Software
kstack
**61 features shipped** — including `Cargo workspace: control-plane, agent, shared proto crate; CI green on fmt+clippy+test`, `Docker dev stack: Postgres 16 + NATS compose file; migrations runner applies schema/000_init.sql`, `axum API core: mTLS-ready server, auth, subtree-scoped tokens, response envelope, idempotency keys, problem+json errors, OpenAPI served`.
latest v1.163.0
Features
Features
- Cargo workspace: control-plane, agent, shared proto crate; CI green on fmt+clippy+test
- Docker dev stack: Postgres 16 + NATS compose file; migrations runner applies schema/000_init.sql
- axum API core: mTLS-ready server, auth, subtree-scoped tokens, response envelope, idempotency keys, problem+json errors,
- Job queue on SELECT FOR UPDATE SKIP LOCKED; every mutation writes audit_log
- Agent enrolment: bootstrap token -> client cert; NATS subscribe + timer fallback
- Reconciler framework: fetch -> observe -> plan -> validate -> apply -> report; atomic writes; generation rollback
- Manifest render pipeline: per-node scoping, content hash, version rows
- website (static) resource end to end behind edge nginx
- ssl_cert via ACME HTTP-01 (staging CA in tests)
- Secrets: envelope encryption, KEK outside Postgres
- Panel skeleton: Node.js 26 app, login, account list, create-site form against real API
- G1 demo: delete nginx config by hand -> agent heals it; rebuild node container -> re-converges
Features
- Debian tenant image pipeline; shared read-only overlayfs base layer
- Per-site container lifecycle: create, isolated id-map, cgroup limits, pids cap, CPU slice, suspend, destroy, orphan swee
- Multi-version PHP-FPM 7.4-8.4, pm=ondemand, per-site selection (8.1/8.3 in dev; matrix is a build arg)
- OpenLiteSpeed + lsphp per-site alternative; .htaccess and LSCache verified
- Node and Python app hosting (dev model; in-container unification lands with P1.4)
- Chrooted SFTP/FTP, per-site cron, log shipping (#85 + overnight parts 1-2; SFTP chroot via root-owned tree + bind-mounte
- Hardening: Landlock+seccomp, hidepid, private /tmp, veth+nftables, outbound port-25 block
- Panel: site management, file manager, PHP switch, login-as-customer
- Fifty-site load test; measurements replace blueprint §07 planning numbers
- G2: escape attempt fails; ionCube site runs
Features
- PowerDNS (bind backend - the reconciler owns files, not a second DB); dns_zone and dns_record resources
- AXFR enabled and transfer-proven via dig AXFR (secondary topology is deployment config)
- ACME DNS-01, wildcards, renewal scheduler, CAA
- Registrar adapter: NOT kstack scope - Zephyr owns domain registration (founder decision 2026-08-24); kstack hosts zones
- Panel: zone editor, cert status
Features
- DB node role: shared MariaDB + PostgreSQL; db, user, grant provisioning; connection limits
- Zero-downtime credential rotation (P3.1)
- Size accounting per cycle, over-quota flagging (never destroy), remote-access CIDR rules (P3.2)
- Dedicated-instance upsell path (db_instances in node capacity; instance-strict DSN resolution across provisioning, brows
- Panel: DB browser (db.query/db.dump/db.import as tenant over the command channel), create/rotate with once-only reveal,
- Wave 1: internal sites migrated onto kstack
Features
- restic per tenant, separate keys, off-network S3; backup_policy resource
- Restore granularity: file, site, database, whole account
- Automated weekly drill: random tenant -> scratch restore -> verify -> report (scratch container variant lands with P1.4
- Panel: self-service restore (Backups card on site + database pages; drills page)
- **Platform DR — the control plane's own backup** (plan #65, v0.14.0, 2026-08-26: `pg_dump | restic` streamed off-box on
- External pen test of tenant boundary; findings closed (gates wave 2)
Features
- Postfix + Dovecot nodes; mail_domain, mailbox, forwarder resources (Rspamd joins in P5.4)
- Outbound throttles + anomaly cut-off, proven by simulation before any customer mail
- SPF, DKIM rotation, DMARC ingestion, PTR, MTA-STS; outbound via relay (plan #38; PTR guidance + relay contract stay foun
- Webmail, autoresponders (P5.4, plan #39); aliases, catch-all, quotas landed with P5.2
