Pre-release. HostCraft is in testing and not yet for sale. These docs describe the current build and may change. Join the waitlist to hear when it launches.
HostCraft documentation
Hosting. Simplified. Built better.
HostCraft is one program that runs the control panel and everything it manages: websites and PHP, databases, DNS, email with spam filtering, a web application firewall, malware scanning and free SSL certificates, all set up by a single install command. Under the hood: nginx, PHP-FPM, MariaDB, PowerDNS, Postfix, Dovecot, Rspamd, Coraza, CrowdSec, ClamAV, Snuffleupagus and acme.sh.
curl -fsSL https://hostcraft.io/install.sh | sudo bash -s -- [email protected]- Trust
- Performance
- Simplicity
- Control




Start here
Section titled “Start here”InstallationCurl one-liner, manual install, system requirements.Configurationconfig.yaml, env vars, license JWT, paths.Roles and accessSix roles, sub-user presets, WebAuthn, API tokens.cPanel migrationThe cutover playbook, the 14 edge cases, fallback windows.SecuritySix-component stack, policy actions, IP whitelisting.Backupsrestic, S3, B2, retention defaults, restore procedures.User GuideFor hosting customers: websites, email, databases, files, backups.Admin GuideFor server administrators: accounts, plans, security, migration, updates.MailDNS records, DKIM rotation, deliverability, queue management.WP ToolkitInstall, update, clone, smart-update, hardening.Operationsdoctor, log locations, common troubleshooting.DeveloperAPI reference, webhooks, hook scripts.Cluster modeJoining a panel from an agent node. Phase 6.
What v1 ships with
Section titled “What v1 ships with”HostCraft v1 is the production-ready cPanel/WHM replacement. Everything listed below ships in v1 and is tested against real-world hosting workloads.
| Layer | Choice |
|---|---|
| Daemon | Go 1.27, single static binary, systemd unit |
| Frontend | React 19 + TypeScript 6 + Vite 8 + Tailwind 4.3 + React Router 8, embedded via go:embed |
| Panel database | SQLite (solo), PostgreSQL (cluster) |
| Web server | nginx + PHP-FPM, FrankenPHP optional per site |
| PHP versions | 7.0 to 8.4 from Sury or Remi, plus 5.6 in legacy mode |
| Database | MariaDB default, MySQL alternative |
| DNS | PowerDNS with MariaDB backend |
| Postfix + Dovecot + Rspamd + SnappyMail webmail | |
| Security | Coraza + CrowdSec + ClamAV + Snuffleupagus + FIM + outbound monitor |
| SSL | Let's Encrypt and ZeroSSL via acme.sh |
| Backups | restic to S3, B2, or local |
| Updates | Cosign-signed binaries, atomic swap, auto-rollback |