When Apple discontinued macOS Server.app, Mac users lost the simple, point-and-click way to run websites and services. FrontierStack brings that back and goes much further: it installs, controls, secures and monitors Apache, PHP, MySQL, PostgreSQL, Nginx and more than a thousand other services — on the Mac in front of you and on every server you link to it — and it puts a tool-using AI administrator at the helm.

This manual is the complete reference for the desktop app. A companion Mobile Manual covers the iPhone and iPad app. Read this first chapter end to end; after that, dip into whichever part you need.

1.1What FrontierStack is

FrontierStack is a native macOS application — not a web panel, not a container you have to babysit. It manages real services on real machines using the tools they already ship with: Homebrew formulae, launchd and systemd units, Apache and Nginx config, certificates, firewalls and SSH. It is three things at once:

• A control panel. Install, start, stop and configure services with validation, live status and one-click fixes — the macOS Server replacement, modernised.
• A monitoring and alerting system. A continuous health sweep watches services, sites, certificates, disks and your whole fleet, and turns the first sign of trouble into a message on the channels you choose.
• An AI administrator. A guard-railed, tool-using assistant with a live, accurate picture of your setup. It can diagnose what is broken, propose a fix you approve, run it locally or across your fleet, and reshape the app to exactly what you run.

1.2An AI-first design

Most apps bolt a chat box onto the side. FrontierStack is built the other way around: the AI is a first-class operator of the same controls you use. Because it acts only through a fixed set of audited tools — read a log, run a diagnostic, restart a service, issue a certificate, write a file — everything it does is something you could do by hand, and everything that changes the system is shown to you for approval first.

Three principles make this safe enough to trust with production servers:

• Read-only by default. Out of the box the assistant can look but not touch. Changes and scripts are unlocked by explicit toggles, and every mutating action shows an approval card before it runs.
• Your secrets never reach the model. Passwords and API tokens live in a local .env vault. Scripts reference them by name; the app injects the real value at run time, locally or over SSH. The cloud model sees the name, never the value. Logs and files are secret-redacted before they are sent.
• You bring your own AI. Point it at a cloud model or a local one (Ollama, LM Studio). If you drive it from your own subscription tool over MCP — Claude Code, Cursor — there is no metered per-token bill at all.

1.3Who it is for

FrontierStack suits anyone running — or wanting to run — servers on a Mac:

• Developers who want a clean local stack instead of MAMP or XAMPP.
• Small businesses self-hosting POS, CRM, e-commerce, mail and helpdesk on a Mac mini.
• Admins keeping a vintage Xserve or Mac mini on macOS Server useful by managing it remotely.
• Anyone moving from metered SaaS to self-hosted, or running a fleet of Macs, Linux boxes, BSD servers and Raspberry Pis from one window.

1.4Key concepts and vocabulary

A handful of terms recur throughout this manual. Meet them once here.

1.5How this manual is organised

The manual follows the shape of the work:

• Part I — Getting Started: install, first run, and a tour of the interface.
• Part II — Running Services: the web stack, databases, the full catalog, and sites & domains.
• Part III — Fleet, Network & Security: linking servers, networking and the perimeter, hardening, and monitoring & alerts.
• Part IV — Automation & AI: scripts and schedules, the AI Administrator in full, MCP, and the AI stack.
• Part V — Business & Reference: vertical solutions, settings, shortcuts, licensing and troubleshooting.

If you are brand new, continue to Chapter 2, Installation & First Run. If you just want to understand the AI, jump ahead to Chapter 13 — but the safety model there assumes the concepts above.

FrontierStack installs like any other Mac app — drag it to /Applications and open it. What happens next is up to you: it can run entirely with the per-action password prompts macOS already gives you, or you can grant it a small set of permissions once and never be asked again. This chapter walks the whole first run, then shows how to migrate an existing local stack so you keep your sites and databases.

2.1System requirements

FrontierStack is a native, signed macOS application. You need:

Nothing in this list is unusual; if your Mac is recent enough to run a current macOS, it can run FrontierStack.

2.2Downloading and first launch

Download the app, move FrontierStack.app into your /Applications folder, and double-click it. Because the app is signed by Enfour, Inc. (Apple Developer team 6Y87KNMALP) and notarised, macOS opens it without the unidentified-developer warning.

1. Open FrontierStack. The main window appears with the service sidebar on the left and a health overview in the centre — the layout you met in Chapter 1.
2. If Homebrew isn't present yet, panes that need it will say so and offer to install it. You can do that now or later.
3. FrontierStack enforces a single running instance. If a copy is already open and you launch it again, the existing window is simply brought to the front rather than a second copy starting. This keeps two windows from fighting over the same services and config files.

The first launch makes no changes to your system. The app reads what is installed and shows you the state of things; nothing is started, stopped or reconfigured until you ask.

2.3The Setup Assistant

The first time you open FrontierStack it offers a short Setup Assistant rather than dropping you into a sidebar of several hundred services. It is eight pages, it asks about you rather than about configuration, and nothing it asks is permanent — every answer only decides what the app shows and suggests first. You can leave at any point and reopen it from Add Server or Device ▸ Setup Assistant.

Finishing opens one more step: the Services Manager, filling the screen, with the sections that match your answers already open and every item in them switched off. Switch on what you want in the sidebar and choose Continue. Choose Skip — or Continue without switching anything on — and everything recommended is turned on instead. The AI Administrator and AI Models stay on either way, and the AI Administrator is briefed only once this step closes.

The last page is about licensing, and it is honest rather than a sales gate. FrontierStack works unlicensed — monitor this Mac, connect servers, use the AI Administrator, read every diagnostic. One capability in the plan you just built is licensed: running a migration. Moving a stack copies databases, sites and configuration onto a target and changes what runs there, so it needs a licence. Without one FrontierStack still detects the source, lists the sites and databases it found, and shows exactly what a migration would move — and the AI Administrator will still write you the full plan. Only carrying the move out is gated, and the Migration pane says so on the button rather than failing silently.

Containers, backup destinations and monitoring are deliberately not installed from the Stack page. They need decisions the assistant should not make on your behalf, so they go into the plan instead.

2.4The privileged helper — and the permissions macOS asks for

Starting and stopping services and editing system configuration (Apache, Nginx, MySQL, DNS, the firewall) are privileged operations. Out of the box, FrontierStack performs each one through the standard macOS authorisation prompt: you type your password every time. That is safe but quickly becomes tedious.

The optional helper removes that friction. It is a small privileged tool — an SMAppService daemon — that the app registers with macOS so it can carry out admin actions without re-entering your password each time. You install it deliberately: use the Install affordance at the foot of the sidebar, or accept the prompt when an action first needs it.

1. Click Install on the helper row at the bottom of the sidebar.
2. macOS shows its Login Items & Extensions approval (or asks you to enable the background item in System Settings ▸ General ▸ Login Items). Approve it — this is macOS asking whether to let the daemon run, not the app overriding anything.
3. The sidebar row flips to show the helper registered and running. From now on, service start/stop and config edits proceed without the per-action password prompt.

You can remove the helper at any time; FrontierStack then falls back to per-action admin prompts. Both modes work — the helper is purely a convenience.

2.5Installing Homebrew

Most of the catalog — web servers, databases, caches, mail, dozens of CLI tools — is installed as Homebrew formulae. Homebrew is the package manager FrontierStack uses to fetch and update those services, so if it isn't already on your Mac you'll want it early.

Open the Homebrew pane from the sidebar. If Homebrew is missing, the pane says "Homebrew isn't installed. It's the package manager this app uses to install services," with a Get Homebrew… button. Installation runs in the app's in-app console: it executes the official Homebrew installer and, at the point the installer needs administrator rights, you type your own password into the console. FrontierStack never captures or stores it — the prompt is Homebrew's own.

Once Homebrew is present, the pane becomes a full package manager: a searchable table of installed formulae and casks with their versions, an Install formula or cask field, an Update All button that shows the outstanding count, and per-row Update / Uninstall actions. The AI Administrator can drive the same flow with its install_homebrew and install_package tools, again through the in-app console where you enter your password.

2.6Nix, Devbox and Home Manager

Everything Nix lives in the Nix pane (under Infrastructure as Code), in tabs. Overview shows which Nix is installed — upstream Nix, Determinate Nix or Lix — whether its daemon is running and whether flakes are on. Without Nix, it offers both installers. It also catches the problem Mac users meet most: a macOS update replaces /etc/zshrc, so new terminals say nix: command not found although Nix is fine. Repair Shell Set-up puts the installer’s lines back.

• Packages searches nixpkgs and installs, removes, upgrades or rolls back the packages in your Nix profile.
• Devbox lists every project with a devbox.json in your usual project folders, with its packages, scripts and the services Devbox runs for it. Start, stop, restart or attach to them, open a devbox shell, or generate a Dev Container, Dockerfile or direnv file. Run a service with Devbox sets up PostgreSQL, MySQL, MariaDB, Redis, Valkey, Nginx, Caddy, Apache or PHP + Nginx in its own folder under ~/FrontierStack/Devbox and starts it, with no Docker and no Homebrew service.
• nix-darwin (when installed) switches, builds and rolls back the Mac’s system configuration. Store shows how much space /nix/store uses and collects garbage.
• A stopped daemon, a missing /nix volume or a failing Devbox service shows under Needs Attention and can raise an alert. Servers with Nix, NixOS or Devbox get a Nix tab in the Server Activity window.

The Home Manager tab is for Nix Home Manager, set up on its own or as a nix-darwin module. It shows where your configuration lives and whether it is a flake, and can set Home Manager up with a flake in ~/.config/home-manager.

• Switch Configuration builds and activates your configuration, Build Only checks it without activating, and Update Inputs runs nix flake update. Each runs in the in-app console.
• Flake inputs shows how long ago nixpkgs was pinned and turns orange after 60 days: Nix packages only get security fixes when you update and switch.
• Generations lists every generation with its date. Activate rolls back to one; Remove Old Generations clears those older than 30 days and frees the disk space.
• The pane also lists the packages and dotfiles the current generation provides and Home Manager’s launchd agents. Nix packages using too much CPU or memory appear under Needs Attention, as in the Homebrew pane.

2.7Tool versions with mise

mise (short for mise-en-place) gives each project the right Node, Python, Ruby, Go or Terraform version, its environment variables and its tasks — one tool in place of nvm, pyenv, asdf, direnv and make. The mise pane (under Runtimes) installs it and warns when your shell doesn’t activate it, since until then new terminals ignore the versions mise installed; Activate in Shell fixes that.

• Tools lists every installed version, the config that asks for it and which one is active. Add a tool for every folder, uninstall a version, or prune versions nothing uses.
• Updates shows tools behind the newest version their config allows and upgrades them.
• Projects lists folders with a mise.toml or .tool-versions: their tools and tasks, whether mise trusts them yet, and which kinds of secrets they use (age, SOPS or fnox). FrontierStack never decrypts or shows a secret value.
• Secrets (fnox) lists every fnox.toml with its providers and secret names, warns about secrets kept as plain text, and marks the ones KeyRotate can rotate through fnox.
• Servers with mise get a mise tab in the Server Activity window.

2.8The Command-Line PATH pane

FrontierStack detects installed tools by resolving them the way your shell does. Occasionally a tool you've installed (via pip, pipx, a virtualenv, or a non-standard prefix) isn't on the PATH the app sees, so it reports the tool as missing. The Command-Line PATH pane fixes that.

• Pick your shell profile (for example ~/.zprofile). Directories you add are written to a clearly marked managed block in that file and prepended to your PATH — open a new terminal to pick up the change.
• Directories to add lets you add a path by typing it or with Choose…; the top entry is searched first. Current PATH (effective) shows your login shell's PATH, tagging entries the app manages.
• PATH Doctor diagnoses why a tool isn't detected: enter a command (e.g. mlx_lm.server, gcloud) and it reports whether the app finds it, whether only your shell finds it, or whether it isn't installed at all — with a one-click Add to managed PATH for any directory the app is missing.

2.9The Install Wizard

If you're starting from scratch, the Install Wizard (in the sidebar) is the fastest way to a working stack. Pick a target use-case — WordPress/PHP, Full-Stack JS, Python/Django, Rails, static site, database, or reverse proxy — and the wizard pre-selects the recommended components (web server, database, cache) for that goal. Adjust the selection to taste, then it installs everything through Homebrew.

The same pane shows the status of the native Apache + MySQL + PHP stack at a glance, and detects all-in-one bundles already on your Mac — XAMPP, MAMP, AMPPS, Local. If it finds one, it routes you to Migrate Setups rather than installing a parallel stack, so you don't end up running two of everything.

2.10Migrating an existing stack

If you already run sites locally under MAMP, XAMPP or Apple's Server.app, you don't have to rebuild them. The Migrate Setups pane detects those stacks and brings their pieces into FrontierStack's native Homebrew stack: web files, MySQL databases, PHP settings, and the Apache vhosts that define each site.

