# TurboStack YAML configuration parameters

> Machine-readable reference of every YAML key of a TurboStack host configuration.
> One block per parameter. Scope tells you where the key belongs: `host` at the top level,
> `system_user` under `system_users[]`, `application` under `system_users[].vhosts[]`.
> Human documentation: https://docs.turbostack.app/reference/yaml/
> Full documentation index: https://docs.turbostack.app/llms.txt


## Application parameters

### server_name
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: common
does: The domain names this application answers on, separated by spaces.
why: This is the application's address. Without it the application is not reachable.
requires: Required. Must be unique across the host.

### app_type
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: common
does: Tells TurboStack which application to provision, so it applies the right web server rules, caching and file layout.
why: Saves you from configuring the stack by hand for a known application.
requires: Leave it empty for a plain PHP site. The GUI dropdown lists the currently supported types.

### app_install
scope: application
type: boolean
default: false
set_in: YAML only
frequency: moderate
does: Actually runs the installer for the chosen application type, instead of only preparing the configuration.
why: Get a working installation without downloading and installing the software yourself.

### app_name
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: moderate
does: Names a secondary application under the same system user, in its own subfolder.
why: Run several applications under one account, for example a shop and a separate blog.
requires: Lowercase letters and digits, starting with a letter, at most 33 characters. Only one application per user may leave this empty.

### monitoring_url
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: moderate
does: The URL that uptime monitoring requests for this application.
why: Point monitoring at a health-check endpoint instead of the homepage.

### cert_type
scope: application
type: string
allowed: letsencrypt | selfsigned | custom
default: none
set_in: GUI or YAML
frequency: common
does: Selects where the certificate comes from - issued automatically, self-signed, or supplied by you.
why: Choose `letsencrypt` for free automatic HTTPS that renews itself, or `custom` for a certificate you bought.
requires: Required once `server_name` is set.

### cert_fullchain
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: moderate
does: The certificate chain, in PEM format, for a certificate you supply yourself.
why: Use a certificate from your own supplier, for example an extended-validation certificate.
requires: Only with `cert_type: custom`. Must match `cert_pvk`, which is verified before deployment.

### cert_pvk
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: moderate
does: The private key, in PEM format, belonging to `cert_fullchain`.
why: Required alongside your own certificate.
requires: Only with `cert_type: custom`.
warning: A mismatch between key and certificate stops the deployment.

### cert_challenge
scope: application
type: string
allowed: http | dns
default: http
set_in: GUI or YAML
frequency: moderate
does: How ownership of the domain is proven when a certificate is issued.
why: Domain Name System (DNS) validation is the only way to get a wildcard certificate, and it works before the domain points at the server.

### cert_provider
scope: application
type: string
allowed: hostedpower | cloudflare
default: none
set_in: GUI or YAML
frequency: moderate
does: Which DNS provider is used for DNS validation.
why: Lets the platform create the validation record for you automatically.
requires: Only with `cert_challenge: dns`.

### cert_cloudflare_api_token
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: The API token used to create the DNS validation record.
why: Needed when your domain is managed at Cloudflare and you use DNS validation.
requires: Only with `cert_provider: cloudflare`.

### php_version
scope: application
type: string
unit: version
default: none
set_in: GUI or YAML
frequency: common
does: The PHP version this application runs on, with its own process pool.
why: Match the version your application supports, and upgrade one application at a time.
requires: Quote the value, for example `"8.4"`. The GUI dropdown lists the installed versions.

### nodejs_version
scope: application
type: string
unit: version
default: none
set_in: GUI or YAML
frequency: moderate
does: Installs the given Node.js major version for this application.
why: Run a Node.js application. Setting this key is what enables the runtime.
requires: Quote the value, for example `"24"`. Usually combined with `proxy_enabled`.

### python_version
scope: application
type: string
unit: version
default: none
set_in: GUI or YAML
frequency: moderate
does: Installs the given Python version for this application.
why: Run a Python application.

### ruby_version
scope: application
type: string
unit: version
default: none
set_in: GUI or YAML
frequency: expert
does: Installs the given Ruby version for this application.
why: Run a Ruby application such as Rails.

### ruby_start_cmd
scope: application
type: string
default: A standard Puma start command
set_in: GUI or YAML
frequency: expert
does: The command used to start the Ruby application server.
why: Use a different application server than the default.

### ruby_sidekiq
scope: application
type: boolean
default: false
set_in: GUI or YAML
frequency: expert
does: Runs a Sidekiq background-worker service for this application.
why: Process background jobs for a Ruby application.

### ruby_sidekiq_cmd
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: Overrides the command used to start Sidekiq.
why: Pass your own queue or concurrency options.

### dotnet_version
scope: application
type: string
unit: version
default: none
set_in: GUI or YAML
frequency: expert
does: Installs the given .NET version and runs your application as a service behind the web server.
why: Run a .NET application.

### docker_enabled
scope: application
type: boolean
default: false
set_in: GUI or YAML
frequency: moderate
does: Allows this application's system user to run containers.
why: Run a containerized application, with the web server proxying to the container.
requires: Usually combined with `proxy_enabled` and `proxy_upstream_port`.

