Automated Multi-Site Web Hosting Platform

The challenge

Manual website configuration works until many sites, domains, certificates, PHP versions, users, and servers must be managed consistently. Small differences between technicians or older deployments create security gaps and turn migration and troubleshooting into archaeology.

The operator needed repeatable engineering processes without hiding the underlying NGINX configuration behind an opaque control panel.

Requirements

• Create repeatable site, user, directory, NGINX, PHP, certificate, and logging configuration
• Preserve operator visibility into native Linux configuration rather than hiding it behind an opaque control panel
• Validate configuration before activation and provide actionable diagnostics when provisioning fails
• Support existing sites, multiple PHP versions, migrations, backups, and safe upgrades
• Apply secure defaults while allowing controlled site-specific exceptions

Architecture

A command and service layer translates site definitions into deterministic operating-system configuration. Templates generate NGINX virtual hosts, PHP-FPM pools, filesystem ownership, log paths, and certificate bindings. Preflight checks validate domains, ports, paths, permissions, syntax, dependencies, and configuration conflicts before activation.

┌─────────────┐     ┌──────────────────────────────────┐
│ Operator    │────▶│ Command / service layer          │
│ (CLI/API)   │     │ Preflight · templates · audit    │
└─────────────┘     └──────────────┬───────────────────┘
                                   │
                    ┌──────────────▼───────────────────┐
                    │ Generated Linux configuration      │
                    │ users · dirs · NGINX · PHP-FPM   │
                    └──────────────┬───────────────────┘
         ┌─────────────────────────┼─────────────────────────┐
         ▼                         ▼                         ▼
   ┌───────────┐            ┌─────────────┐           ┌────────────┐
   │ NGINX     │            │ PHP-FPM     │           │ TLS / logs │
   │ vhosts    │            │ per-site    │           │ backups    │
   └───────────┘            └─────────────┘           └────────────┘

Major capabilities

• Automated site and domain provisioning
• NGINX virtual-host generation and testing
• Per-site PHP-FPM pools and version selection
• TLS certificate integration and renewal support
• Standardized filesystem ownership and permissions
• Logs, diagnostics, backups, and deployment validation
• Multi-site and multi-server operations
• Repeatable install, upgrade, migration, and repair tooling

Security and privacy

Each site receives deliberate filesystem and runtime boundaries. Secure protocol and header defaults are applied centrally. Configuration is tested before reload, privileged operations are narrowly controlled, and secrets remain outside public document roots. Exceptions are explicit so temporary workarounds do not silently become permanent policy.

Implementation

The platform encoded proven manual practices into templates and idempotent actions. Provisioning was broken into inspectable stages: preflight, user and directory creation, runtime configuration, web configuration, certificate work, syntax validation, activation, and health verification. Existing sites could be adopted gradually.

Difficult problems solved

• Automating privileged configuration without making failures destructive
• Supporting legitimate per-site differences without losing standardization
• Keeping generated configuration readable enough for direct diagnosis
• Handling partial failures so a certificate or reload problem does not leave the server in an unknown state

Operational results