1. Open Migrate Setups. It scans for installed sources — MAMP / MAMP Pro, XAMPP, Pancake Stack and Apple Server — and reports what it found: the sites, the database, and whether PHP was detected. (The AI Administrator's detect_migration_sources tool runs the same read-only scan.)
2. Review the Sites to import list. Each candidate shows its server name and listening port; anything that can't be brought across cleanly appears under Skipped with the reason.
3. For settings, the Import All Settings action copies the source's php.ini, my.cnf and nginx.conf over the matching Homebrew config. A .pre-mamp.bak backup of each file is kept so you can compare or revert.
4. Choose Import Selected to run the migration. Live progress is shown in the pane as it installs the needed Homebrew services, copies web files, migrates the MySQL databases and imports the vhosts.
5. Review afterwards. Source configs often reference the old tool's paths and ports (for example MAMP's extension_dir, datadir, socket, or port 8889), so check the imported settings before relying on them.

From Pancake Stack. Keep Pancake running so its MySQL answers. FrontierStack reads Pancake's site list and copies its databases with the Homebrew MySQL tools, using the root password Pancake keeps in your keychain; macOS asks once whether FrontierStack may read Pancake's data and use that password — choose Allow. Pancake gave each site its database settings through the environment, so the Give each site its own MySQL user step creates a MySQL user per site and writes it into the site's wp-config.php or Laravel .env. Python apps, custom Apache directives and sites without one of those files are listed in the log for you to finish by hand. Pancake itself is not changed.

The AI Administrator can drive this end-to-end with run_migration, but only after detecting sources and confirming with you — and only with changes enabled.

2.11Where your data lives

FrontierStack keeps its own state in predictable, standard places, so you always know what it touches and can back it up:

Keeping the app's Apache config in its own frontierstack/ directory means FrontierStack can manage vhosts safely without clobbering configuration you maintain by hand. The bundle identifier is jp.co.enfour.frontierstack (the helper and DDNS components use the .helper and .ddns suffixes).

With the app installed, the helper decided, Homebrew in place and any old stack migrated, you're ready to actually use it. Chapter 3, The Interface tours the window in detail: the sidebar, panes, search, the menu bar, and the controls you'll reach for every day.

FrontierStack manages an enormous range of services, yet it presents them through a single, familiar macOS window: a sidebar of things on the left, the screen for the selected thing in the centre, and a row of always-available tools in the toolbar. Learn this layout once and every pane in the book — from Apache to a Cloudflare zone — sits exactly where you expect it. This chapter walks the interface end to end so the rest of the manual can simply say "open the Sites pane" and trust that you know how.

3.1The main window

The window is a standard macOS NavigationSplitView with three regions. On the left is the service sidebar: a scrollable, collapsible list of every service and tool you have chosen to see, grouped into categories. In the centre is the active pane — the screen for whatever you selected in the sidebar, with its own header, tabs and controls. Running across the top is the toolbar, whose buttons are available no matter which pane you are in.

From right to left, the toolbar holds: Search (the magnifying glass, also ⌘F); the AI assistant (the wand, which opens the floating command palette); a Shell button that drops a terminal into the current working directory; a Dark mode toggle that forces dark even when macOS is in light; and, when the selected pane can be floated, a break-off button to pop it out as a palette. If you have unsaved changes to a Setup, an orange Unsaved menu appears here too. When KeyRotate is installed, its ring-of-keys button sits in a group of its own at the far left; it opens KeyRotate, or brings it to the front.

The sidebar's width is yours to set — drag the divider and FrontierStack remembers it across launches. Your last-selected pane is restored when you reopen the app, so you return to where you left off.

Sidebar groups tame a sidebar that spans several sites or companies. Right-click any pinned server, device, Cloudflare zone, Wi-Fi network or cluster and assign it to a group ("Osaka office", "Acme Corp"); group rows at the top of the sidebar then switch between the sets, showing the active group's items plus everything ungrouped — grouping is optional, and ungrouped items are always visible. A red count on a non-active group warns that something hidden inside it has a problem, and a group linked to a Location activates itself when you arrive on that network. The iPhone app mirrors the same folders in its Fleet tab.

3.2The service sidebar

The sidebar is organised into two tiers. At the top sits Overview — the app's own built-in tools: Local Health, Status Page, Alerts, Spend & Billing, Domains, Logs, Certificates, Notes, Scripts, Setups, Settings and more. Below it, one section per service category — Web Servers, Databases, Caching, Mail, Networking, Security Tools, Containers, AI and dozens more — each listing the services you have chosen to show from the catalog (Chapter 6). Every section header is a chevron you can click to collapse, and the app remembers which groups you leave folded.

Each service row shows a status dot when it is running. Right-click a service for two quick actions: Pin to Top of Section keeps a service you touch often at the top of its category, and Hide removes it from the sidebar. Hiding never uninstalls anything — the service keeps running and stays reachable from Search; it just stops cluttering the list.

Below the categories, the sidebar grows extra sections for the things you pin elsewhere in the app: linked servers (each with little category icons showing which services it runs), monitored Wi-Fi networks, Cloudflare zones and Kubernetes clusters. Type in the filter field at the top of the sidebar to narrow every section at once.

3.3Presets and Setups

Two features shape what the sidebar shows. The Presets menu (in the menu bar) is the fast way to load a whole use-case at once. Its Base — show services for… section swaps the sidebar to a curated set for a scenario (a web stack, a mail server, a shop), while Add to current view… layers an extra group onto what you already have. Show All reveals everything; it is the escape hatch when you cannot find something.

Setups go further: a Setup is a named snapshot of your whole working view — which services are hidden, which are pinned, and the floating palettes you have open and where they sit. Save one from Presets ▸ Save Current as Setup… (or from the Setups pane), then flip between Setups from the top of the Presets menu; the active one carries a check mark. The palette layout auto-saves into the active Setup as you move windows around, so a Setup always reflects how you really work. Change which services are shown and the Setup goes dirty; the toolbar shows an orange Unsaved badge with Update, Save as New and Revert.

A Setup can also be bound to a Location (Chapter 8). Bind your "Office" Setup to your office network and FrontierStack switches to it automatically when you arrive — the right services, the right palettes, for where you are.

3.4Floating palettes and mini-palettes

Sometimes you want to keep one screen visible while you work elsewhere. Any monitor-style pane can be broken off into a floating palette: a small, always-on-top utility window built on macOS NSPanel, so it stays above the main window and other apps. Use the break-off button in the toolbar (or ⌘⌥⇧W to close the front palette). Local Health, Containers, Cloud Servers, the Wi-Fi Analyzer and others all float.

For an even lighter footprint there are mini-palettes — compact, glanceable summaries rather than the full pane. Minis exist for Local Health, Cloudflare Zones, Wi-Fi, Printers, Router & Network, Containers, Scripts, Message Delivery and AWS. Each mini row has a button to open the matching pane in the main window when you need the detail. Open palettes are part of a Setup, so a saved view restores your floating windows exactly as you arranged them.

3.5The command and AI palette

The wand button in the toolbar opens the AI assistant palette — a draggable, always-on-top NSPanel with a single ask-anything field ("why is my site down?", "tune MySQL", "show only what I use"). It is the same AI Administrator covered in Chapter 13, surfaced as a floating window you can keep beside whatever you are doing. Like every floating palette it stays above the main window; unlike the others it talks back, proposes fixes and — with your approval — acts. It carries its own conversation history and an approval card for any mutating action, so nothing runs until you say so.

3.6The menu-bar item

FrontierStack can place a small item in the macOS menu bar (toggle Show in Menu Bar). It is the quickest way to act without bringing the whole window forward. From it you can Start or Stop your startup group, Restart any of the core servers (Apache, Nginx, PHP-FPM, MySQL, Postgres) or everything running at once, refresh status, and open or quit the app. Only Background quits the app but keeps the background service (MCP, the CLI, paired devices, monitors) running, turning it on first if needed. The FrontierStack icon stays in the menu bar, now served by the background service, with Open FrontierStack and Quit FrontierStack; quitting there stops the background service until FrontierStack is next opened or you next log in. The icon also stays after a background launch quits when idle. Launch-at-login settings are in Settings › General.

Its Localhost Sites section lists every site from the Localhost pane by name, marked with a filled circle when running and a hollow one when stopped, together with what serves it and the versions (for example Apache 2.4.62 · PHP 8.3.14 or PHP 8.4.5). Each site's submenu starts, stops, restarts or opens it; Start and Open in Browser waits until the server is listening before opening the page.

3.7In-app Search

Search (the magnifying glass, ⌘F) is the fastest way to reach anything. Start typing "search services, tools & actions…" and the palette matches panes, tools, services and actions as you go — including services you have hidden from the sidebar. Pick a result and the app navigates straight to it. A Semantic mode lets you search by meaning ("block an IP", "free up disk") rather than exact names, so you can find a capability without knowing what FrontierStack calls it.

3.8The Help window

Open Help with ⌘? for a dedicated FrontierStack Help window. It is a real book of in-app documentation, organised to mirror the app. Help is more than reading: its pages carry Open in app links. Click one and FrontierStack jumps the main window to that exact pane or service — the Help window stays open beside it, so you can read a procedure and follow along step by step. Many panes have a small help button in their header that opens Help at the matching topic.

3.9The Notes pane

Notes is your private place for credentials, runbooks and per-service instructions. Each note has a title, a service tag and a body, and the whole thing is encrypted in the macOS Keychain — not stored in plain files. The defining feature is the per-note lock: every note carries a Share with AI Administrator toggle that is off by default. While a note is locked, the AI literally cannot read it. Unlock a note only when you want the assistant to use those credentials or steps; it then appears in the AI's list_notes and can be read on demand.

3.10The Status Page

The Status Page pane publishes a static index.html built from the same up/down data as Local Health, so customers or colleagues can see what is running without access to the app. Choose a destination — a folder inside one of your Apache sites' DocumentRoots, so it is served at a path like /status/ — set a page title, and decide whether to Include item details (leave detail lines off for a public page, since they can reveal internal hosts and ports). The page regenerates on an interval you set, or on demand with Generate Now. Serve with picks Apache or the built-in server (a bundled static file server on a port of your choice, localhost or LAN), and Launch keeps that server running at login or at system start so the page outlives the app. A Servers section can list pinned servers with monitors, kept live even while the app is closed, and Internet access offers persistent routes (Cloudflare Tunnel, Tailscale, router port-forward with Dynamic DNS). Location Pages publish a separate page for any place or client, listing only what you put there in Places; an item has one physical place but can be shared with any number of clients, and appears on each of their pages. Chapter 11 has the details.

3.11Local Health and Locations at a glance

Two Overview panes anchor everyday use, and each has a full chapter of its own. Local Health is the board that answers "is everything OK?": every monitored service, device and subsystem with an UP or DOWN state and a one-line summary. You mark items as critical from their own panes to add them to the board, and it doubles as a floating palette and a mini. Its full treatment — the health sweep, thresholds and how it drives alerts — is Chapter 11.

Locations teach the app where your Mac is on the network right now — Home, Office, On VPN — matched from the Wi-Fi network or subnet. Locations make monitoring network-aware: while you are somewhere unrecognised the app treats you as Away and pauses location-scoped checks, so a café or hotel network never sets off false alarms. They also bind Setups, as we saw above. The complete model — defining locations, scoping alerts and reachability, the fleet — is Chapter 8.

With the layout learned, you are ready to put it to work. The next part of the manual opens the panes themselves, starting with Chapter 4, The Web Stack.

A web server is the heart of most self-hosted setups, so FrontierStack treats it as a first-class citizen. The Apache pane installs, starts, validates and configures a Homebrew Apache; the PHP, Localhost, Certificates and DNS panes round out a complete development and hosting stack — and every change goes through validation so a typo never takes a site down silently.

This chapter covers the panes that make and run web sites on the Mac in front of you. Connecting that stack to a real domain and the public internet is Chapter 7; tightening it for production is Chapter 10.

4.1The Apache pane

Open the Apache pane from the sidebar to see your web server’s state at a glance: version, whether it is running, and the ports it listens on. The buttons across the top are the controls you reach for daily — Start, Stop, Restart and Validate Config. Validation runs apachectl -t (a real syntax check) and shows the result in Last Result, so you can confirm a change is sound before you reload.

FrontierStack recommends a Homebrew Apache rather than the macOS system copy. The Homebrew server lives under /opt/homebrew (or /usr/local on Intel Macs), runs as you through brew services without a root prompt for every action, and is not locked down by System Integrity Protection — so a current mod_php loads cleanly and the whole stack stays on one toolchain. The system Apache under /etc/apache2 is wiped by OS updates and ties you to Apple’s bundled libphp. If Homebrew Apache is not installed, the pane offers Install Homebrew Apache… in one click.

