Reproducible Infrastructure
The entire server is defined in versioned code — rebuild an identical machine on demand, audit every change in review, eliminate configuration drift
Platforms & Infrastructure
From Bare Server to Production Hosting. One Playbook. Every Time.
PM HostStack is the Ansible-based automation that provisions a fresh Debian server into a hardened, performance-tuned multi-stack hosting platform — WordPress and Next.js side by side, per-site isolation, automated SSL, nightly backups, and a full web admin panel for daily operations.
Consolidation Without Compromise
Many sites on one tuned server, each with OS-level isolation — shared-hosting economics with dedicated-hosting separation
Performance as Architecture
Layered caching, JIT-compiled PHP, tuned database and kernel — engineered for millions of monthly hits, not assembled from package defaults
Security by Default
Firewall, intrusion response, SSH hardening, per-site sandboxing, and automated compromise scanning are part of provisioning, not a later project
What it's about
PM HostStack
Hand-configured servers drift. Every "quick fix" over SSH makes the next migration harder, and nobody can say with certainty how the machine actually differs from the documentation. PM HostStack replaces that uncertainty with infrastructure as code: the entire hosting stack — web server, PHP, database, cache, firewall, certificates, backups — is defined in versioned Ansible roles and variables. Running the playbook produces the same server every time, and re-running it is safe by design.
The result is not a generic setup script but a deliberately engineered hosting platform: NGINX with FastCGI caching, PHP-FPM with OPcache and JIT compilation, a deeply tuned MariaDB, Redis object caching, and kernel-level network tuning — dimensioned for sites serving millions of hits per month. On top of it sits a web-based admin panel that handles daily operations, so creating a site, installing WordPress, or deploying a Next.js build never requires touching the command line.
PM HostStack is developed by premotion media and is the automation behind premotion media's own managed hosting. The same playbook that runs our production infrastructure is available for your servers — deployed on your own VPS or dedicated hardware, with no dependency on any proprietary hosting control panel.
Features
Thought through to the daily workflow.
Every building block is focused on a clear benefit and fits into existing processes.
Feature Section
A single playbook run takes a freshly booted Debian 13 machine to a production-ready hosting server. Every component is a tagged Ansible role, so the full stack — or any single layer — can be deployed, updated, or audited independently.
One Playbook, a Complete Production Server
A single playbook run takes a freshly booted Debian 13 machine to a production-ready hosting server. Every component is a tagged Ansible role, so the full stack — or any single layer — can be deployed, updated, or audited independently.
- Complete stack in one run: system tuning, firewall, MariaDB, Redis, PHP-FPM, NGINX, SSL, backups, admin panel
- Cloud-init user-data for first boot on any common VPS provider
- Idempotent by design: re-running the playbook changes only what actually drifted
- Role tags for targeted runs — update just NGINX, just PHP, or just security
- Dry-run mode with full diff preview before anything touches the server
- Optional roles (Node.js, monitoring, backups, PageSpeed, admin panel) enabled per server with a single variable
- All secrets encrypted with Ansible Vault — no plaintext passwords in configuration
WordPress and Next.js on the Same Server
PM HostStack is genuinely multi-stack. Each site is declared with a type — PHP, Next.js, static, or redirect — and the automation generates the right virtual host, runtime, and process management for it.
- PHP/WordPress sites with per-site PHP-FPM pools and FastCGI page caching
- Next.js/React sites run under PM2 in cluster mode behind an NGINX reverse proxy, each as its own systemd service
- Static sites and forwarding (redirect) domains as first-class site types
- Domain aliases with automatic 301 redirects to the canonical host
- Multiple PHP versions installed side by side — each site pins its own version, switchable without downtime
- Deterministic port allocation for Node.js apps, tracked in a server-side registry and never exposed through the firewall
Performance Architecture for Millions of Hits
The stack is not assembled from defaults — every layer is tuned for high-traffic, read-heavy workloads, with a design target of four-million-plus hits per month on a single domain.
- NGINX FastCGI cache with stale-serving, background refresh, and thundering-herd protection
- Redis object cache over a unix socket — faster than TCP for local connections
- PHP OPcache with JIT tracing compilation and tuned memory budgets
- MariaDB with deep InnoDB tuning, thread-pool connection handling, and warm-restart buffer pool persistence
- Kernel tuning: BBR congestion control, raised file descriptor limits, optimized TCP buffers
- HTTP/2 as standard, optional HTTP/3 (QUIC), Brotli and gzip compression
- Immutable long-lived caching for static assets, direct filesystem serving for Next.js build output
- Optional PageSpeed module with RAM-disk cache for automatic asset optimization
Strict Per-Site Isolation
On a multi-tenant server, one compromised site must never mean ten compromised sites. PM HostStack enforces isolation at the operating-system level, not just in the web server configuration.
- A dedicated system user per site — site users cannot read each other's files
- A dedicated PHP-FPM pool and socket per site, running as that site's user
- Next.js processes run as the site user with their own isolated process manager home
- Per-site databases with per-site database users
- systemd sandboxing for site services: no privilege escalation, private temp directories, protected system paths
- Per-site IP whitelisting for sites that should only be reachable from defined networks
Security Hardening as the Default
Hardening is not a checklist applied afterwards — it is built into the roles. A freshly provisioned server is locked down from the first minute.
