Webscale Documentation on Webscale Product Documentation

2026.33

Mon, 01 Jan 0001 00:00:00 +0000

Changes

New Pro Magento V4 stack

This adds hosting image support for the pro-magento-v4 stack type.

Component upgrades

Component	Previous	Current
Composer	2.10.1	2.10.2
Alpine	3.24.0	3.24.1
RabbitMQ	4.3.1	4.3.2

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.10.2	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.33
Container	php-fpm:8.2-arm64	Debian 13.5	8.2.31, composer-2.10.2	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.33
Container	php-fpm:8.3-arm64	Debian 13.5	8.3.31, composer-2.10.2	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.33
Container	php-fpm:8.4-arm64	Debian 13.5	8.4.22, composer-2.10.2	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.33
Container	php-fpm:8.5-arm64	Debian 13.5	8.5.7, composer-2.10.2	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.33
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.10.2	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.33
Container	php-fpm:8.2-deb	Debian 13.5	8.2.31, composer-2.10.2	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.33
Container	php-fpm:8.3-deb	Debian 13.5	8.3.31, composer-2.10.2	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.33
Container	php-fpm:8.4-deb	Debian 13.5	8.4.22, composer-2.10.2	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.33
Container	php-fpm:8.1	Alpine 3.21.7	8.1.34, composer-2.10.2	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.33
Container	php-fpm:8.2	Alpine 3.24.1	8.2.31, composer-2.10.2	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.33
Container	php-fpm:8.3	Alpine 3.24.1	8.3.31, composer-2.10.2	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.33
Container	php-fpm:8.4	Alpine 3.24.1	8.4.22, composer-2.10.2	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.33
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.3.2	arm64	public.ecr.aws/webscale/rabbitmq:2026.33
Container	varnish	Debian 12.14	6.0.18	arm64	public.ecr.aws/webscale/varnish:2026.33

2026.32

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Varnish transient memory

Update varnish to use 1/8th of overall system memory for the transient pool, increased from a fixed 1GB.

Opensearch network access

Fix the opensearch binding to always use host networking, for both the essentials systems and those where webscale-opensearch is installed. This avoids a problem where podman does not create the correct nftables rules.

Core server image on Standard V4

Add a new image-monitor unit to the core server that allows it to receive the same image as an associated cluster so that it can be used to run cron, for example.

2026.31

Mon, 01 Jan 0001 00:00:00 +0000

Changes

New webscale-valkey package

A new webscale-valkey package is added to the webscale debian repository that allows valkey to be used on NFS servers.

Component upgrades

Component	Previous	Current
Composer	2.9.8	2.10.1
PHP	8.4.21	8.4.22
PHP	8.5.6	8.5.7

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.10.1	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.31
Container	php-fpm:8.2-arm64	Debian 13.5	8.2.31, composer-2.10.1	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.31
Container	php-fpm:8.3-arm64	Debian 13.5	8.3.31, composer-2.10.1	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.31
Container	php-fpm:8.4-arm64	Debian 13.5	8.4.22, composer-2.10.1	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.31
Container	php-fpm:8.5-arm64	Debian 13.5	8.5.7, composer-2.10.1	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.31
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.10.1	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.31
Container	php-fpm:8.2-deb	Debian 13.5	8.2.31, composer-2.10.1	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.31
Container	php-fpm:8.3-deb	Debian 13.5	8.3.31, composer-2.10.1	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.31
Container	php-fpm:8.4-deb	Debian 13.5	8.4.22, composer-2.10.1	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.31
Container	php-fpm:8.1	Alpine 3.21.7	8.1.34, composer-2.10.1	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.31
Container	php-fpm:8.2	Alpine 3.23.4	8.2.31, composer-2.10.1	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.31
Container	php-fpm:8.3	Alpine 3.23.4	8.3.31, composer-2.10.1	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.31
Container	php-fpm:8.4	Alpine 3.23.4	8.4.22, composer-2.10.1	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.31
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.3.1	arm64	public.ecr.aws/webscale/rabbitmq:2026.31
Container	varnish	Debian 12.14	6.0.18	arm64	public.ecr.aws/webscale/varnish:2026.31

2026.30

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Standard Magento stack improvements

Opensearch and Valkey instances are properly bound to allow external network traffic.
The html/app/etc directory can be included in the share variable, allowing it to be shared and the automatic configuration to be suppressed.
An authorization bug preventing the php-fpm service from starting has been fixed.
A default /etc/php/env.php is made available and can be incorporated into a site env.php using array_replace_recursive.
An error causing the /etc/php/registry-auth.json to fail to generate has been corrected.
An issue with the relay proxy using the wrong document root has been corrected. It also now prints additional information about its config at startup in its log.
Stack definitions now include default variable values.
The relay proxy now runs within the php-fpm container context to simplify file system access.
The relay proxy uses a specific Magento behavior module that provides greater fidelity to Magento requirements. Similar modules for Symfony (Shopware), and Wordpress are also included.

Component upgrades

Component	Previous	Current
RabbitMQ	4.3.0	4.3.1

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.30
Container	php-fpm:8.2-arm64	Debian 13.5	8.2.31, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.30
Container	php-fpm:8.3-arm64	Debian 13.5	8.3.31, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.30
Container	php-fpm:8.4-arm64	Debian 13.5	8.4.21, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.30
Container	php-fpm:8.5-arm64	Debian 13.5	8.5.6, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.30
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.30
Container	php-fpm:8.2-deb	Debian 13.5	8.2.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.30
Container	php-fpm:8.3-deb	Debian 13.5	8.3.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.30
Container	php-fpm:8.4-deb	Debian 13.5	8.4.21, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.30
Container	php-fpm:8.1	Alpine 3.21.7	8.1.34, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.30
Container	php-fpm:8.2	Alpine 3.23.4	8.2.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.30
Container	php-fpm:8.3	Alpine 3.23.4	8.3.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.30
Container	php-fpm:8.4	Alpine 3.23.4	8.4.21, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.30
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.3.1	arm64	public.ecr.aws/webscale/rabbitmq:2026.30
Container	varnish	Debian 12.14	6.0.18	arm64	public.ecr.aws/webscale/varnish:2026.30

2026.29

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Fix CONTAINER_IMAGE_URI not propagated

Previously, when CONTAINER_IMAGE_URI metadata is set on a cluster, it was not propagated to the web server stack, and instead the default base image was run. This change updates stack variable processing, making metadata available and updates the php-fpm template to use CONTAINER_IMAGE_URI if it is present.

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.29
Container	php-fpm:8.2-arm64	Debian 13.5	8.2.31, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.29
Container	php-fpm:8.3-arm64	Debian 13.5	8.3.31, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.29
Container	php-fpm:8.4-arm64	Debian 13.5	8.4.21, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.29
Container	php-fpm:8.5-arm64	Debian 13.5	8.5.6, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.29
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.29
Container	php-fpm:8.2-deb	Debian 13.5	8.2.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.29
Container	php-fpm:8.3-deb	Debian 13.5	8.3.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.29
Container	php-fpm:8.4-deb	Debian 13.5	8.4.21, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.29
Container	php-fpm:8.1	Alpine 3.21.7	8.1.34, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.29
Container	php-fpm:8.2	Alpine 3.23.4	8.2.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.29
Container	php-fpm:8.3	Alpine 3.23.4	8.3.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.29
Container	php-fpm:8.4	Alpine 3.23.4	8.4.21, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.29
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.3.0	arm64	public.ecr.aws/webscale/rabbitmq:2026.29
Container	varnish	Debian 12.14	6.0.18	arm64	public.ecr.aws/webscale/varnish:2026.29

2026.28

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Mitigation for CVE-2026-46333

This release includes mitigation for CVE-2026-46333, disabling ptrace for non-root users.

Relay proxy improvements

Updates to the relay proxy for essentials and standard stacks. This allows for Wordpress to be installed at /var/www/html.

Fix bad permissions for opensearch

Updates to the nfs-server fix-shared-permissions command to exclude opensearch and redis directories.

PHP logging improvements

Use REQUEST_URI instead of %r%Q%q for URI logging in PHP-FPM container logs. This avoids the problem of all logs containing the path of the front controller (usually /index.php).

2026.27

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Mitigate CVE-2026-42945

This release includes an update to nginx 1.24.0-2ubuntu7.8 for relevant images to prevent the attack described in CVE-2026-42945.