If you keep several Apache builds — the Homebrew one, a legacy local build, or a remote server’s — the binary picker (see Add Homebrew Apache / Add Local Build…) lets you register and switch between them, each with its own version and ports shown.

4.2Modules, ports and the managed config

Lower in the Apache pane are the parts of the config you most often edit, each surfaced as a control rather than a file:

For anything not exposed as a control, the config rows give you Edit Managed Config… (the FrontierStack include) and Edit httpd.conf… (the main file) directly. Every save validates with apachectl -t, reloads gracefully, and rolls back if the new config does not parse — so a bad edit is caught before it can break the running server.

Toggling a module rewrites its LoadModule line and revalidates. If a change leaves httpd -t failing — the classic case is enabling proxy_fcgi without proxy, which the app now auto-enables for you — the Modules window shows the error and won’t close silently: you either correct it or choose Save anyway. When Apache is wedged and won’t start (the classic Homebrew Bootstrap failed: 5: Input/output error, from a service that was already loaded, or from sudo brew services leaving some httpd paths owned by root), the pane’s Recovery & reset section offers three escalating fixes: Restart cleanly (stops httpd in both the user and system launchd domains, then starts it once), Reset config to default (backs up your httpd.conf and restores Homebrew’s), and Remove & Reinstall (clears the root-owned paths and reinstalls the formula). All run in the in-app console so you see the sudo prompt and output. If Service Watchdog keep-alive is also on for Apache, it may restart httpd on its own — expected, but pause it if it fights a manual recovery.

4.3Choosing the PHP version

Open the PHP pane to manage the PHP runtimes installed on the Mac. Homebrew lets several major versions live side by side (for example [email protected] through the current release), and FrontierStack treats them as a set you switch between rather than a single global install.

Version ▸ Add Version… installs another version alongside the ones already there — nothing is replaced, and the version you are using does not change. The list has two parts. Homebrew’s own releases are the ones still supported upstream. Below them sit the end-of-life builds — PHP 8.0 back to 5.6 — which PHP itself no longer patches and Homebrew has dropped; FrontierStack fetches those from the community shivammathur/php tap, and asks you to confirm each one first, because installing from a tap means running that tap’s own code. Keep an end-of-life PHP for testing or maintaining a legacy site on your own machine, and never point the public internet at it.

There are two distinct choices:

• The Apache module. In the Apache pane’s PHP Module section, the Load for websites picker chooses which version’s libphp.so Apache loads. Changing it rewrites the managed config and reloads Apache.
• Per-site PHP. A local dev server (the Localhost pane, below) has its own PHP Version picker listing every installed version, so one project can run on an older PHP while another runs on the latest — without changing what the rest of the machine uses. This is the usual way to keep a legacy app and a new one happy at the same time. It applies to both local runtimes: the PHP built-in server and the Apache runtime. One caveat for Apache, which serves through mod_php: a version is only usable there if its keg ships libphp.so, and the editor tells you when the one you picked does not. When it does not, run that site on the built-in server, or serve it through PHP-FPM.

PHP Cache. The PHP pane’s PHP Cache section chooses between No cache, OPcache and OPcache + APCu. OPcache keeps each script’s compiled form in shared memory, so pages run faster; APCu adds a key-value cache that apps call directly (apcu_store/apcu_fetch) — WordPress object-cache plugins, Laravel and Symfony use it. Set the OPcache memory and Check for changed files: Every request suits development, because an edited file shows on the next reload; Never suits production, where code changes appear only after a restart. APCu is a PECL extension, so the first time you pick it, press Install APCu. Apply Cache Settings writes php.ini and restarts Apache. Sites served through PHP-FPM pick up the change when their pool restarts.

The Runtime Health pane gives the wider picture — PHP alongside Python, Node.js, Java, Go, Rust, Ruby, Perl and .NET — with a self-check that flags a missing or end-of-life runtime before it bites you.

The Runtimes section also carries a React pane for front-end work. It scaffolds a new app (Vite, TanStack Start or Next.js), points at any React project, and offers a curated companion-library list filed by the job each does — state management (Zustand, Jotai, Redux Toolkit), data fetching and server state (TanStack Query — the library formerly called React Query — and SWR), full-stack frameworks (TanStack Start, Next.js), routing, validation (ArkType, Zod), forms, and authentication (Clerk). Each row shows its docs, whether the selected project already uses it, and a one-click npm install into that project.

4.4Updating PHP on an older Mac with MacPorts

Older Macs (macOS 10.13 High Sierra and earlier, including Apple Server.app machines) still run Apple's built-in PHP. On High Sierra that is PHP 7.1, which has had no security fixes since 2019. Homebrew no longer supports macOS this old, but MacPorts still does. Use it to install a current PHP alongside Apple's, then move the command line and the websites over to it. Run the commands in Terminal on that Mac, or over SSH. Every port command that changes something needs sudo; the error “attempt to write a readonly database” means it was left off. For a linked server, you can also ask the AI Administrator to walk you through these steps.

1. Make sure Terminal finds MacPorts. If port answers “command not found” although /opt/local/bin/port exists, the MacPorts installer didn't add its PATH line. Open ~/.bash_profile (or ~/.profile, if that is the file your shell reads) and find the comment “MacPorts Installer addition”. If nothing sits between it and “Finished adapting”, add this line there, then open a new Terminal window:

export PATH="/opt/local/bin:/opt/local/sbin:$PATH"

2. Update MacPorts and see what's installed. The last command lists the PHP 8 versions MacPorts offers.

sudo port selfupdate
port installed 'php*'
port echo 'name:^php8[0-9]$'

3. Install the new PHP and its extensions. The example uses PHP 8.4. Install the same extensions your sites already use; port installed 'php80-*' lists an older version's set.

sudo port install php84 php84-fpm php84-mysql php84-openssl
sudo port install php84-curl php84-intl php84-mbstring php84-gd php84-zip
sudo cp /opt/local/etc/php84/php.ini-production /opt/local/etc/php84/php.ini

Set date.timezone in the new php.ini. MacPorts usually downloads a ready-made build. If it compiles from source instead, this can take an hour and needs Apple's command-line tools (xcode-select --install).

4. Switch the command line.

sudo port select --set php php84
hash -r; php -v

php -v should now report 8.4. Apple's /usr/bin/php stays at 7.1, so cron jobs and scripts that name it by its full path keep the old version until you change them to /opt/local/bin/php.

5. Switch the websites to PHP-FPM. Apple's Apache can't load MacPorts' mod_php, which is built for MacPorts' own Apache. Run PHP as a FastCGI service instead:

cd /opt/local/etc/php84
sudo cp php-fpm.conf.default php-fpm.conf
sudo cp php-fpm.d/www.conf.default php-fpm.d/www.conf

In php-fpm.d/www.conf, set user = _www and group = _www, the account Apache runs as on macOS. PHP-FPM listens on 127.0.0.1:9000; if lsof -iTCP:9000 -sTCP:LISTEN shows something already using that port, choose another. Start it now and at every boot:

sudo port load php84-fpm

Then tell Apache to send .php files to it. Save the lines below as a file ending in .conf, for example zz-php84-fpm.conf. On a Server.app Mac it goes in /Library/Server/Web/Config/apache2/other/. On a Mac without Server.app, put it in /etc/apache2/other/ and remove the # in front of the mod_proxy and mod_proxy_fcgi LoadModule lines in /etc/apache2/httpd.conf.

<FilesMatch "\.php$">
    SetHandler "proxy:fcgi://127.0.0.1:9000"
</FilesMatch>

This takes precedence over Apple's PHP module without removing it, so leave Server.app's PHP setting as it is. Apple's setup also runs .html pages through PHP, but PHP-FPM handles only .php. To include other extensions, add them both here and to security.limit_extensions in www.conf.

6. Check the configuration and restart the web server. On a Server.app Mac:

export SERVER_INSTALL_PATH_PREFIX=/Applications/Server.app/Contents/ServerRoot MODULE_INSTALL_PATH_PREFIX=
httpd -t -D WEBSERVICE_ON -f /Library/Server/Web/Config/apache2/httpd_server_app.conf
sudo serveradmin stop web; sudo serveradmin start web

Server.app's Apache keeps its own process ID file, so don't use apachectl graceful there. On a Mac without Server.app, run sudo apachectl configtest, then sudo apachectl graceful. If the check reports anything other than “Syntax OK”, fix the file before restarting.

7. Confirm. Put a file containing <?php phpinfo(); in a site's folder and open it in a browser. Server API should read “FPM/FastCGI” and the version should be 8.4. Delete the file afterwards, because it shows the server's configuration to anyone.

4.5The Modernize Old Mac Server pane

For a linked Mac that still runs Apple’s Server.app, the Modernize Old Mac Server pane (Setup & Migration) does the steps above for you, then keeps going. Choose the server and press Check server. It first finds out which services the server actually runs and shows only the sections that apply, listing the ones it left out; nothing changes until you press a button, and every change runs in the console so you can watch it.

1. System disk — shown at the top when the system runs from a spinning disk: move it to an SSD, inside the Mac or as an external SSD over Thunderbolt, USB 3 or FireWire 800, whichever is fastest on that model.
2. MacPorts — install or update MacPorts, and put it on the Terminal PATH.
3. PHP 8.4 (PHP-FPM) — install PHP 8.4 beside Apple’s PHP, then Switch websites: the old php.ini limits are copied, Deprecated notices hidden, and every site’s home page checked before and after, with an automatic switch back if one breaks. The PHP-FPM pool is sized to the Mac’s memory (not PHP’s stock 5 workers); Size Workers to Memory redoes it from the real worker size.
4. Health check — which PHP answered each site, failures, visible PHP messages and the most frequent PHP errors.
5. Code updates — mechanical PHP 8 fixes ($s{0} offsets, each() loops, literal create_function(), magic quotes, error_reporting(E_ALL), opt-in short <? tags), with the rest handed to the AI Administrator.
6. Apache migration (optional) — everything else in the pane works with Server.app’s web service, so you can keep it (Keep Server.app’s web; the one-run paths then leave it alone). Or move all web services to MacPorts Apache, which still gets fixes — serviceproxy and Server.app’s own Apache behind it (after Apple’s PHP is retired; Test Front End Only moves serviceproxy alone): Retire serviceproxy works like Retire Apple’s PHP — every site, Server.app service path, page and file is named and fetched through both front ends before and after, scripts other than a folder’s index page are never opened, and serviceproxy comes straight back if any answer differs. Restore serviceproxy undoes it.
7. Server.app services — a guard that keeps the service proxy (ports 80/443) running and reports a broken proxy configuration rather than restarting it blindly; for an installation still running Apple’s BIND, a guided move to Cloudflare or a current MacPorts BIND; where Server.app’s L2TP VPN runs, a recommendation to move users to WireGuard, OpenVPN or Tailscale and turn it off.
8. Directory (LDAP & Kerberos) — checks for anonymous reads, the LDAPS certificate and weak Kerberos encryption; a pf rule that limits the directory ports to private networks; nightly encrypted Open Directory archives.
9. Password-guessing blocks — the mail block described in Chapter 18, plus a login guard for SSH, Screen Sharing, Kerberos and websites. Attacks arriving through Cloudflare are listed per site for a Cloudflare rate-limit rule.
10. Mail authentication (DKIM) — OpenDKIM, a key per domain, signing once DNS has the key; records published from the pane, copied, or handed to the AI.
11. Mail TLS — TLS 1.2 and later only, and a Let’s Encrypt certificate issued on this Mac in place of a self-signed one.
12. Mail DNS — SPF (with its lookup count), DMARC, DKIM, TLS-RPT and MTA-STS per domain; DMARC to quarantine and TLS-RPT from the pane, SPF fixes and MTA-STS with the AI.
13. Spam filtering — rspamd, adding X-Spam headers only.
14. Remote access (Tailscale) — Tailscale as a system service that starts at boot with nobody logged in, from the 1.44.3 build staged for macOS 10.13 (the installer refuses a server older than the build supports). It also checks that tailnet traffic really leaves through the tunnel: Tailscale.app running alongside fights over the routes and takes them away when it quits. Retire Tailscale.app quits it, stops it starting at login and restarts the daemon.
15. Newer curl, rsync & OpenSSL — installed in /opt/local beside Apple’s copies, which Server.app keeps using.
16. Admin-ports firewall — Screen Sharing, Remote Desktop, port 311, AFP, SMB and optionally SSH answer only private networks, Tailscale and the address FrontierStack connects from. The rules undo themselves within 10 minutes unless FrontierStack confirms them over a fresh connection.
17. File integrity — a daily, root-only SHA-256 check of startup jobs, sudoers, pf, ssh keys, cron, Server.app and Apache configuration and the sites’ PHP. FrontierStack alerts on changes, and on a baseline replaced behind its back; Accept changes records the current files as the new baseline.
18. Scanning with ClamAV — the pane installs and schedules the open-source ClamAV scanner: daily signature updates and a weekly, report-only scan of the websites plus a check for web-shell code and PHP in upload folders; optionally virus scanning of incoming mail through the spam filter.
19. OpenSSH — install a newer OpenSSH, run it on port 2222 with Apple’s host keys, test a login, then switch port 22. The switch needs a second way in, and reverts by itself unless FrontierStack reconnects to confirm.
20. Network around this server — read from your linked firewall and Subnets: Suricata and Zenarmor on the OPNsense in front of it, where a web application firewall belongs, VPN-only administration, and which machines share its network.
21. Security checklist — TLS, SPF, DMARC, DKIM, reverse DNS, the service proxy, SSH logins and OS support, each linked to the pane that fixes it.

