Web Servers

Managed Web Servers run Nginx or Apache for you — the platform provisions the VM, installs and configures the web server (optionally with PHP), binds your domains, deploys your content, and can publish the site to the internet on demand.

Create a web server

In the portal, go to Web Servers → Instances → Create and choose:

Type — Nginx or Apache, and a version (the launchable versions are in the dropdown; the recommended one is marked).
Flavor — the size, from the web.co1.* family (small … xlarge).
Storage — disk size for the document root.
VPC + subnet.
PHP — optionally enable PHP and pick a version (8.1 / 8.2 / 8.3).

From the CLI

Lifecycle commands are type-specific (fm webserver nginx … / fm webserver apache …).

bash

fm webserver nginx instance create \
  --name site-1 \
  --version 1.30 \
  --flavor web.co1.small \
  --storage 20 \
  --vpc my-vpc \
  --subnet my-subnet \
  --php-enabled --php-version 8.3

# Apache is symmetric: fm webserver apache instance create …

With Terraform

hcl

resource "frostmoln_nginx_instance" "site" {
  name        = "site-1"
  version     = "1.30"
  flavor_id   = "web.co1.small"
  storage_gb  = 20
  vpc_id      = frostmoln_vpc.main.id
  subnet_id   = frostmoln_subnet.main.id
  php_enabled = true
  php_version = "8.3"
}

(frostmoln_apache_instance is the Apache equivalent.)

PHP is fixed for the life of an instance

Enabling PHP or changing the PHP version requires recreating the instance — it can't be toggled on a running web server. Pick the version you need at create time.

Deploy content

Publish your site by uploading a .tar.gz archive of your document root. The platform unpacks it into a new release directory and atomically swaps the live symlink to it, so the switch-over is instant and the previous release is kept for rollback.

In the portal, open the web server's detail page and use the Deploy tab to upload an archive; the deploy history is listed there.

From the CLI

bash

# Deploy an archive to an instance
fm webserver nginx deploy <instance-id> ./site.tar.gz

# List previous deployments (newest first)
fm webserver nginx deploys list <instance-id>

# Apache: fm webserver apache deploy … / fm webserver apache deploys list …

With Terraform

hcl

resource "frostmoln_webserver_deployment" "site" {
  instance_id    = frostmoln_nginx_instance.site.id
  source_archive = "${path.module}/site.tar.gz"
}

Terraform tracks the archive's content hash — rebuild site.tar.gz and the next terraform apply pushes a new deployment automatically.

Configuration

A small, curated set of settings can be adjusted without touching raw Nginx/Apache config. The keys are the same for both types:

Key	What it controls
`indexFiles`	Index filenames tried for a directory request (e.g. `index.html index.php`)
`spaFallback`	Serve `index.html` for unmatched routes (single-page-app fallback)
`clientMaxBodySize`	Maximum request/upload body size (e.g. `25m`)
`gzip`	Enable gzip compression of responses
`securityHeaders`	Send a baseline set of security response headers
`error404Page`	Path to a custom 404 page
`error500Page`	Path to a custom 500 page

In the portal, use the Config tab on the web server's detail page.

From the CLI

bash

# Show the current configuration
fm webserver nginx config get <instance-id>

# Set a value
fm webserver nginx config set <instance-id> spaFallback=true
fm webserver nginx config set <instance-id> clientMaxBodySize=25m

With Terraform

Set the config map on the instance resource:

hcl

resource "frostmoln_nginx_instance" "site" {
  # … create arguments as above …

  config = {
    indexFiles        = "index.html index.htm"
    spaFallback       = "true"
    clientMaxBodySize = "25m"
    gzip              = "true"
    securityHeaders   = "true"
  }
}

Domains

Bind one or more domains to a running web server. The binding is a record on the platform: the server answers any hostname pointed at its IP, so it is DNS that makes a domain live — the binding marks which domains you consider yours and which one is the default.

bash

fm webserver nginx domain add <instance-id> --name example.com

HTTPS is not terminated for you yet

The platform does not issue or renew certificates for a bound domain. The TLS flag on the binding — and the TLS toggle and green Enabled badge on the instance in the portal — record your intent only: no certificate is provisioned, nothing listens on 443, and the site is served over HTTP. Terminate TLS in front of the web server yourself if you need HTTPS today.

(Or the frostmoln_webserver_domain Terraform resource.) Point your domain's DNS at the server's public IP (see below), and mark one domain as the default.

Publish to the internet

A managed web server is private by default — it gets a private IP and is reachable only from instances on the same VPC. To serve it to the public internet, expose it: the platform allocates a public IP, associates it with the server, and the instance then shows a public IP.

In the portal, use the Expose action on the instance.

From the CLI

bash

fm webserver nginx expose <instance-id>     # allocate + attach a public IP
fm webserver nginx unexpose <instance-id>   # release it (back to private)

With Terraform

hcl

resource "frostmoln_nginx_instance" "site" {
  # … create arguments as above …
  public = true
}

Exposing allocates a billed public IP

Exposure allocates a public IP, which is billed for as long as it is held. Un-exposing the server — or deleting it — releases the public IP.

What is open, and to whom

Every web server gets its own security group — a firewall the platform creates and attaches when the instance is created. It allows inbound tcp/80 and tcp/443 from any source (0.0.0.0/0), and outbound traffic is unrestricted. While the server is private no public IP is associated, so nothing outside your VPC can reach it; once you expose it, those two ports are open to the whole internet.

Anything that can already route into your VPC — your other instances, a peering, a VPN — reaches 80/443 too, including the load balancer suggested below.

The group's id is on the instance (security_group_id in Terraform, and shown in the portal), so you can inspect its rules:

bash

fm network security-group get <sg-id>

The source range is not configurable yet

This group is managed by the platform: it is not intended for you to edit, and changes to it are normally rejected. That also means you cannot yet narrow 80/443 to your own address range. A future release will let you restrict the source; the default on existing servers will not change under you. If you need it restricted today, keep the web server private and put a load balancer or your own proxy in front of it.

Lifecycle and limits

Start, stop, restart, resize (grow storage), and delete from the instance detail page or the CLI (fm webserver nginx instance start|stop|restart|resize|delete).
PHP is fixed after create — to change it, recreate the instance.
Rollback — the previous release is retained after each deploy.
No built-in load balancing or autoscaling across web-server instances (put a load balancer in front for that).

Network: Public IPs · Load Balancers · Compute / Instances

Compute / Instances

DNS

Databases

Kubernetes

IAM Access Policies

Container Registry

Web Servers

Create a web server

From the CLI

With Terraform

Deploy content

From the CLI

With Terraform

Configuration

From the CLI

With Terraform

Domains

Publish to the internet

From the CLI

With Terraform

What is open, and to whom

Lifecycle and limits

DNS

Web Servers ​

Create a web server ​

From the CLI ​

With Terraform ​

Deploy content ​

From the CLI ​

With Terraform ​

Configuration ​

From the CLI ​

With Terraform ​

Domains ​

Publish to the internet ​

From the CLI ​

With Terraform ​

What is open, and to whom ​

Lifecycle and limits ​

Related ​

Web Servers

Create a web server

From the CLI

With Terraform

Deploy content

From the CLI

With Terraform

Configuration

From the CLI

With Terraform

Domains

Publish to the internet

From the CLI

With Terraform

What is open, and to whom

Lifecycle and limits

Related