Web servers
Nginx, Apache, or a supported Nginx + Apache hybrid. Virtual hosts generated, tested with nginx -t/apachectl, then activated.
In development · Early access open
Your servers.
Your applications.
One control plane.
ServerNest manages the Linux servers you already own. Install a lightweight agent, and run your web stack, PHP applications, databases and SSL from one dashboard — without opening a single inbound management port.
- Ubuntu 24.04 LTS & Debian 13
- Outbound-only mTLS agent
- You keep root & your data
# one-time, short-lived enrollment token
$ curl -fsSL https://get.servernest.io | sudo bash -s -- \
--token snt_••••••••••••
✓ Verified installer signature
✓ Generated server keypair (key never leaves host)
✓ Exchanged token for client certificate
✓ Connected → agent.servernest.io:443 (mTLS)
✓ Inventory reported: ubuntu 24.04 · nginx · php-fpm
● web-01 is healthy. Inbound ports opened: 0Illustrative preview of the planned enrollment flow.
Built for
- Freelance PHP developers
- WordPress, Drupal & Joomla agencies
- Laravel & Symfony teams
- Small hosting providers
- Agencies managing client servers
How it works
Bring your own server. We bring the control plane.
ServerNest isn't a cloud provider. Use any VPS you like. The agent dials out to us — we never need to reach in.
-
01
Connect
Create a server in the dashboard and run the signed installer with a single-use, short-lived enrollment token.
-
02
Enroll
The agent generates its own keypair, receives a unique client certificate and opens an outbound mTLS WebSocket.
-
03
Inspect
Heartbeat and inventory flow in: OS, services, PHP versions and health. Unsupported combinations are flagged, not guessed.
-
04
Operate
Every change is a typed, validated, audited operation — with progress, logs, exit status and rollback state you can see.
What you'll manage
The whole PHP web stack, done safely.
Planned scope for the first release. Every config change is validated before it goes live, and the last known-good version is restored if a reload fails.
PHP versions & FPM pools
Run multiple PHP versions side by side with a dedicated PHP-FPM pool per application — validated against a real compatibility matrix.
Application isolation
Each application gets its own Linux user, filesystem permissions and runtime pool. One compromised site doesn't hand over the server.
Databases
Create MySQL/MariaDB databases and scoped users per app. Optional Redis-compatible cache when your app needs it.
Domains & SSL
Point domains, issue and renew Let's Encrypt certificates automatically, or bring your own. Renewal state always visible.
Monitoring & audit
Server and application health at a glance — clearly separating healthy, degraded and disconnected. Every action is in the audit log.
Coming right after the core release
Application profiles
It knows what your app actually is.
Profiles are declarative, versioned and reviewed — not arbitrary shell scripts. Each one knows its document root, writable paths, CLI tooling and health checks.
WordPress
WP-CLI, core/plugin/theme updates with approval, maintenance mode, cache flush.
Drupal
Composer deploys, Drush status & cache rebuild, cron freshness, private files outside webroot.
Joomla
Install, update and backups with version/runtime compatibility checks.
Laravel
public/ root, Artisan, queues & scheduler, migrations with approval. .env never exposed.
Symfony
bin/console, cache warmup, Messenger worker health, migrations with approval.
Generic PHP
Your document root, PHP version, extensions and web-server profile. No assumptions.
Static sites
No PHP-FPM needed. Nginx static config, cache headers and HTTP health checks.
Later
Node.js, Next.js, Nuxt, Python, Django, FastAPI, Magento, PrestaShop, TYPO3, Moodle and more.
Initial support matrix
We'd rather block an unsupported combination than pretend it works.
- Operating system
- Ubuntu Server 24.04 LTS, Debian 13
- Architecture
- x86-64 / AMD64
- Web server
- Nginx · Apache · Nginx + Apache
- PHP
- Multiple versions, tested per OS & package source
- Database
- MySQL / MariaDB
- Cache
- Redis-compatible (optional)
- SSL
- Let's Encrypt · custom certificates
Security by design
A control plane you don't have to trust blindly.
No inbound management port
The agent connects out over TLS 443 with mutual certificate authentication. SSH is optional for bootstrap or recovery — never a runtime dependency.
Unique, revocable server identity
Each server holds its own private key and certificate. Enrollment tokens are single-use and short-lived. A revoked agent can't reconnect.
Typed operations, no remote shell
The agent runs an allowlist of validated, typed operations — not arbitrary commands. Destructive actions require explicit confirmation.
Least privilege everywhere
Per-application OS identities, scoped database users, secrets encrypted at rest and redacted from logs. Tenant isolation is enforced in the backend and data layer.
Fully auditable
Who did what, on which server, when — and what happened. Internal support access is time-limited, audited and has no implicit access to your secrets.
Degraded-mode safe
If ServerNest is unreachable, your websites keep running. The agent journals state locally and reconnects with backoff when we're back.
Principles
Your infrastructure stays yours.
You own it
Your cloud account, your server, your root access, your data. Leave any time with your files, databases and backups.
Transparent
See progress, logs, exit codes and rollback status for every operation. No black boxes.
Honest compatibility
An explicit, tested support matrix. Unsupported combinations are blocked or clearly marked.
Roadmap
Built in the open, one solid slice at a time.
ServerNest is in active development. Nothing below is described as shipped until it's verified.
- Phase 0
Foundation
Monorepo, local environment, API, agent & gateway skeletons, CI.
In progress - Phase 1
Agent vertical slice
Enrollment, mTLS, WebSocket, heartbeat, inventory, health check, reboot recovery.
- Phase 2
Server managers
Nginx, Apache, PHP & FPM pools, system users, databases, SSL.
- Phase 3
Application engine
Profile manifests for WordPress, Drupal, Joomla, Laravel, Symfony, PHP, static.
- Phase 4
Dashboard
Teams, server & app inventory, operations timeline, logs and metrics.
- Phase 5
Deploy & backup
Git integrations, releases, rollback, backup targets and restore.
- Phase 6
Beta hardening
Security review, tenant-isolation audit, pen-test plan, beta onboarding.
Early access
Help shape ServerNest.
We're looking for developers, agencies and small hosts to join the private beta. Tell us about your setup and we'll reach out as soon as there's something you can connect a server to.
- Early access to the beta
- Direct line to the people building it
- No spam — product updates only