Keeping PHP patched. The pane compares the server’s PHP with php.net’s latest release of its branch, so it warns the day PHP ships a security release, even before MacPorts has packaged it; until MacPorts has, the warning says so. Once it has, Update PHP 8.4 (the Install button, run again) upgrades the PHP ports and restarts PHP-FPM, so no worker keeps running the old code. The Update for curl, rsync and OpenSSL upgrades those ports the same way, and the MacPorts section lists every MacPorts tool that is out of date on the server. The MacPorts installer works on every macOS version MacPorts supports, including macOS 26 and 27. In the security checklist, websites still served by Apple’s PHP are a failing item: it has had no fixes since 2019 and runs inside Apache as mod_php, the setup most exposed to remote-code flaws.

4.6Sites and virtual hosts

The Websites list in the Apache pane is where you manage virtual hosts. Each row shows the site’s name, the bind address and the port (for example :8080), and a Running toggle for its live status. The buttons let you Add Site…, edit, duplicate, disable, Push to Server… (copy a vhost to a linked server), and open the site in a browser. Import Sites… and Copy from… pull existing vhosts in from MAMP, XAMPP, Apple’s Server.app or another Apache, bound to localhost by default.

Adding or editing a site, you set the essentials a vhost needs: its ServerName (the domain), the document root (Choose… a folder), and the bind address and port. Enable the site and it appears in the list with a live status dot; FrontierStack writes the vhost into a .conf file under the managed tree, validates, and reloads. To create the vhost, certificate and a Cloudflare DNS record together, use New Site + DNS… — the one-flow wizard described in Chapter 7.

4.7TLS certificates for sites

The Certificates pane issues and manages the certificates that put the padlock on your sites. It offers three paths, suited to different needs:

Once issued, Deploy to Apache wires the certificate into the site’s vhost. The Expiry Monitoring section watches your certificates (and any domain you add with Watch) and alerts you well before they lapse — the deeper hardening story, including HSTS and modern cipher policy, is in Chapter 10.

4.8Updating certificates, here and on linked servers

Every certificate in Installed Certificates shows who issued it and how many days it has left. Update… on its row renews it in place, offering only the methods that fit that certificate: Re-issue self-signed (the same private key by default, up to 397 days), Renew with certbot or acme.sh (so the client’s own deploy hooks run), Renew with mkcert, or Replace from files… for a certificate bought elsewhere. The previous files are kept beside the new ones as .bak, and you can reload the web server in the same step.

When you have linked servers, a Host picker appears at the top of the pane. Choose a server and the pane reads its certificates over SSH: Let’s Encrypt lineages, acme.sh, /etc/ssl and the nginx, Apache, Caddy and HAProxy certificate folders. Only certificates with their private key beside them are listed. Update and Create… work there too; changes run as root with the server’s saved sudo password, so without one the server is shown read-only.

Installed certificates are watched automatically, on this Mac and on linked servers, so Alerts warn before any of them expire with no setup. The bell on each row turns watching on or off, and certificates that were already expired when first seen are left out.

4.9The .htaccess editor

Per-directory Apache rules — rewrites, redirects, access control — live in .htaccess files, and FrontierStack gives them a dedicated editor with line numbers and a syntax sanity check. Open a site’s document-root .htaccess with Use Site Root, or point it at a custom path. Insert Recipe drops in common, correct snippets (a front-controller rewrite, a force-HTTPS block) so you start from working rules rather than memory, and the editor flags obvious problems before you save. Export PHP Router… turns .htaccess rewrite rules into a router file for a built-in PHP dev server — useful when you move a site to the Localhost pane.

4.10Nginx and reverse proxies

FrontierStack manages Nginx as an alternative web server or a reverse proxy in front of an app. When both are installed, the Domains view groups your sites by server — Apache virtual hosts and Nginx server blocks side by side — reading each Nginx server block’s listen port, root and TLS state. A reverse proxy is the standard pattern for fronting an application that speaks HTTP on a high port (a Node, .NET or Python service): Nginx terminates TLS on 443 and forwards to the app. Because Apache and Nginx both want 80/443 by default, use the Apache pane’s Ports section to move one off those ports if you run them together.

4.11Localhost, DNS and dev stacks

Three more panes complete the local picture:

• Localhost — a manager for ad-hoc local dev servers. Add a New Local Server, pick a Runtime (PHP, Python/Django, Node/Vite, or a private Apache, Nginx or Caddy…) and folder, set a port and an optional ServerName, and Start it — with per-server Environment Globals and a .test resolver so myapp.test resolves locally. A Free Port helper and a stop whatever is holding localhost action clear the usual conflicts. Tick Also serve on Tailscale to reach a server from your other Tailscale devices at this Mac’s tailnet address on the same port — the server still listens on localhost only and FrontierStack forwards tailnet connections to it, so the LAN can’t reach it. For a Django server, Allow Tailscale Host… adds the tailnet address to the project’s ALLOWED_HOSTS after showing you the change (or hands you the line to add, when the setting is built from environment variables). The AI Administrator (and an agent over MCP) can start a folder the same way with debug_share action serve; the reply names the localhost host and port and, when asked, the Tailscale URL, so the agent can report where the site is running.
• DNS — local name resolution and authoritative hosting. Run dnsmasq, unbound or nsd; import and export zone files; and flush the resolver when records change so the Mac stops serving a stale answer.
• LAMP / DevStacks — one-click stacks. The LAMP pane offers presets (Choose a Setup) that install and start a matched set of components together (Install & Start, Start All, Stop All); DevStacks detects the framework of a project folder and shows the right commands and npm scripts to run it.

An Localhost overview shows every local server you have running, side by side, so you can run many sites at once without a wall of Terminal windows to babysit.

4.12Putting a site online, and handing it to an agent

Every local server has an Internet access box in its detail. Pick Cloudflare hostname and type a name on one of your zones (say demo.example.com), and FrontierStack adds the route and the DNS record and runs cloudflared as a system service, so the address stays up when the app is closed and after a reboot. The first site asks once for your admin password. Later sites share the same tunnel, each on its own hostname. A temporary link (trycloudflare.com) and Tailscale Funnel are the other choices. Vite and Django normally refuse hostnames they don’t know, so Cloudflare routes hand them localhost instead and they work unchanged.

The same globe button sits on Apache ▸ Websites rows (the tunnel asks Apache for the site by its ServerName) and on catalogue services, Docker containers, Vagrant boxes and Spin apps.

Hosting Preferences… (in the Localhost pane, and under Settings ▸ Websites & Hosting) says where your new sites belong. Choose this Mac, an Apache site, one of your servers, here.now, Hostinger, Vercel or ChatGPT Sites, and if you like a different place per kind of site. It also holds the web server new sites run on — Apache, Nginx, Caddy, or Ask each time — the domain new sites are named under, the folder they’re created in, who builds them, and the design skills (folders holding a SKILL.md) the builder should follow.

Then ask the AI Administrator for a site (“a one-page site for the bakery, warm colours, opening hours and a map”). Unless you said, or set one in Hosting Preferences, it first asks which web server the site should run on — Apache, Nginx, Caddy or Other (you name it). A static or PHP site is then served on this Mac by a private instance of that server; another server is noted for the builder and previewed with the built-in one. In one step it then creates the folder, writes the .env with the site’s settings (never passwords), a BRIEF.md, rules for the builder in AGENTS.md and your design skills in .claude/skills, starts the server, gives it its public address and makes the first git commit. It then builds the pages itself, or hands the job to Claude Code or Codex running in an isolated Sandcastle container; their files are copied back into the folder when they finish, and you get a notification. An outside agent connected over MCP can ask for the same set-up and build in the folder it’s given.

A web stack is only as good as the data underneath it. FrontierStack treats databases as first-class services: it installs and runs them, browses what is inside, lets the AI Administrator inspect and repair a site's database in plain language, and — the part most setups forget — backs everything up on a verified schedule that you can actually restore from. This chapter covers the relational engines, the in-memory caches, the newer vector and analytics stores, and the backup machinery that protects them all.

5.1The MySQL / MariaDB pane

Open MySQL from the Databases section of the sidebar. The pane installs the server through Homebrew if it isn't present, then gives you the controls Server.app used to: Start, Stop and a live status light, the listening port (default 3306), and a list of the databases on the server. MariaDB — the drop-in MySQL-compatible fork — is managed the same way; the pane recognises whichever is installed.

Local development follows one deliberate convention: the local root account has no password. This is the MAMP/XAMPP norm and it is what makes one-click setup and the AI's SQL tools work without a credential prompt. It is safe precisely because MySQL on your Mac listens only on 127.0.0.1 and is reachable only from the machine itself. The moment a database needs to be reached from elsewhere — a passworded account, or a database on a linked server — you switch to the secret vault, described below.

5.2Database Ops and running SQL

The Database Ops pane is where databases stop being a black box. Its Replication section detects whether a configured server is a MySQL replica or a PostgreSQL standby and shows the lag: MySQL reads SHOW REPLICA STATUS (IO and SQL threads, Seconds_Behind_Source); PostgreSQL uses pg_is_in_recovery() and the replay timestamp. Stopped replication, or lag past your threshold, raises an alert on your channels — the basis of the Database Slave monitoring preset.

For inspecting or fixing data, the AI Administrator carries a run_sql tool. Ask it in plain language — "why are these orders showing the wrong total?", "delete the duplicate users older than the originals" — and it runs SQL against the local server and shows you the result as a table, much like MAMP's Claude integration. Because statements can modify data, run_sql requires changes enabled; read-only queries work the moment the assistant is on. It defaults to local root with no password and is local-only by design.

5.3Passworded and remote databases

The local-root shortcut stops exactly where the network begins. For a database that needs a password, or one on a remote or linked server, you never paste the password into a prompt or a tool. Instead you add it once to the AI Administrator's Script secrets (.env) bar as a named secret — DB_PASSWORD or MYSQL_PWD — and the assistant runs the mysql client through run_script, referencing the value as $DB_PASSWORD and running it over SSH against the named server. The real value stays on your Mac and is injected at run time; the cloud model sees the name, never the secret.

5.4PostgreSQL

Open Postgres for projects that want advanced SQL, rich JSON, full-text search or GIS. The pane installs and runs PostgreSQL (default port 5432) and sits alongside MySQL with the same start/stop/status controls. Choose PostgreSQL when your application or framework expects it; otherwise MySQL/MariaDB remains the easy default. Both engines are first-class targets for the backup jobs and AI tools described later, and PostgreSQL is the foundation for several of the specialised stores below — pgvector for embeddings, TimescaleDB for time-series, and PostgREST for an instant REST API over a Postgres database.

5.5Supabase: local stack, hosted projects and Supabase MCP

The Supabase pane works on three levels. Locally, it drives the supabase CLI: choose a project folder, Start the whole stack in Docker (Postgres, Auth, Storage, Realtime, PostgREST, Edge Functions and Studio), copy its service URLs and keys, run migrations, open a SQL console, or register the local database as a Database Ops backup job. For hosted projects, save a Supabase personal access token (Account ▸ Access Tokens) in Supabase — connection. FrontierStack then shows each project's status and runs Supabase's security and performance advisors against it, at most every 30 minutes per project. List project refs to watch only those. Turn on Alert me when this needs attention to be told when a project is unhealthy or a security advisor reports an ERROR-level finding, such as a public table without row-level security.

AI Access (Supabase MCP) connects the AI Administrator to Supabase's official MCP server. The hosted target uses the same token. Enter a project ref to limit it to one project, leave Allow writes off to keep read-only mode (Supabase runs every query as a read-only Postgres user and hides tools that change anything), and tick only the tool groups you want. The local target is the stack's own /mcp endpoint, normally http://127.0.0.1:54321/mcp. Ask things like “which tables in my Supabase project have no RLS?” or “show the last hour of auth errors”. Reads run straight away; migrations, deploys and project changes need Allow changes and always show an approval card. Other MCP clients copies a ready-made config for Claude, Cursor and similar apps, and can add a read-only Supabase entry to MCP Servers.