### k8s_enabled
scope: application
type: boolean
default: false
set_in: GUI or YAML
frequency: expert
does: Installs a lightweight Kubernetes orchestrator on the host.
why: Run container workloads that need orchestration.

### rabbitmq_enabled
scope: application
type: boolean
default: false
set_in: GUI or YAML
frequency: moderate
does: Provisions a message-broker account for this application, and installs the broker on the host if needed.
why: Applications that process work in the background, such as OroCommerce, need a message broker.

### git
scope: application
type: list
default: empty
set_in: GUI or YAML
frequency: moderate
does: The repositories that are cloned and kept up to date for this application.
why: Deploy from your own repository instead of copying files to the server by hand.
requires: The clone runs as the account that owns the application, so the files get the right owner straight away.

### git.repo
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: moderate
does: The address of the repository to clone, either an HTTPS or an SSH address.
why: Tells the platform where your code lives.
requires: Required for every entry. An entry without it is skipped.

### git.version
scope: application
type: string
default: main
set_in: GUI or YAML
frequency: moderate
does: Which branch, tag or commit is checked out.
why: Follow a branch on a staging host, and pin a production host to a released tag.

### git.path
scope: application
type: string
default: The account's own folder
set_in: GUI or YAML
frequency: moderate
does: Where the repository is placed, relative to the account's folder.
why: Put the code straight into the folder the application is served from, for example `public_html`.
requires: The path is read as relative to the account's folder, so a leading slash is ignored. Leave it empty to clone into the account's folder itself.

### varnish_enabled
scope: application
type: boolean
default: false
set_in: GUI or YAML
frequency: common
does: Puts this application behind the full-page cache.
why: The single biggest speed win for PHP storefronts such as Magento and Shopware.
requires: Nothing at host level - turning this on is what installs Varnish on the host, and the platform picks the version. The host keys under Caching and queues only tune it. Do not use this for Node.js applications.

### proxy_enabled
scope: application
type: boolean
default: false
set_in: GUI or YAML
frequency: common
does: Makes the web server forward requests to an application running on a local port.
why: The standard way to publish a Node.js, Python, .NET or containerized application.

### proxy_upstream_port
scope: application
type: integer
unit: port
default: 3000
set_in: GUI or YAML
frequency: common
does: The local port your application listens on.
why: Tells the web server where to send the requests.
requires: Required when `proxy_enabled` is true.

### proxy_upstream_host
scope: application
type: string
default: 127.0.0.1
set_in: GUI or YAML
frequency: expert
does: The address the web server forwards to.
why: Only change it when the application runs somewhere other than this server.

### php_fpm_pm_max_children
scope: application
type: integer
unit: count
default: Inherited from the host
set_in: YAML only
frequency: expert
does: The maximum number of PHP processes this application may run at once.
why: Raise it for a busy application, lower it to stop one application using all the memory.
warning: Too high a value can exhaust server memory and take down every application on the host.

### php_fpm_pm_start_servers
scope: application
type: integer
unit: count
default: Inherited from the host
set_in: GUI or YAML
frequency: expert
does: How many PHP processes are started immediately.
why: Reduces warm-up delay after a restart on a busy application.

### php_fpm_pm_min_spare_servers
scope: application
type: integer
unit: count
default: Inherited from the host
set_in: GUI or YAML
frequency: expert
does: The minimum number of idle PHP processes kept ready.
why: Absorbs traffic spikes without waiting for new processes.

### php_fpm_pm_max_spare_servers
scope: application
type: integer
unit: count
default: Inherited from the host
set_in: GUI or YAML
frequency: expert
does: The maximum number of idle PHP processes kept ready.
why: Frees memory again after a spike.

### php_fpm_pm_max_requests
scope: application
type: integer
unit: count
default: Inherited from the host
set_in: YAML only
frequency: expert
does: How many requests a PHP process handles before it is recycled.
why: Recycling limits the impact of memory leaks in application code.

### php_enhance
scope: application
type: boolean
default: false
set_in: YAML only
frequency: expert
does: Stops PHP from checking whether source files changed on disk.
why: A real speed gain on production applications that are deployed, not edited live.
warning: Code changes are ignored until PHP is reloaded. Never use it on a site you edit directly.

### php_opcache_preload_script
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: Loads your framework into memory once at startup, instead of on every request.
why: A large speed gain for frameworks that support preloading, such as Symfony and Laravel.
requires: Only one application per PHP version may set this, and the file must exist. Otherwise the deployment fails.

### php_user_tmp_dir
scope: application
type: boolean
default: false
set_in: YAML only
frequency: expert
does: Gives this application its own temporary folder instead of the shared one.
why: Keeps sessions and uploads separated between applications on the same host.

### newrelic_appname
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: The name this application reports under in New Relic.
why: Recognise the application in your monitoring dashboard.

### newrelic_license
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: The licence key used to send performance data.
why: Enables application performance monitoring for this application only.

### tideways_apikey
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: The key used to send profiling data to Tideways.
why: Find slow code paths in a PHP application.

### tideways_service
scope: application
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: The service name this application reports under.
why: Separate several applications in the same Tideways account.

### tideways_sample_rate
scope: application
type: integer
default: none
set_in: GUI or YAML
frequency: expert
does: What percentage of requests is profiled.
why: Lower it to reduce the overhead of profiling on a busy site.


