429-too-many-requests-turboshield-rate-limiting","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"429 Too Many Requests - TurboShield rate limiting","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"A 429 on TurboStack is produced by **TurboShield**, the platform's web-traffic\nprotection layer. When a client exceeds the allowed request rate, TurboShield\nreturns a **soft 429** - it is deliberately *not* a firewall ban, so a legitimate\nclient recovers automatically once its request rate drops. See\nWhat is TurboShield?.\n\nTurboShield runs at the host level with a single protection level:\n\n| Level | Behavior |\n|---|---|\n| `low` | Lenient limits; minimal bot controls. |\n| `medium` | Balanced protection. This is the default. |\n| `high` | Stricter limits and tighter bot controls. |\n| `attack` | Most aggressive limits, for an active attack. |\n\nWhat to do:\n\n- **Legitimate clients getting 429s** (your own crawler, a partner API,\n monitoring): add them to the host IP allow-list so they bypass rate limiting -\n see the Security tab and\n Whitelist an IP address. If your\n level is too strict for normal traffic, lower it on the Security tab.\n- **Abusive traffic causing the 429s is desirable**: leave TurboShield on, and\n raise the level to `high` or `attack` temporarily while the incident lasts, then\n return to `medium`. Avoid running permanently at `attack`, which can throttle\n real visitors."} {"id":"troubleshooting/http-4xx-errors.md#prevent-it","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/#prevent-it","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"Prevent it","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"- Keep monitoring and partner IPs on the host allow-list so they are never\n blocked or rate-limited.\n- Leave TurboShield at `medium` for typical workloads and only raise it during\n abuse - see Security hardening.\n- Set upload/body limits to match real requirements, and validate large uploads\n client-side before sending."} {"id":"troubleshooting/http-4xx-errors.md#when-to-contact-support","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/#when-to-contact-support","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"When to contact support","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"If a 403 persists after checking the firewall and permissions, if the web-server\nbody limit blocks a legitimately large upload, or if TurboShield is throttling\ngenuine traffic you cannot resolve with the allow-list, contact\nSupport. Include the host and domain, the client IP, the\nexact error code, and what the client was doing."} {"id":"troubleshooting/http-4xx-errors.md#related","url":"https://docs.turbostack.app/troubleshooting/http-4xx-errors/#related","path":"troubleshooting/http-4xx-errors.md","title":"Fixing 403, 413 and 429 errors","heading":"Related","keywords":"403 forbidden 413 request entity too large 429 too many requests rate limit upload size limit firewall block turboshield post_max_size upload_max_filesize","text":"- Configure the Firewall\n- Block an IP address\n- Whitelist an IP address\n- Override PHP settings\n- Configure Nginx\n- What is TurboShield?\n- TurboStack CLI\n- Fixing 502, 503 and 504 errors"} {"id":"troubleshooting/index.md#intro","url":"https://docs.turbostack.app/troubleshooting/","path":"troubleshooting/index.md","title":"Troubleshooting","heading":"","keywords":"turbostack troubleshooting diagnose host issues server problems health tab tscli rollback deploy","text":"# Troubleshooting\n\nWhen something goes wrong with your site or server, TurboStack gives you everything you need to\nfind the cause and fix it: a live **Health** view, fleet-wide **Monitoring**, a full change\n**History**, and the **TurboStack CLI (`tscli`)** for acting on the running server. This page\nexplains a repeatable method; the pages below cover specific symptoms.\n\n> [!TIP]\n> Most issues are resolved fastest by answering one question first: **did this start right after a\n> publish or deploy?** If so, jump to History and consider rolling\n> back."} {"id":"troubleshooting/index.md#a-method-that-works","url":"https://docs.turbostack.app/troubleshooting/#a-method-that-works","path":"troubleshooting/index.md","title":"Troubleshooting","heading":"A method that works","keywords":"turbostack troubleshooting diagnose host issues server problems health tab tscli rollback deploy","text":"1. **Reproduce & scope.** What exactly happens, on which application/domain, and since when? Does it\n affect one site or the whole host?\n2. **Observe.** Open the host's Health tab (CPU, RAM, swap, disk and\n per-service checks) and the Monitoring dashboard (active alerts).\n3. **Correlate with changes.** Check History - Revisions, Deploys\n and Cloning. A recent change is the most common trigger.\n4. **Act on the running server.** Use the TurboStack CLI (`tscli`) over SSH to\n reload services or clear caches - see each symptom page for the exact command.\n5. **Fix permanently.** Make lasting changes in the TurboStack Platform - the GUI or Source (YAML) - and\n publish. `tscli` acts on the live server now, but a future\n publish re-applies your saved configuration.\n6. **Verify.** Confirm the metric or error is gone in Health/Monitoring before you close out."} {"id":"troubleshooting/index.md#first-places-to-look","url":"https://docs.turbostack.app/troubleshooting/#first-places-to-look","path":"troubleshooting/index.md","title":"Troubleshooting","heading":"First places to look","keywords":"turbostack troubleshooting diagnose host issues server problems health tab tscli rollback deploy","text":"| Where | What it tells you |\n|---|---|\n| Health | Live resource metrics and per-service status for one host, with Top Issues. |\n| Monitoring | Active alerts across all your hosts, by priority (P1/P2/P3). |\n| History | Recent configuration changes and deploys - and the rollback control. |\n| Logs (over SSH) | Web server, PHP, database and mail logs for the details. |\n| TurboStack CLI | Inspect and act: reload services, clear caches, check the firewall. |"} {"id":"troubleshooting/index.md#symptom-guides","url":"https://docs.turbostack.app/troubleshooting/#symptom-guides","path":"troubleshooting/index.md","title":"Troubleshooting","heading":"Symptom guides","keywords":"turbostack troubleshooting diagnose host issues server problems health tab tscli rollback deploy","text":"- **Site problems:** Why is my site slow?, 502, 503 and 504 errors,\n 403, 413 and 429 errors\n- **Resources:** Out of memory, High CPU and load,\n Disk full\n- **Services:** Database problems, TLS certificate problems,\n Email deliverability\n- **Security:** OpenSSH vulnerability alert in a security scan\n- **Application-specific:** see the Troubleshooting page under each app in\n Applications."} {"id":"troubleshooting/index.md#what-turbostack-manages-for-you","url":"https://docs.turbostack.app/troubleshooting/#what-turbostack-manages-for-you","path":"troubleshooting/index.md","title":"Troubleshooting","heading":"What TurboStack manages for you","keywords":"turbostack troubleshooting diagnose host issues server problems health tab tscli rollback deploy","text":"Several layers are operated by Hosted Power, so they are rarely the thing you need to fix yourself:\nthe Firewall and TurboShield,\nBackups, and OS security updates. If you suspect one of these, or an\nissue needs a managed change, contact Support."} {"id":"troubleshooting/index.md#when-to-contact-support","url":"https://docs.turbostack.app/troubleshooting/#when-to-contact-support","path":"troubleshooting/index.md","title":"Troubleshooting","heading":"When to contact support","keywords":"turbostack troubleshooting diagnose host issues server problems health tab tscli rollback deploy","text":"If you have worked through the relevant symptom guide and the problem persists - or it involves a\nmanaged layer - reach out via Support. Include the **host name** and\n**domain**, **what changed** and **when it started**, and any **error message or log output**."