5.6Redis and other caches

Sessions, queues, rate limits and hot-path caching usually want an in-memory store rather than a relational table. FrontierStack runs the two standards from the Caching catalog: Redis (port 6379), the in-memory key-value store that also backs Redis Streams, and Memcached (port 11211) for a simple distributed cache. Install, start and monitor them like any other service. Most CMS and framework deployments pair Redis with MySQL or PostgreSQL; the Service Catalog (Chapter 6) lists every option.

5.7Vector and analytics databases

Two newer families of store get their own catalog categories. Vector databases hold embeddings for retrieval-augmented generation (RAG) and semantic search; they are how the AI stack (Chapter 15) gives a model access to your own documents. Analytics databases are columnar or time-series engines built for fast aggregation over large datasets rather than transactional reads and writes.

For purely in-process vector search there is also FAISS (a library, no port). Pick the engine your framework expects; the panes install and run each one through the same catalog machinery.

5.8Data pipelines & ETL

Moving and reshaping data between these stores is its own discipline. The Data Pipelines & ETL catalog category covers it at the overview level: Airbyte and Meltano for extract-load with hundreds of connectors, dbt for SQL-based transformation and modelling, and orchestrators such as Dagster, Prefect and Kestra for scheduling the work. These are full platforms; FrontierStack installs and runs them and surfaces their web UIs, but the pipeline logic lives in each tool. For programmatic data-pipeline DAGs there is also Apache Airflow in the Workflow Orchestration category.

5.9Backups: dumps, the overview pane, and CCC

A database with no tested backup is a future outage. FrontierStack approaches this from two directions. In Database Ops you define a verified dump schedule per server: name, engine (MySQL or PostgreSQL), host, port, user, database (blank = all) and a backup directory. Due jobs run automatically while the app is open, and Run Now triggers one immediately. Each run does more than dump — mysqldump runs with --single-transaction for a consistent InnoDB snapshot, then Verify checks gzip integrity and that the dump ends with its completion marker (catching truncated or half-written files), writes an .md5 sidecar, rotates to your keep count, and rsyncs the result offsite over key-based SSH.

The AI Administrator exposes the same operations as tools: db_dump dumps a database to a .sql file on the target (using mysqldump or pg_dump), and backup_now makes a timestamped tar.gz of configs, a site or a data folder. Both are mutating, so they require approval and changes enabled; for the DB password they reference a $NAME vault secret, never a pasted value.

The Backups overview pane rolls up every mechanism so staleness is obvious at a glance: Time Machine status, Carbon Copy Cloner tasks, app-managed Apache config snapshots, config version history in Git, and scheduled auto-exports. The Carbon Copy Cloner pane reads CCC's tasks and history through its ccc command-line tool and lets you Run a task on demand. Both Time Machine and CCC feed the Alerts engine — a backup that hasn't run within its threshold, or a failed CCC task, raises an alert on your channels (Chapter 11).

The app's own settings are covered as well. The sidebar's pins and hidden services, saved Setups and network Locations are kept in JSON files in the app's support folder rather than only in macOS preferences; every Git snapshot carries them together with a copy of the preferences, and an hourly shadow copy of the preferences means a wiped preferences file is put back automatically at the next launch. Restore App Settings… under Config version history restores them by hand from the latest snapshot.

5.10Restore — and restore safety

Backups exist to be restored, and restore is the dangerous half. The AI's restore tool extracts a .tar.gz archive or imports a .sql dump into a database. Because importing a dump overwrites the live database and extracting an archive overwrites files in place, restore is mutating and potentially destructive: it always requires explicit approval with changes enabled, and SQL imports reference the DB password as a $NAME vault secret.

5.11Recovering a broken database

Sometimes a database is worse than down — it won't start, or a table is corrupt. FrontierStack gives the AI Administrator (Chapter 13) the same tools you would reach for by hand, behind the usual approval card. mysql_check_tables and pg_check_tables run mysqlcheck / pg_amcheck to find corrupt or crashed tables; with repair on they take a mysqldump/pg_dump backup first, then repair (--auto-repair / REINDEX), so a fix is reversible. mysql_service_control and pg_service_control start, stop, restart or check the server across systemd, launchd, Homebrew or service(8), local or over SSH.

For the hard cases there are guided skills — “Recover Broken MySQL” and “Recover Broken PostgreSQL” — that walk the whole runbook: read the error log, diagnose the fault, dump everything readable, rebuild into a fresh data directory, repair or recreate the damaged tables, and restart — always renaming the old data directory aside as a cold backup, never deleting it, and confirming before every destructive step. On a remote host, the fastest way in is the red Emergency button on the database's row in the server pane: it opens the assistant pre-loaded with the right recovery skill for that host.

5.12ORMs and app-native tooling: Drizzle and Convex

Finally, two tools meet your application where it defines its schema. The Drizzle ORM pane detects a Drizzle project (its tables, migrations and backend dialect) and runs drizzle-kit tasks for you — Generate SQL from your schema, Migrate, Push the schema directly, Pull (introspect) an existing database, and open Drizzle Studio to browse data. The Convex pane manages Convex, a reactive backend with a built-in database: run npx convex dev to watch and push functions, or stand up a self-hosted backend in Docker. Both need Node.js, which the panes will install via Homebrew if it is missing. These cover the application's own data layer; the dumps and backups above still protect whatever they write underneath.

FrontierStack ships a catalog of 1817+ services across 114 categories. Every entry can be discovered, installed, started, configured and monitored from the app — and the AI Administrator can act on any of them. This chapter is the field guide: each category, what lives in it, and a one-line description of every service. Service descriptions are kept in English so they match the labels in the app.

Each service also has its own page on the website at frontierstack.app/services/ with ports, default web UI and the Homebrew formula.

6.1Overview

6.2Setup & Migration

6.3Locations & Places

6.4Fleet & Remote

6.5Networking

6.6VPN

6.7Routers & Firewalls

6.8Web Servers

6.9DNS

6.10Runtimes

6.11Databases

6.12Vector Databases

6.13Analytics Databases

6.14Data Pipelines & ETL

6.15Caching

6.16Search

6.17Backup

6.18Storage & NAS

6.19Object Storage & S3-Compatible

6.20Mail

6.21Mailing Lists

6.22Email Deliverability & Reputation

6.23Message Queues & Streaming

6.24Push Services

6.25Chat & Collaboration

6.26SMS & iMessage Gateways

6.27Business Messaging

6.28Calendars

6.29Identity & Accounts

6.30Customer Identity

6.31Decentralized Identity

6.32Version Control

6.33CI/CD

6.34Build & Compile

6.35Internal Developer Portals

6.36Infrastructure as Code

6.37API Testing & Synthetic Monitoring

6.38Proxies & Load Balancers

6.39Proxy Gateways

6.40CDN & Edge

6.41Hosting

6.42AWS Control

6.43AI / LLMs

6.44AI Clusters

6.45Agent Platforms

6.46FinOps & Cloud Cost

6.47Containers

6.48Service Mesh (Kubernetes)

6.49Apps & CMS

6.50Knowledge & Memory

6.51E-Commerce

6.52QR & Link Management

6.53Student Information Systems

6.54Learning Management

6.55Digital Library

6.56Campus & School Ops

6.57Sourcing & Suppliers

6.58Print-on-Demand

6.59Shipping & Fulfilment

6.60Inventory Sync

6.61Profit Analytics

6.62Mesh Networking

6.63Anonymity Networks

6.64Secrets & Vaults

6.65Monitoring

6.66Security Tools

6.67SIEM & Security Data

6.68Secrets Scanning & Supply Chain Security

6.69Policy, Compliance & Governance

6.70MDM & Device Management

6.71Logging & Observability

6.72Incident Management & On-Call

6.73Status Pages

6.74Mining

6.75ML Workbench

6.76AI Governance & Safety

6.77GPU Infrastructure

6.78Speech AI

6.79Image & Video AI

6.80MCP

6.81Self-Hosted Apps

6.82Web3

6.83Crypto

6.84RPC Services

6.85Tools

6.86Home Automation

6.87Cameras

6.88IoT

6.89MQTT Brokers

6.90POS Systems

6.91CRM & Loyalty

6.92Helpdesk & Ticketing

6.93IT Assets

6.94Project Management

6.95PMS

6.96Meeting Rooms & Desk Booking

6.97Coworking & Shared Spaces

6.98Facilities & Maintenance

6.99Accounting & ERP

6.100E-Signature

6.101Healthcare

6.102Automation & Workflows

6.103Workflow Orchestration

6.104HRIS Integration

6.105VoIP & Telephony

6.106Contact Centre & IVR

6.107SEO & Marketing

6.108Conversion Rate Optimization

6.109Social Media

6.110Media Servers

6.111Download Automation

6.112AV & Stage

6.113Render Farm

6.114Tracking & Telematics

A working website is more than a running Apache. The domain has to resolve, the certificate has to be valid, the right machine has to answer, the CDN has to be in front of it, and the search engines have to know it exists. FrontierStack gathers all of that into the Sites pane and a small family of companion tools, so the whole chain — registrar, DNS, TLS, CDN, host, SEO — is visible and fixable from one window. This chapter covers the web above the stack; for the vhosts and certificates themselves see Chapter 4.

7.1The Sites pane and Domain Health

Open Sites from the sidebar. At the top sits the Domain Health section, a live dashboard that collects every hostname FrontierStack knows about: the local Apache and Nginx vhosts you have defined, the vhosts on linked servers, every Cloudflare zone on your token, and every domain in the registrar monitor. Each domain gets a row with a set of status badges; press Check on a row, or Check All in the header, and the app probes the domain end to end and colours the badges green or amber.

The point of the dashboard is to answer one question reliably: is this domain actually serving, and from where? Because the checks run against the public internet (a real DNS lookup, a real HTTP request, a real TLS handshake), they catch the failures a local config check never sees — a record that points at the wrong IP, an expired certificate, a Cloudflare zone stuck in "pending", a site that resolves but returns a 502.

7.2Search Console, Analytics and Ahrefs on each site

Under its health badges, every Domain Health row has a short line with three chips: Search Console, GA4 and Ahrefs. Grey means the service isn't set up for that site, green means it is on and nothing is wrong, yellow means there is something worth a look, and orange means a problem that also raises an alert. Hover over a chip to see what was found, or click it to open that service's pane. This line doesn't copy the vendors' consoles. It answers two questions for each site: is the service on, and is there anything the owner should know?

The checks build up depending on what you have connected:

• With no keys at all, FrontierStack reads the live home page, robots.txt and the domain's TXT records. It finds the Google Analytics and Tag Manager tags, the Ahrefs Web Analytics script, and the Google and Ahrefs verification tokens. It warns when the home page carries a noindex (in a meta tag or an X-Robots-Tag header), or when robots.txt shuts Googlebot, AhrefsBot or AhrefsSiteAudit out of the whole site. An old Universal Analytics (UA-) tag is pointed out too, because it no longer collects anything.
• With Google signed in (the Search Console pane's Sign in with Google, or a service-account key), each site is matched to its Search Console property. FrontierStack then checks:
  • whether you are still verified for the property;
  • whether submitted sitemaps report errors;
  • what Google's URL Inspection says about the home page: whether it could be fetched, whether robots.txt or a noindex blocks it, and whether it is indexed;
  • whether search impressions have collapsed week on week.
  The same sign-in matches the site to its GA4 property, by the web stream's URL or by the measurement ID the page actually sends to. It warns when the property stops receiving data, or when the page sends to a different measurement ID from the one the property expects.
• With a Cloudflare token, the zone's firewall events are read for Googlebot, AhrefsBot and AhrefsSiteAudit requests that a WAF, rate-limit or bot rule blocked in the last day, and the rule responsible is named. Only requests from Google's and Ahrefs' own networks count. When Cloudflare blocks an impostor that merely claims to be Googlebot, it is doing its job, so that isn't reported.

Everything is rechecked every six hours, and also whenever you press Check or Check All. Problems are sent to Alerts under the Search & Analytics group, one item per site and service, so a fixed problem sends a recovery. Ahrefs problems are only raised for sites where Ahrefs is actually in use, because blocking a crawler you don't use is a choice, not a fault.

7.3ChatGPT Sites: monitor, use your domain, or self-host

The ChatGPT Sites section uses one shared registry everywhere it appears in FrontierStack. Paste a public name.openai.chatgpt.site URL and it joins Domain Health, SEO and Alerts like any other site. Mark a workspace- or owner-only Site private and outside probes pause, because its sign-in page is not an outage.

Import or Move offers two owner-authorised routes. Use my domain keeps the Site on ChatGPT: first add the domain in the Site's ChatGPT settings, then copy the exact DNS records ChatGPT supplies. FrontierStack validates that every record belongs to the selected Cloudflare zone and publishes it DNS-only; for another DNS provider, add the records there and use Save Domain. Both paths keep the original Sites address and the custom domain in the registry. Return to ChatGPT and refresh the domain status after DNS propagates.