## Host service parameters

### webserver
scope: host
type: string
allowed: nginx | apache2
default: nginx
set_in: GUI or YAML
frequency: common
does: Selects the web server for this host.
why: Nginx suits almost every workload. Choose Apache when an application needs `.htaccess` files or Apache modules.

### da_webserver
scope: host
type: string
allowed: apache | nginx | nginx_apache
default: `nginx_apache` when TurboShield is on, otherwise `apache`
set_in: YAML only
frequency: expert
does: Which web server the DirectAdmin control panel builds and runs. `nginx_apache` puts Nginx in front of Apache, which keeps `.htaccess` support while Nginx serves the traffic.
why: A DirectAdmin host manages its own web server, so it needs a separate setting from `webserver`.
requires: Only on hosts that run the DirectAdmin control panel. Every other host chooses its web server with `webserver`.

### mysql_version
scope: host
type: string
unit: version
allowed: 5.7 | 8.0 | 8.4
default: none
set_in: GUI or YAML
frequency: common
does: Installs MySQL in the given version. Leave it out, or set `0`, to not install it.
why: The database most PHP applications use, including WordPress, Magento and Shopware.
warning: Changing the major version on a live host is a migration, not a setting. Plan and test it.

### mysql_innodb_size
scope: host
type: string
unit: size
default: Tuned to the server
set_in: GUI or YAML
frequency: expert
does: How much memory MySQL uses to cache data and indexes (the InnoDB buffer pool).
why: The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows as the server grows. It is the most effective database performance setting, but only override the automatic value with measured evidence.

### mysql_bindaddress
scope: host
type: string
default: Local only
set_in: GUI or YAML
frequency: expert
does: Which network addresses MySQL accepts connections on. Give an address, or the keyword `ANY` to listen on every interface.
why: Needed when a separate application server must reach this database.
requires: On a host that runs Kubernetes or Docker, MySQL listens on every interface unless you set this key yourself.
warning: `ANY` puts the database on every interface, including any public one. Exposing a database to the public internet is a serious risk - give a specific private address and restrict access with the firewall.

### mysql_server
scope: host
type: boolean
default: true
set_in: GUI or YAML
frequency: expert
does: Whether the database server itself is installed.
why: Set it to false on an application server that only needs the client tools.

### mysql_server_only
scope: host
type: boolean
default: false
set_in: YAML only
frequency: expert
does: Installs only the database server, without the local application-side setup.
why: For a dedicated database server that hosts no applications.

### mysql_client_host_name
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: Points this server's database client at a database on another server.
why: Split application and database across two servers.

### mysql_client_host_ip
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: The address of that remote database server.
why: Used together with `mysql_client_host_name`.

### mysql_timezone
scope: host
type: string
default: The server's time zone
set_in: YAML only
frequency: expert
does: Sets the default time zone of the MySQL database server.
why: Make database timestamps match the time zone your application expects, regardless of the server's own time zone.

### postgresql_version
scope: host
type: string
unit: version
default: none
set_in: GUI or YAML
frequency: moderate
does: Installs PostgreSQL in the given version.
why: The database used by Odoo and Medusa, and an option for several other applications.
warning: Changing the major version on a live host is a migration. Plan and test it.

### postgresql_shared_buffers
scope: host
type: string
unit: size
default: Tuned to the server
set_in: GUI or YAML
frequency: expert
does: How much memory PostgreSQL uses for caching (shared buffers).
why: The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. It is the main PostgreSQL performance setting, but only override the automatic value with measured evidence.

### postgresql_extensions
scope: host
type: list
allowed: vector | postgis | timescaledb | pg_stat_statements
default: empty
set_in: GUI or YAML
frequency: expert
does: Enables extra PostgreSQL extensions.
why: Adds capabilities such as geographic data or vector search.
requires: Only these four names are accepted. Any other value stops the deployment with an error.

### postgresql_listen_addresses
scope: host
type: string
default: Local only
set_in: GUI or YAML
frequency: expert
does: Which addresses PostgreSQL accepts connections on. Give an address, or the keyword `ANY` to listen on every interface.
why: Needed for a separate application server.
requires: On a host that runs Kubernetes or Docker, PostgreSQL listens on every interface unless you set this key yourself.
warning: `ANY` puts the database on every interface, including any public one. Give a specific private address and restrict access with the firewall.

### postgresql_extra_access
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: expert
does: Extra access rules stating which user may reach which database from which address.
why: Grant a specific external system access without opening the database entirely.

### postgresql_client_only
scope: host
type: boolean
default: false
set_in: GUI or YAML
frequency: expert
does: Installs only the client tools, not the server.
why: For an application server that connects to a database elsewhere.

### postgresql_client_host_name
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: Points this server's database client at a PostgreSQL database on another server.
why: Split application and database across two servers.
requires: used with `postgresql_client_only` and `postgresql_client_host_ip`.

### postgresql_client_host_ip
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: The address of that remote PostgreSQL server.
why: Used together with `postgresql_client_host_name`.

### mongodb_version
scope: host
type: string
unit: version
allowed: 7.0 | 8.0
default: none
set_in: GUI or YAML
frequency: expert
does: Installs MongoDB in the given version.
why: For applications that store documents rather than tables.