} {"id":"troubleshooting/index.md#related","url":"https://docs.turbostack.app/troubleshooting/#related","path":"troubleshooting/index.md","title":"Troubleshooting","heading":"Related","keywords":"turbostack troubleshooting diagnose host issues server problems health tab tscli rollback deploy","text":"- TurboStack CLI\n- Health\n- Monitoring\n- Publishing changes\n- Performance tuning\n- Glossary - what the terms and abbreviations mean\n- Support"} {"id":"troubleshooting/openssh-vulnerability-scan.md#intro","url":"https://docs.turbostack.app/troubleshooting/openssh-vulnerability-scan/","path":"troubleshooting/openssh-vulnerability-scan.md","title":"OpenSSH vulnerability alert in a security scan","heading":"","keywords":"openssh vulnerability false positive backported fix cve-2024-6387 security scan ssh version debian security tracker","text":"# OpenSSH vulnerability alert in a security scan\n\nWhen you run a security scan against your server, you may see an alert about an OpenSSH\nvulnerability. OpenSSH is the software behind Secure Shell (SSH), the encrypted remote access to\nyour server. In most cases this alert is a **false positive**: the scanner reports a problem that\nis not actually present.\n\nThis page explains why that happens and how to confirm your server is patched."} {"id":"troubleshooting/openssh-vulnerability-scan.md#why-this-happens","url":"https://docs.turbostack.app/troubleshooting/openssh-vulnerability-scan/#why-this-happens","path":"troubleshooting/openssh-vulnerability-scan.md","title":"OpenSSH vulnerability alert in a security scan","heading":"Why this happens","keywords":"openssh vulnerability false positive backported fix cve-2024-6387 security scan ssh version debian security tracker","text":"Scanners often decide whether software is vulnerable by reading its version number and comparing\nit against a Common Vulnerabilities and Exposures (CVE) database. That check misses one important\ndetail about how Linux distributions ship security fixes.\n\n- **Backported fixes.** Distributions such as Debian apply security patches to the version they\n already ship, without changing the upstream version number. Your OpenSSH keeps the same version\n string but contains the fix.\n- **Scanner limitations.** A scanner that only matches version numbers does not see the\n backported patch, so it assumes the version is still vulnerable.\n\nAs a result, a scan may flag `OpenSSH_8.0p1` as vulnerable even though the specific CVE was\nalready fixed in that package. A well-known example is\nCVE-2024-6387 (sometimes called\n\"regreSSHion\"), which distributions patched quickly through backports.\n\n> [!NOTE]\n> TurboStack applies operating system security updates automatically, on a daily schedule, so\n> backported OpenSSH fixes reach your server without any action from you."} {"id":"troubleshooting/openssh-vulnerability-scan.md#confirm-your-server-is-patched","url":"https://docs.turbostack.app/troubleshooting/openssh-vulnerability-scan/#confirm-your-server-is-patched","path":"troubleshooting/openssh-vulnerability-scan.md","title":"OpenSSH vulnerability alert in a security scan","heading":"Confirm your server is patched","keywords":"openssh vulnerability false positive backported fix cve-2024-6387 security scan ssh version debian security tracker","text":"You can check this yourself in two steps.\n\n1. Look up the CVE in Debian's public\n Security Tracker. It shows, per Debian\n release, whether a fix has been released and in which package version. Search for the exact\n CVE from your scan report, for example\n CVE-2024-6387.\n\n2. Check the OpenSSH version installed on your server over SSH:\n\n ```bash\n # Installed OpenSSH packages and their versions\n dpkg -l | grep openssh\n\n # Running OpenSSH version\n ssh -V\n ```\n\nCompare the package version from `dpkg -l` with the \"fixed version\" listed in the Security\nTracker for your Debian release. If your installed version is equal to or newer than the fixed\nversion, the vulnerability is patched, even though the upstream version number in the scan looks\nold."} {"id":"troubleshooting/openssh-vulnerability-scan.md#when-to-act","url":"https://docs.turbostack.app/troubleshooting/openssh-vulnerability-scan/#when-to-act","path":"troubleshooting/openssh-vulnerability-scan.md","title":"OpenSSH vulnerability alert in a security scan","heading":"When to act","keywords":"openssh vulnerability false positive backported fix cve-2024-6387 security scan ssh version debian security tracker","text":"- **The Security Tracker shows the CVE as fixed and your package is at or above that version.**\n This is the common case. No action is needed; the scanner alert is a false positive.\n- **The tracker shows the CVE as fixed but your package is older.** Your server missed an update.\n Contact Support so it can be applied.\n- **The tracker shows the CVE as open (no fix yet).** The fix is not available for your release\n yet. Contact Support if the finding is high severity.\n\nFor vulnerabilities that TurboStack detects on your host itself, review the\nThreat Center tab, which reports genuine findings with a\nseverity you can act on. See also the Security overview."} {"id":"troubleshooting/openssh-vulnerability-scan.md#related","url":"https://docs.turbostack.app/troubleshooting/openssh-vulnerability-scan/#related","path":"troubleshooting/openssh-vulnerability-scan.md","title":"OpenSSH vulnerability alert in a security scan","heading":"Related","keywords":"openssh vulnerability false positive backported fix cve-2024-6387 security scan ssh version debian security tracker","text":"- Security overview\n- Security hardening checklist\n- Threat Center\n- What is SSH?\n- Support"} {"id":"troubleshooting/out-of-memory.md#intro","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"# Out of memory (OOM) and memory pressure\n\nWhen a host runs out of RAM, the Linux kernel's OOM killer terminates whichever process it\nconsiders least essential to free memory. The result is unpredictable: a database, a PHP worker,\nor a cache may be killed mid-request. TurboStack gives you the tools to spot memory pressure early\nand to right-size the services that consume it."} {"id":"troubleshooting/out-of-memory.md#symptoms","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/#symptoms","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"Symptoms","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"- Processes disappear or restart on their own (the kernel \"OOM-killed\" them).\n- **Swap usage** climbs and stays high, and the whole host feels sluggish - a sign the server is\n paging memory to disk to stay alive.\n- **Intermittent `5xx` errors** as PHP workers or the database are killed and restarted (see\n Fixing 502, 503 and 504 errors).\n- Database connections drop, or MySQL/PostgreSQL restarts unexpectedly."} {"id":"troubleshooting/out-of-memory.md#diagnose-it-on-turbostack","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/#diagnose-it-on-turbostack","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"Diagnose it on TurboStack","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"Start on the host's Health tab:\n\n- The **RAM** and **Memory swap** cards show current usage and an OK/Warning/Critical status. Use\n the **1H / 8H / 1D / 7D** range buttons to see whether pressure is constant or spikes at certain\n times (for example during a cron run or traffic peak). Sustained high swap is the clearest sign\n of memory pressure.\n- **Top issues** ranks detected problems by severity and category - a memory or stability issue\n here usually names the service involved and a recommended fix.\n- **Latest reports** holds the investigation reports for the host. Open the most recent one to see\n whether memory or swap was already flagged.\n\n> [!TIP]\n> Look here before you connect over SSH. When a host is under memory pressure, **Top issues** and\n> **Latest reports** often report it already, as a PERFORMANCE or STABILITY issue about memory or\n> swap. That tells you which service is consuming the memory before you go looking yourself.\n\nCheck whether a recent change is responsible. Open the host's **History** (Revisions / Deploys) to\nsee if a recent publish raised a worker count or a sizing key; if so, you can roll back.\n\nFor a live view, connect to the host over SSH with your own SSH client, using a key that is listed\non the host's SSH tab. Inspect per-process memory, then check the\nkernel log for OOM-killer events:\n\n```bash\nfree -h # total, used and free memory and swap\nps aux --sort=-%mem | head # top processes by memory use\njournalctl -k | grep -iE 'oom|out of memory' # OOM-killer events\n```"} {"id":"troubleshooting/out-of-memory.md#common-causes-and-fixes","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/#common-causes-and-fixes","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"Common causes and fixes","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"> [!IMPORTANT]\n> Memory sizing on TurboStack is **auto-tuned to your server**. Change a sizing key only with\n> measured evidence, and apply the smallest increase that relieves the pressure. Guessing at\n> larger values commonly makes things worse. See\n> Performance tuning."