Self-host starts from the Site's local project folder. FrontierStack reads .openai/hosting.json and package.json, identifies the framework and ready output folder, shows D1/R2 bindings and the names of example environment variables, and copies the reviewed web output into a managed Apache domain. The importer never runs package scripts, never reads secret values, skips links and source-control metadata, limits the copy to 50,000 files or 5 GB, and uses a staging folder so a failed replacement can be rolled back. Build the project first, then import dist, build, out, public, or another folder containing index.html.

7.4Proving domain ownership

Vendors verify that a domain is yours by asking you to publish a DNS TXT record only its owner could create — the same proof-by-DNS idea as ACME's DNS-01 challenge, but every vendor has its own record format. The Verify button on a Domain Health row keeps those formats in one place: pick the service — Google (Search Console / Workspace), Microsoft 365, Meta, Apple Business Manager, Atlassian, OpenAI, Stripe, GitHub organizations, or a custom record — paste the token from the vendor's console, and FrontierStack publishes the TXT record straight into the domain's Cloudflare zone. If the domain isn't on your Cloudflare token, it hands you the exact record to add at your DNS host instead. A bare token is completed automatically (paste abc123 for Google and the record becomes google-site-verification=abc123).

The sheet also shows the verification records already published on the apex — a quick audit of who this domain is currently proven to — and Check DNS queries public DNS (1.1.1.1) for the new record, so you know the proof is visible before you press "Verify" on the vendor's side.

For certificates, the Let's Encrypt service pane (Security & Secrets category) is a standing health check on the other kind of domain proof: it watches the ACME API, Let's Encrypt's status page and a domain's live certificate, and — because ACME clients renew when 30 days remain — alerts when a certificate is overdue for renewal, catching broken certbot/acme.sh automation weeks before visitors ever see an expiry warning.

7.5Spam blocklists: domains, mail servers and your network's public IP

Receivers decide whether to accept mail partly by asking public blocklists. Blocklists on a Domain Health row (the same section appears on a Cloudflare zone's pane and in the Mail Server pane) looks the domain up on the domain lists — Spamhaus DBL, SURBL, URIBL — and its mail servers (MX hosts and single SPF addresses) on the IP lists — Spamhaus ZEN, SpamCop, Barracuda, PSBL, Mailspike. Each answer is decoded per list, so the result says why a listing exists, with a Look Up button for the list's removal page. The row then shows the last result.

Regular check in the same section puts a domain on a schedule: Off, Daily, Weekly, Every 2 weeks or Monthly. Only a domain on a regular check raises Alerts. The lists rate-limit busy resolvers, so checks run one target at a time with a pause in between, never on the Alerts sweep, and the result is kept across launches. The Spam Blocklists section under Domain Health lists every watched domain with its rate and last result, and has a switch for the Alerts.

Network public IPs, in the same section, checks the public (WAN) address of every pinned router or firewall — the External IP set in its device details — on the IP lists, on a schedule of its own. A machine on guest Wi-Fi or the LAN that sends spam does it through that NAT address, and a listing there is often the first sign from outside, long before anyone inside notices.

The Mail Server Policy survey on a linked server's pane (see Chapter 10) runs the same lookups for that server's public address and the domains it receives mail for, and reports a listing as a failure, a caution entry as a warning, and an unanswered list as information. It reuses answers for six hours, so reopening the pane does not query the lists again.

7.6AI SEO and "Fix My Site"

Two of the badges on a domain row are not just diagnostics — they are buttons that hand the problem to the AI Administrator. Fix My Site takes a broken or misbehaving site and runs the assistant through a fixed playbook: reproduce the fault by curling the site locally with its Host header, read the relevant logs, check that Apache, PHP and the database are running, and then state the single most likely root cause with concrete next steps. With Allow changes off it only advises; with it on it may apply the reversible fixes (restart a service, correct a wrong value in a config file, repair the database). There is a WordPress-aware variant for the classic white screen, "Error establishing a database connection", broken permalinks and stuck maintenance mode.

The SEO action runs an on-device read-only audit: the assistant fetches the home page, robots.txt and the sitemap, scores the site out of 100 and writes a short report (titles, meta descriptions, headings, crawlability, structured data). The result opens in an SEO report sheet so you can read the findings and act on them.

7.7One-click CMS installs (Apps & CMS)

WordPress gets a single pane that both installs new sites and runs the ones you already have — on this Mac or on any fleet server. That merge matters: the old installer pane could only ever write to This Mac, whereas everything here runs through WP-CLI on whichever host you pick, so a remote server is a first-class target for a new install. Install a new WordPress site, at the foot of the pane, downloads WordPress onto the selected host, writes wp-config.php, creates the database and completes setup with the administrator account you name. Nothing is copied up from your Mac, and an install already sitting at that path is refused rather than overwritten. Serving the new folder still needs a virtual host — create one in the Sites pane for a local site, or on the server's own web server. Installing a CMS is only the first day of its life, and the same pane covers the rest. Choose a host — This Mac or any fleet server — and scan for wp-config.php under the usual web roots, and every WordPress install on that machine appears with its core, plugin and theme versions and whatever is waiting to be updated. Update all exports the database before it touches anything, because a bad plugin update is recoverable and a lost database is not. Check integrity compares the core files against the checksums WordPress.org publishes, which is the quickest way to find a defaced or backdoored install; add a free WPScan token and the pane also checks your installed plugins and core against the vulnerability database, marking anything with no published fix. Multisite networks list their subsites. Each site also carries an Add a plugin list — a curated catalogue covering booking, commerce, mail delivery, backups, caching and security — which installs straight onto that site, local or remote, with an option to activate it once installed. The list is deliberately not a mirror of the WordPress.org directory: every entry either fails visibly when it breaks or produces something FrontierStack already monitors elsewhere, and each says what the app can tell you about it once it is running, so an install never implies monitoring that does not exist. Anything already on the site shows as installed rather than being offered twice, and a premium plugin with no WordPress.org slug links to its own page instead. On a host with no WordPress site yet — or without WP-CLI — the catalogue is still shown, greyed out and not selectable, so you can see what will be on offer instead of meeting an empty pane. The remaining jobs are the ones that otherwise mean an SSH session and a half-remembered command: resetting the password of a locked-out administrator, search-replace to move a site between domains (WP-CLI rewrites URLs buried in serialized PHP, where a plain SQL replace corrupts them — so always dry-run first), cloning a site to staging, and exporting or optimising the database. A clone copies the files, gives the copy its own database, rewrites the URLs inside it and sets it to discourage search engines, so staging can never write to production or outrank it. Everything runs through WP-CLI over SSH, and the pane offers to install WP-CLI on any host that lacks it. Pin a site and Alerts will tell you about pending updates, a failed integrity check or a new vulnerability.

Sites moved from GoDaddy. GoDaddy’s Managed WordPress puts a must-use system plugin and a Memcached object-cache.php into every site, and its older hosting adds a gd-config.php include to wp-config.php. None of them work anywhere else — a restored GoDaddy backup typically stops at a white screen or a database-connection error. The pane spots them on refresh and offers Remove GoDaddy Leftovers…: the files move to ~/frontierstack-godaddy-leftovers on the server with a copy of wp-config.php, the include is commented out, and after a database export into the same folder, links still on the temporary *.myftpupload.com address are pointed at the site’s own. It won’t run on GoDaddy’s own servers, where those files are the platform.

If your WordPress lives on managed hosting rather than your own machines, the hosting panes now list those sites too: WP Engine, Kinsta, Cloudways and Pressable each pull your installs through their API — environment, primary domain and status — and they roll up into Cloud Servers alongside your VPS instances, so one inventory covers everything you run. These are sites rather than machines, so they carry no power controls.

The Apps & CMS section installs the other self-hosted CMS onto your Apache/PHP/MySQL stack in a single flow, each with its own pane: Drupal, Joomla, Statamic, Grav, Kirby, Craft CMS and FreshRSS — plus Magento Open Source, which uses the same installer but is filed under E-Commerce. The installer downloads the app (or runs composer create-project for the Composer-based Statamic and Craft), extracts it into the document root, and — for the ones that need a database (Drupal, Joomla, Craft) — creates the database and user and writes the config where the app expects it. The flat-file CMS (Grav, Kirby, Statamic) need no database at all. It then opens the app's setup or admin page so you can create your account (/admin, /panel, /cp, /admin/install…), while FrontierStack wires the virtual host, PHP and trusted HTTPS around it. For the install folder you can pick a site Apache already manages — a menu prefills its domain, document root and port — or Choose… a new empty folder; a matching Apache vhost is created for a new folder, or updated when the domain is an existing site. If an install misbehaves, Fix My Site (AI) above debugs it.

FreshRSS is the exception that finishes the job. It is a self-hosted RSS and Atom reader, and unlike the CMS above it leaves you no setup wizard at all: name an account and password in the pane, and the installer downloads the release, creates the database, runs FreshRSS's own command-line installer to write its configuration and build the schema, creates that account, and registers a virtual host pointing at p/ — the subfolder FreshRSS actually serves from, with the rest of its code left outside the web root where it belongs. The browser then opens on the login screen of a working reader rather than on step one of an installation. Because its API is Google Reader-compatible, mobile clients such as Reeder and NetNewsWire can sync against it once you expose it, which makes it a natural companion to the HTTPS and remote-access work elsewhere in this book.

Magento Open Source also installs completely, for a different reason: Magento removed its browser installer, so the only way in is its command line. The pane gathers what bin/magento setup:install needs — an admin username, password, email and name, the store currency, and the address of a running OpenSearch (or Elasticsearch 8) server — and checks the slow-to-discover problems first: a PHP older than 8.2 or missing one of Magento's extensions, a search server that does not answer, and the MySQL version. Only then does it run composer create-project, from the keyless Mage-OS mirror by default or from Adobe's repo.magento.com with your Marketplace access keys, which are used for that one download and not stored. That download is several hundred packages and usually takes 5–15 minutes. The installer then creates the database, runs the setup with your account, makes the folders Magento writes to at runtime writable by the web server, and registers a virtual host that serves pub/. The admin lives at a random path such as /admin_k3x9qz/, which the log shows and the browser opens. Magento normally makes every admin set up two-factor sign-in through an emailed link; for a local test store that cannot send mail, a toggle turns this off (it starts off for .local and .test names). If setup fails after the download, fix the cause and press Install again: the pane resumes from the database step without downloading again. Finally, Magento does its indexing and email from cron, so run bin/magento cron:install in the install folder once the store is up.

The same pane installs the licensed Adobe Commerce (on-premises) edition: set Edition to Adobe Commerce and enter the Marketplace access keys of the account that holds the licence, since that edition downloads only from repo.magento.com. Its MySQL settings for Magento section reads three values from the chosen instance — log_bin_trust_function_creators, which must be on while binary logging is (MySQL 8’s default), or MySQL refuses the triggers Magento’s indexers create with error 1419; max_allowed_packet, at least 64 MB; and, if you tick it, an InnoDB buffer pool of 1 GB. Apply sets them at once with SET GLOBAL, then writes them under [mysqld] in the instance’s my.cnf, after saving a timestamped backup beside it, so a restart does not quietly undo them. Sizes are only ever raised, and a server on another host gets the lines to add rather than an edit. Install runs the same step. Once the store is installed, the pane also shows its live sales monitor. Adobe’s hosted editions — Adobe Commerce on Cloud Infrastructure, Adobe Commerce as a Cloud Service and Adobe Commerce Optimizer — are services in the catalog, each with a monitor of its own.

The pane is called Magento and has three tabs. This Mac is the installer described above. Stores manages every Magento store FrontierStack knows about, on this Mac or on any server in the fleet — Find Stores scans a server’s web roots. For each store it reports the version and whether a newer security patch exists, the deploy mode, whether the storefront answers, maintenance mode, whether cron is installed and when its last job finished, stale indexers, disabled caches, a default /admin/ path or missing two-factor sign-in on a server, and today’s exceptions, worst first. Its buttons flush the cache, reindex, switch indexer modes, toggle maintenance, change the deploy mode, run setup:upgrade safely behind the maintenance page, install cron, unlock an admin and tail the logs, always as the owner of the store’s files. Fix My Store (AI) passes the store to the AI Agent, which reads the same evidence through its ecommerce tool and proposes changes you approve one by one.