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.27
Container	php-fpm:8.2-arm64	Debian 13.4	8.2.31, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.27
Container	php-fpm:8.3-arm64	Debian 13.4	8.3.31, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.27
Container	php-fpm:8.4-arm64	Debian 13.4	8.4.21, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.27
Container	php-fpm:8.5-arm64	Debian 13.4	8.5.6, composer-2.9.8	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.27
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.27
Container	php-fpm:8.2-deb	Debian 13.4	8.2.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.27
Container	php-fpm:8.3-deb	Debian 13.4	8.3.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.27
Container	php-fpm:8.4-deb	Debian 13.4	8.4.21, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.27
Container	php-fpm:8.1	Alpine 3.21.7	8.1.34, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.27
Container	php-fpm:8.2	Alpine 3.23.4	8.2.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.27
Container	php-fpm:8.3	Alpine 3.23.4	8.3.31, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.27
Container	php-fpm:8.4	Alpine 3.23.4	8.4.21, composer-2.9.8	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.27
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.3.0	arm64	public.ecr.aws/webscale/rabbitmq:2026.27
Container	varnish	Debian 12.13	6.0.17	arm64	public.ecr.aws/webscale/varnish:2026.27

2026.26

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Mitigate CVE-2026-43284 and CVE-2026-43500

This release includes mitigation for CVE-2026-43284 and CVE-2026-43500, aka “Dirty Frag” .

Relay proxy dropped connection fix

Improvements are made in error recovery for the relay proxy when clients close connections. Previously, when a client closed a connection, it could result in connection in an inconsistent state. Then subsequent requests could attempt to use the connection and fail because the state maintained by the proxy server was not consistent with the state of the connection in PHP-FPM. This change causes a FastCGI abort to be used when a client terminates a connection early, releasing PHP-FPM resources as early as possible and preventing connection reuse.

2026.25

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Mitigate CVE-2026-31431

This change mitigates the local privilege escalation vulnerability registered as CVE-2026-31431 and documented with an exploit at https://copy.fail/ .

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.25
Container	php-fpm:8.2-arm64	Debian 13.4	8.2.30, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.25
Container	php-fpm:8.3-arm64	Debian 13.4	8.3.30, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.25
Container	php-fpm:8.4-arm64	Debian 13.4	8.4.20, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.25
Container	php-fpm:8.5-arm64	Debian 13.4	8.5.5, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.25
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.25
Container	php-fpm:8.2-deb	Debian 13.4	8.2.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.25
Container	php-fpm:8.3-deb	Debian 13.4	8.3.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.25
Container	php-fpm:8.4-deb	Debian 13.4	8.4.20, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.25
Container	php-fpm:8.1	Alpine 3.21.7	8.1.34, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.25
Container	php-fpm:8.2	Alpine 3.23.4	8.2.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.25
Container	php-fpm:8.3	Alpine 3.23.4	8.3.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.25
Container	php-fpm:8.4	Alpine 3.23.4	8.4.20, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.25
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.3.0	arm64	public.ecr.aws/webscale/rabbitmq:2026.25
Container	varnish	Debian 12.13	6.0.17	arm64	public.ecr.aws/webscale/varnish:2026.25

2026.24

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Add custom image support to essentials

Essentials servers have been fitted with optional PHP-FPM custom image support. By placing a Dockerfile at /etc/php/image/Dockerfile and running the build-php-image command, a custom image is created that will be used for the dev environment and the php-fpm service. The image may be updated at any time by repeating the command, which will update the configuration and reload php-fpm.

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.24
Container	php-fpm:8.2-arm64	Debian 13.4	8.2.30, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.24
Container	php-fpm:8.3-arm64	Debian 13.4	8.3.30, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.24
Container	php-fpm:8.4-arm64	Debian 13.4	8.4.20, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.24
Container	php-fpm:8.5-arm64	Debian 13.4	8.5.5, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.24
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.24
Container	php-fpm:8.2-deb	Debian 13.4	8.2.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.24
Container	php-fpm:8.3-deb	Debian 13.4	8.3.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.24
Container	php-fpm:8.4-deb	Debian 13.4	8.4.20, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.24
Container	php-fpm:8.1	Alpine 3.21.7	8.1.34, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.24
Container	php-fpm:8.2	Alpine 3.23.4	8.2.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.24
Container	php-fpm:8.3	Alpine 3.23.4	8.3.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.24
Container	php-fpm:8.4	Alpine 3.23.4	8.4.20, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.24
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.3.0	arm64	public.ecr.aws/webscale/rabbitmq:2026.24
Container	varnish	Debian 12.13	6.0.17	arm64	public.ecr.aws/webscale/varnish:2026.24

2026.23

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Add supervisor to essentials and nfs-server

This release defines a new supervisor systemd service on the essentials and nfs-server images. When enabled it will run supervisord in the standard php container for the system. Logs are written to the host at /var/log/supervisor/supervisor.log. Program configuration can be provided either in a custom container at /etc/supervisor/conf.d/*.conf or via the host /etc/supervisor/*.conf. The configuration for supervisor itself is not modifiable directly. A shim, supervisorctl, is provided on the host that allows for controlling it as though it were installed on the host.

2026.22

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Add amd64 container-host image

For those cases where an arm64 container-host will not work, an amd64 container-host image is published starting with this release.

Component upgrades

Component	Previous	Current
Alpine	3.21.6	3.21.7
Alpine	3.23.3	3.23.4
Composer	2.9.5	2.9.7

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.22
Container	php-fpm:8.2-arm64	Debian 13.4	8.2.30, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.22
Container	php-fpm:8.3-arm64	Debian 13.4	8.3.30, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.22
Container	php-fpm:8.4-arm64	Debian 13.4	8.4.20, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.22
Container	php-fpm:8.5-arm64	Debian 13.4	8.5.5, composer-2.9.7	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.22
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.22
Container	php-fpm:8.2-deb	Debian 13.4	8.2.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.22
Container	php-fpm:8.3-deb	Debian 13.4	8.3.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.22
Container	php-fpm:8.4-deb	Debian 13.4	8.4.20, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.22
Container	php-fpm:8.1	Alpine 3.21.7	8.1.34, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.22
Container	php-fpm:8.2	Alpine 3.23.4	8.2.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.22
Container	php-fpm:8.3	Alpine 3.23.4	8.3.30, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.22
Container	php-fpm:8.4	Alpine 3.23.4	8.4.20, composer-2.9.7	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.22
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.2.5	arm64	public.ecr.aws/webscale/rabbitmq:2026.22
Container	varnish	Debian 12.13	6.0.17	arm64	public.ecr.aws/webscale/varnish:2026.22

2026.21

Mon, 01 Jan 0001 00:00:00 +0000

Changes

NFS server commands for managing packages

With the creation of the webscale-redis and webscale-opensearch packages comes the need to be able to install them on newer base images where root access is not provided. To enable this, this release contains commands install-package and uninstall-package that take a package name (redis or opensearch) and automatically handle the privilege escalation to install or uninstall the packages.

Component upgrades

Component	Previous	Current
PHP	8.4.19	8.4.20
PHP	8.5.4	8.5.5

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.21
Container	php-fpm:8.2-arm64	Debian 13.4	8.2.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.21
Container	php-fpm:8.3-arm64	Debian 13.4	8.3.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.21
Container	php-fpm:8.4-arm64	Debian 13.4	8.4.20, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.21
Container	php-fpm:8.5-arm64	Debian 13.4	8.5.5, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.21
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.21
Container	php-fpm:8.2-deb	Debian 13.4	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.21
Container	php-fpm:8.3-deb	Debian 13.4	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.21
Container	php-fpm:8.4-deb	Debian 13.4	8.4.20, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.21
Container	php-fpm:8.1	Alpine 3.21.6	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.21
Container	php-fpm:8.2	Alpine 3.23.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.21
Container	php-fpm:8.3	Alpine 3.23.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.21
Container	php-fpm:8.4	Alpine 3.23.3	8.4.20, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.21
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.2.5	arm64	public.ecr.aws/webscale/rabbitmq:2026.21
Container	varnish	Debian 12.13	6.0.17	arm64	public.ecr.aws/webscale/varnish:2026.21

2026.20

Mon, 01 Jan 0001 00:00:00 +0000

Changes

New webscale-opensearch package

This release begins publishing a new webscale-opensearch debian package that is used on V4 and older hosting environments to install an NFS-server-local OpenSearch or Elasticsearch service.