- UFW firewall with deny-by-default policy; only SSH, HTTP, and HTTPS are open
- Nine purpose-built fail2ban jails: SSH brute force, WordPress login floods, vulnerability scanners, bad bots, request-rate abuse, and more
- SSH hardening: no root login, key-only authentication, limited retry attempts
- Rate limiting on WordPress login endpoints, author-enumeration blocking, XML-RPC lockdown
- Security headers on every site: HSTS, content-type, frame, referrer, and permissions policies
- Blocking of sensitive files for Node.js sites: environment files, Git metadata, package manifests
- Automatic security updates via unattended upgrades
- All third-party package sources cryptographically verified with pinned signing keys
SSL Automation That Never Breaks the Server
Certificate handling is where naive hosting automation fails: one missing certificate file can take down the configuration for every site. PM HostStack uses a two-phase approach that makes this failure mode structurally impossible.
- Let's Encrypt certificates obtained automatically per site, renewed by a system timer
- Two-phase rollout: sites go live HTTP-first, then flip to HTTPS the moment their certificate exists
- The web server configuration never references a certificate that is not on disk — a missing cert can never block all other sites
- Certificate coverage is verified against the actual certificate contents, so adding a domain alias extends the certificate automatically
- Forwarding domains and new sites get correct behavior before, during, and after certificate issuance
A Web Admin Panel for Daily Operations
Provisioning is code — but day-to-day operations should not require an Ansible run. The included admin panel, served on its own port with IP-restricted access, covers the routine work of running a hosting server.
- Dashboard with live system stats, service health, and a complete site overview
- Create, edit, and delete sites of all types — including web root, database, SSL, and runtime setup in one step
- Per-site PHP version switching from a dropdown, with zero-downtime pool handover
- Database management with one-click phpMyAdmin auto-login
- Encrypted credential vault (AES-256-GCM) for database and WordPress credentials — passwords are revealed on demand, never embedded in page source
- Traffic analytics from server logs: visitors vs. bots, cache hit rates, top pages, blocked requests, and bot classification
- Error log and slow-query analysis with grouped patterns and efficiency ratings
- Per-site scheduled tasks managed as systemd timers — created, edited, and monitored from the panel
- Git-based deployments, including private repositories via per-site deploy keys, plus Next.js build and restart from the browser
WordPress Operations and Compromise Scanning
For agencies running many WordPress installations, PM HostStack automates the work around the CMS — from installation to database hygiene to detecting a hacked site early.
- One-click WordPress installation with a hardened configuration: Redis object cache pre-wired, file editing disabled, forced SSL admin, revision limits
- Auto-login into WordPress admin directly from the panel
- Plugin overview and update management via WP-CLI, restricted to a safe command allowlist
- Weekly automated database maintenance: expired transients purged, revisions trimmed, orphaned metadata removed, core tables optimized — at idle priority with zero impact on live traffic
- Built-in security scanner for WordPress compromises: signature-based malware detection with five severity levels, core-file checksum verification to suppress false positives, finding history, and email alerts
- Nightly automated scan runs with results and dispositions tracked over time
Backups and Monitoring Built In
Recovery and visibility are part of the platform, not an afterthought bolted on later.
- Nightly backups per site: file archive plus consistent database dump, on a randomized schedule at low system priority
- Fail-loud backup design: a failed dump is never silently masked as a successful backup
- Configurable retention with automatic cleanup
- Backup creation, download, and restore accessible from the admin panel
- Optional Prometheus exporters for system and PHP-FPM metrics, firewall-scoped to your monitoring server
- Log rotation across the stack: web server, PHP, process manager, and slow-query logs
How it works
A clear path to the result.
- 01
Step 1 — Declare Your Infrastructure
Define your sites in the inventory: domain, type (PHP, Next.js, static, or redirect), PHP version, database, aliases, and options. Secrets go into an encrypted Ansible Vault — nothing sensitive is ever stored in plain text.
- 02
Step 2 — Boot the Server
Start with a fresh Debian 13 machine at any VPS or dedicated-server provider. Optional cloud-init user-data prepares the deploy user and SSH access on first boot.
- 03
Step 3 — Run the Playbook
One command provisions everything in order: kernel tuning, firewall, database, cache, PHP, web server, runtimes, backups, and the admin panel. A dry-run mode shows the full diff before you commit.
- 04
Step 4 — Certificates Flip On Automatically
New sites go live HTTP-first. As soon as each certificate is issued, the configuration upgrades to HTTPS with HSTS and modern TLS — without ever risking the other sites on the server.
- 05
Step 5 — Operate from the Admin Panel
Daily work happens in the browser: create sites, install WordPress, manage databases and credentials, deploy from Git, rebuild Next.js apps, review traffic and error analytics.
- 06
Step 6 — Let the Automation Run
Nightly backups, weekly database maintenance, certificate renewals, and security scans run on schedule. When you change your infrastructure definition, re-run the playbook — it converges the server to the new state and nothing else.