} {"id":"troubleshooting/out-of-memory.md#php-memory-limit-and-too-many-workers","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/#php-memory-limit-and-too-many-workers","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"PHP `memory_limit` and too many workers","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"Total PHP memory is roughly `memory_limit` multiplied by the number of PHP-FPM workers. A high\n`memory_limit` is usually fine on its own, but combined with many concurrent workers it can exhaust\nRAM under load.\n\n- Right-size `memory_limit` to what the application actually needs - see\n How to override PHP settings.\n- Review the PHP-FPM process-manager limits (max/spare workers) so concurrency matches available\n memory; see Performance tuning. Raise worker counts only\n when you have the headroom."} {"id":"troubleshooting/out-of-memory.md#database-buffer-pool-shared-buffers-too-large","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/#database-buffer-pool-shared-buffers-too-large","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"Database buffer pool / shared buffers too large","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"The database keeps a large in-memory cache. If it is sized too aggressively for the host, it\ncompetes with PHP and the OS for RAM. With evidence (sustained pressure traced to the database),\nadjust the relevant sizing key:\n\n| Key | Engine |\n| --- | --- |\n| `mysql_innodb_size` | MySQL InnoDB buffer pool |\n| `postgresql_shared_buffers` | PostgreSQL shared buffers |\n| `redis_memory` | Redis maximum memory before eviction |\n\nThese are documented in Performance tuning. Apply changes\nin the TurboStack Platform (GUI or Source) and publish."} {"id":"troubleshooting/out-of-memory.md#too-many-processes-competing-for-ram","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/#too-many-processes-competing-for-ram","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"Too many processes competing for RAM","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"Several memory-hungry services on one host (database, Redis, Elasticsearch, Varnish, plus PHP\nworkers) can add up to more than the host has. Confirm the biggest consumer on the **Health** tab\nor over SSH, then either reduce that service's allocation or reduce concurrency elsewhere rather\nthan raising everything at once."} {"id":"troubleshooting/out-of-memory.md#the-host-has-genuinely-outgrown-its-plan","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/#the-host-has-genuinely-outgrown-its-plan","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"The host has genuinely outgrown its plan","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"If usage is legitimate - traffic and data have grown, and every service is already right-sized -\nthe host simply needs more RAM. Upgrade the plan from the Customer Center, or talk to sales to choose a larger host."} {"id":"troubleshooting/out-of-memory.md#prevent-it","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/#prevent-it","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"Prevent it","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"- Treat the auto-tuned defaults as the baseline; override only with evidence and re-measure after\n each change - see Performance tuning.\n- Keep `memory_limit` realistic and worker counts in line with available RAM.\n- Watch the **RAM** and **Memory swap** cards on Health and the\n fleet Monitoring dashboard so you catch a rising trend before it\n becomes an outage."} {"id":"troubleshooting/out-of-memory.md#when-to-contact-support","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/#when-to-contact-support","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"When to contact support","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"Contact Support if the host keeps hitting OOM after right-sizing, if you\nneed to scale the plan, or if a managed service is being killed and you cannot see why. Include the\nhost, the affected domain, what changed recently, and the time of the OOM event so the log can be\ncorrelated."} {"id":"troubleshooting/out-of-memory.md#related","url":"https://docs.turbostack.app/troubleshooting/out-of-memory/#related","path":"troubleshooting/out-of-memory.md","title":"Out of memory (OOM) and memory pressure","heading":"Related","keywords":"out of memory oom memory pressure swap killed process oom killer memory_limit innodb buffer pool","text":"- Performance tuning\n- How to override PHP settings\n- Health\n- High CPU usage and server load\n- Fixing 502, 503 and 504 errors\n- TurboStack CLI"} {"id":"troubleshooting/site-down-5xx.md#intro","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"# Fixing 502, 503 and 504 errors\n\nA 5xx status code means the web server reached your application but did not get a\nusable response back. On TurboStack this almost always points at the PHP backend\nrather than the visitor - and TurboStack gives you the tools to find the cause and\nrecover quickly."} {"id":"troubleshooting/site-down-5xx.md#what-each-code-means","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#what-each-code-means","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"What each code means","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"| Code | Name | What it usually means |\n|---|---|---|\n| **502** | Bad Gateway | The web server (nginx/apache) forwarded the request to PHP-FPM but got an invalid or empty reply. PHP-FPM is typically **down, crashed, or restarting**. |\n| **503** | Service Unavailable | The backend is **temporarily unable** to handle the request. PHP-FPM is overloaded (no free workers), the app is in maintenance mode, or a service is mid-restart. |\n| **504** | Gateway Timeout | PHP-FPM accepted the request but **did not respond in time**. The common cause is a slow query, a stuck external call, or a long-running request that exceeded the timeout. |\n\nIn short: **502** = backend not answering, **503** = backend too busy, **504** =\nbackend too slow."} {"id":"troubleshooting/site-down-5xx.md#symptoms","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#symptoms","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"Symptoms","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"- Visitors see a plain \"502 Bad Gateway\", \"503 Service Unavailable\" or \"504\n Gateway Timeout\" page instead of your site.\n- Errors are intermittent (overload) or constant (a crashed service).\n- The error often starts right after a deploy or a configuration change."} {"id":"troubleshooting/site-down-5xx.md#diagnose-it-on-turbostack","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#diagnose-it-on-turbostack","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"Diagnose it on TurboStack","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"Observe first, then act on the running server.\n\n1. **Health tab.** Open the host's Health tab.\n Check **Top Issues** and the **Services** list for failing web-server or PHP\n checks. Also watch the **CPU**, **RAM** and **swap** cards - a host that is out\n of memory or pinned at 100% CPU will produce 502/503/504s under load.\n2. **History / Revisions.** Open\n Revisions to see whether a recent\n **publish or deploy** coincides with when the errors began. If so, you have a\n strong candidate cause - and the option to roll back.\n3. **Logs over SSH.** Connect via SSH and read the\n web-server and PHP-FPM error logs for the affected application. PHP fatal errors,\n \"unable to connect\" messages to the PHP-FPM socket, and \"max_children reached\"\n warnings each point to a different fix below.\n\n> [!TIP]\n> If errors only appear under traffic spikes, treat it as an overload problem\n> (503/504); if the site is down for every request, treat it as a crashed\n> backend or a bad config (502)."} {"id":"troubleshooting/site-down-5xx.md#a-configuration-change-has-not-been-applied-502","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#a-configuration-change-has-not-been-applied-502","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"A configuration change has not been applied (502)","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"If you just changed the web-server config, the running server may still be using\nthe old (or a broken) configuration. Apply the change safely:\n\n```bash\ntscli nginx reload\n```\n\n`reload` validates the configuration first and applies it without dropping live\nconnections; use `tscli nginx restart` only if a full restart is genuinely\nneeded. See the TurboStack CLI for details."