Skip to content
Saphira Linux

Web

Saphira Linux webDragon

A Saphira feature that turns a normal installation into a managed web platform: Nginx, PHP-FPM 8.5 and Node.js, with TLS you do not have to babysit. You own the machine; webDragon removes the repetitive systems administration.

Tools included — beta state
Saphira Linux webDragon, the Open Source web server mascot

The site is the unit

webDragon works at the level of a site, not the individual configuration files underneath it. An administrator describes a site in ordinary terms — its domain name, whether it needs PHP, Node.js or both, where its content or application lives, and whether it needs HTTPS — and saphira-site turns that intention into the appropriate Saphira, Nginx, PHP, Node and TLS configuration.

Creating a site with saphira-site

Today saphira-site is an interactive wizard that asks a small number of questions and then generates and installs the configuration. It prompts for:

  • Hostname — validated as a real DNS name before anything is written.
  • Site type — Static (plain files), PHP, or Node. PHP offers a public + server layout, PHP-inside-htdocs, or a custom document and application root.
  • Listeners — IPv4 only, IPv6 only, or dual stack.
  • Proxy — whether the site sits behind HAProxy and, if so, whether PROXY protocol is used, plus the trusted upstream proxy address.
  • Security policy — Strict, Relaxed or Permissive, which sets the Content-Security-Policy and the standard security headers (including HSTS once TLS is enabled).
TipEvery generated virtual host carries a header comment identifying it as Generated by saphira-site for <host>, so you can always tell which files webDragon manages.

What gets generated

For the web server, saphira-site writes an Nginx virtual host at /etc/nginx/vhosts/<host>.conf containing a /health endpoint, the ACME challenge location, and the right body for the chosen type: a static document root, a PHP block that fastcgis to a per-site unix socket, or a Node block that proxies to 127.0.0.1:<port>. For PHP sites it also writes a PHP-FPM 8.5 pool at /etc/php85/php-fpm.d/<host>.conf.

Safe by transaction

Installing a site is a transaction. saphira-site backs up any existing configuration, runs nginx -t to validate the result, and rolls back to the previous configuration if validation fails. Enabling a site creates a symlink in /etc/nginx/vhosts.enabled and validates again, rolling back if Nginx rejects it. If Nginx is running it offers to reload so the site goes live immediately; if it is not, the configuration is still valid, just not yet active.

Where a site lives

A site's files live under /srv/<host>: htdocs for the web root, server for application code when a split layout is chosen, app for application material, and css, js and images directories. The layout is ordinary and easy to inspect.

NoteCombined PHP and Node on a single site, and a simpler non-interactive or declarative way to define a site, are planned but are not yet part of saphira-site. Today a site is one type at a time.