### mongodb_bindip
scope: host
type: string
default: Local only
set_in: GUI or YAML
frequency: expert
does: Which addresses MongoDB accepts connections on. Give a comma-separated list of addresses, or the keyword `ANY` to listen on every interface.
why: Needed for a separate application server.
requires: On a host that runs Kubernetes or Docker, MongoDB listens on every interface. Unlike the other databases it does so even when this key is set to `127.0.0.1`, so give a specific private address if you need to keep it narrow.
warning: `ANY` puts the database on every interface, including any public one. Give specific private addresses and restrict access with the firewall.

### mssql_version
scope: host
type: string
unit: version
allowed: 2019 | 2022 | 2025
default: none
set_in: GUI or YAML
frequency: expert
does: Installs Microsoft SQL Server.
why: Required by .NET applications such as nopCommerce.
requires: which versions are available depends on the server operating system.

### mssql_edition
scope: host
type: string
allowed: Developer | Enterprise | Express | Standard | Web
default: none
set_in: GUI or YAML
frequency: expert
does: Which SQL Server edition is installed.
why: Editions differ in features and licensing. The GUI dropdown lists the available ones.

### redis_enabled
scope: host
type: boolean
default: true
set_in: GUI or YAML
frequency: common
does: Installs Redis, used for sessions and object caching.
why: Recommended for almost every application, which is why it is on by default.

### redis_memory
scope: host
type: string
unit: size
default: Tuned to the server
set_in: GUI or YAML
frequency: expert
does: How much memory the cache instance may use.
why: Rarely needs changing. The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. The automatic value accounts for disk use as well as memory.
warning: Raising it also increases disk use. Override the automatic value only after measuring.

### redis_persistent_memory
scope: host
type: string
unit: size
default: Tuned to the server
set_in: YAML only
frequency: expert
does: How much memory the persistent Redis instance may use - the instance that keeps its data on disk.
why: The platform sizes this to the server's memory automatically and re-tunes it on every publish. Override only after measuring, for workloads that persist a lot of cache or session data.
warning: Raising it also increases disk use.

### redis_listen_addresses
scope: host
type: string
allowed: internal
default: Local only
set_in: GUI or YAML
frequency: expert
does: Which addresses Redis accepts connections on. Leave it unset to stay on localhost; `internal` also binds the host's private network addresses.
why: Needed when another server must reach the cache.
requires: `internal` is the only accepted value. Anything else, including `any`, stops the deployment with an error. On a host that runs Kubernetes or Docker, Redis uses `internal` unless you set this key yourself.
warning: Keep it restricted to trusted networks. Setting `internal` turns off the Redis protected mode, and so does running Kubernetes or Docker on the host.

### varnish_version
scope: host
type: string
unit: version
default: Chosen by the platform
set_in: YAML only
frequency: expert
does: Pins the version of the full-page cache. You almost never set this.
why: Nothing has to be set at host level to run Varnish. Turning on `varnish_enabled` for any application installs it, and the platform picks the version itself: 8.0, or 7.6 on Debian 11 and older, or 6.0 for the Enterprise edition. Setting this key by hand only does anything on a host where no application has `varnish_enabled` at all. That installs the cache before anything uses it.
warning: As soon as one application on the host has `varnish_enabled`, the platform's own choice replaces whatever you put here, and it does not warn you that it did.

### varnish_cache_size
scope: host
type: string
unit: size
default: Tuned to the server
set_in: GUI or YAML
frequency: expert
does: How much memory the full-page cache may use.
why: The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. A larger cache holds more pages, but takes memory from the applications, so only override the automatic value after measuring.

### varnish_type
scope: host
type: string
allowed: opensource | enterprise
default: opensource
set_in: GUI or YAML
frequency: expert
does: Which edition of the cache is installed.
why: The commercial edition adds features that need a licence.
requires: `enterprise` only works when Hosted Power has put a licence in place for this host. Without it the deployment stops with an error, so leave it on `opensource` unless the licence has been arranged.

### varnish_customvcl
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: Replaces the generated cache rules with your own.
why: For caching behavior the standard configuration cannot express.
warning: Custom cache rules are easy to get wrong and can serve the wrong content to visitors.

### varnish_modules
scope: host
type: boolean
default: true
set_in: GUI or YAML
frequency: expert
does: Installs the extra Varnish module set (vmods) alongside the cache.
why: Custom VCL often calls functions that only exist in these modules.
requires: Open-source Varnish only. The Enterprise edition ships its own modules and ignores this key.

### varnish_backend_host
scope: host
type: string
default: The local application
set_in: YAML only
frequency: expert
does: Points the cache at a custom backend host instead of the local application.
why: Put the full-page cache in front of an origin that runs on another server.
requires: set together with `varnish_backend_port`; the custom backend is only used when both are set.

### varnish_backend_port
scope: host
type: integer
default: none
set_in: YAML only
frequency: expert
does: The port of the custom cache backend host.
why: Used together with `varnish_backend_host`.

### rabbitmq_version
scope: host
type: string
default: latest
set_in: YAML only
frequency: expert
does: Pins the message broker to a specific version.
why: Match a version your application is tested against.

