KStack
Hosting, under control. The hosting control panel your customers log into, on servers you own: websites, mail, DNS, databases, backups, virtual machines, object storage and AI endpoints, with unlimited customers and sites. Add a server in one paste, give it a job, and it stays the way you set it.
Hosting, under control.
The hosting control panel for servers you own. The panel your customers log into, with websites, mail, DNS, databases, backups, virtual machines, object storage and AI endpoints on hardware you already have, and unlimited customers and sites.
- Add a server in one paste. Tick the jobs it holds and KStack sets it up. The panel never holds a login to your servers; they ask what to run and report back.
- It stays the way you set it. If someone changes a setting by hand, it is put back and you are told. A rebuilt server added again comes back whole.
- Sites keep running. Every server holds its own copy of what to run, so websites, DNS and mail keep serving even if the panel cannot be reached.
- Unlimited customers and sites. The licence counts servers, never customers or sites, and resellers get a panel in their own brand.
Your hosting platform, your way
Each server takes one or more jobs: web, database, DNS, mail, backup or statistics. Debian 13 or Ubuntu 26.04 for web servers, Rocky Linux for the rest.
nginx, OpenLiteSpeed, LiteSpeed Enterprise with your own licence, or Apache. You choose for each web server; every site on it is served the same way.
Plans pinned to a location, so a customer’s data stays where you promised, and a per-job switch to stop new work landing on a server.
Every website in its own container
New web servers run each website in its own container with its own memory, process and CPU limits, built to keep one site’s trouble away from the next. An administrator can still run a server as a plain web server if they prefer.
- Certificates without the chore. Issued and renewed automatically, wildcards included when the zone is on KStack DNS. HTTP/2 everywhere, HTTP/3 on OpenLiteSpeed.
- A web firewall and safe headers. ModSecurity with the OWASP rules per site when you switch it on, HSTS and security headers by default, and a firewall for each server job.
- Keys, not passwords. SFTP locked to the site’s own files with keys only; FTP where a customer needs it; two-factor sign-in on every account, required when you say so.
One panel, total control
Add one with a pasted command and give it jobs. A changed setting is put back; a reinstalled server added again gets everything back. Every change is checked before it goes live, and a failed one leaves the previous state intact.
A PHP version per site from the ones you offer, Node and Python applications, per-site cron and Redis, a file manager, and a git remote whose pushes go live and are refused if someone edited files on the server.
Unlimited customers. Resellers get their own branding per hostname, custom nameservers and a panel domain with its own certificate; allowances are pooled and enforced, with every refusal explained.
Every nameserver holds every zone. DNSSEC is a switch, and the record for your registrar appears only once every nameserver serves the zone signed. Thirty versions of zone history, restored in one click.
MariaDB and PostgreSQL, a database and user per customer, a database browser in the panel with import and export, credentials rotated in one step and shown once, and a dedicated instance where a customer needs one.
Each customer’s backups kept apart with their own keys, off the server; a second copy in the customer’s own S3 if they want it; test restores every week, oldest first; restore a single file; recently deleted sites, databases and zones brought back within a retention window.
Seven applications, installed in one action
What you and your customers can put on a website in one action. Each is installed by the platform with its database and its first administrator, and checked by the server before it is called installed. Open one in the panel to see every website running it and to set what a new install gets.
- WordPress, Joomla and Flarum on PHP. Installed with their database, their admin account and a certificate. WordPress comes with the toolkit: staging, malware scanning, git deploy and updates that take a backup first.
- Ghost, Wiki.js and NodeBB on Node. Ghost, with its owner account, for writers and publications; Wiki.js and NodeBB with their PostgreSQL database and first administrator.
- Zephyr, on a VPS of its own. Billing, clients, support and a storefront for a hosting business, put on a VPS of its own by Zephyr’s own installer, on your customer’s domain.
- Your own recipes and applications. A recipe is your WordPress: the plugins, theme, settings and starting content decided once, offered beside the built-ins on every website’s Apps tab. An application is a Node or Python service you publish.
How KStack is built
A control plane you run, one agent on every server, and the panel your customers log into. The world talks to your servers, never to the control plane. Press play to follow the parts, or pick a scenario to see what keeps serving.
Customers, resellers and your staff log into the same panel with different rights. The panel talks to nothing but the public API, so your own scripts can do everything it can.
Every change is checked first, then recorded as desired state: which websites, mailboxes, zones and databases should exist, and on which server. Nothing is pushed to a server at this point.
The agent on each server calls out to the control plane, fetches its manifest, applies the difference, and reports what it has. Nothing ever connects in to a server, and the control plane holds no login to any of them.
Visitors reach the web servers, mail apps reach the mail servers, resolvers reach the nameservers. The control plane is never in the path, which is why everything keeps serving when it is down.
Zephyr places orders and reads usage; Standby receives alerts and reports availability; a customer’s coding agent reaches one website through a Studio connector. All of it through the public API.
Every part, explained (17)
- Your customers (log into the panel)
- The people who buy hosting from you. They manage their websites, mailboxes, domains and databases in the panel, in your brand, and never see which server anything runs on.
- You and your staff (run the platform)
- You add servers, set plans and locations, and look after customers and resellers in the same panel, with more rights. Anything you can do in the panel your scripts can do through the API.
- Coding agents (Studio connector)
- A customer can connect their own coding agent to one of their websites. The connector reaches that one site, writes land on staging, and a person publishes to live.
- Zephyr or your billing (orders in, usage out)
- KStack has no billing of its own. Zephyr places orders and reads usage out of the box; any other system does the same through the API.