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.20
Container	php-fpm:8.2-arm64	Debian 13.4	8.2.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.20
Container	php-fpm:8.3-arm64	Debian 13.4	8.3.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.20
Container	php-fpm:8.4-arm64	Debian 13.4	8.4.19, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.20
Container	php-fpm:8.5-arm64	Debian 13.4	8.5.4, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.20
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.20
Container	php-fpm:8.2-deb	Debian 13.4	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.20
Container	php-fpm:8.3-deb	Debian 13.4	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.20
Container	php-fpm:8.4-deb	Debian 13.4	8.4.19, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.20
Container	php-fpm:8.1	Alpine 3.21.6	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.20
Container	php-fpm:8.2	Alpine 3.23.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.20
Container	php-fpm:8.3	Alpine 3.23.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.20
Container	php-fpm:8.4	Alpine 3.23.3	8.4.19, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.20
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.2.5	arm64	public.ecr.aws/webscale/rabbitmq:2026.20
Container	varnish	Debian 12.13	6.0.17	arm64	public.ecr.aws/webscale/varnish:2026.20

2026.19

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Improvements to webscale-redis

This release makes multiple improvements to the webscale-redis package.

The default version is now 6.2.6 to match current usage.
Ownership of /etc/redis/* and /var/log/redis/* has been fixed so that the adm group members can update configuration and view logs.
Control of the redis-volatile and redis-persistent systemd services can now be done by members of the adm group.
/etc/redis/env is added as a conf file so it will be retained on future upgrades.
The previous network bind was for loopback only. This change updates it to listen on all interfaces.

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.19
Container	php-fpm:8.2-arm64	Debian 13.4	8.2.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.19
Container	php-fpm:8.3-arm64	Debian 13.4	8.3.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.19
Container	php-fpm:8.4-arm64	Debian 13.4	8.4.19, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.19
Container	php-fpm:8.5-arm64	Debian 13.4	8.5.4, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.19
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.19
Container	php-fpm:8.2-deb	Debian 13.4	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.19
Container	php-fpm:8.3-deb	Debian 13.4	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.19
Container	php-fpm:8.4-deb	Debian 13.4	8.4.19, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.19
Container	php-fpm:8.1	Alpine 3.21.6	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.19
Container	php-fpm:8.2	Alpine 3.23.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.19
Container	php-fpm:8.3	Alpine 3.23.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.19
Container	php-fpm:8.4	Alpine 3.23.3	8.4.19, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.19
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.2.5	arm64	public.ecr.aws/webscale/rabbitmq:2026.19
Container	varnish	Debian 12.13	6.0.17	arm64	public.ecr.aws/webscale/varnish:2026.19

2026.18

Mon, 01 Jan 0001 00:00:00 +0000

Changes

New webscale-redis package

This release begins publishing a new webscale-redis debian package that is used on V4 and before hosting environments to install NFS-server-local volatile and persistent Redis services.

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.18
Container	php-fpm:8.2-arm64	Debian 13.4	8.2.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.18
Container	php-fpm:8.3-arm64	Debian 13.4	8.3.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.18
Container	php-fpm:8.4-arm64	Debian 13.4	8.4.19, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.18
Container	php-fpm:8.5-arm64	Debian 13.4	8.5.4, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.18
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.18
Container	php-fpm:8.2-deb	Debian 13.4	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.18
Container	php-fpm:8.3-deb	Debian 13.4	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.18
Container	php-fpm:8.4-deb	Debian 13.4	8.4.19, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.18
Container	php-fpm:8.1	Alpine 3.21.6	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.18
Container	php-fpm:8.2	Alpine 3.23.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.18
Container	php-fpm:8.3	Alpine 3.23.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.18
Container	php-fpm:8.4	Alpine 3.23.3	8.4.19, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.18
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.2.5	arm64	public.ecr.aws/webscale/rabbitmq:2026.18
Container	varnish	Debian 12.13	6.0.17	arm64	public.ecr.aws/webscale/varnish:2026.18

2026.17

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Fix: docker compose fails with $ in secret

When a $ character was included in a secret, invoker would naively write it to a docker compose .env file. However, docker compose interpolates variables using the $ character resulting in unwanted behavior. This change first updates the web server image to remove the relatively ancient docker-compose command; docker compose must now be used instead. Invoker is updated to use the new command and properly encodes values in the .env file using single quotes and proper escaping, correcting the reported problem.

2026.16

Mon, 01 Jan 0001 00:00:00 +0000

Changes

This release contains Webscale-internal changes and component upgrades.

Component upgrades

Component	Previous	Current
PHP	8.4.18	8.4.19
PHP	8.5.3	8.5.4

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.16
Container	php-fpm:8.2-arm64	Debian 13.3	8.2.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.16
Container	php-fpm:8.3-arm64	Debian 13.3	8.3.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.16
Container	php-fpm:8.4-arm64	Debian 13.3	8.4.19, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.16
Container	php-fpm:8.5-arm64	Debian 13.3	8.5.4, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.16
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.16
Container	php-fpm:8.2-deb	Debian 13.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.16
Container	php-fpm:8.3-deb	Debian 13.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.16
Container	php-fpm:8.4-deb	Debian 13.3	8.4.19, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.16
Container	php-fpm:8.1	Alpine 3.21.6	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.16
Container	php-fpm:8.2	Alpine 3.23.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.16
Container	php-fpm:8.3	Alpine 3.23.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.16
Container	php-fpm:8.4	Alpine 3.23.3	8.4.19, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.16
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.2.4	arm64	public.ecr.aws/webscale/rabbitmq:2026.16
Container	varnish	Debian 12.13	6.0.16	arm64	public.ecr.aws/webscale/varnish:2026.16

2026.15

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Minor Debian container image updates

For Debian-based php-fpm container images, the jq, npm, openssh-client, rsync, and supervisor packages are now included.

Bug fix for auxiliary clusters

When multiple auxiliary clusters were configured in /var/www/deploy/conf.yml and an earlier one was running no servers, later clusters would not be processed as expected. This change causes processing to continue in almost every case.

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.15
Container	php-fpm:8.2-arm64	Debian 13.3	8.2.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.15
Container	php-fpm:8.3-arm64	Debian 13.3	8.3.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.15
Container	php-fpm:8.4-arm64	Debian 13.3	8.4.18, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.15
Container	php-fpm:8.5-arm64	Debian 13.3	8.5.3, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.15
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.15
Container	php-fpm:8.2-deb	Debian 13.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.15
Container	php-fpm:8.3-deb	Debian 13.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.15
Container	php-fpm:8.4-deb	Debian 13.3	8.4.18, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.15
Container	php-fpm:8.1	Alpine 3.21.6	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.15
Container	php-fpm:8.2	Alpine 3.23.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.15
Container	php-fpm:8.3	Alpine 3.23.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.15
Container	php-fpm:8.4	Alpine 3.23.3	8.4.18, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.15
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.2.4	arm64	public.ecr.aws/webscale/rabbitmq:2026.15
Container	varnish	Debian 12.13	6.0.16	arm64	public.ecr.aws/webscale/varnish:2026.15

2026.13

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Minor Debian container image updates

PHP-FPM container images now include full vim instead of vim-tiny.
Containers are given a more user-friendly bash prompt.
Some temporary installation files used during PHP-FPM container builds are removed.

Minor VM image updates

The command configure-environment is made specific to the web server VM images builds only, since that is where it is useful.
The clinvoker which is included in every web server VM image will now process cluster metadata.

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.13
Container	php-fpm:8.2-arm64	Debian 13.3	8.2.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.13
Container	php-fpm:8.3-arm64	Debian 13.3	8.3.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.13
Container	php-fpm:8.4-arm64	Debian 13.3	8.4.18, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.13
Container	php-fpm:8.5-arm64	Debian 13.3	8.5.3, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.13
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.13
Container	php-fpm:8.2-deb	Debian 13.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.13
Container	php-fpm:8.3-deb	Debian 13.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.13
Container	php-fpm:8.4-deb	Debian 13.3	8.4.18, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.13
Container	php-fpm:8.1	Alpine 3.21.6	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.13
Container	php-fpm:8.2	Alpine 3.23.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.13
Container	php-fpm:8.3	Alpine 3.23.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.13
Container	php-fpm:8.4	Alpine 3.23.3	8.4.18, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.13
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.2.4	arm64	public.ecr.aws/webscale/rabbitmq:2026.13
Container	varnish	Debian 12.13	6.0.16	arm64	public.ecr.aws/webscale/varnish:2026.13

2026.11

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Only Webscale-internal changes are included in this release.