### rabbitmq_plugins
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: expert
does: Enables extra broker plugins.
why: Adds protocols or management features your application needs.

### elasticsearch_version
scope: host
type: string
unit: version
default: none
set_in: GUI or YAML
frequency: moderate
does: Installs Elasticsearch in the given version.
why: Required by Magento 2 and used by Akeneo for catalog search.
requires: the value is a release channel such as `8.x`, not an exact version. To not install it, omit the key or set an empty string `""` - never the integer `0`, which fails the deployment.
warning: Changing the major version usually means rebuilding your indexes.

### elasticsearch_heap_size
scope: host
type: string
unit: size
default: Tuned to the server
set_in: GUI or YAML
frequency: expert
does: How much memory the search engine may use (the JVM heap).
why: The platform sets this to the server's memory automatically and re-tunes it on every publish, so it grows with the server. Too little makes search slow; too much starves the rest of the server, so only override the automatic value after measuring.

### elasticsearch_plugins
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: expert
does: Installs extra search plugins.
why: Adds language-specific analysis for better search results.

### elasticsearch_kibana
scope: host
type: boolean
default: false
set_in: GUI or YAML
frequency: expert
does: Installs the Kibana web interface for Elasticsearch, reachable at `https://<host>/kibana`.
why: Inspect indexes and run queries in a browser.
requires: an `elasticsearch_version` must be set. The web server proxies the path and asks for a login first - use one of the host's system user accounts.

### elasticsearch_network_host
scope: host
type: string
default: localhost
set_in: YAML only
frequency: expert
does: Which address Elasticsearch listens on - `localhost`, `INTERNAL` for private-network addresses, or a specific address.
why: Reach the search engine from another server on a private network.
requires: `INTERNAL` resolves to the loopback addresses plus the host's private IPv4 addresses - the same keyword `redis_listen_addresses` uses.
warning: Never bind it to a public address.

### opensearch_version
scope: host
type: string
unit: version
default: none
set_in: GUI or YAML
frequency: moderate
does: Installs OpenSearch in the given version.
why: An alternative search engine, used by Shopware among others.
requires: use either Elasticsearch or OpenSearch on a host, not both. The value is a release channel such as `2.x`; to not install it, omit the key or set an empty string `""`, never the integer `0`.

### opensearch_heap_size
scope: host
type: string
unit: size
default: Tuned to the server
set_in: GUI or YAML
frequency: expert
does: How much memory OpenSearch may use (the JVM heap).
why: Set to the server's memory automatically and re-tuned on every publish, so it grows with the server. Same trade-off as the Elasticsearch heap - only override the automatic value after measuring.

### opensearch_plugins
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: expert
does: Installs extra OpenSearch plugins.
why: Adds language-specific analysis.

### opensearch_dashboards
scope: host
type: boolean
default: false
set_in: GUI or YAML
frequency: expert
does: Installs the OpenSearch web interface, reachable at `https://<host>/dashboards`.
why: Inspect indexes and run queries in a browser.
requires: The web server proxies the path and asks for a login first - use one of the host's system user accounts.

### opensearch_dashboards_usermanagement
scope: host
type: boolean
default: false
set_in: YAML only
frequency: expert
does: Turns on login and user management for the OpenSearch dashboards.
why: Protect the dashboards with authentication and user accounts.
requires: `opensearch_dashboards` must be enabled.

### php_versions
scope: host
type: list
default: The versions your applications use
set_in: YAML only
frequency: moderate
does: Which PHP versions are installed and available on the server.
why: Run applications that need different PHP versions side by side. Normally derived from your applications; set it to install an extra version explicitly.

### php_ioncube_enabled
scope: host
type: boolean
default: false
set_in: YAML only
frequency: expert
does: Installs the ionCube loader for PHP.
why: Required to run commercial PHP software distributed as encrypted, licensed code.

### php_main_version
scope: host
type: string
unit: version
default: The lowest version any application uses
set_in: YAML only
frequency: expert
does: Which PHP version is used on the command line.
why: Matters when you run scripts over SSH and several PHP versions are installed.

### composer_keep_updated
scope: host
type: boolean
default: true
set_in: YAML only
frequency: expert
does: Keeps the Composer binary automatically updated.
why: Always run a current Composer without updating it by hand.

### composer_version
scope: host
type: string
allowed: latest | lts | 2 | 2.2
default: lts
set_in: GUI or YAML
frequency: moderate
does: Which Composer version is installed.
why: Some applications need a specific Composer version to install correctly.

### os_extra_packages
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: moderate
does: Installs extra operating-system packages.
why: Add a tool or library your application needs, without root access.

### system_packages_upgrade_time
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: When automatic package updates are installed. These are routine updates that do not need a reboot.
why: Move updates to a quiet moment for your business.

### maintenance
scope: host
type: list
default: a weekly window managed by the platform
set_in: GUI or YAML
frequency: moderate
does: Sets the weekly window when the platform applies updates that need a reboot.
why: Pick a low-traffic moment so a reboot does not interrupt visitors during your busy hours.
requires: Each entry has a day (1 = Sunday through 7 = Saturday) and an hour (0-23). Set it from the Advanced tab, which offers day and hour dropdowns.

