Sites

The five types

static

Files served directly by nginx. No PHP process at all.

php

A PHP-FPM pool running as the site's own Unix user, confined by open_basedir.

wordpress

A PHP site plus the database, wp-config.php with fresh salts, the admin user, permalinks, HTTPS and a real cron entry replacing WP-Cron. See WordPress.

node

A Node.js application behind nginx on a private port, in a sandboxed systemd unit with a memory ceiling. See Node.js.

proxy

nginx and TLS in front of something already listening on a local port.

Creating a site

klyrn site create example.com
klyrn site create example.com --type static
klyrn site create example.com --type wordpress --admin-email you@example.com
klyrn site create app.example.com --type node --runtime 22 --git https://github.com/you/app
klyrn site create api.example.com --type proxy --port 9000

Flags that apply to any type:

--type

php (the default), static, wordpress, node or proxy.

--php

A PHP version other than the server default.

--account

The hosting account. Derived from the domain if you do not say.

--no-ssl

Do not request a certificate now.

--no-www

Do not also serve www.<domain> as an alias.

--wait

Wait for the job and stream its log. On by default.

WordPress adds --title, --admin-user and --admin-email, which is required. Node adds --runtime, --git, --branch, --start and --build. Proxy needs --port.

The account is a real Unix user with a home at 0710, owned by the account and grouped to www-data, so nginx can traverse it and no other account can list it. Two sites in two accounts cannot read each other's files.

Changing a site

The PHP version, the document root and the www handling all end in the same nginx and PHP-FPM reload, so they are one command.

klyrn site set example.com --php 8.3
klyrn site set example.com --docroot public/web
klyrn site set example.com --www none
klyrn site set example.com --memory-limit 512M --upload-max 64M --max-execution 120
klyrn site set example.com --reset-php     # back to the server defaults

Per-site PHP values are validated against real bounds, not passed through: memory up to 4096 MB, uploads up to 2048 MB, execution time up to 3600 seconds, input vars between 100 and 100000. An upload limit larger than the post limit is refused with the reason, because uploads that big would be rejected anyway. The panel shows the server default beside every field.

A document root that resolves outside the site tree, does not exist, is a symlink or is a file is refused. Changing the PHP version removes the old pool before creating the new one (both versions write the same socket path), so there is a moment with no backend. If the new pool fails to start, KLYRN puts the old one back and tells you the command to run if even that fails.

Suspension

Suspending swaps the vhost for a fixed page and nothing else. Files, databases, backups, cron rows and certificates are never read, moved or deleted.

klyrn site suspend example.com --reason "invoice 4417 unpaid"
klyrn site unsuspend example.com

The suspended page answers 403 Forbidden, not 503. Suspension is a deliberate access decision by the hosting provider, and 503 would tell visitors and search engines to come back later. Every name the site answers for (aliases and redirects included) is suspended with it, because leaving one out would drop that name through to the default server, which answers 200. The TLS configuration is kept when the site has a valid certificate, so a visitor sees the page rather than a certificate error.

A suspension may only be lifted by someone at least as senior as whoever imposed it. A reseller cannot quietly undo an administrator's suspension; the message says who imposed it and who may lift it. Reasons are capped at 300 characters.

Deleting a site

klyrn site delete example.com                  # keep the files
klyrn site delete example.com --remove-files   # remove the site directory too

Deleting removes the vhost, the pool, the cron entries and the database rows KLYRN created for the site. Backups are not deleted with it. To remove a whole account and everything under it, see Deleting an account: that one makes you type the account name.

Logs and secrets

klyrn site show example.com                    # details, certificate, recent jobs
klyrn site logs example.com --kind access --lines 200
klyrn site logs example.com --kind error
klyrn site logs example.com --kind php
klyrn site secrets example.com                 # WordPress admin and database credentials

Logs live at /home/<account>/logs/<domain>.{access,error}.log. Stored credentials are encrypted at rest, and revealing them is written to the audit log with who asked and from where.