Component upgrades

Component	Previous	Current
RabbitMQ	4.2.3	4.2.4

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.11
Container	php-fpm:8.2-arm64	Debian 13.3	8.2.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.11
Container	php-fpm:8.3-arm64	Debian 13.3	8.3.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.11
Container	php-fpm:8.4-arm64	Debian 13.3	8.4.18, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.11
Container	php-fpm:8.5-arm64	Debian 13.3	8.5.3, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.11
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.11
Container	php-fpm:8.2-deb	Debian 13.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.11
Container	php-fpm:8.3-deb	Debian 13.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.11
Container	php-fpm:8.4-deb	Debian 13.3	8.4.18, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.11
Container	php-fpm:8.1	Alpine 3.21.6	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.11
Container	php-fpm:8.2	Alpine 3.23.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.11
Container	php-fpm:8.3	Alpine 3.23.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.11
Container	php-fpm:8.4	Alpine 3.23.3	8.4.18, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.11
Container	rabbitmq	Ubuntu 24.04.4 LTS	4.2.4	arm64	public.ecr.aws/webscale/rabbitmq:2026.11
Container	varnish	Debian 12.13	6.0.16	arm64	public.ecr.aws/webscale/varnish:2026.11

2026.10

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Fix egress-proxy not applied in containerized environments

Previously, when code requiring an egress-proxy was run as a container, the configuration given in PROXY_HOSTNAMES and PROXY_ADDRESS were ineffective. This release fixes the issue by adding additional directives to container creation so that named hosts will be directed at a specified proxy address from within a container environment.

Component upgrades

Component	Previous	Current
PHP	8.4.17	8.4.18
PHP	8.5.2	8.5.3

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
Container	php-fpm:8.1-arm64	Debian 13.2	8.1.34, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.10
Container	php-fpm:8.2-arm64	Debian 13.3	8.2.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.10
Container	php-fpm:8.3-arm64	Debian 13.3	8.3.30, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.10
Container	php-fpm:8.4-arm64	Debian 13.3	8.4.18, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.10
Container	php-fpm:8.5-arm64	Debian 13.3	8.5.3, composer-2.9.5	arm64	public.ecr.aws/webscale/php-fpm:8.5-arm64-2026.10
Container	php-fpm:8.1-deb	Debian 13.2	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.10
Container	php-fpm:8.2-deb	Debian 13.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.10
Container	php-fpm:8.3-deb	Debian 13.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.10
Container	php-fpm:8.4-deb	Debian 13.3	8.4.18, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.10
Container	php-fpm:8.1	Alpine 3.21.6	8.1.34, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.10
Container	php-fpm:8.2	Alpine 3.23.3	8.2.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.10
Container	php-fpm:8.3	Alpine 3.23.3	8.3.30, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.10
Container	php-fpm:8.4	Alpine 3.23.3	8.4.18, composer-2.9.5	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.10
Container	rabbitmq	Ubuntu 24.04.3 LTS	4.2.3	arm64	public.ecr.aws/webscale/rabbitmq:2026.10
Container	varnish	Debian 12.13	6.0.16	arm64	public.ecr.aws/webscale/varnish:2026.10

2026.9

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Fix egress-proxy mistakenly returns 421

In previous release 2026.6 , if an origin certificate was generated with uppercase characters, the egress proxy could fail to match the request hostname. This resulted in either a 421 Misdirected Request response or an unrecognized_name (112) TLS alert. The issue was caused by a case-sensitive hostname comparison when validating configured hosts. Since DNS hostnames are case-insensitive, this behavior was incorrect.

This release fixes the issue by performing hostname comparisons in a case-insensitive manner, ensuring correct request routing regardless of character casing in the origin certificate.

2026.8

Mon, 01 Jan 0001 00:00:00 +0000

Changes

There are two changes for PHP container images.

Bad configuration support

Release 2026.7 described a problem caused by upstream changes exposing bad configuration files. This release contains a workaround that allows bad configurations to continue to be used. A new configuration file x-webscale.conf adds an explicit listen = 9000 and is processed after www.conf. This effectively reverts the upstream change and avoids immediate problems for consumers of the latest image.

2026.7

Mon, 01 Jan 0001 00:00:00 +0000

Changes

PHP 8.3 and PHP 8.4 compatibility

This release resolves the issue that led to the withdrawal of PHP 8.3 and PHP 8.4 container images at version 2026.6.

Background

Upstream packaging changes moved the listen = 9000 override from zz-docker.conf to docker.conf. Because docker.conf is loaded before the default www.conf, the legacy setting listen = 127.0.0.1:9000 in www.conf took precedence, making PHP-FPM inaccessible from outside the container. This release corrects the default www.conf provided in Webscale-built images.

2026.6

Mon, 01 Jan 0001 00:00:00 +0000

Changes

New egress-proxy

An egress proxy is an optional component within a hosting environment designed to route outbound HTTP and HTTPS traffic through a fixed, static IP address. Structurally, this proxy is deployed on the NFS server and is configured for specific hostnames via the web server cluster metadata settings.

See the docs for more detail.

NOTE Container images for PHP 8.3 and PHP 8.4 are not part of this release because of apparent upstream problems.

2026.5

Mon, 01 Jan 0001 00:00:00 +0000

Changes

This release makes two changes with respect to origin certificates for applications using web-server images in a cluster:

The origin certificate authority is automatically trusted.
Server certificates for all applications are made available for use.

Origin certificate authority

The origin certificate authority is used to sign origin certificates for all applications within a control plane account. This CA is written to /usr/local/share/ca-certificates/webscale-account-ca.crt and added to the system’s trusted certificate authorities by running update-ca-certificates.

2026.4

Mon, 01 Jan 0001 00:00:00 +0000

Changes

This release addresses a regression in the nfs-server image and introduces significant enhancements to deployment orchestration and environment management.

Fix EE-1846 list-images fails

deploy-cli: Restored the command to nfs-server VM images. It was previously omitted in releases 2026.2 and 2026.3. This had no impact on existing servers.

Improvements to ComposeUp

Project names are now inferred from compose.yaml (manual override still supported).
Now runs natively within the project directory rather than using explicit –file flags.
Added support for environment specification and AWS Secrets Manager to match ContainerRun logic.
Generated environment variables are persisted to a local .env file for subsequent command use.

Deployment with managed clusters

run-deploy-and-cleanup: Now supports managed clusters via a cluster key in /var/www/deploy/conf.yml.
Maintenance Mode: Add enter_maintenance: true to conf.yml to toggle maintenance mode during the deployment lifecycle when using managed clusters.
Hook lifecycle for managed clusters:
1. App enters maintenance mode (optional)
2. “Started” hooks execute
3. New deployment activates
4. “Verified” hooks execute
5. App exits maintenance mode (optional)
Compatibility: When using managed clusters, blue-green-deploy is no longer supported and legacy conf.yml attributes are ignored.

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
VM	nfs-server	Ubuntu Minimal 24.04		amd64, arm64
VM	web-server	Ubuntu Minimal 24.04		amd64, arm64
VM	container-host	Ubuntu Minimal 24.04		arm64
Container	php-fpm:8.1-arm64	Debian 13.2	php 8.1.34, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.3
Container	php-fpm:8.2-arm64	Debian 13.2	php 8.2.30, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.3
Container	php-fpm:8.3-arm64	Debian 13.2	php 8.3.29, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.3
Container	php-fpm:8.4-arm64	Debian 13.2	php 8.4.16, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.3
Container	php-fpm:8.1-deb	Debian 13.2	php 8.1.34, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.3
Container	php-fpm:8.2-deb	Debian 13.2	php 8.2.30, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.3
Container	php-fpm:8.3-deb	Debian 13.2	php 8.3.29, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.3
Container	php-fpm:8.4-deb	Debian 13.2	php 8.4.16, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.3
Container	php-fpm:8.1	Alpine 3.21.5	php 8.1.34, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.3
Container	php-fpm:8.2	Alpine 3.23.2	php 8.2.30, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.3
Container	php-fpm:8.3	Alpine 3.23.2	php 8.3.29, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.3
Container	php-fpm:8.4	Alpine 3.23.2	php 8.4.16, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.3
Container	rabbitmq	Ubuntu 24.04.3 LTS	rabbitmq 4.2.2	arm64	public.ecr.aws/webscale/rabbitmq
Container	varnish	Debian 12.12	varnish-6.0.16	arm64	public.ecr.aws/webscale/varnish

2026.3

Mon, 01 Jan 0001 00:00:00 +0000

Changes

The web-server VM image is enhanced to use instance profile permissions with the amazon-ecr-credential-helper so that invoker will be able to automatically pull images without PrepareEcrLoginPassword. This is necessary for the new ComposeUp command, since it does not have a mechanism to pass credentials using a file reference, but can also be used with ContainerRun by omitting username and password parameters.