### supervisor_enabled
scope: host
type: boolean
default: false
set_in: GUI or YAML
frequency: expert
does: Installs a process manager for long-running background processes.
why: An alternative to user system services for keeping workers running.

### dkim.keys
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: moderate
does: The mail domains this host signs outgoing mail for. A signing key pair is generated on the server for each entry, and existing keys are never overwritten.
why: Signed mail is far more likely to reach the inbox instead of the spam folder.
requires: `dkim` must be a map that contains a `keys` list. The older `dkim: true` form is refused and stops the deployment. After the key is generated, publish the matching public record in the Domain Name System (DNS).

### dkim.keys.fqdn
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: moderate
does: The mail domain this key signs for, written in full.
why: Tells the platform which sender domain the key belongs to.
requires: Required for every entry. An entry without it stops the deployment.

### dkim.keys.selector
scope: host
type: string
default: cloud
set_in: GUI or YAML
frequency: expert
does: The label that identifies this key in DNS. The record you publish is the selector, followed by `._domainkey.` and the domain.
why: Lets one domain hold more than one key, which is what makes it possible to replace a key without a gap in signing.

### mail_devtool
scope: host
type: string
allowed: mailpit | mailhog
default: none
set_in: GUI or YAML
frequency: expert
does: Installs a mail testing tool with a web interface that collects the messages your applications send.
why: See exactly what your application sends, including the full message, without anything reaching a real recipient.
requires: Only the two values above are accepted; anything else stops the deployment. The platform also points PHP at the collector by default.
warning: Use this on development and staging hosts only. While it is set, mail your applications send is kept on the server instead of being delivered.

### mailhog_install
scope: host
type: boolean
default: false
set_in: GUI or YAML
frequency: expert
does: Records that mail collecting is switched on for this host. The interface writes it when you enable **Enable mail capturing and mail testing**, which then shows the `mail_devtool` field.
why: Only meaningful together with `mail_devtool`.
requires: On its own this key installs nothing. `mail_devtool` is what selects and installs the tool, so set that as well.

### pmm_master.server_hostname
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: The collection server this host sends its database statistics to. Setting it is what switches advanced database monitoring on.
why: Find the queries that make a database slow, with history you can compare against a quiet period.
requires: At least one database must be configured on the host. Without one, the panel stays empty.

### pmm_sampling_rate
scope: host
type: integer
unit: count
default: 50
set_in: GUI or YAML
frequency: expert
does: How often a query is recorded. A value of `50` records one query in every fifty, not one in two.
why: Lower it for a more complete picture on a quiet database, raise it to keep the measuring itself cheap on a busy one.
requires: Only used together with `pmm_master.server_hostname`.


## Users and access parameters

### system_users
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: common
does: The list of accounts on this host, each with its own applications.
why: Separating applications per account keeps their files, databases and processes apart.

### username
scope: system_user
type: string
default: none
set_in: GUI or YAML
frequency: common
does: The account name, which also determines the home directory and the database name.
why: Required for every account.
requires: Lowercase letters and digits, starting with a letter, at most 24 characters. Some reserved names are refused.

### ftp
scope: system_user
type: list
default: empty
set_in: GUI or YAML
frequency: moderate
does: Extra file-transfer accounts under this system user.
why: Give an external designer or agency access to one folder only.

### user
scope: system_user
type: string
default: none
set_in: GUI or YAML
frequency: moderate
does: The login name of the file-transfer account.
why: Required for every entry under `ftp`.

### homedir
scope: system_user
type: string
default: none
set_in: GUI or YAML
frequency: moderate
does: The folder this account is limited to.
why: Restricts access to one application instead of the whole account.
requires: Must be inside the system user's own directory. The deployment fails otherwise.

### ftp_sftp
scope: host
type: boolean
default: false
set_in: GUI or YAML
frequency: moderate
does: Enables encrypted file transfer over SFTP.
why: Plain FTP sends passwords unencrypted. Use SFTP whenever you can.
requires: Required before you can add SSH keys to a file-transfer account, otherwise the deployment fails.

### ftp_sftp_port
scope: host
type: integer
unit: port
default: 222
set_in: YAML only
frequency: expert
does: The port SFTP listens on.
why: Avoids a clash with regular SSH.

### ftp_hostname
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: The host name shown for file-transfer connections.
why: Give customers a branded address to connect to.

### db_extra_users
scope: system_user
type: list
default: empty
set_in: GUI or YAML
frequency: moderate
does: Additional database accounts alongside the automatically created one.
why: Give a reporting tool or an external developer their own database login.

### name
scope: system_user
type: string
default: none
set_in: GUI or YAML
frequency: moderate
does: The login name of the extra database user.
why: Required for every entry under `db_extra_users`.
requires: Lowercase letters and digits, starting with a letter, at most 24 characters, and unique.

### db_role
scope: system_user
type: string
allowed: admin | readonly
default: none
set_in: GUI or YAML
frequency: moderate
does: The role - `admin` has full read/write access to all databases on the server, `readonly` has read-only access.
why: A reporting tool or external analyst should almost always be `readonly`; `admin` reaches every database on the server.
requires: Required, and must be exactly one of the two values.

### ssh_keys
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: common
does: Public keys that get access to every account on this host.
why: Give your whole team access in one place, without sharing passwords.