} {"id":"troubleshooting/site-down-5xx.md#php-fpm-is-down-or-has-crashed-502","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#php-fpm-is-down-or-has-crashed-502","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"PHP-FPM is down or has crashed (502)","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"A crashed or stopped PHP-FPM pool is the most common cause of a constant 502.\nFirst reload the web server (above) so it reconnects to the backend. If PHP is\ngenuinely stuck - workers hung and not recovering - you can force a clean restart\nas a **last resort**:\n\n> [!WARNING]\n> `tscli php kill` terminates **all** PHP-FPM workers on the host. Requests in\n> flight are aborted, which can interrupt transactions. Use it only when PHP is\n> stuck and nothing else has recovered it.\n\n```bash\ntscli php kill\n```\n\nPHP-FPM is then restarted by the platform and begins serving again. If PHP keeps\ncrashing, look at the logs for the underlying fatal error (often a memory limit\nor a bug in newly deployed code)."} {"id":"troubleshooting/site-down-5xx.md#php-fpm-is-overloaded-no-free-workers-503","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#php-fpm-is-overloaded-no-free-workers-503","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"PHP-FPM is overloaded - no free workers (503)","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"Under heavy traffic, every PHP-FPM worker can be busy, so new requests are queued\nor refused. Confirm with the Health tab (high CPU/RAM, \"max_children\" in the\nlogs), then:\n\n- Resolve what is consuming the workers - a slow page, a crawler, or a traffic\n spike (see Why is my site slow? and\n High CPU and load).\n- If the host is simply too small for sustained load, increase the PHP-FPM worker\n pool via the per-application PHP-FPM tuning keys in\n Configure PHP, then publish. Raise worker\n counts with care - each worker uses memory, and over-provisioning can push the\n host into swap (see Out of memory)."} {"id":"troubleshooting/site-down-5xx.md#long-running-requests-and-timeouts-504","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#long-running-requests-and-timeouts-504","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"Long-running requests and timeouts (504)","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"A 504 means PHP did not answer in time. Common culprits are slow database\nqueries, large imports/exports, or external API calls that hang.\n\n- For genuinely long operations, raise PHP's `max_execution_time` via the PHP\n advanced options - see\n Override PHP settings. Note that\n the web server also enforces its own proxy/FastCGI read timeout.\n- Better still, move long jobs out of the web request entirely (queues, cron,\n CLI) so visitors are never blocked."} {"id":"troubleshooting/site-down-5xx.md#stale-bytecode-after-a-deploy-502-500","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#stale-bytecode-after-a-deploy-502-500","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"Stale bytecode after a deploy (502/500)","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"After deploying new code, PHP may still be running the old compiled bytecode,\nwhich can cause fatal errors until OPcache is refreshed:\n\n```bash\ntscli opcache clear\n```\n\nThe first request afterwards is slightly slower while scripts recompile - this is\nnormal. See Flush the OPcache."} {"id":"troubleshooting/site-down-5xx.md#prevent-it","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#prevent-it","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"Prevent it","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"- Watch the Health tab and the fleet\n Monitoring dashboard so you catch overload and\n crashes before visitors do.\n- Clear OPcache as part of every deploy, and reload Nginx after config changes.\n- Keep heavy work (imports, reports, third-party calls) out of synchronous web\n requests.\n- Size PHP-FPM workers and memory from evidence, not guesswork - see\n Performance tuning."} {"id":"troubleshooting/site-down-5xx.md#when-to-contact-support","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#when-to-contact-support","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"When to contact support","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"If the host stays unhealthy after the steps above, or PHP-FPM keeps crashing for\nno clear reason, contact Support. Include the host and\ndomain, the exact error code, what changed recently (a publish or deploy), and\nthe relevant log excerpt."} {"id":"troubleshooting/site-down-5xx.md#related","url":"https://docs.turbostack.app/troubleshooting/site-down-5xx/#related","path":"troubleshooting/site-down-5xx.md","title":"Fixing 502, 503 and 504 errors","heading":"Related","keywords":"502 bad gateway 503 service unavailable 504 gateway timeout 5xx error php-fpm down php-fpm crashed gateway timeout reload nginx clear opcache","text":"- TurboStack CLI\n- Configure PHP\n- Override PHP settings\n- Flush the OPcache\n- Out of memory\n- High CPU and load\n- Why is my site slow?\n- Fixing 403, 413 and 429 errors"} {"id":"troubleshooting/site-slow.md#intro","url":"https://docs.turbostack.app/troubleshooting/site-slow/","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"# Why is my site slow?\n\nA slow site usually has one constrained layer - a cold cache, a heavy database\nquery, unexpected traffic, or an undersized server. TurboStack gives you the tools to find which\none it is and fix it, rather than guessing. Always measure before you change anything."} {"id":"troubleshooting/site-slow.md#symptoms","url":"https://docs.turbostack.app/troubleshooting/site-slow/#symptoms","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"Symptoms","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"- Pages take seconds to load, or time out under load.\n- The site is fast for logged-out visitors but slow in the admin or checkout.\n- Slowness comes and goes, or only appears at certain times of day.\n- The first request after a deploy is slow, then it recovers."} {"id":"troubleshooting/site-slow.md#diagnose-it-on-turbostack","url":"https://docs.turbostack.app/troubleshooting/site-slow/#diagnose-it-on-turbostack","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"Diagnose it on TurboStack","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"Start by confirming where the time goes - do not change config without measuring.\n\n1. Open the host's Health tab and read the **Host Monitoring**\n cards: **CPU**, **RAM**, **Memory swap**, and **Disk**. Use the 1H/8H/1D/7D range buttons to\n see whether the pressure is constant or spikes. Sustained high CPU, RAM near full, or any\n active swapping all point to a resource bottleneck.\n2. Check **Top Issues** on the same tab - TurboStack ranks the most important PERFORMANCE and\n STABILITY problems it has detected and suggests a fix.\n3. Look at the **Services** checks (database, cache, web server) and the database/cache hit-ratio\n metrics. A low cache hit ratio means requests are missing the cache and hitting PHP or the\n database directly.\n4. Use the fleet Monitoring dashboard to see trends across hosts and\n any open alerts.\n5. Check **History** (Revisions / Deploys) to see whether a recent publish or deploy coincides with\n the slowdown. If so, that change is the most likely cause and you can roll back.\n\n> [!TIP]\n> Swap activity on the Health tab is the clearest sign of memory pressure. When a host is swapping,\n> everything slows down - treat it as a memory problem first (see\n> Out of memory)."} {"id":"troubleshooting/site-slow.md#cold-or-missing-caches","url":"https://docs.turbostack.app/troubleshooting/site-slow/#cold-or-missing-caches","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"Cold or missing caches","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"After a deploy, a content change, or a cache flush, the caches are empty and every request does\nfull work until they warm up. A persistently low hit ratio (rather than a brief dip) points to a\ncaching layer that is being bypassed or invalidated too often.\n\nTurboStack provides several caching layers - Redis object cache, Varnish full-page cache, and PHP\nOPcache. The fastest safe fix is usually to let the cache warm, and to clear only the layer that is\nserving stale or broken content. Connect over SSH and use `tscli`:\n\n```bash\ntscli varnish clear # purge stale full-page cache\ntscli opcache clear # force PHP to recompile after a code change\n```\n\n- See Clear the Redis cache,\n Clear the Varnish cache, and\n Flush the PHP OPcache for what each command does and what\n to expect.