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
VM	nfs-server	Ubuntu Minimal 24.04		amd64, arm64
VM	web-server	Ubuntu Minimal 24.04		amd64, arm64
VM	container-host	Ubuntu Minimal 24.04		arm64
Container	php-fpm:8.1-arm64	Debian 13.2	php 8.1.34, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.3
Container	php-fpm:8.2-arm64	Debian 13.2	php 8.2.30, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.3
Container	php-fpm:8.3-arm64	Debian 13.2	php 8.3.29, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.3
Container	php-fpm:8.4-arm64	Debian 13.2	php 8.4.16, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.3
Container	php-fpm:8.1-deb	Debian 13.2	php 8.1.34, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.3
Container	php-fpm:8.2-deb	Debian 13.2	php 8.2.30, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.3
Container	php-fpm:8.3-deb	Debian 13.2	php 8.3.29, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.3
Container	php-fpm:8.4-deb	Debian 13.2	php 8.4.16, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.3
Container	php-fpm:8.1	Alpine 3.21.5	php 8.1.34, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.3
Container	php-fpm:8.2	Alpine 3.23.2	php 8.2.30, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.3
Container	php-fpm:8.3	Alpine 3.23.2	php 8.3.29, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.3
Container	php-fpm:8.4	Alpine 3.23.2	php 8.4.16, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.3
Container	rabbitmq	Ubuntu 24.04.3 LTS	rabbitmq 4.2.2	arm64	public.ecr.aws/webscale/rabbitmq
Container	varnish	Debian 12.12	varnish-6.0.16	arm64	public.ecr.aws/webscale/varnish

2026.2

Mon, 01 Jan 0001 00:00:00 +0000

Changes

The debian-based php 8.1 build is now available for the arm64 architecture.
The unzip package is now installed on all debian-based php 8.1+ container images, allowing Magento to install without requiring permissions changes.
The /var/www directory is created in debian-based php 8.1+ container images to allow it to be bind-mounted to a host directory.
The file /var/log/msmtp.log is created with owner www-data and group www-data in debian-based php 8.1+ container images to allow msmtp logging to occur without changes to customer-specific builds.
The web server VM image now includes docker compose support.
A new invoker command command.ComposeUp allows running docker compose up as part of an invoker sequence.
The package vim-tiny is used on new servers instead of the full vim.
A new command on NFS servers, label-shared-disk, sets the shared label on an unassigned NVMe device, allowing a previous shared disk to be labeled on a new instance after its attachment in AWS.
A new command on NFS servers, unmount-shared-disk, allows an existing shared disk to be unmounted so that it can be safely detached.
A new command on NFS servers, mount-shared-disk, allows mounting a volume with the shared label.
The unused invoker service has been removed from nfs-server and generic-server VM images.

Component upgrades

Component	Previous	Current
Alpine	3.22.2	3.23.2
Composer	2.9.1	2.9.3
PHP	8.1.33	8.1.34
PHP	8.2.29	8.2.30
PHP	8.3.27	8.3.29
PHP	8.4.14	8.4.16
rabbitmq	4.2.1	4.2.2

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
VM	nfs-server	Ubuntu Minimal 24.04		amd64, arm64
VM	web-server	Ubuntu Minimal 24.04		amd64, arm64
VM	container-host	Ubuntu Minimal 24.04		arm64
Container	php-fpm:8.1-arm64	Debian 13.2	php 8.1.34, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.1-arm64-2026.2
Container	php-fpm:8.2-arm64	Debian 13.2	php 8.2.30, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2026.2
Container	php-fpm:8.3-arm64	Debian 13.2	php 8.3.29, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2026.2
Container	php-fpm:8.4-arm64	Debian 13.2	php 8.4.16, composer-2.9.3	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2026.2
Container	php-fpm:8.1-deb	Debian 13.2	php 8.1.34, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2026.2
Container	php-fpm:8.2-deb	Debian 13.2	php 8.2.30, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2026.2
Container	php-fpm:8.3-deb	Debian 13.2	php 8.3.29, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2026.2
Container	php-fpm:8.4-deb	Debian 13.2	php 8.4.16, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2026.2
Container	php-fpm:8.1	Alpine 3.21.5	php 8.1.34, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.1-2026.2
Container	php-fpm:8.2	Alpine 3.23.2	php 8.2.30, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.2-2026.2
Container	php-fpm:8.3	Alpine 3.23.2	php 8.3.29, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.3-2026.2
Container	php-fpm:8.4	Alpine 3.23.2	php 8.4.16, composer-2.9.3	amd64	public.ecr.aws/webscale/php-fpm:8.4-2026.2
Container	rabbitmq	Ubuntu 24.04.3 LTS	rabbitmq 4.2.2	arm64	public.ecr.aws/webscale/rabbitmq
Container	varnish	Debian 12.12	varnish-6.0.16	arm64	public.ecr.aws/webscale/varnish

2025.44

Mon, 01 Jan 0001 00:00:00 +0000

Changes

Add container shutdown hooks
Install libzip on Debian container images. In versions 2025.33 through 2025.41, the zip extension was non-functional on Debian-13-based images
Container images based on Debian 13 have been upgraded from 13.1 to 13.2
PHP 8.4 container images are updated to php 8.4.14 from 8.4.13
PHP 8.3 container images are updated to php 8.3.27 from 8.3.26

Artifacts matrix

Image Type	Family / Variant	OS	Packages	Architectures	URI
VM	nfs-server	Ubuntu Minimal 24.04		amd64, arm64
VM	web-server	Ubuntu Minimal 24.04		amd64, arm64
VM	container-host	Ubuntu Minimal 24.04		arm64
Container	php-fpm:8.2-arm64	Debian 13.2	php 8.2.29	arm64	public.ecr.aws/webscale/php-fpm:8.2-arm64-2025.44
Container	php-fpm:8.3-arm64	Debian 13.2	php 8.3.27	arm64	public.ecr.aws/webscale/php-fpm:8.3-arm64-2025.44
Container	php-fpm:8.4-arm64	Debian 13.2	php 8.4.14	arm64	public.ecr.aws/webscale/php-fpm:8.4-arm64-2025.44
Container	php-fpm:8.1-deb	Debian 13.2	php 8.1.33	amd64	public.ecr.aws/webscale/php-fpm:8.1-deb-2025.44
Container	php-fpm:8.2-deb	Debian 13.2	php 8.2.29	amd64	public.ecr.aws/webscale/php-fpm:8.2-deb-2025.44
Container	php-fpm:8.3-deb	Debian 13.2	php 8.3.27	amd64	public.ecr.aws/webscale/php-fpm:8.3-deb-2025.44
Container	php-fpm:8.4-deb	Debian 13.2	php 8.4.14	amd64	public.ecr.aws/webscale/php-fpm:8.4-deb-2025.44
Container	php-fpm:8.1	Alpine 3.21.5	php 8.1.33	amd64	public.ecr.aws/webscale/php-fpm:8.1-2025.44
Container	php-fpm:8.2	Alpine 3.22.2	php 8.2.29	amd64	public.ecr.aws/webscale/php-fpm:8.2-2025.44
Container	php-fpm:8.3	Alpine 3.22.2	php 8.3.27	amd64	public.ecr.aws/webscale/php-fpm:8.3-2025.44
Container	php-fpm:8.4	Alpine 3.22.2	php 8.4.14	amd64	public.ecr.aws/webscale/php-fpm:8.4-2025.44
Container	rabbitmq	Ubuntu 24.04.3 LTS	rabbitmq 4.2.1	arm64	public.ecr.aws/webscale/rabbitmq
Container	varnish	Debian 12.12	varnish-6.0.16	arm64	public.ecr.aws/webscale/varnish