### ssh_port
scope: host
type: integer
unit: port
default: 22
set_in: YAML only
frequency: moderate
does: The port the server listens on for SSH.
why: A non-standard port removes most automated login attempts from your logs.
warning: Set the wrong value and you lock yourself out. The firewall is opened for the new port automatically.

### ssh_passwords
scope: host
type: boolean
default: true
set_in: GUI or YAML
frequency: moderate
does: Whether logging in with a password is allowed at all.
why: Turning it off is one of the most effective hardening steps, because passwords can be guessed.
requires: Add and test your SSH key first.


## Security parameters

### turboshield.enabled
scope: host
type: boolean
default: true
set_in: GUI or YAML
frequency: common
does: Turns the protection on for this host.
why: On by default. Switching it off removes the protection completely.

### turboshield.level
scope: host
type: string
allowed: low | medium | high | attack
default: medium
set_in: GUI or YAML
frequency: common
does: How aggressive the limits are, and whether the attack-only mechanisms run.
why: Raise it while an attack is happening, and lower it again afterwards.

### turboshield.allow_bots
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: moderate
does: Bots that are never slowed down.
why: Protects crawlers your revenue depends on, such as marketplace and comparison feeds.

### turboshield.limit_bots
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: moderate
does: Bots that are strictly slowed down.
why: Your lever against crawlers that consume capacity without bringing customers.

### turboshield.bot_protection
scope: host
type: boolean
default: false
set_in: YAML only
frequency: moderate
does: Shows suspicious visitors an automatic browser check before they reach your site.
why: Effective against scraping and credential stuffing spread across many addresses.
requires: Requires Nginx.

### firewall_whitelist
scope: host
type: list
default: empty
set_in: GUI or YAML
frequency: common
does: Addresses that bypass every check and can never be blocked automatically.
why: The most important list to maintain. Prevents your own office, integrations and monitoring from being locked out.
warning: A trusted address skips all protection. Keep the list short and never add a broad public range.

### firewall_country_block
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: moderate
does: Refuses all traffic from the listed countries.
why: Cuts a lot of unwanted traffic when you only sell in certain regions.
warning: Blocks real customers and travelling staff in those countries.

### firewall_country_allow
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: expert
does: Allows traffic only from the listed countries.
why: For applications meant for one region only, such as an internal tool.
warning: Everything else is refused, including search engines and monitoring.

### firewall_tcp_ports
scope: host
type: list
default: Detected automatically
set_in: YAML only
frequency: moderate
does: Which TCP ports the firewall opens.
why: Open a port for your own service.
warning: Every open port is a way in. Only open what you actually use.

### firewall_udp_ports
scope: host
type: list
default: Detected automatically
set_in: YAML only
frequency: expert
does: Which UDP ports the firewall opens.
why: For services that do not use TCP.

### imunify.enabled
scope: host
type: boolean
default: false
set_in: GUI or YAML
frequency: common
does: Installs and activates the Web Application Firewall and malware scanning on the host.
why: Blocks application-layer attacks that the network firewall cannot see, and finds malware in your files.

### imunify.email
scope: host
type: string
default: none
set_in: GUI or YAML
frequency: common
does: The address that receives Web Application Firewall alerts, such as a malware detection.
why: Without it you only see findings when you open the interface yourself.
requires: Only used when `imunify.enabled` is true.


## Dependencies and rules

- A runtime is enabled by setting its version key. There is no separate enable key. `php_version`, `nodejs_version`, `python_version`, `ruby_version` and `dotnet_version` each enable that runtime just by being set.
- Varnish is enabled per application, and that is the whole of it. `varnish_enabled: true` on any application installs Varnish on the host and puts that application behind it. There is no host key to install it first, and the platform chooses the version. The host keys under Caching and queues (`varnish_cache_size`, `varnish_type`, `varnish_customvcl`) only tune a cache that an application has already asked for.
- A host uses either Elasticsearch or OpenSearch, never both. Set `elasticsearch_version` or `opensearch_version`, not both on the same host.
- To not install a search engine, omit the key or set an empty string. `elasticsearch_version: ""` disables it. Never use the integer `0` - it fails the deployment.
- A proxied runtime (Node.js and similar) needs the proxy turned on. Set `proxy_enabled: true` and `proxy_upstream_port` so the web server forwards requests to the application process.
- A separate database server uses the client/server split keys. On the database host set `mysql_server_only: true`; on the application host set `mysql_client_host_name` and `mysql_client_host_ip` to point at it.
- Memory sizes are auto-tuned - do not set them up front. `mysql_innodb_size`, `redis_memory`, `varnish_cache_size`, `elasticsearch_heap_size` and similar are sized to the server automatically and re-tuned on every publish. Override only with measured evidence.
- Prefer a supported (non-EOL) version. Older versions still install but may not receive security updates. The GUI dropdown lists the versions available now.


## Configuration recipes

> Complete, copy-ready host configurations. Each uses only the parameters above.