\n- See Performance tuning for how the layers fit together and\n how to size them.\n\n> [!NOTE]\n> `tscli redis clear` flushes the **cache instance (6379)** - all of its databases - while leaving\n> the **persistent instance (6378)** with sessions and queues intact. Expect a temporary slowdown\n> while the cache rebuilds.\n\nAfter clearing, expect the first requests to be slower while the caches refill. Warm critical pages\nby visiting them (or let your sitemap/crawler do it) before judging the result."} {"id":"troubleshooting/site-slow.md#slow-database-queries","url":"https://docs.turbostack.app/troubleshooting/site-slow/#slow-database-queries","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"Slow database queries","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"A single slow or unindexed query can drag down an otherwise healthy site, especially in the admin\nor at checkout. If the database service check shows high load or long query times while CPU and RAM\nlook fine elsewhere, the database is the bottleneck.\n\nSee Database connection and performance problems for how to spot slow\nqueries, read the database logs, and size the buffer pool."} {"id":"troubleshooting/site-slow.md#slow-php-application-code","url":"https://docs.turbostack.app/troubleshooting/site-slow/#slow-php-application-code","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"Slow PHP application code","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"When caches are warm and the database is healthy but pages are still slow, the time is being spent\nin PHP itself. Use the Blackfire profiler to find the exact functions and calls that are slow.\nEnable it temporarily over SSH, profile the slow request, then disable it again:\n\n```bash\ntscli blackfire enable\n# ... reproduce and profile the slow page ...\ntscli blackfire disable\n```\n\n> [!NOTE]\n> `tscli blackfire enable` and `disable` restart PHP-FPM, which briefly interrupts PHP processing.\n> Enable the profiler only while you are actively investigating, and disable it afterwards."} {"id":"troubleshooting/site-slow.md#bot-and-crawler-traffic","url":"https://docs.turbostack.app/troubleshooting/site-slow/#bot-and-crawler-traffic","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"Bot and crawler traffic","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"A surge of automated traffic - aggressive crawlers, scrapers, or a small attack - can saturate PHP\nand the database even when nothing else changed. On the Health graphs this shows up as a traffic\nspike that tracks the slowdown.\n\nTurboShield watches request rates and throttles abusive clients automatically. Clients that exceed\nthe limit receive a soft `429` response - a brief slowdown, not a firewall ban.\nRaising the protection level (`low` / `medium` / `high` / `attack`) tightens the limits during an\nevent. See What is TurboShield?.\n\nFor a single clearly abusive address you can also block it directly:\n\n```bash\ntscli firewall check 203.0.113.10\ntscli firewall block 203.0.113.10\n```"} {"id":"troubleshooting/site-slow.md#undersized-or-saturated-resources","url":"https://docs.turbostack.app/troubleshooting/site-slow/#undersized-or-saturated-resources","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"Undersized or saturated resources","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"If CPU is pinned, RAM is full, or the host is swapping under normal traffic - with warm caches and\nno runaway query - the server has insufficient capacity for the current load. See\nHigh CPU and load and Out of memory to confirm."} {"id":"troubleshooting/site-slow.md#when-to-optimize-vs-scale","url":"https://docs.turbostack.app/troubleshooting/site-slow/#when-to-optimize-vs-scale","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"When to optimize vs. scale","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"Optimize first, scale second:\n\n- **Optimize** when the bottleneck is one layer: a cold or bypassed cache, a slow query, or\n inefficient PHP. Fixing the root cause is cheaper and faster than adding hardware.\n- **Scale** (or raise an auto-tuned sizing key with evidence) only when the host is consistently\n resource-bound under legitimate traffic *after* caches are warm and code and queries are tuned.\n Adding capacity to mask an unindexed query or a misconfigured cache just postpones the problem.\n\nThe sizing keys (`mysql_innodb_size`, `redis_memory`, `varnish_cache_size`, and others) are\nauto-tuned to the server. Override them only with measured evidence - see\nPerformance tuning."} {"id":"troubleshooting/site-slow.md#prevent-it","url":"https://docs.turbostack.app/troubleshooting/site-slow/#prevent-it","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"Prevent it","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"- Keep caching enabled and warm; clear caches surgically, not reflexively.\n- Set a `monitoring_url` on every production application so you are alerted to slowdowns early\n (see Monitoring).\n- Profile heavy pages with Blackfire before they become a problem.\n- Let TurboShield manage traffic rather than chasing individual bots.\n- Make permanent config changes in the TurboStack Platform and a publish - `tscli` acts on the running\n server now but does not change saved config."} {"id":"troubleshooting/site-slow.md#when-to-contact-support","url":"https://docs.turbostack.app/troubleshooting/site-slow/#when-to-contact-support","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"When to contact support","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"If the host stays slow after you have warmed the caches, ruled out the database, and confirmed it\nis not traffic - or if a managed layer looks misconfigured - open a ticket at\nSupport. Include the host and domain, what changed (and when), the Health\ngraphs or Top Issues you are seeing, and any relevant log output."} {"id":"troubleshooting/site-slow.md#related","url":"https://docs.turbostack.app/troubleshooting/site-slow/#related","path":"troubleshooting/site-slow.md","title":"Why is my site slow?","heading":"Related","keywords":"site slow application slow magento slow improve performance slow page load cache hit ratio Blackfire bot traffic","text":"- Performance tuning\n- Database connection and performance problems\n- High CPU and load\n- Out of memory\n- TurboStack CLI\n- What is TurboShield?\n- Health"} {"id":"troubleshooting/tls-certificate-issues.md#intro","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"# TLS certificate problems\n\nTurboStack issues and renews Let's Encrypt certificates automatically, so most HTTPS\nproblems are caused by Domain Name System (DNS) issues or by how the site links to its own resources. This page covers the common\ncases - a certificate that never issues, a renewal that fails, and browser warnings - and how to\nfix each one safely.\n\n> [!NOTE]\n> With `cert_type: letsencrypt`, issuance and renewal are **fully managed**. TurboStack requests\n> the certificate during publishing and renews it well before expiry - you do not run any\n> certificate commands yourself."} {"id":"troubleshooting/tls-certificate-issues.md#symptoms","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#symptoms","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"Symptoms","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"- The site loads over `http://` but `https://` fails to connect or shows no certificate.\n- The browser shows a padlock warning, \"Not secure\", or \"Your connection is not private\".\n- A previously working certificate has expired or stopped renewing.\n- The page is HTTPS but elements (images, scripts) fail to load with mixed-content warnings."} {"id":"troubleshooting/tls-certificate-issues.md#diagnose-it-on-turbostack","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#diagnose-it-on-turbostack","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"Diagnose it on TurboStack","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"1. **Check the certificate status.** Open the host's **Applications** tab and review the application's\n **Hostnames** / Transport Layer Security (TLS) settings - confirm `cert_type` is `letsencrypt` and that every hostname the\n site answers to is listed in `server_name`. See\n TLS certificates.\n2. **Check DNS.** A certificate cannot be issued until the domain resolves to the host. Confirm the\n A/AAAA records point at the server's public IPs - see\n Connecting your domain.\n3. **Check what the browser reports.