2025.41

Mon, 01 Jan 0001 00:00:00 +0000

Highlights

Add rabbitmq-delayed-message-exchange plugin
Alpine 3.21.4 has been updated to 3.21.5
Alpine 3.22.1 has been updated to 3.22.2

Artifacts matrix

Image Type	Family / Variant	Base / Details	Architectures
VM	`nfs-server`	Ubuntu Minimal 24.04	amd64, arm64
VM	`web-server`	Ubuntu Minimal 24.04	amd64, arm64
VM	`container-host`	Ubuntu Minimal 24.04	arm64
Container	`php-fpm` 8.1 (debian)	Debian 13 “Trixie”	amd64
Container	`php-fpm` 8.2 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.3 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.4 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.1 (alpine)	Alpine 3.21.5, php 8.1.33	amd64
Container	`php-fpm` 8.2 (alpine)	Alpine 3.22.2, php 8.2.29	amd64
Container	`php-fpm` 8.3 (alpine)	Alpine 3.22.2, php 8.3.26	amd64
Container	`php-fpm` 8.4 (alpine)	Alpine 3.22.2, php 8.4.13	amd64
Container	`rabbitmq` 4.1.4	Debian 13 “Trixie”	amd64, arm64
Container	`varnish` (entrypoint)	Varnish Cache 6.0.16	arm64

Changes

Add rabbitmq-delayed-message-exchange plugin
Began republishing latest rabbitmq with rabbitmq-delayed-message-exchange plugin installed (but not enabled).
Removed set-rabbitmq-version command as it is no longer used.

2025.38

Mon, 01 Jan 0001 00:00:00 +0000

Highlights

Corrected Varnish memory leak.
The PHP 8.3 version is updated to PHP 8.3.26
The PHP 8.4 version is updated to PHP 8.4.13

Artifacts matrix

Image Type	Family / Variant	Base / Details	Architectures
VM	`nfs-server`	Ubuntu Minimal 24.04	amd64, arm64
VM	`web-server`	Ubuntu Minimal 24.04	amd64, arm64
VM	`container-host`	Ubuntu Minimal 24.04	arm64
Container	`php-fpm` 8.1 (debian)	Debian 13 “Trixie”	amd64
Container	`php-fpm` 8.2 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.3 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.4 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.1 (alpine)	Alpine 3.21.4, php 8.1.33	amd64
Container	`php-fpm` 8.2 (alpine)	Alpine 3.22.1, php 8.2.29	amd64
Container	`php-fpm` 8.3 (alpine)	Alpine 3.22.1, php 8.3.26	amd64
Container	`php-fpm` 8.4 (alpine)	Alpine 3.22.1, php 8.4.13	amd64
Container	`varnish` (entrypoint)	Varnish Cache 6.0.16	arm64

Changes

Downgraded the Varnish Cache version to the stable version, fixing a memory leak.
Instance upgrade scripts are corrected

2025.36

Mon, 01 Jan 0001 00:00:00 +0000

Highlights

Fixed issue causing long headers to fail in the varnish cache

Artifacts matrix

Image Type	Family / Variant	Base / Details	Architectures
VM	`nfs-server`	Ubuntu Minimal 24.04	amd64, arm64
VM	`web-server`	Ubuntu Minimal 24.04	amd64, arm64
VM	`container-host`	Ubuntu Minimal 24.04	arm64
Container	`php-fpm` 8.1 (debian)	Debian 13 “Trixie”	amd64
Container	`php-fpm` 8.2 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.3 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.4 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.1 (alpine)	Alpine 3.21.4, php 8.1.33	amd64
Container	`php-fpm` 8.2 (alpine)	Alpine 3.22.1, php 8.2.29	amd64
Container	`php-fpm` 8.3 (alpine)	Alpine 3.22.1, php 8.3.25	amd64
Container	`php-fpm` 8.4 (alpine)	Alpine 3.22.1, php 8.4.12	amd64
Container	`varnish` (entrypoint)	Varnish Cache 7.6.5	arm64

Changes

Fixed issue causing long headers to fail in the varnish cache

2025.34

Mon, 01 Jan 0001 00:00:00 +0000

Highlights

Added an arm64 container image for php 8.2.

Artifacts matrix

Image Type	Family / Variant	Base / Details	Architectures
VM	`nfs-server`	Ubuntu Minimal 24.04	amd64, arm64
VM	`web-server`	Ubuntu Minimal 24.04	amd64, arm64
VM	`container-host`	Ubuntu Minimal 24.04	arm64
Container	`php-fpm` 8.1 (debian)	Debian 13 “Trixie”	amd64
Container	`php-fpm` 8.2 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.3 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.4 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.1 (alpine)	Alpine 3.21.4, php 8.1.33	amd64
Container	`php-fpm` 8.2 (alpine)	Alpine 3.22.1, php 8.2.29	amd64
Container	`php-fpm` 8.3 (alpine)	Alpine 3.22.1, php 8.3.25	amd64
Container	`php-fpm` 8.4 (alpine)	Alpine 3.22.1, php 8.4.12	amd64
Container	`varnish` (entrypoint)	Varnish 7.6.5	arm64

Changes

Added an arm64 container image for php 8.2.

2025.33

Mon, 01 Jan 0001 00:00:00 +0000

Highlights

Debian variants move to Debian 13.1 “Trixie”.
Alpine variants updated to 3.21.4 / 3.22.1 as applicable.
varnish container now auto-allocates ~80% of host RAM for caching.

Artifacts matrix

Image Type	Family / Variant	Base / Details	Architectures
VM	`nfs-server`	`rabbitmq` service available	amd64, arm64
VM	`web-server`	`libnginx-mod-http-image-filter` available	amd64, arm64
VM	`container-host`	—	arm64 only
Container	`php-fpm` 8.1 (debian)	Debian 13 “Trixie”	amd64
Container	`php-fpm` 8.2 (debian)	Debian 13 “Trixie”	amd64
Container	`php-fpm` 8.3 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.4 (debian)	Debian 13 “Trixie”	amd64, arm64
Container	`php-fpm` 8.1 (alpine)	Alpine 3.21.4	amd64
Container	`php-fpm` 8.2 (alpine)	Alpine 3.22.1	amd64
Container	`php-fpm` 8.3 (alpine)	Alpine 3.22.1	amd64
Container	`php-fpm` 8.4 (alpine)	Alpine 3.22.1	amd64
Container	`varnish` (entrypoint)	Memory ~80% of host	arm64 only

Changes

[vm:nfs-server] rabbitmq service

Removed unused rabbitmq-server package; added containerized rabbitmq.
Config: /etc/rabbitmq/rabbitmq.conf; data: /var/lib/rabbitmq.
adm users may edit config; default version 3.13.
Manage with /opt/webscale/sbin/set-rabbitmq-version 3.13 or systemd:
- sudo systemctl enable|disable|restart|start|stop rabbitmq
Reset tool: /opt/webscale/sbin/reset-rabbitmq (cleans data, restarts).

[vm:nfs-server] WMA configurability

adm users can edit /etc/webscale/wma-config.json and restart webscale-monitoring-agent for log capture.

[vm:web-server] libnginx-mod-http-image-filter

Module installed and available for configuration.

[vm:web-server] host networking mode

ContainerRun invoker supports network_mode: host.

[container:php-fpm:8.1-deb]

PHP 8.1.33; base Debian 13 “Trixie”.

[container:php-fpm:8.2-deb]

PHP 8.2.29; base Debian 13 “Trixie”.

[container:php-fpm:8.3-deb]

PHP 8.3.25; base Debian 13 “Trixie”.

[container:php-fpm:8.3-arm64]

PHP 8.3.25; base Debian 13 “Trixie”.

[container:php-fpm:8.4-deb]

PHP 8.4.12; base Debian 13 “Trixie”.

[container:php-fpm:8.4-arm64]

PHP 8.4.12; base Debian 13 “Trixie”.

[container:php-fpm:8.1 (alpine)]

PHP 8.1.33; base Alpine 3.21.4.

[container:php-fpm:8.2 (alpine)]

PHP 8.2.29; base Alpine 3.22.1.

[container:php-fpm:8.3 (alpine)]

PHP 8.3.25; base Alpine 3.22.1.

[container:php-fpm:8.4 (alpine)]

PHP 8.4.12; base Alpine 3.22.1.

