This manual serves as a production-grade infrastructure deployment record and a comprehensive operational guide for your homelab cluster setup on hvu24k. It documents the exact configuration matrix used to successfully orchestrate your flat-file ecosystem, eliminating any future reliance on multi-VPS platforms.

Unlike standard web server blocks, Nginx's Layer 4 stream {} map feature does not natively understand leading-dot shortcuts (.ffcms.stream) or classic asterisks (*.ffcms.stream) unless the map is explicitly formatted for hostnames.

When Nginx encountered a leading dot in the map file, it treated it as a literal string instead of a wildcard evaluation, causing it to fail back to your default 1Panel route. To force Nginx's stream map tool to handle wildcard lookups correctly, you must use a leading asterisk format (*) without a leading dot.

# --- FLAT-FILE CMS FLIGHT TRACKER ---
ffcms.stream                  192.168.0.172:443;
*.ffcms.stream                192.168.0.172:443;

Apply changes by running:

sudo nginx -t && sudo systemctl reload nginx

To achieve optimal performance and strict platform isolation, the fleet is split dynamically into two standalone FastCGI process pools.

These modern frameworks utilize advanced Symfony or Laravel core architectures, operating on your fast PHP 8.3 pipeline:

• statamic.ffcms.stream (Fully active on Statamic v6 with its clean Laravel core layout)
• grav.ffcms.stream (Fully active on Grav 2.0 with its integrated Admin dashboard)
• kirby.ffcms.stream (Fully active on Kirby Starterkit, securely hidden behind your Apache Basic Auth license gate)
• dokuwiki.ffcms.stream (Fully active modern text wiki engine)
• herbie.ffcms.stream (Fully active Symfony-based Markdown engine)

These robust engines operate seamlessly under your primary PHP 8.1 web processing layer:

• boidcms.ffcms.stream (Newly launched minimalist engine - Default Login: admin / password)
• flatpress.ffcms.stream (Newly launched stable blogging portal)
• htmly.ffcms.stream (Newly launched Markdown blogging layout)
• mecha.ffcms.stream (Newly launched hyper-minimalist file engine)
• mozilo.ffcms.stream (Newly launched plain-text page manager)
• pulse.ffcms.stream (Fully active clean reinstallation profile)
• bludit.ffcms.stream (Fully active production profile)
• getsimple.ffcms.stream (Fully active with secure asset routing parameters)
• typemill.ffcms.stream
• inline.ffcms.stream
• pluck.ffcms.stream
• pluxml.ffcms.stream
• yellow.ffcms.stream (Datenstrom Yellow framework)
• wonder.ffcms.stream

Note: Baun CMS, Flextype, Typesetter, Monstra, Batflat, and Parvula have been cleanly unlinked, deleted, and purged to maintain strict system hygiene.

Used for heavy frameworks that separate core configuration logic from the public web entry hub. This ensures the master app files sit safely outside public reach, while public traffic is funneled exclusively into the public or web subfolder.

<VirtualHost *:80>
     ServerAdmin clytn50@gmail.com
     DocumentRoot /var/www/html/statamic/public/
     ServerName statamic.ffcms.stream
     ServerAlias www.statamic.ffcms.stream

     # 🚀 FORCE PHP 8.3 SOCKET FOR LARAVEL CORE REQUIREMENTS
     <FilesMatch \.php$>
          SetHandler "proxy:unix:/var/run/php/php8.3-fpm.sock|fcgi://localhost"
     </FilesMatch>

     <Directory /var/www/html/statamic/public/>
          Options FollowSymLinks
          AllowOverride All
          Require all granted
     </Directory>

     ErrorLog ${APACHE_LOG_DIR}/statamic_error.log
     CustomLog ${APACHE_LOG_DIR}/statamic_access.log combined
</VirtualHost>

Used to enforce strict Apache Basic Authentication at the proxy URL request layer before third-party .htaccess files load or rewrite rules process. This keeps Kirby invisible to public crawlers and fulfills free evaluation tier guidelines.

<IfModule mod_ssl.c>
<VirtualHost *:443>
     ServerAdmin clytn50@gmail.com
     DocumentRoot /var/www/html/kirby/
     ServerName kirby.ffcms.stream
     ServerAlias www.kirby.ffcms.stream

     # 🚀 ROUTE TRAFFIC TO THE HIGH-PERFORMANCE PHP 8.3 FPM SOCKET
     <FilesMatch \.php$>
          SetHandler "proxy:unix:/var/run/php/php8.3-fpm.sock|fcgi://localhost"
     </FilesMatch>

     <Directory /var/www/html/kirby/>
          Options +FollowSymLinks
          AllowOverride All
          Require all granted
     </Directory>

     # 🔐 FORCE LOCATION AUTHENTICATION GATES PRIOR TO DIRECTORY PROCESSING
     <Location />
          AuthType Basic
          AuthName "Kirby Private Staging Cluster"
          AuthUserFile /etc/apache2/.kirby.htpasswd
          Require valid-user
     </Location>

     ErrorLog ${APACHE_LOG_DIR}/kirby_error.log
     CustomLog ${APACHE_LOG_DIR}/kirby_access.log combined
</VirtualHost>
</IfModule>

To renew or create certificates for a precise subdomain without altering your cluster's broader mappings:

sudo certbot --apache -d htmly.ffcms.stream -d www.htmly.ffcms.stream

Always select option 2 to enforce permanent, automated HTTPS secure redirection mapping passes.

When flat-file engines like Pulse CMS expect safe hashed credentials inside their configuration arrays rather than plain text, compute them natively using the target CLI binary:

/usr/bin/php8.1 -r 'echo password_hash("YOUR_TARGET_PASSWORD", PASSWORD_BCRYPT) . "\n";'

If an engine throws infinite rejection loops (such as Pulse CMS displaying “Too many login failures” even after a complete reinstallation pass), the browser cache is passing stale session metrics.

1. Open Browser DevTools (**F12**).
2. Navigate to **Application** -> **Storage** / **Session Storage** / **Cookies**.
3. Clear all tracking keys bound to the subdomain domain string.
4. Force-purge backend temporary paths: ''sudo rm -rf /var/www/html/pulse/data/cache/*''
5. Close all windows, open a brand-new **Incognito Tab**, and run a raw curl check: ''curl -I https://ffcms.stream'' to verify the ''HTTP/1.1 200 OK'' clean entry profile.

sudo chown -R www-data:www-data /var/www/html/
sudo find /var/www/html/ -type d -exec chmod 755 {} \;
sudo find /var/www/html/ -type f -exec chmod 644 {} \;
sudo systemctl restart apache2