** Click the padlock to see the certificate's domains and expiry\n date. The error message usually names the exact problem (wrong domain, expired, self-signed).\n4. **Check recent changes.** If HTTPS broke after a change, review the host's **History** to see\n whether a recent publish changed `server_name`, `cert_type`, or `cert_challenge`.\n\n> [!TIP]\n> To check the certificate and its chain from outside the server, test the site with an external\n> tool such as the SSL Labs Server Test or the\n> GlobalSign SSL Check. They report the certificate's validity,\n> the full chain, and the expiry date as a visitor's browser sees them."} {"id":"troubleshooting/tls-certificate-issues.md#certificate-not-issued-dns-isn-t-pointing-at-the-host-yet","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#certificate-not-issued-dns-isn-t-pointing-at-the-host-yet","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"Certificate not issued - DNS isn't pointing at the host yet","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"This is the most common cause. With the default **HTTP challenge**, Let's Encrypt validates\nownership by connecting to your domain over HTTP and expecting to reach this server. If the domain\ndoesn't resolve to the host - or still points at an old server - validation fails and no certificate\nis issued.\n\n**Fix:**\n\n1. Point the domain at the host's public IPv4 (and IPv6) addresses, then wait for DNS to propagate - \n see Connecting your domain.\n2. Make sure every name in `server_name` resolves to the host, including `www`.\n3. Publish again so TurboStack re-requests the certificate.\n\n> [!TIP]\n> For a domain that isn't pointed at the server yet, or for a **wildcard** (`*.example.com`)\n> certificate, use the **DNS challenge** instead - see\n> TLS certificates."} {"id":"troubleshooting/tls-certificate-issues.md#renewal-failed","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#renewal-failed","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"Renewal failed","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"Renewal is automatic, but it can still fail if the conditions that allowed issuance have since\nchanged. Common examples: DNS was repointed elsewhere, a hostname was added to `server_name` that\ndoes not resolve, or a redirect now blocks the Let's Encrypt validation path.\n\n**Fix:**\n\n1. Confirm DNS for every hostname still points at this host.\n2. Make sure plain HTTP on the validation path is reachable. A blanket force-HTTPS redirect is fine\n on TurboStack, because the platform handles the ACME challenge. However, a custom redirect or\n rule that returns errors for all HTTP requests can block validation.\n3. Re-trigger by publishing the host; TurboStack will attempt\n issuance again.\n\nIf renewal keeps failing after DNS and reachability are confirmed, contact support."} {"id":"troubleshooting/tls-certificate-issues.md#browser-warning-wrong-or-missing-domain","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#browser-warning-wrong-or-missing-domain","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"Browser warning: wrong or missing domain","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"If you reach the site by a hostname that is not listed on the certificate, the browser reports a\nname mismatch. This happens with a bare subdomain, or `www` when only the apex domain was added.\n\n**Fix:** add every hostname the site serves to `server_name` (space-separated) so they're all\ncovered by one certificate, then publish. See\nTLS certificates."} {"id":"troubleshooting/tls-certificate-issues.md#browser-warning-certificate-expired","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#browser-warning-certificate-expired","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"Browser warning: certificate expired","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"A managed Let's Encrypt certificate should never expire on its own. If a browser reports an expired\ncertificate, it usually means renewal has been failing for some time (see **Renewal failed** above)\nor the browser cached an old certificate. Reload after fixing renewal; if it persists, publish to\nforce a fresh issuance."} {"id":"troubleshooting/tls-certificate-issues.md#browser-warning-not-trusted-self-signed","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#browser-warning-not-trusted-self-signed","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"Browser warning: not trusted / self-signed","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"A \"not trusted\" warning where you expected a public certificate usually means the application is still\nset to `cert_type: selfsigned` (intended for internal or test sites). Switch it to `letsencrypt`\nand publish - see TLS certificates."} {"id":"troubleshooting/tls-certificate-issues.md#mixed-content-padlock-shows-a-warning","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#mixed-content-padlock-shows-a-warning","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"Mixed content - padlock shows a warning","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"The page itself is served over HTTPS, but it links to some resources (images, CSS, scripts) using\nhard-coded `http://` URLs. Browsers block or flag this insecure content.\n\n**Fix:** update the application so it generates HTTPS (or protocol-relative) URLs. In most CMS and\ne-commerce apps this means setting the site's base/secure URL to `https://`. Use the browser's\ndeveloper console to find which resources are still requested over HTTP."} {"id":"troubleshooting/tls-certificate-issues.md#https-works-but-http-isn-t-redirected","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#https-works-but-http-isn-t-redirected","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"HTTPS works but HTTP isn't redirected","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"If both `http://` and `https://` serve the site, force all traffic onto HTTPS so visitors always get\nthe secure version - see How to force HTTPS. On TurboStack\nthis is the recommended setup; the platform still allows Let's Encrypt's validation requests through."} {"id":"troubleshooting/tls-certificate-issues.md#prevent-it","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#prevent-it","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"Prevent it","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"- Point DNS at the host **before** requesting a certificate, and keep records current when you\n migrate (Connecting your domain).\n- Keep `cert_type: letsencrypt` and list every hostname in `server_name`.\n- Force HTTPS site-wide and fix mixed content at the source\n (Force HTTPS).\n- Follow the Security hardening checklist for TLS best\n practices."} {"id":"troubleshooting/tls-certificate-issues.md#when-to-contact-support","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#when-to-contact-support","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"When to contact support","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"If DNS resolves correctly, the HTTP validation path is reachable, and a certificate still won't\nissue or renew, contact support. Include the **host**, the affected\n**domain(s)**, the exact browser error, and what changed recently (DNS move, new hostname, redirect\nrule)."} {"id":"troubleshooting/tls-certificate-issues.md#related","url":"https://docs.turbostack.app/troubleshooting/tls-certificate-issues/#related","path":"troubleshooting/tls-certificate-issues.md","title":"TLS certificate problems","heading":"Related","keywords":"tls certificate error ssl not working certificate not renewing https not secure lets encrypt failed mixed content certificate expired","text":"- TLS certificates - certificate types and where to check status.\n- Connecting your domain - DNS prerequisites for issuance.\n- How to force HTTPS - redirect HTTP to HTTPS correctly.\n- Security hardening checklist.\n- Publishing - re-trigger issuance.\n- Troubleshooting overview."} {"id":"trust/access-and-encryption.md#intro","url":"https://docs.turbostack.app/trust/access-and-encryption/","path":"trust/access-and-encryption.md","title":"Access control and encryption","heading":"","keywords":"ssh access key based authentication tls encryption https secure access","text":"# Access control and encryption\n\nAccess to your host is controlled with keys and permissions, and traffic to your applications is\nencrypted in transit."