- Standby (alerts out, uptime in)
- KStack alerts arrive in Standby as incidents, and the panel shows the availability Standby reports for each server.
- Panel (public API only)
- The web panel for customers, resellers and staff. It uses nothing but the public API, so anything the panel can do, your own tools can do too.
- API (the one your scripts use)
- One API for the panel, your scripts, your billing and the servers. It checks every change before it is accepted, writes down what should exist, and never logs in to a server.
- Desired state (what runs where)
- Every account, website, mailbox, zone and setting in one database. Each server works from a versioned manifest built from it, so there is one answer to what should be running.
- Web servers (a container per site)
- Every website in its own container with its own CPU, memory and process limits, served by the web server you chose for that machine, with certificates issued and renewed automatically.
- Mail servers (mailboxes, kmail)
- Mail always runs on servers of its own, never beside websites. Mailboxes, the kmail webmail at mail.<domain>, spam filtering, sending reputation and archiving live here.
- Nameservers (every zone, DNSSEC)
- Every nameserver holds every zone. DNSSEC is a switch, and the record for your registrar appears only once every nameserver serves the zone signed.
- Database servers (MariaDB · PostgreSQL)
- A database and a user per customer on shared database servers, or a dedicated instance where a customer needs one.
- Backup servers (a key per customer)
- Each customer’s backups kept apart under their own key, test-restored every week, oldest first, with a second copy in the customer’s own S3 if they want it. An optional statistics server records each site’s usage every minute.
- VM hosts (virtual machines)
- Virtual machines from cloud images on your own hosts. Object storage and AI endpoints run on servers of their own, managed by the same agent as every other job.
- Website visitors (straight to the server)
- People visiting your customers’ sites connect to the web server and nothing else. The control plane is never in their path, so a problem there is invisible to them.
- Mail apps, phones (set themselves up)
- Outlook, Apple Mail and phones read the same mailbox over IMAP and send over SMTP, and set themselves up from the domain. Webmail is at mail.<domain>.
- DNS lookups (ask the nameservers)
- The internet’s resolvers ask your nameservers directly, and get signed answers for every zone where DNSSEC is switched on.
Bring your customers with you
KStack reads what you have and moves it, then shows you what it found before it changes anything.
- Sites from cPanel or Plesk. Upload an archive, see what is in it, approve, and the site is built on one of your servers.
- Mail, message for message. Folders, flags, dates and the message bytes themselves arrive exactly as they were, verified as it goes, and a run that is interrupted resumes where it stopped.
- Mailboxes can keep their passwords. Where your old panel’s mailbox archive carries each password in a form KStack can read, mailboxes keep it and nobody has to reconfigure a phone.
Mail on servers of its own
Mail never shares a server with websites. Each mail server carries its own mailboxes, webmail and sending reputation.
- kmail webmail at mail.yourdomain. Phones and mail apps set themselves up from the domain.
- The records, done for you. SPF, DKIM, DMARC, MTA-STS and DANE published when the domain’s DNS is on KStack, and listed to copy when it is not.
- A sending reputation that looks after itself. Sending addresses are warmed up on a schedule the platform enforces, watched against blocklists, and a sender that misbehaves is cut off.
- Archiving with legal hold. For customers who must keep their mail.
Your customer’s coding agent, on one website
A customer presses Connect a coding agent on their website and gets a connector that reaches that site and nothing else in the account. You do not run the agent, choose the model or pay for its tokens.
- Writes land on staging. The agent reads the site and changes files on the staging copy. The live site is never written to.
- A person publishes. Publishing staging to live is a button a person presses, and a backup is taken first.
- Named, expiring, revocable. Thirty days, ninety days or a year, with the last use shown; revoke one and the agent is refused from its next request.
Pricing
- ✓ Per node, per month
- ✓ From ten nodes
- ✓ Unlimited customers and sites
- ✓ Any job: web, database, DNS, mail, backup, statistics
- ✓ A removed node stops counting
- ✓ Signed updates while the licence is current
Prices exclude VAT.
Frequently asked questions
Can I run it on servers I already have?
Yes. Debian 13 or Ubuntu 26.04 for web servers, Rocky Linux for database, mail, DNS, backup and statistics. You keep the hardware; KStack sets up whatever jobs you give each server.
What happens if the panel cannot be reached?
Websites, DNS and mail keep serving: every server holds its own manifest. Until the panel is back, certificates are not renewed, backups do not run and you cannot add servers.
Does KStack need a login to my servers?
No. You add a server once with a pasted command, and after that it asks the panel what to run and reports back. KStack never SSHes into a server.
Which web server does it use?
Your choice per web server: nginx, OpenLiteSpeed, LiteSpeed Enterprise with your own licence, or Apache. Every site on that server is served the same way.
Which applications can my customers install?
WordPress, Joomla, Ghost, Wiki.js, NodeBB, Flarum and Zephyr are built in, each installed with its database and first administrator. You can add your own: a recipe is your WordPress with the plugins and settings decided once, and an application is a Node or Python service you publish.
Do I have to use Zephyr for billing?
No, but you need something: KStack has no billing of its own. Zephyr works with it out of the box, and any other system can place orders through the API and read monthly usage.
Does it work with Standby?
Yes. KStack alerts arrive in Standby as incidents, and the panel shows the availability Standby reports for each server.
What happens if my licence lapses?
Servers and sites already running keep running. Adding servers and receiving updates need a current licence.
Want to see it working first?
Book a walkthrough with our team. Tell us what you run today and we will show you the parts that matter to you.
Priced per node, never per customer
£5 a node a month, from ten nodes, with customers and sites unlimited. Prices exclude VAT.
Subscribe to KStack