Who is it for?
Made for concrete requirements.
The solution is a particularly good fit for these teams, roles and business models.
Agencies Managing Many Client Sites
Consolidate dozens of WordPress and Next.js projects onto tuned servers you actually control. Every client site gets its own system user, PHP pool, database, and certificate — and your team gets one panel for all of it.
Companies Replacing Shared Hosting
Outgrown shared hosting but not ready to build an ops team? PM HostStack delivers managed-hosting-grade infrastructure on your own server, with the operational routine reduced to a web panel.
Development Teams Running Mixed Stacks
Marketing site on WordPress, product on Next.js? Both run on the same hardened server with the right runtime, caching, and process management for each — no second infrastructure to maintain.
Hosting and Managed-Service Providers
Use reproducible provisioning as the foundation of your own hosting offer: identical servers on demand, versioned configuration, and per-tenant isolation enforced at the operating-system level.
Ops Teams Committed to Infrastructure as Code
Every configuration decision lives in versioned roles and variables. Servers are cattle, not pets: rebuildable from code, auditable in review, and free of undocumented manual drift.
Organizations with Data Sovereignty Requirements
Run the full stack on infrastructure you choose — your provider, your region, your hardware. No proprietary control panel, no external SaaS dependency in the hosting path.
Tech & scope
The key details at a glance.
- Product Type
- Ansible automation project (playbook + roles) with web-based admin panel
- Target OS
- Debian 13 (Trixie), amd64
- Automation
- Ansible with pinned Galaxy collections; secrets via Ansible Vault
- Web Server
- NGINX with HTTP/2, optional HTTP/3 (QUIC), Brotli and gzip
- PHP
- Multiple PHP versions side by side, per-site FPM pools, OPcache + JIT tracing
- Database
- MariaDB with InnoDB tuning and thread pool
- Caching
- NGINX FastCGI/proxy cache, Redis over unix socket, OPcache
- Node.js
- Node.js LTS with PM2 cluster mode (optional role)
- Site Types
- PHP/WordPress, Next.js, static, redirect (forwarding domains)
- SSL
- Let's Encrypt with two-phase issuance and automatic renewal
- Security
- UFW, fail2ban (9 jails), SSH hardening, security headers, systemd sandboxing
- Admin Panel
- PHP 8.4, framework-free, served on a dedicated port with IP whitelist
- Credential Storage
- Encrypted vault, AES-256-GCM with derived keys
- Backups
- Nightly systemd timer, per-site archive + database dump, retention cleanup
- Monitoring
- Optional Prometheus node and PHP-FPM exporters
- Panel UI Language
- English
- Author
- premotion media
- Deployment & Pricing
- Available on request from premotion media
FAQ
Frequently asked questions.
What exactly is PM HostStack?
An Ansible-based automation project that provisions and maintains complete multi-tenant hosting servers — the tuned web, PHP, database, and caching stack plus firewall, SSL, backups, and a web admin panel. It is the same automation premotion media uses for its own managed hosting.
Which kinds of sites can one server host?
Four site types are supported side by side: PHP/WordPress sites, Next.js/React applications, static sites, and forwarding domains that redirect to another host while preserving the request path. Each type gets its own purpose-built server configuration.
How are sites isolated from each other?
At the operating-system level. Every site runs under its own system user with its own PHP-FPM pool and socket (or its own Node.js process manager), its own database and database user, and file permissions that prevent one site from reading another. A compromise of one site does not open the door to its neighbors.
Can different sites run different PHP versions?
Yes. Multiple PHP versions are installed side by side, and each site pins its own version. Switching a site's version from the admin panel performs an ordered pool handover designed to avoid any downtime window.
Do I need to be an Ansible expert to operate it?
No. Ansible is used for provisioning and structural changes; everything operational — creating sites, installing WordPress, managing databases, credentials, deployments, scheduled tasks, and backups — happens in the web admin panel.
How does the WordPress security scanner work?
A nightly scan checks WordPress sites for compromise indicators: malware signatures, suspicious recent file changes, and anomalies. Findings are graded across five severity levels, verified against official file checksums to suppress false positives, tracked historically, and can trigger email alerts.
What happens if a certificate cannot be issued?
Nothing breaks. Sites launch HTTP-first, and the configuration only references certificates that actually exist on disk. A missing or delayed certificate affects only that one site's HTTPS — it can never take down the web server or block certificates for other sites.
What do I need to get started?
A fresh Debian 13 server at any VPS or dedicated-server provider and a domain pointed at it. premotion media provisions the stack, migrates existing sites on request, and hands over a fully operational platform. Deployment options and pricing are available on request from premotion media.
Ready?
Your Hosting. Defined in Code. Run by Automation.
PM HostStack turns hosting infrastructure from a fragile, hand-maintained snowflake into a reproducible product: one playbook provisions a hardened, performance-tuned server for WordPress and Next.js alike, and one admin panel runs the daily operations — sites, SSL, databases, deployments, backups, and security scans. Whether premotion media operates it for you or hands you the keys: every server is built the same way, and every layer can be rebuilt from code.
Discuss your project