} {"id":"trust/access-and-encryption.md#key-based-access","url":"https://docs.turbostack.app/trust/access-and-encryption/#key-based-access","path":"trust/access-and-encryption.md","title":"Access control and encryption","heading":"Key-based access","keywords":"ssh access key based authentication tls encryption https secure access","text":"Server access uses **public-key SSH authentication**. You can disable password authentication and run\nSSH on a custom port. Manage keys per person (and at group level) so you can grant and revoke access\ncleanly. See SSH access."} {"id":"trust/access-and-encryption.md#encryption-in-transit","url":"https://docs.turbostack.app/trust/access-and-encryption/#encryption-in-transit","path":"trust/access-and-encryption.md","title":"Access control and encryption","heading":"Encryption in transit","keywords":"ssh access key based authentication tls encryption https secure access","text":"Applications are served over **HTTPS** with free Let's Encrypt certificates that renew automatically, so\ndata between your visitors and the server is encrypted. See\nTLS certificates."} {"id":"trust/access-and-encryption.md#controlling-who-can-do-what","url":"https://docs.turbostack.app/trust/access-and-encryption/#controlling-who-can-do-what","path":"trust/access-and-encryption.md","title":"Access control and encryption","heading":"Controlling who can do what","keywords":"ssh access key based authentication tls encryption https secure access","text":"- Give people their own Customer Center access through\n contacts and teams, with only the permissions\n they need.\n- Protect your account with two-factor authentication.\n- On the TurboStack Platform, access is scoped to your account, and a single login can manage several accounts.\n\n> [!NOTE]\n> For details on encryption at rest for your specific plan, contact support."} {"id":"trust/access-and-encryption.md#related","url":"https://docs.turbostack.app/trust/access-and-encryption/#related","path":"trust/access-and-encryption.md","title":"Access control and encryption","heading":"Related","keywords":"ssh access key based authentication tls encryption https secure access","text":"- SSH access\n- TLS certificates\n- Two-factor authentication\n- Security hardening"} {"id":"trust/backups-and-recovery.md#intro","url":"https://docs.turbostack.app/trust/backups-and-recovery/","path":"trust/backups-and-recovery.md","title":"Backups and recovery","heading":"","keywords":"backups restore backup disaster recovery data recovery off-site backup retention","text":"# Backups and recovery\n\nHosted Power takes managed backups of your environment as part of the Service Level Agreement (SLA),\nso you can recover after a mistake, a bad deploy, or an incident."} {"id":"trust/backups-and-recovery.md#automatic-backups","url":"https://docs.turbostack.app/trust/backups-and-recovery/#automatic-backups","path":"trust/backups-and-recovery.md","title":"Backups and recovery","heading":"Automatic backups","keywords":"backups restore backup disaster recovery data recovery off-site backup retention","text":"- Backups run **daily** and are kept for **20 days**. This applies to every TurboStack environment,\n whichever SLA tier you are on. Need a longer retention or extra snapshots? Ask\n Support.\n- They cover your environment - the application files and databases on the host.\n- Because the platform backs up daily for you, running your own daily backup on the host is usually\n redundant and just consumes disk - see Disk full."} {"id":"trust/backups-and-recovery.md#restoring-data","url":"https://docs.turbostack.app/trust/backups-and-recovery/#restoring-data","path":"trust/backups-and-recovery.md","title":"Backups and recovery","heading":"Restoring data","keywords":"backups restore backup disaster recovery data recovery off-site backup retention","text":"You restore from the host's Backups tab - browse the backup jobs,\nopen a backup's contents, and restore files or a database (restore to staging first to verify, when\nyou can).\n\n> [!NOTE]\n> Restores are included in the price and service. The time needed to perform a restore falls outside\n> the SLA response window. For a large or urgent recovery, contact support."} {"id":"trust/backups-and-recovery.md#related","url":"https://docs.turbostack.app/trust/backups-and-recovery/#related","path":"trust/backups-and-recovery.md","title":"Backups and recovery","heading":"Related","keywords":"backups restore backup disaster recovery data recovery off-site backup retention","text":"- Backups (Hosts tab)\n- How we protect your platform\n- Support"} {"id":"trust/ddos-and-abuse-protection.md#intro","url":"https://docs.turbostack.app/trust/ddos-and-abuse-protection/","path":"trust/ddos-and-abuse-protection.md","title":"DDoS and abuse protection","heading":"","keywords":"ddos protection abuse protection bot mitigation rate limiting turboshield","text":"# DDoS and abuse protection\n\nA Distributed Denial-of-Service (DDoS) attack floods your environment with traffic so that real\nvisitors can no longer reach it. Hosted Power mitigates this at the network and application level."} {"id":"trust/ddos-and-abuse-protection.md#how-attacks-are-mitigated","url":"https://docs.turbostack.app/trust/ddos-and-abuse-protection/#how-attacks-are-mitigated","path":"trust/ddos-and-abuse-protection.md","title":"DDoS and abuse protection","heading":"How attacks are mitigated","keywords":"ddos protection abuse protection bot mitigation rate limiting turboshield","text":"- **Rate limiting.** TurboShield caps abusive request rates per IP and returns a soft HTTP 429 instead\n of serving the flood. It also caps how many concurrent connections a single IP may hold. That cap\n scales with the TurboShield level (from 160 connections at the lowest level down to 60 in attack\n mode) and is kept deliberately high so legitimate HTTP/2 and HTTP/3 clients, which open many parallel\n streams, are not blocked by mistake. See TurboShield.\n- **High availability.** The platform runs active/passive VIP failover with keepalived: if the active\n node fails under load, the virtual IP moves to a standby node so the service stays reachable. This is\n failover for resilience, not an application-layer traffic filter.\n- **Blackhole routing.** Attack traffic can be routed into a \"black hole\" and discarded before it\n reaches the host.\n- **Reputation-based blocking.** The firewall bans known-bad\n and repeat-offender IPs automatically.\n\nFor very large attacks, a third-party DDoS-protection service (such as Cloudflare) can be added in\nfront for extra capacity."} {"id":"trust/ddos-and-abuse-protection.md#what-to-do-during-an-attack","url":"https://docs.turbostack.app/trust/ddos-and-abuse-protection/#what-to-do-during-an-attack","path":"trust/ddos-and-abuse-protection.md","title":"DDoS and abuse protection","heading":"What to do during an attack","keywords":"ddos protection abuse protection bot mitigation rate limiting turboshield","text":"1. Raise the host's TurboShield level to **attack** while the incident lasts, then return it to\n **medium** afterwards - see Configure TurboShield.\n2. Block or allow specific IPs from the TurboStack CLI (`tscli firewall block`,\n `tscli firewall whitelist`).\n3. If the attack overwhelms the host, contact support - the on-call team\n can mitigate at the network level and escalate to the cloud provider if needed."} {"id":"trust/ddos-and-abuse-protection.md#related","url":"https://docs.turbostack.app/trust/ddos-and-abuse-protection/#related","path":"trust/ddos-and-abuse-protection.md","title":"DDoS and abuse protection","heading":"Related","keywords":"ddos protection abuse protection bot mitigation rate limiting turboshield","text":"- How we protect your platform\n- TurboShield\n- Firewall\n- TurboStack CLI"} {"id":"trust/how-we-protect-you.md#intro","url":"https://docs.turbostack.app/trust/how-we-protect-you/","path":"trust/how-we-protect-you.md","title":"How we protect your platform","heading":"","keywords":"platform security server hardening automatic updates turboshield turboradar malware scanning","text":"# How we protect your platform\n\nEvery TurboStack host runs several security layers that Hosted Power manages for you. You do not\nconfigure these - they are on by default and kept up to date centrally."} {"id":"trust/how-we-protect-you.md#hardened-base-with-automatic-updates","url":"https://docs.turbostack.app/trust/how-we-protect-you/#hardened-base-with-automatic-updates","path":"trust/how-we-protect-you.md","title":"How we protect your platform","heading":"Hardened base with automatic updates","keywords":"platform security server hardening automatic updates turboshield turboradar malware scanning","text":"Hosts run a hardened operating system, and security updates are applied automatically. The platform\nchecks for updates several times a day and patches centrally, so known vulnerabilities are closed\nquickly without action from you."