[container:varnish]

Entrypoint now sizes cache to ~80% of host memory.

ASN is

Mon, 01 Jan 0001 00:00:00 +0000

This condition determines if a request originated from a specific Autonomous System Number (ASN) by performing a geolocation lookup on the requester’s IP address.

Note:

This web control condition is available on both Request and Response web controls.

Configuration

Defined ASNs: A list of one or more ASNs to match against, each a positive number with no leading zero. The condition returns true if the request’s ASN is present in this list. At least one ASN must be defined.

Measurement

To evaluate this condition, the proxy resolves the IP address from the incoming request and matches it against a geolocation database. It retrieves the ASN associated with that IP and returns true if the number exists within the Defined ASNs list. If the IP address cannot be mapped to an ASN, the condition returns false.

ASN is not

Mon, 01 Jan 0001 00:00:00 +0000

This condition determines if a request originated from an Autonomous System Number (ASN) that is not present in a specified list.

Note:

This web control condition is available on both Request and Response web controls.

Configuration

Defined ASNs: A list of one or more ASNs to exclude from matching, each a positive number with no leading zero. The condition returns true if the request’s ASN is not present in this list. At least one ASN must be defined.

Measurement

To evaluate this condition, the proxy resolves the IP address from the incoming request and performs a lookup against a geolocation database. It retrieves the ASN for the IP and returns true only if that number is absent from the Defined ASNs list. If the IP address cannot be mapped to an ASN, the condition returns true.

Cookie is set

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the Cookie request header to verify the existence of a specific cookie name. It returns true if the named cookie is present in the incoming request.

Configuration

Case sensitive: Whether to enable case sensitivity during the name comparison. When disabled, the condition performs a case-insensitive match against all cookies sent in the request.
Name: The exact name the condition must match to return true. This field is required and supports a maximum of 50 characters.

Measurement

The condition parses the Cookie header from the incoming request and evaluates the presence of the specified key.

Cookie is not set

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the Cookie request header to verify the absence of a specific cookie name. It returns true if the named cookie is missing from the incoming request.

Configuration

Case sensitive: Whether to enable case sensitivity during the name comparison. When disabled, the condition performs a case-insensitive match against all cookies sent in the request.
Name: The exact name the condition must not match to return true. This field is required and supports a maximum of 50 characters.

Measurement

The condition parses the Cookie header from the incoming request and evaluates the presence of the specified key.

Cookie value matches

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the Cookie request header to determine if the value of a specific cookie matches a regular expression . It returns true if the named cookie contains a value that matches the defined pattern.

Configuration

Case sensitive: Whether to enable case sensitivity during the name and value comparison. When disabled, the condition performs a case-insensitive match for the cookie name and evaluates the pattern against all cookies that match that name.
Cookie name: The exact name of the cookie to inspect. This field is required and supports a maximum of 50 characters.
Cookie value pattern: The RE2 regular expression used to evaluate the cookie’s value. The condition returns true if the pattern matches the value of the specified cookie. This field is required and supports a maximum of 255 characters.

Measurement

The condition extracts the specified cookie name from the Cookie request header and evaluates its value against the configured pattern.

Cookie value does not match

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the Cookie request header to determine if the value of a specific cookie does not match a regular expression . It returns true if the named cookie contains no values that match the defined pattern.

Configuration

Case sensitive: Whether to enable case sensitivity during the name and value comparison. When disabled, the condition performs a case-insensitive match for the cookie name and evaluates the pattern against all cookies that match that name.
Cookie name: The exact name of the cookie to inspect. This field is required and supports a maximum of 50 characters.
Cookie value pattern: The RE2 regular expression used to evaluate the cookie’s value. The condition returns true if the pattern does not match the value of the specified cookie. This field is required and supports a maximum of 255 characters.

Measurement

The condition extracts the specified cookie name from the Cookie request header and evaluates its value against the configured pattern.

Country of origin is

Mon, 01 Jan 0001 00:00:00 +0000

This condition determines if a request originated from a specific country by performing a geolocation lookup on the requester’s IP address.

Configuration

Selected countries: A list of one or more countries to match against. The condition returns true if the request originates from any country in this list. At least one country must be selected.

Measurement

The condition resolves the IP address from the incoming request and matches it against a geolocation database (MaxMind GeoLite2). It retrieves the ISO country code associated with that IP and returns true if the code exists within the Selected countries list. If the IP address cannot be mapped to a country, the condition returns false.

Country of origin is not

Mon, 01 Jan 0001 00:00:00 +0000

This condition determines if a request originated from a country that is not present in a specified list.

Configuration

Selected countries: A list of one or more countries to exclude from matching. The condition returns true if the request originates from any country that is not in this list. At least one country must be selected.

Measurement

The condition resolves the IP address from the incoming request and performs a lookup against a geolocation database (MaxMind GeoLite2). It retrieves the ISO country code for the IP and returns true only if that code is absent from the Selected countries list. If the IP address cannot be mapped to a country, the condition returns true.

IP address in set

Mon, 01 Jan 0001 00:00:00 +0000

This condition identifies if the requester’s IP address is in a pre-defined address set.

Configuration

Select address set: The named collection of IP addresses or CIDR ranges to match against. The condition returns true only if the requester’s IP is found within this set. This field is required.

Measurement

The condition resolves the IP address from the incoming request and evaluates it against the specified address set. The process validates the request IP against both individual addresses and CIDR notations. If the IP falls within the defined range, the condition returns true.

IP address not in set

Mon, 01 Jan 0001 00:00:00 +0000

This condition identifies if the requester’s IP address is not in a pre-defined address set.

Configuration

Select address set: The named collection of IP addresses or CIDR ranges to check against. The condition returns true only if the requester’s IP is not found within this set. This field is required.

Measurement

The condition resolves the IP address from the incoming request and evaluates it against the specified address set. The process validates the request IP against both individual addresses and CIDR notations. If the IP falls outside the defined range, the condition returns true.

IP address is allowlisted

Mon, 01 Jan 0001 00:00:00 +0000

This condition checks if the requester’s IP address is included in the Allowlist within an account’s address set. It compares the address from the request to the list of addresses managed in that section of the dashboard and returns true if a match is found.

Configuration

No further configurations are necessary for this condition. The logic is applied automatically to all addresses currently present in the Allowlist.

Deploy a new release

Mon, 01 Jan 0001 00:00:00 +0000

Follow these steps to deploy a new application release.

Prerequisites

SSH Connect access to the Essentials server
The branch/tag or build you want to deploy

1. Open SSH Connect and dev shell

Webscale CP > Accordion Menu (top left) > SSH Connect

Find the instance you want to connect to and open a terminal session by clicking on the instance link.

Then run:

dev

to jump to php-fpm container.

2. Go to the web root

All commands below are run inside this dev shell in `/var/www/html`.

cd /var/www/html

3. Update the code

Example: Git-based deployment

git fetch origin
git checkout <branch-or-tag>
git pull origin <branch-or-tag>

4. Run deployment tasks (example)

Magento

php bin/magento maintenance:enable && \
rm -rf generated/* \
var/view_preprocessed/* \
var/di/* \
var/cache/* \
var/page_cache/* \
pub/static/frontend/* \
pub/static/adminhtml/* && \
php bin/magento setup:upgrade && \
php bin/magento cache:clean && \
php bin/magento cache:flush && \
php bin/magento cache:enable && \
php bin/magento setup:di:compile && \
php -d memory_limit=2G bin/magento setup:static-content:deploy en_US -f --jobs=4 && \
php bin/magento maintenance:disable

Shopware

# Run once to install the deployment helper if it is not installed yet
composer require --no-audit shopware/deployment-helper

# Deployment commands
vendor/bin/shopware-deployment-helper run --skip-asset-install --skip-theme-compile
php bin/console database:migrate --all
php bin/console theme:compile --sync
php bin/console theme:refresh
php bin/console cache:clear
php bin/console cache:warmup

5. Verify the deployment

Load the site in a browser
Optionally check versions:

php bin/magento --version
# or
php bin/console --version

6. When to contact Webscale

Contact Webscale support if:

Deploy a new release

Mon, 01 Jan 0001 00:00:00 +0000

Webscale Pro V3 runs your application in containers with supporting services managed by Webscale. Use this guide to deploy a new release for your environment.