- IMAP migration tool; thousand-mailbox lossless test (plan #40: 1000/1000 mailboxes migrated + verified byte-for-byte 202
- Panel: mailbox management (plan #39: mail section, once-only credentials, forwarders, autoresponder editor, DNS card, we
- Inbox placement verified at major providers
- DNSSEC zone signing + DANE TLSA automation tied to cert issuance (plan #41; founder ask 2026-08-24: full compliance)
- Compliance email archiving: journal -> WORM retention -> legal hold -> indexed search -> verified retrieval drills (plan
- Sending-IP pools: one-call drain, platform-enforced warm-up, per-tenant-per-pool attribution (plan #44, 2026-08-25: poli
- IP reputation system: DNSBL monitor, complaint ingestion, health surface, auto-drain on listing (plan #45, 2026-08-25: 1
Features
- Reseller surface: pools enforced, white-label branding, custom nameservers, custom panel domain (plan #57, 2026-08-25: g
- Zephyr provisioning module + metered usage; order -> live with no manual step
- Standby collectors, dashboards, alerts for every role
- Analytics role: ClickHouse node, shippers, per-site graphs + log viewer, retention tiers (plan #56, 2026-08-25: access-l
- WordPress install/clone/staging/auto-update; malware scan; git deploy; 2FA (2FA landed with #57; plan #60, 2026-08-25: w
- Compliance evidence surface: per-account attestation report + panel controls page (plan #43, 2026-08-25: controls are DA
- Control-plane product surface, admin side (plan #62 track, v0.8.0-v0.10.0, 2026-08-25: real email+password login w/ per-
- Control-plane product surface, customer side: health-first home LANDED (v0.11.0, 2026-08-25: hero + guided steps + visit
- The people side of the panel: profiles and RBAC (plan #82, build plan #83, v0.32.0, 2026-08-26). The founder asked for S
- The permission model actually binds (2026-08-27, v0.44.0). #82 built the registry, the roles and requestOnly; nothing on
- The platform places resources when nobody names a node (2026-08-27, v0.44.0). `node_id` was required since P0 under a co
- Enhance extractors + translators + automated verifier, rehearsed on wave-1 sites
Features
- Add-a-node upgrade path repaired (2026-08-27): `POST /v1/nodes/{id}/upgrade_command` had never worked on a node that had
- Add-a-node, properly: enrol a bare box first, assign roles after (plan #74, v0.21.0, 2026-08-26: the control plane serve
- [~] Node management (plan #75): **phase 1 LANDED** — a role is something the box *becomes*. The agent installs what each
- Many addresses per box (plan #76, v0.32.0, 2026-08-26: `ip_allocation` was designed in P0 and never used; this connects
- Node naming and infrastructure DNS (plan #77, v0.32.0, 2026-08-26: we are our own authoritative DNS, so adding a node al
- A node going quiet is an event (2026-08-27). The most important operational fact on a hosting platform produced nothing
- Recurring work that notices when it has stopped (2026-08-27). Every periodic job reschedules itself, and a chain that br
- A node that reports before anyone theorises (plan #122, v1.32.0-v1.32.7, 2026-09-03). Three incidents in one week had on
- Per-node telemetry: bandwidth PER INTERFACE plus load/mem/swap/disk, deltas computed on the node (plan #78)
- Storage layout: put a role's data on the disk you choose, and move it there later (plan #80, v0.27.0, 2026-08-26: `capac
- Per-website bandwidth read from the container veth, not access logs — logs are blind to a compromised site's outbound (p
Features
- Wave 2: static + simple PHP customers
- Wave 3: complex PHP + databases
- Wave 4: reseller subtrees
- Wave 5: mail with dual delivery
- All watch windows closed clean; Enhance decommissioned; licence cancelled
Features
- [~] Webmail and groupware. **Webmail SHIPPED, in its own repo** — `kmail`, a managed SOGo fork, at v0.4.6: brand-themed
- kstack Drive: storage node role, per-tenant volumes + XFS quotas, native Rust WebDAV service, share links, versioning fr
- WOPI host so self-hosted Collabora/OnlyOffice EDIT files in our storage without owning them (docs licensing = founder de
- Workspace bundle sellable through Zephyr: order -> provisioned, no manual step