Host on a Server is the one-click route to a live store. Choose an Ubuntu 24.04+ or Debian 12+ server, a domain and the admin account, and FrontierStack works through eleven stages, showing each as it goes: check the server (memory, disk, nothing else on port 80); install Nginx, PHP-FPM, MySQL or MariaDB, Composer and Redis; install a loopback-only OpenSearch; create the database with Magento’s MySQL settings; create a magento user with its own PHP-FPM pool; download Magento with Composer; run setup:install; build the Nginx site from Magento’s own nginx.conf.sample; switch to production mode; install cron; and get a Let’s Encrypt certificate. Expect 20–40 minutes. It needs root on the server, and the passwords it generates travel in a private file that is deleted at the end. A failed stage stops the job with its reason; fix it and press Host Store again, and finished stages are skipped. The new store joins the Stores tab with alerts turned on.

7.8The Domain Registrar monitor

Sites tells you whether a domain works today; the Domain Registrars pane (in the DNS category) tells you whether it will keep working. Add a domain and FrontierStack watches three things on a schedule and raises an alert when any of them drifts:

• Expiry — the registration end date, registrar and nameservers, pulled over RDAP (with a whois fallback). Works for any domain, whatever the registrar.
• DNS — whether the domain still resolves (dig).
• SSL — the certificate expiry, checked directly with openssl.

A renewal warning fires when the expiry is within your reminder window, already past, or when auto-renew is off. For supported registrars the pane can import your domain list and auto-renew status by API — GoDaddy, Porkbun, Gandi, Value Domain, Route 53 (via the AWS CLI) and Cloudflare (reusing the Cloudflare token — this one needs a user API token, as Cloudflare Registrar does not accept account-owned cfat_ tokens). Registrars without a usable list API (Namecheap, Squarespace, Onamae, Muumuu Domain) you add by hand; RDAP still monitors them.

7.14.1Domain companies: registrar uptime

A Cloudflare zone tells you nothing about who holds the registration. FrontierStack looks each pinned zone up over RDAP and shows its registrar and live nameservers in a Domain Company section of the zone pane; in the Cloudflare pane each zone's line reads e.g. active · Pro · registered at GoDaddy. Every registrar and DNS host behind your domains — GoDaddy, Namecheap, Porkbun, Gandi, Squarespace, DNSimple, Route 53, Value Domain, Onamae, Name.com, Hover, Dynadot, IONOS, OVHcloud, Sakura and Cloudflare itself — is checked every five minutes on three signals:

• Official status — the company's status page (Statuspage or Instatus JSON; AWS's Route 53 RSS), including each of its services — domains, DNS, email, hosting, SSL, website builder — where the page lists them.
• Reachability — its website and API host answer.
• Nameservers — for domains still delegated to it, its nameservers answer for them.

A yellow building icon next to a zone in the sidebar means its registrar or DNS host is degraded; red means down. Pin a company (from the zone pane, the zone's context menu or the Domain Companies list in Domain Registrars) and it gets its own sidebar row with a pulsing dot when down. A company going down raises a Domain company alert. Companies without a status page are judged on reachability alone, and when this Mac can reach none of them the check reports offline rather than a false outage.

7.14.2Moving a domain to Cloudflare

With a Cloudflare token set, two moves are one click where the registrar has an API:

• DNS only — for a domain not yet on Cloudflare, Add to Cloudflare DNS… in Domain Registrars creates the zone, copies its current public records in and pins it. Review the records, then use Switch Nameservers in the zone's Domain Company section: FrontierStack sets Cloudflare's two nameservers at GoDaddy, Porkbun, Gandi, DNSimple or Route 53 and asks Cloudflare to re-check activation. For other registrars it shows the two nameservers to copy.
• The registration — Transfer to Cloudflare… opens a checklist that reads the domain's live state: DNS active on Cloudflare, outside the 60-day lock, transfer lock off (with Unlock for GoDaddy, DNSimple and Route 53), and the authorization code (fetched from Route 53 or Gandi, emailed by DNSimple). The last step opens Cloudflare's transfer page, where you confirm and pay one year's renewal — Cloudflare has no API for starting a transfer.

7.9Cloudflare: zones, DNS, cache, tunnels and protection

The Cloudflare pane is where you paste an API token and choose which zones appear in the sidebar. Each zone you Pin to sidebar becomes its own pane with that zone's Cloudflare/DNS/HTTP/SSL health, DDoS and bot protection, WAF rules, Workers, CDN analytics, development mode and cache purging (everything, a list of URLs, or by prefix). Scope the token carefully: a read-only token lists zones, but DNS edits, certificate DNS-01 validation, Dev Mode, cache purge and zone creation each need their own permission, and creating a brand-new zone needs the account-level Zone · Zone · Edit permission. The Create Token… buttons open Cloudflare's token form with every permission the app uses already filled in (only that optional account-level zone-creation row must still be added by hand), a Test Token button probes the live API and lists exactly which of those abilities the token has or lacks (reads are exercised directly; writes are probed with deliberately-invalid requests, so nothing is changed), and a Dashboard button deep-links into the Cloudflare web console for the current zone.

When a pinned zone shows a warning or its HTTP check has stopped answering, the pane's Diagnose button finds out why instead of leaving you with a coloured dot. It probes each layer of the serving path in order — the zone's state at Cloudflare, the public nameservers, DNS resolution, HTTPS through the edge (decoding Cloudflare's 52x errors: 521 origin down, 522 timeout, 524 the app or its database hanging, 525/526 origin TLS), the origin server's ports 80 and 443 directly, and finally the machine FrontierStack knows serves the domain: the local web server if that is this Mac, or a linked server's on-host monitor service states (a stopped mysql surfaces right in the report). When the public path is broken it also sweeps the fleet: which linked servers are up, which binds the origin IP, and which already serves this domain's vhost — so a host that went offline and took the sites' front-door IP with it is named directly, together with the server that could take over. Each layer is shown pass/fail, ending with a plain-language conclusion — which layer broke and what to do about it.

Cloudflare turns up across the app: the AI's dns_record tool writes records into a zone you manage and updates existing ones in place — including flipping a subdomain between proxied (orange cloud) and DNS-only — issue_certificate can validate over Cloudflare DNS-01, and email_auth_dns can publish SPF/DMARC for you (see Chapter 13). The same account also powers Cloudflare DDNS and the Cloudflare Tunnel for exposing a local site — both covered in Chapter 9.

7.14.3When a site is under attack: Under Attack Mode

Every pinned zone's pane opens with an I'm Being Attacked button. It switches the zone to Cloudflare's Under Attack Mode (security level under_attack): every visitor gets a browser check of a few seconds before reaching the origin, which stops most request floods. You confirm before it turns on, because while it is on, anything that cannot run JavaScript — API clients, webhooks, mobile apps, uptime monitors — is blocked too. The same command sits on the zone's sidebar right-click menu (I'm Being Attacked…) and in the Cloudflare Zones mini palette, so you can reach it without hunting for the pane. A red shield in the sidebar and an ATTACK badge in the palette mark zones in the mode. Stand Down turns it off with no prompt and restores the security level the zone had before (or medium if the mode was switched on outside FrontierStack). The token needs Zone · Zone Settings · Edit; the AI Administrator can do the same with cloudflare_dev_mode action=under_attack.

7.14.4Email Routing and Email Service

The zone pane's Email section shows whether Email Routing is on and ready, its routing rules and catch-all, any destination address that is still unverified (mail forwarded there is dropped until it is confirmed), the last seven days of Email Service events with failures highlighted, and the zone's MX targets. It also warns when a mail hostname is orange-clouded: Cloudflare's proxy carries only web traffic, so SMTP and IMAP to a proxied host fail — set it to DNS-only. The Email Delivery monitor has a matching Cloudflare Email Service section listing every pinned zone, read with the same token. The token needs Zone · Email Routing Rules · Read (and Account · Email Routing Addresses · Read for destinations); the AI reads the same picture with cloudflare_dev_mode action=email_status.

7.14.5Core Web Vitals

The zone pane's Core Web Vitals section reports what real visitors experienced over the last seven days, from Cloudflare's free Web Analytics, with bots excluded:

Each value is the 75th percentile, with the share of page loads that were "good" and a green, orange or red rating. Web Analytics must be on for the site, and the token needs Account · Account Analytics · Read — now pre-filled by the Create Token… buttons. AI: cloudflare_dev_mode action=web_vitals.

7.14.6Rate-limiting and WAF rules

The zone pane's Rules section lists the zone's rate-limiting and custom WAF rules, each with its action, its limits (for example "block, more than 20 requests / 10 s per IP") and its expression. The switch turns a rule off and on. Edit changes the name, expression, action and limits. The … menu offers Revert to Previous Version — FrontierStack keeps the version from before its last edit — and Delete Rule, which the app cannot undo. Changes are live on Cloudflare as soon as you apply them, and Cloudflare rejects an expression it cannot parse without changing anything.

Watch for the orange warning. A rule with no hostname condition applies to every hostname in the zone, not only your website. A rule that matches a URL path such as /djs/ also matches a media or image host whose paths contain the same segment, so a visitor loading one page can be blocked with error 1015 (HTTP 429) partway through its images — and a cached image does not help, because rate limits run before the cache. The editor offers one-click Exclude <host> buttons that wrap the expression as (http.host ne "host") and (…).

New Rule… creates a rate limit, a custom WAF rule, a cache rule (cache for a set time, or bypass the cache) or a redirect. It asks for a hostname, with an optional path prefix, instead of a bare path, so a new rule cannot silently cover every host; a hand-written expression gets the same warning. Managed WAF, URL rewrite and request/response header rules are listed when the zone has them. They can be switched on and off, renamed and deleted, but their parameters (cache TTL, redirect target, headers) are shown rather than edited — recreate the rule to change them.

Each kind needs its own token permission — Zone WAF, Cache Rules, Single Redirect or Transform Rules — Read to view and Edit to change; the pane names whichever is missing. Rules in Cloudflare opens the dashboard. AI: cloudflare_dev_mode action=rules lists the rules, action=rule_create adds one and action=rule_update changes one (each needs Allow changes and your confirmation). It can disable a rule but never delete one.

7.14.7Security events and Bot Fight Mode

The zone pane's Security Events section shows what Cloudflare blocked, challenged or logged on the zone in the last 24 hours, grouped by source (rate limiting, custom rule, managed rules, DDoS, browser integrity check…), rule and hostname. Custom and rate-limit rule ids are shown by name. An orange triangle means visitors were stopped on a hostname other than the main site — typically a media or image host caught by a rule meant for pages. Start here when images go missing or visitors report error 1015 or 429, then fix the rule under Rules.

Below the list, Bot Fight Mode shows and switches Cloudflare's free bot challenge. Turning it on asks first: it can block legitimate bots, feeds, webhooks and monitors, and on the free plan a rule cannot exempt them. Needs Zone · Analytics · Read. AI: action=security_events and action=bot_fight.

7.14.8Cache by hostname

The zone pane's Cache by Hostname section shows, for the last 24 hours, each hostname's requests and the share of cacheable requests served from Cloudflare's cache (HTML and API responses are left out), plus the top files that were not served from cache. A zone-wide hit rate hides an image host that never caches; this does not. A host well below 100% usually has no cache rule, an origin sending Set-Cookie or Cache-Control: no-store, or a rule blocking requests before they reach the cache. AI: action=cache_hosts.

7.14.9Workers

The account pane's Workers section lists every Worker with the routes that point at it, the last day's requests, errors and 99th-percentile CPU time, and a bar showing usage against the plan's published allowance — 10 million requests a month on Workers Paid, 100,000 a day on Free — turning orange at 70% and red at 90%. Needs Account · Workers Scripts · Read, Workers Routes · Read and Account Analytics · Read, all pre-filled by Create Token…. AI: action=workers.

7.14.10Plan and notifications

The account pane's Plan & Notifications section lists the account's subscriptions (plan, price, state, renewal date) and its notification policies, and warns when there are none — nothing would then tell you about an outage, an expiring certificate or Workers usage. It is read-only; Billing and Notifications open the dashboard. Needs Account · Billing · Read (pre-filled) and Account · Notifications · Read, which has no token-template shortcut and must be added by hand. AI: action=plan_usage.

7.14.11Turnstile widgets

Turnstile is Cloudflare's free CAPTCHA replacement for sign-up, login and contact forms. The Cloudflare pane's Turnstile section lists your widgets with a Copy Site Key button each. New Widget… asks for a name, up to ten hostnames and a mode (Managed, recommended; Non-interactive; Invisible). The new widget's secret is shown with Copy and Save Secret to Script Secrets, which stores it as $TURNSTILE_SECRET_<NAME> for your scripts. Each row's ⋯ menu reaches an existing widget's secret too: Copy Secret Key (the clipboard clears after 60 seconds), Save Secret to Script Secrets and Rotate Secret…. Rotating has Cloudflare issue a new secret while the old one keeps working for two hours, so put the new one on every server that verifies the widget before then; a copy already in Script Secrets is updated for you. The site key goes in the page; the secret stays on your server, which checks each visitor's token with Cloudflare's siteverify endpoint. Delete Widget… lives in the same menu.