### A simple website (WordPress)
A content site or blog on its own domain, with automatic HTTPS.
```yaml
webserver: nginx
mysql_version: "8.4"           # WordPress stores its data in MySQL
redis_enabled: true            # object cache (recommended, especially WooCommerce)
system_users:
  - username: prod
    vhosts:
      - server_name: example.com www.example.com
        app_type: wordpress
        php_version: "8.4"
        cert_type: letsencrypt  # automatic HTTPS
```
This is the smallest useful configuration: one application, a database and a
cache. You do not size anything - the platform tunes MySQL and Redis to the
server automatically. Setting `cert_type: letsencrypt` requests a certificate
and redirects HTTP to HTTPS once it is issued.

### A busy online store (Magento 2)
A Magento 2 storefront that must stay fast during a sale.
```yaml
webserver: nginx
mysql_version: "8.4"           # Magento core database
elasticsearch_version: "8.x"   # required by Magento for catalog search
redis_enabled: true            # sessions and object cache
system_users:
  - username: prod
    vhosts:
      - server_name: shop.example.com www.shop.example.com
        app_type: magento2
        php_version: "8.4"
        cert_type: letsencrypt
        varnish_enabled: true   # installs and fronts the full-page cache
```
Magento needs all four performance layers: the database, a search engine,
Redis for sessions and the object cache, and Varnish for full-page caching.
Varnish needs nothing at host level: `varnish_enabled` on the storefront
installs it and puts the store behind it.
Every memory size (buffer pool, Redis, Varnish, search heap) is auto-tuned to
the server and re-tuned on every publish, so a bigger server scales the store
up without any change here.

### A Shopware store
A Shopware 6 storefront with caching.
```yaml
webserver: nginx
mysql_version: "8.4"           # Shopware core database
redis_enabled: true            # cache and session storage
system_users:
  - username: prod
    vhosts:
      - server_name: shop.example.com www.shop.example.com
        app_type: shopware
        php_version: "8.4"
        cert_type: letsencrypt
        varnish_enabled: true   # full-page cache for storefront performance
```
Like Magento, Shopware benefits from Redis and a full-page cache. It does not
require a separate search engine on TurboStack. If you prefer OpenSearch over
Elasticsearch for product search, set `opensearch_version` instead - never
both on one host.

### Odoo (business software)
Move an Odoo installation onto TurboStack.
```yaml
webserver: nginx
postgresql_version: "17"       # Odoo requires PostgreSQL
system_users:
  - username: prod
    vhosts:
      - server_name: odoo.example.com
        app_type: odoo          # TurboStack runs Odoo behind nginx for you
        cert_type: letsencrypt
```
Odoo uses PostgreSQL, not MySQL, and runs as a service behind an Nginx reverse
proxy that TurboStack sets up from `app_type: odoo`. You do not set a PHP
version - Odoo is a Python application managed by the platform.

### A Laravel application
A PHP application built on Laravel, with background queues.
```yaml
webserver: nginx
mysql_version: "8.4"           # application database
redis_enabled: true            # queues, cache and sessions
system_users:
  - username: prod
    vhosts:
      - server_name: app.example.com
        app_type: laravel
        php_version: "8.4"
        cert_type: letsencrypt
        # rabbitmq_enabled: true  # add a message broker if your jobs need one
```
Laravel uses Redis for its queue, cache and session drivers, so `redis_enabled`
covers most background-job needs. Add a dedicated message broker with
`rabbitmq_enabled` only if your application specifically uses one.

### A Node.js application
A Node.js service (for example an API or a JavaScript framework).
```yaml
webserver: nginx
system_users:
  - username: prod
    vhosts:
      - server_name: api.example.com
        app_type: generic
        nodejs_version: "24"     # setting the version enables the Node.js runtime
        proxy_enabled: true      # nginx forwards requests to your Node process
        proxy_upstream_port: 3000
        cert_type: letsencrypt
```
A Node.js application is enabled simply by setting `nodejs_version` - there is
no separate "enable" key. Because the application listens on its own port,
`proxy_enabled` tells the web server to forward requests to it, and
`proxy_upstream_port` is the port your process listens on.

### Several applications on one host
Two applications, each with its own runtime, on the same server.
```yaml
webserver: nginx
mysql_version: "8.4"
redis_enabled: true
system_users:
  - username: shop
    vhosts:
      - server_name: shop.example.com
        app_type: magento2
        php_version: "8.4"
        cert_type: letsencrypt
        varnish_enabled: true
  - username: api
    vhosts:
      - server_name: api.example.com
        app_type: generic
        nodejs_version: "24"
        proxy_enabled: true
        proxy_upstream_port: 3000
        cert_type: letsencrypt
```
One host can run several applications side by side, each under its own system
user and with its own runtime and version. Host services (MySQL, Redis) are
shared; the per-application keys under each `vhosts` entry are independent.

### Application server plus a separate database server
Keep the database on its own server for larger workloads.
```yaml
# On the application server:
webserver: nginx
mysql_client_host_name: db1.example.com
mysql_client_host_ip: 10.0.0.5
system_users:
  - username: prod
    vhosts:
      - server_name: app.example.com
        app_type: laravel
        php_version: "8.4"
        cert_type: letsencrypt
# On the database server (separate host configuration):
# mysql_version: "8.4"
# mysql_server_only: true
```
For a larger workload you can split the database onto its own server. The
application host points at it with `mysql_client_host_name` and
`mysql_client_host_ip`. The database host is configured with
`mysql_server_only: true`, so it installs the server without a web stack.