} {"id":"trust/how-we-protect-you.md#firewall","url":"https://docs.turbostack.app/trust/how-we-protect-you/#firewall","path":"trust/how-we-protect-you.md","title":"How we protect your platform","heading":"Firewall","keywords":"platform security server hardening automatic updates turboshield turboradar malware scanning","text":"A firewall runs on every host and reacts to abuse within seconds. It watches failed logins across\nservices (SSH, FTP, mail and HTTP) and bans repeat offenders automatically. See\nFirewall."} {"id":"trust/how-we-protect-you.md#turboshield","url":"https://docs.turbostack.app/trust/how-we-protect-you/#turboshield","path":"trust/how-we-protect-you.md","title":"How we protect your platform","heading":"TurboShield","keywords":"platform security server hardening automatic updates turboshield turboradar malware scanning","text":"TurboShield rate-limits traffic per visitor and classifies bots, throttling abusive request rates\nbefore they overload the host. A throttled client receives a soft HTTP 429 response rather than a\nhard ban. See TurboShield and\nDDoS and abuse protection."} {"id":"trust/how-we-protect-you.md#turboradar-and-malware-protection","url":"https://docs.turbostack.app/trust/how-we-protect-you/#turboradar-and-malware-protection","path":"trust/how-we-protect-you.md","title":"How we protect your platform","heading":"TurboRadar and malware protection","keywords":"platform security server hardening automatic updates turboshield turboradar malware scanning","text":"TurboRadar provides runtime threat detection and scans for commerce malware, watching for suspicious\nprocess behavior and known-bad files after your application is deployed. It **detects and reports** -\nfindings surface in the host's Threat Center. Actively blocking\nmalicious requests - injection attempts, distributed brute-force attacks and known exploits - is done\nby the Web Application Firewall (WAF), TurboShield and the Firewall."} {"id":"trust/how-we-protect-you.md#encryption-backups-and-traffic-protection","url":"https://docs.turbostack.app/trust/how-we-protect-you/#encryption-backups-and-traffic-protection","path":"trust/how-we-protect-you.md","title":"How we protect your platform","heading":"Encryption, backups and traffic protection","keywords":"platform security server hardening automatic updates turboshield turboradar malware scanning","text":"- **Free SSL/TLS** (Secure Sockets Layer / Transport Layer Security) for your applications - see Access control and encryption.\n- **Managed daily backups** - see Backups and recovery.\n- **Network-level Distributed Denial-of-Service (DDoS) mitigation** - see DDoS and abuse protection."} {"id":"trust/how-we-protect-you.md#related","url":"https://docs.turbostack.app/trust/how-we-protect-you/#related","path":"trust/how-we-protect-you.md","title":"How we protect your platform","heading":"Related","keywords":"platform security server hardening automatic updates turboshield turboradar malware scanning","text":"- Threat Center\n- Security overview\n- Security hardening (your part)"} {"id":"trust/index.md#intro","url":"https://docs.turbostack.app/trust/","path":"trust/index.md","title":"Trust and security","heading":"","keywords":"turbostack security hosted power security is turbostack secure managed hosting security","text":"# Trust and security\n\nTurboStack is a **fully managed** platform: Hosted Power secures, patches and maintains the underlying\nservers so you can focus on your application. This section explains what is handled for you, and where\nyour own responsibility begins."} {"id":"trust/index.md#what-managed-and-secured-means","url":"https://docs.turbostack.app/trust/#what-managed-and-secured-means","path":"trust/index.md","title":"Trust and security","heading":"What \"managed and secured\" means","keywords":"turbostack security hosted power security is turbostack secure managed hosting security","text":"On every host, the platform provides:\n\n- A hardened operating system with **automatic security updates**.\n- A **firewall** on every host and **TurboShield** rate limiting and bot control.\n- **TurboRadar** runtime threat detection and malware scanning.\n- **Malware protection** and a **Web Application Firewall (WAF)**.\n- Free **SSL/TLS** (Secure Sockets Layer / Transport Layer Security) encryption and **managed daily backups**.\n- Network-level **Distributed Denial-of-Service (DDoS)** mitigation.\n\nSee How we protect your platform for the detail."} {"id":"trust/index.md#shared-responsibility","url":"https://docs.turbostack.app/trust/#shared-responsibility","path":"trust/index.md","title":"Trust and security","heading":"Shared responsibility","keywords":"turbostack security hosted power security is turbostack secure managed hosting security","text":"Security is shared between Hosted Power and you:\n\n| Hosted Power handles | You handle |\n|---|---|\n| Server hardening, OS and platform patching | Keeping your application, plugins and themes up to date |\n| Firewall, TurboShield, TurboRadar, WAF, DDoS mitigation | Strong passwords, who you grant access to, and your own data |\n| Managed backups and the network | App-level configuration and which services you expose |\n\nYour part is covered in the Security hardening checklist."} {"id":"trust/index.md#in-this-section","url":"https://docs.turbostack.app/trust/#in-this-section","path":"trust/index.md","title":"Trust and security","heading":"In this section","keywords":"turbostack security hosted power security is turbostack secure managed hosting security","text":"- How we protect your platform\n- DDoS and abuse protection\n- Backups and recovery\n- Access control and encryption\n- Reporting a security issue"} {"id":"trust/index.md#related","url":"https://docs.turbostack.app/trust/#related","path":"trust/index.md","title":"Trust and security","heading":"Related","keywords":"turbostack security hosted power security is turbostack secure managed hosting security","text":"- Security overview\n- Security hardening (your part)\n- Support"} {"id":"trust/responsible-disclosure.md#intro","url":"https://docs.turbostack.app/trust/responsible-disclosure/","path":"trust/responsible-disclosure.md","title":"Reporting a security issue","heading":"","keywords":"report vulnerability responsible disclosure security contact security issue","text":"# Reporting a security issue\n\nIf you discover a security vulnerability in TurboStack or your hosted environment, please report it to\nus so we can fix it. We appreciate responsible disclosure."} {"id":"trust/responsible-disclosure.md#how-to-report","url":"https://docs.turbostack.app/trust/responsible-disclosure/#how-to-report","path":"trust/responsible-disclosure.md","title":"Reporting a security issue","heading":"How to report","keywords":"report vulnerability responsible disclosure security contact security issue","text":"Email **support@hosted-power.com** with the details. Include:\n\n- What you found and the **potential impact**.\n- The **affected host, domain or URL**.\n- Clear **steps to reproduce** it.\n- How we can **reach you** for follow-up.\n\nWe will acknowledge your report and work with you on a fix."} {"id":"trust/responsible-disclosure.md#please-do","url":"https://docs.turbostack.app/trust/responsible-disclosure/#please-do","path":"trust/responsible-disclosure.md","title":"Reporting a security issue","heading":"Please do","keywords":"report vulnerability responsible disclosure security contact security issue","text":"- Report the issue privately and give us reasonable time to resolve it before disclosing it.\n- Only test against your own environment."} {"id":"trust/responsible-disclosure.md#please-do-not","url":"https://docs.turbostack.app/trust/responsible-disclosure/#please-do-not","path":"trust/responsible-disclosure.md","title":"Reporting a security issue","heading":"Please do not","keywords":"report vulnerability responsible disclosure security contact security issue","text":"- Access, modify or delete data that is not yours.\n- Run disruptive tests (for example denial-of-service) or anything that degrades the service for\n others."} {"id":"trust/responsible-disclosure.md#related","url":"https://docs.turbostack.app/trust/responsible-disclosure/#related","path":"trust/responsible-disclosure.md","title":"Reporting a security issue","heading":"Related","keywords":"report vulnerability responsible disclosure security contact security issue","text":"- How we protect your platform\n- Support"}