7.14.12Named tunnels: health, alerts and Access

Each named tunnel row (see Chapter 9) carries a status line: Cloudflare's view of its connectors — healthy, degraded, down or inactive — and, for a tunnel this Mac runs, whether the local port answers, since a healthy tunnel in front of a stopped service still fails. The bell opts that tunnel into an alert if it or its service goes down (Alerts group Network & Routing). Protect… puts a Cloudflare Access sign-in in front of the hostname: list email addresses and/or @domains, choose how long a sign-in lasts (one hour to 30 days), and visitors sign in with a one-time PIN sent to their email or through your identity provider. FrontierStack creates a reusable allow policy and a self-hosted Access application; a blue lock marks protected tunnels, and Remove Access takes it off. Access needs Zero Trust set up on the account once (the free plan covers 50 users) and Account · Access: Apps and Policies · Edit.

7.14.13AI access through Cloudflare MCP

The AI Access (Cloudflare MCP) section lets the AI Administrator use Cloudflare's official MCP server at mcp.cloudflare.com with the token you already saved — useful for products FrontierStack has no pane for (WAF rules, Workers, R2, KV, D1, Access). Turn on Let the AI Administrator use Cloudflare MCP and press Test Connection. Out of the box it is read-only: the AI can search Cloudflare's documentation and its full API specification. Allow API calls (execute), off by default, lets it run JavaScript against the live API; every run needs Allow changes and your approval. MCP clients connected to FrontierStack reach the same server through the hosted_mcp tool with provider=cloudflare (see the tools table in Chapter 13). Other MCP clients ▸ Copy Config gives a token-free entry for Claude, Cursor and similar apps, which sign in to Cloudflare themselves with OAuth.

7.14.14Cloudflare developer tools

The Cloudflare pane's Developer Tools section installs Cloudflare's own tooling from its agent-setup guide. Install adds the Cloudflare CLI (cf, beta) with npm in the in-app console, adding Node through Homebrew first if needed; Sign In… runs cf auth login and opens your browser to authorize your account (it does not use the saved API token). The Claude Code plugin row adds the cloudflare/skills marketplace and installs the cloudflare plugin, Cloudflare's skills plus its API, docs, bindings, builds and observability MCP servers. That installs third-party plugin code, so run /reload-plugins in Claude Code afterwards. It needs Claude Code on this Mac.

7.10Hosting providers

Not everything you run lives on a Mac. The Hosting category brings VPS and managed providers into the same window. VPS providers — DigitalOcean, Vultr, Linode, Hetzner, Sakura and others — expose their servers through an API token: paste it, and the pane lists each server with plan, location, status and IP, and lets you power one on, off or restart with a confirmation. Dashboard-style providers store their token and surface quick links to the control panel, docs and sign-up. Hostinger goes further: with an API token from hPanel ▸ Account ▸ API the pane lists and powers your VPSs, takes a VPS snapshot (Hostinger keeps one per VPS, so a new one replaces it), lists your domain portfolio with expiry dates and your hosting websites, and lets the AI Administrator read and set DNS records with dns_record (provider=hostinger). Its AI Access (Hostinger MCP) section connects the AI to Hostinger's official MCP server with the same token — read tools only, until you turn on Allow writes. Either way the credential lives in the Keychain, and the servers you can reach over SSH become part of your fleet (Chapter 8). ConoHa signs in with three values from its control panel’s API page — the API user, its password and the tenant ID — lists and powers your VPS 3.0 (or legacy 2.0) servers, and adds a DNS section for ConoHa DNS zones: add, edit and delete records here, or let the AI do it with dns_record (provider=conoha). ConoHa DNS is free for ConoHa customers and is the usual API-managed home for a domain registered at Onamae.com, which has no DNS API of its own. Tencent Cloud signs every request with an API key pair (SecretId and SecretKey from CAM ▸ API Keys; the SecretKey never leaves the Mac). It lists and powers your CVM and Lighthouse servers in every region, manages DNSPod records (or the AI does, with provider=dnspod), and shows your SSL certificates by expiry, COS storage buckets (flagging any an ACL leaves publicly readable), CDN and EdgeOne sites, and this month’s charges. Set the account’s site — international or China — because the two keep separate accounts. Domains registered at Tencent Cloud are imported in Domain Registrars like any other registrar’s, and new ones can be bought there: Tencent quotes its price, registers to a registrant profile on the account and pays from the balance, after a preview and a confirmation.

Xserver (エックスサーバー) takes one API key from the XServer account (API キー管理) — read-only is enough except for setting up SSH for a move — and covers its rental servers, XServer Business, Xserver Domain, Xserver VPS, Xserver VPS Cloud and Xserver for WordPress. The pane lists every contract with its plan and renewal date — VPS Cloud VPSs, DB servers, load balancers, NFS volumes and additional IPs included — and powers the VPSs and VPS Cloud resources, shows each rental server's disk and file use and any certificate that has expired or is about to, copies the contracts into Spend & Billing with Xserver's published 12-month list price, and imports Xserver Domain renewals into Domain Registrars; a live monitor raises an alert for a suspended contract, a renewal due with auto-renew off, a quota at 90%, an expired certificate or an expiring key. Move to This Mac… brings a rental server's sites home: FrontierStack reads the domains, document roots, databases and WordPress installs from the API, registers its own SSH key there, rsyncs each document root and copies each database — live with mysqldump, using the password from the site's wp-config.php, or from last night's automatic backup — into Homebrew MySQL. It rewrites the /home/xs… paths, gives each WordPress its own local MySQL user, adds the sites to Apache (on 127.0.0.1 until you choose to serve them publicly) and writes XSERVER-IMPORT.md with the DNS zones, cron jobs, mail accounts and the cut-over steps. Mail is not moved: Xserver exports neither mailboxes nor their passwords. Running the move needs a licence; the inventory does not.

7.11IndexNow: instant search-engine submission

When a page changes, you do not have to wait for a crawler to notice. IndexNow Manager (in SEO & Marketing) tells the participating engines — Bing, Yandex, Seznam, Naver and others — immediately. Pick one of your managed sites, press Install Key File, and FrontierStack writes the <key>.txt file into the site's document root so the engines can confirm you own the key; Verify checks it is being served. Then submit a single URL, fire off the pending queue, or feed it from a sitemap, and it can auto-submit on a schedule. Everything goes to api.indexnow.org, which fans out to all participating engines; the URL's host must match the selected site and its key.

7.12OpenSEO and DataForSEO: your own SEO toolkit

OpenSEO (SEO & Marketing) is an open-source alternative to Semrush and Ahrefs — keyword research, rank tracking, competitor insights, backlinks, site audits and AI visibility — with an MCP server so your AI agent can use the same data. Its pane starts with one question: where does it run?

• Hosted — app.openseo.so. Free to try, $10/month to support the project; SEO data is billed through OpenSEO credits (DataForSEO's price plus 28%), so you do not need your own DataForSEO account.
• Docker on this Mac — Set Up & Start pulls ghcr.io/every-app/open-seo and starts it on http://localhost:3001. Your projects live in the open_seo_data volume, so Apply Settings & Restart (after changing a key or the port) and Update (latest image) keep them. OpenSEO's telemetry is off by default, and you can share your OpenRouter key to enable its SAM agent.
• Self-hosted elsewhere — enter the URL of an existing instance, or press Deploy to Cloudflare…. FrontierStack clones the repository, writes an owner-only .env.selfhost with your DataForSEO key and the email addresses allowed through Cloudflare Access, and runs pnpm deploy:selfhost in the in-app console. The first run signs you in to Cloudflare; answer yes to customising the OAuth scopes and enable access:write. Paste the Worker URL it prints back into Instance URL.

The live monitor reads the instance's /api/health endpoint, which lists the setup checks for the DataForSEO key, database, auth mode, AI and Search Console. Pin Alert me and a failing check raises an alert. If you paste an oseo_ API key, it is checked against the MCP endpoint, so a revoked key is flagged too. The AI agents section copies the MCP URL, a claude mcp add command and a Claude Desktop/Cursor config. The API-key variant reads $OPENSEO_API_KEY from your shell, so FrontierStack never puts the key on the clipboard.

DataForSEO is the data source behind OpenSEO, and it has its own live monitor, which the OpenSEO pane embeds. Enter the API login and password from app.dataforseo.com ▸ API Access (not your dashboard password), or leave the login empty and paste the longer Base64 credential. The monitor shows your prepaid balance, today's spend and API calls, and it can alert you when today's spend passes a threshold or the balance drops below a floor you set. Self-hosted OpenSEO installs take the same credential, so you enter it once.

7.13Site Clone: copying sites between machines

The Site Clone pane (Setup & Migration) copies a website — its files and its MySQL database — from where it is now to somewhere else, in four numbered steps. Pick where the site is now (This Mac, one of your pinned servers, or a hosting account reached over SFTP/FTPS) and where the copy goes (This Mac, a pinned server, A new server… or a hosting account). Find Sites & Databases lists the folders a server's web server serves and its databases, so you pick rather than type. A new server is linked over SSH when the clone starts; Pin it to the sidebar keeps it with your other servers afterwards. The database can be copied once, or kept in sync as a MySQL replica: FrontierStack creates a replication login on the source, loads a dump taken at a known binary-log position, and starts a replication channel on the copy that carries only that database. Check tests both ends first, without changing anything, and names whatever stops a replica (MySQL older than 8.0.23, binary logging off, a source that only listens on 127.0.0.1).

Two more tools move a site without a manual rsync dance. Copy Websites Between Apache handles the local case: when you have more than one Apache install on the Mac (say a Homebrew one and an old Server.app one), choose the source install, tick the sites you want, and FrontierStack copies their document roots and vhost definitions into the currently selected Apache. Sites with the same domain are overwritten, so it is also how you re-import after a migration.

To move a site to another machine, the AI's promote_site tool clones a local site to one named fleet host: it uploads the document root, writes the vhost (Apache or Nginx) on the far side, reloads the web server, and can add the Cloudflare A record pointing at the new host — the same steps as a manual fleet push, in one call.

7.14Provisioning a new web project

The pieces above combine into a single flow for standing up a project's infrastructure from nothing. The idea is a clean division of labour: your AI tool (over MCP) owns the code; FrontierStack owns the infrastructure. The built-in Provision Web Project skill walks the assistant through the recipe in order:

1. Discover — inventory the target, its privilege access, installed Apache/Nginx and connected DNS provider; identify or install missing prerequisites before making a public change.
2. Zone — cloudflare_zone_create makes the Cloudflare zone and returns the nameservers to set at the registrar (and tells you plainly if the token lacks account-level zone-create rights).
3. Vhost + folder — vhost_create defines the Apache/Nginx site. If you did not provide a document root, FrontierStack creates an empty platform-appropriate folder and reports its path. It does not design or generate site content.
4. DNS — dns_record points the name at the host.
5. TLS — issue_certificate issues a Let's Encrypt certificate.
6. Preview — a temporary share for a localhost test point (Chapter 9).
7. Promote — optionally promote_site clones it onto a fleet host.

Domain registration can join the front of this recipe through domain_register, so an agent can in principle buy the name, create the zone, stand up the vhost, issue the certificate and clone to the fleet — with every money-spending or system-changing step previewed for your approval first.

Everything so far has been about the Mac in front of you. This part of the manual widens the lens to the whole estate: the Linux boxes in a rack, a vintage Xserve still running macOS Server, a Raspberry Pi on a shelf, a cloud VPS, even a Windows host. You link each one once over SSH, and from then on FrontierStack treats them as a single fleet — running diagnostics, fanning commands out, deploying sites, and watching their health. It also keeps track of where this Mac is on the network, so a laptop that moves between home, office and a café doesn't fire false alarms about servers it simply can't see right now.

This chapter covers linking and running the fleet. Chapter 9 goes deeper on the network and perimeter, Chapter 10 on hardening and the security audits, and Chapter 11 on continuous monitoring and alerts. The AI Administrator can drive almost everything here over the same tools — see Chapter 13.

8.1Locations & Places

Open Locations & Places ▸ Locations. A location is simply a named network — Home, Office, On VPN — recognised from several signals: the Wi-Fi SSID, the router (gateway) MAC address, the Wi-Fi BSSID, the subnet prefix of your IP address (e.g. 192.168.1.), your public IP block, and whether a VPN is up. The header shows where you are right now (Now: Office), with the live snapshot beneath it: Wi-Fi name, IP, gateway and VPN state. Detection runs every 30 seconds.

When FrontierStack sees a network it doesn't recognise it offers a New network detected banner — click Add… to save it. You can also press Add Current Network as Location, then refine the criteria: a location matches when all the set criteria hold (with SSID and router MAC treated as any-of), so leaving a field blank simply ignores it. When several locations match, the most specific one wins rather than the first in the list. Use the Mode picker to pin a location manually instead of auto-detecting — handy when the signals are ambiguous.