Hosting, under control.
A Rust control plane and declarative node agents. You describe what should exist; each node reconciles itself towards it, every cycle, and reports what it actually found — so the box is never quietly different from what you asked for.
See plansConfiguration drift stops being your problem.
Most panels write a config file and hope. Delete an nginx config by hand and the agent puts it back. Rebuild a node from bare metal and it converges to the same state without anyone restoring anything.
The manifest this node should be running.
What is actually on the box right now.
The difference between the two.
Refuse a plan that would break something.
Atomic writes, with generation rollback.
What changed, and what it found.
One resource model, not five subsystems.
Websites, DNS zones, mailboxes, databases and virtual machines are rows of one resource type, so listing, quota and permission behaviour is written once instead of five times.
What you can sell
Per-site container, PHP 7.4 to 8.4, Node and Python.
PowerDNS with AXFR, DNSSEC signing, CAA.
Postfix and Dovecot, webmail, autoresponders.
Shared MariaDB and PostgreSQL, or a dedicated instance.
ACME HTTP-01 and DNS-01, wildcards.
restic, per-tenant keys, off-network storage.
SPF, DKIM, DMARC, MTA-STS, DANE.
Aliases, catch-all, quotas.
Websites
Isolated id-map, cgroup limits, a process cap and a CPU slice, with suspend and destroy as first-class operations and an orphan sweep behind them.
7.4 through 8.4 on demand, selected per site. OpenLiteSpeed with lsphp is available as an alternative, with .htaccess and LSCache verified rather than assumed.
Install, clone, staging and updates through wp-cli in the container, with a snapshot taken first — an update is refused outright if no backup policy covers the site.
Chrooted SFTP and FTP, per-site cron, a file manager, per-site error logs, and login-as-customer for when it is faster to look than to ask.
SPF, DKIM with rotation, DMARC report ingestion, MTA-STS and DANE tied to certificate issuance. Outbound throttles and an anomaly cut-off were proven by simulation before any customer mail went through them.
Per-tenant attribution, platform-enforced warm-up budgets and one-call drain, with a DNSBL monitor that can drain a listed address automatically — and never silently un-drains it after delisting.
The IMAP tool moved 1,000 of 1,000 mailboxes and verified them byte for byte. An interrupted run resumes; bad credentials fail visibly rather than half-way.
Journal capture into object-lock storage with a hash-chained ledger, legal hold that beats expiry, and retrieval drills where tampering with either the store or the ledger fails loudly.
Webmail
kmail is our own client, themed from each account’s branding — light and dark, per domain, white-label down to the sign-in page. A reseller’s customer never meets somebody else’s product name.
Attachments dropped or picked in the composer and uploaded to the draft as they arrive, the account’s own IMAP keywords as coloured labels, and an inbox that refreshes itself with the unread count in the tab title.
People added to an event are completed from the directory and invited by email on save, and their replies come back as marks on the event.
One drawer for the rail and folders, list or reader one at a time, and a reader header that stacks instead of overlapping itself.
Data
Shared MariaDB and PostgreSQL with connection limits, size accounting per cycle and over-quota flagging that never destroys anything — plus a dedicated instance when a tenant outgrows shared.
Rotation is a supported operation rather than a maintenance window, and new credentials are revealed exactly once.
restic per tenant with separate keys and off-network storage, restore granularity from a single file to a whole account, and a weekly drill that picks a random tenant, restores to scratch and verifies it.
Its own database streams off-box on a schedule, with a drill that restores into a scratch database and checks the secrets are readable — so a restore can never report success while the keys are gone.
Resellers and operations
Branding by hostname, custom nameservers, a custom panel domain with its own vhost and certificate, and per-account two-factor on panel login.
Pool grants are enforced at provision time behind advisory locks, and a refusal names the quota that stopped it rather than failing vaguely.
The emptiest node that holds the role, accepts work and is still reporting. Naming one explicitly still wins, and a refusal says which of the three conditions failed.
Each role probes itself — nginx answers a rendered vhost with the site’s own Host header, a nameserver holds every zone it was given. “Could not ask” is never recorded as “not serving”.
Frequently asked questions
Does kstack register domains?
No, deliberately. Zephyr owns domain registration and transfers; kstack hosts the zones. Keeping the registrar relationship in one place avoids two systems each believing they own a domain.
What happens if someone edits a config on the box?
The next reconcile puts it back. The manifest is the truth and the box is compared against it, so a hand-edit is a temporary state rather than a permanent divergence nobody remembers making.
Can I move customers from another panel?
Mail yes — the IMAP migration tool is proven lossless at a thousand mailboxes and resumable if interrupted. Web and database migration tooling for specific source panels is in progress; talk to us about your particular estate.
How does billing work?
Through Zephyr. Resources and plans defined in kstack are sold from your Zephyr catalog, so ordering, invoicing and renewals stay in one place.
How is it priced?
Per node. You add machines as you grow rather than counting sites or accounts.
Put one node up and break it on purpose.
The fastest way to judge kstack is to enrol a box, delete something it manages, and watch the next cycle put it back.
Book a walkthrough