1. Open SSH connect and container shell

Click the three bars in the upper left site navigation > SSH connect
Find the NFS instance for your environment and open a terminal session by clicking on the instance link.

2. Switch to the deployment user

On the NFS host, switch to the deployment user (for example webscalebuilder):

IP address is not allowlisted

Mon, 01 Jan 0001 00:00:00 +0000

This condition checks if the requester’s IP address is missing from the Allowlist within an account’s address set. It compares the address from the request to the list of addresses managed in that section of the dashboard and returns true if no match is found.

Configuration

No further configurations are necessary for this condition. The logic is applied automatically to all addresses currently present in the Allowlist.

IP address is a threat

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the client IP address of an incoming request to determine if it is a known malicious source. It returns true if the address matches an entry in the threat database.

Configuration

Bot IP shield: This condition requires the Bot IP Shield add-on to be active for the application.
Setup: No further configurations are necessary for this condition. The underlying threat data is automatically updated via Webroot’s BrightCloud® IP Reputation Service every five minutes to reflect the latest global attack sources.

Measurement

The condition resolves the IP address from the incoming request and evaluates it against the threat reputation database.

IP address is not a threat

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the client IP address of an incoming request to verify it is not a known malicious source. It returns true if the address is absent from the threat database.

Configuration

Bot IP shield: This condition requires the Bot IP Shield add-on to be active for the application.
Setup: No further configurations are necessary for this condition. The underlying threat data is automatically updated via Webroot’s BrightCloud® IP Reputation Service every five minutes to reflect the latest global attack sources.

Measurement

The condition resolves the IP address from the incoming request and evaluates it against the threat reputation database.

Random

Mon, 01 Jan 0001 00:00:00 +0000

This condition triggers actions randomly based on a specified percentage of traffic.

Configuration

Percentage of traffic: A numerical value between 0 and 100 that defines the likelihood of the condition matching. A value of 0 will never return true, while a value of 100 will always return true. This field is required.

Measurement

For every incoming request, the condition evaluates a uniform random float between 0.0 and 1.0. The configured Percentage of traffic is converted to a probability (e.g. 20% becomes 0.2). The condition returns true if the generated random value is less than this probability.

Rate limit

Mon, 01 Jan 0001 00:00:00 +0000

This condition tracks the volume of requests from a specific requester and returns true if that volume exceeds a defined threshold within a set time period. Rate counters are measured centrally across all proxies serving an application, and each evaluated client ID is allocated its own counter as long as requests are received for it within the interval.

Counting only occurs if the other conditions within the web control are met. The counter set for a rate limit condition is unique to the specific web control that contains it; an identical condition in another web control maintains its own independent counter set.

Referrer is

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the Referer request header to determine if it matches a specified list of wildcard patterns. It returns true if the header value matches any of the defined patterns.

Configuration

Case sensitive: Whether to enable case sensitivity during the comparison. When disabled, the condition performs a case-insensitive match against the Referer header sent in the request.
Referrer pattern: The input field used to add new wildcard patterns. Multiple entries can be added simultaneously by separating them with a comma, a pipe (|), or a new line.
Defined patterns: The list of all active patterns for this condition. The condition returns true if the requester’s referrer matches any entry in this list.

Pattern matching

The system supports flexible wildcard entries to simplify configuration. To ensure comprehensive matching, the system automatically translates wildcard entries into optimized regular expressions during processing:

Referrer is not

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the Referer request header to determine if it does not match a specified list of wildcard patterns. It returns true if the header value matches none of the defined patterns.

Configuration

Case sensitive: Whether to enable case sensitivity during the comparison. When disabled, the condition performs a case-insensitive match against the Referer header sent in the request.
Referrer pattern: The input field used to add new wildcard patterns for exclusion. Multiple entries can be added simultaneously by separating them with a comma, a pipe (|), or a new line.
Defined patterns: The list of all active patterns for this condition. The condition returns true only if the requester’s referrer matches none of the entries in this list.

Pattern matching

Referrer is defined

Mon, 01 Jan 0001 00:00:00 +0000

This condition checks if the Referer header sent in the request matches any of the aliases associated with the application. It returns true if the requester’s referrer hostname is recognized as an application alias.

Configuration

No further configurations are necessary for this condition. The logic is applied automatically by comparing the request header against the application’s current list of aliases.

Measurement

The condition extracts the hostname from the Referer header of the incoming request. It then performs a lookup against the list of aliases configured for the application and returns true if a match is found. This is commonly used to identify traffic originating from within the same application.

Referrer is not defined

Mon, 01 Jan 0001 00:00:00 +0000

This condition checks if the Referer header sent in the request does not match any of the aliases associated with the application. It returns true if the requester’s referrer hostname is not recognized as an application alias.

Configuration

No further configurations are necessary for this condition. The logic is applied automatically by comparing the request header against the application’s current list of aliases.

Measurement

The condition extracts the hostname from the Referer header of the incoming request. It then performs a lookup against the list of aliases configured for the application and returns true if no match is found. This is commonly used to identify traffic originating from outside the application.

Request header value matches

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the value of a specified header sent in the request to determine if it matches a regular expression . It returns true if the named header contains a value that matches the defined pattern.

Configuration

Case sensitive: Whether to enable case sensitivity during the name and value comparison. When disabled, the condition performs a case-insensitive match for the header name and evaluates the pattern against all headers sent in the request that match that name.
Name: The exact name of the request header to inspect. This field is required and supports a maximum of 50 characters.
Pattern: The RE2 regular expression used to evaluate the header’s value. The condition returns true if the pattern matches the value of the specified header. This field is required and supports a maximum of 255 characters.

Measurement

The condition extracts all values for the specified header name from the incoming request and evaluates them against the configured pattern.

Magento and Shopware commands

Mon, 01 Jan 0001 00:00:00 +0000

Use the dev helper to run Magento and Shopware commands inside the application container.

1. Open SSH Connect and dev shell

In Webscale CP:

Accordion Menu (top left) > SSH Connect
Find the instance you want to connect to and open a terminal session by clicking on the instance link.

Then run:

dev

to jump to the php-fpm container.

All commands below are run inside this dev shell in `/var/www/html`.

2. Magento commands

Pattern

php bin/magento <command>

Common examples

php bin/magento cache:flush
php bin/magento indexer:reindex
php bin/magento setup:upgrade --keep-generated
php bin/magento setup:static-content:deploy en_US -f --jobs=4

3. Shopware commands

Pattern

php bin/console <command>

Common examples

php bin/console database:migrate --all
php bin/console cache:clear:all
php bin/console cache:warmup
php bin/console theme:compile

Magento and Shopware commands

Mon, 01 Jan 0001 00:00:00 +0000

Use your environment-specific shell helper to run Magento and Shopware commands inside the application container.

1. Open SSH connect and container shell

Click the three bars in the upper left site navigation > SSH connect
Find the NFS / web worker instance for your environment and open a terminal session by clicking on the instance link.

On the NFS host

Run the shell helper script:

Request header value does not match

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the value of a specified header sent in the request to determine if it does not match a regular expression . It returns true if the named header contains no values that match the defined pattern.

Configuration

Case sensitive: Whether to enable case sensitivity during the name and value comparison. When disabled, the condition performs a case-insensitive match for the header name and evaluates the pattern against all headers sent in the request that match that name.
Name: The exact name of the request header to inspect. This field is required and supports a maximum of 50 characters.
Pattern: The RE2 regular expression used to evaluate the header’s value. The condition returns true if the pattern does not match the value of the specified header. This field is required and supports a maximum of 255 characters.

Measurement

The condition extracts all values for the specified header name from the incoming request and evaluates them against the configured pattern.

Request headers match

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the incoming request to verify the presence of a specific set of header names and their corresponding values. It returns true if any defined header name is present and contains a value that matches its respective regular expression .

Configuration

Case sensitive: Whether to enable case sensitivity during the comparison. When disabled, the condition performs a case-insensitive match for both the header names and the values against the defined patterns.
Name: The exact name of the request header to inspect. Multiple headers can be added to the list.
Pattern: The RE2 regular expression used to evaluate the specific header’s value.
Defined patterns: The list of all active name-pattern pairs for this condition. The condition returns true only if the request matches every entry in this list.

Measurement

The condition resolves the specified headers from the incoming request and evaluates them against the Defined patterns as a collective set.

Request headers do not match

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the incoming request to verify if a specific set of header names and their corresponding values is absent. It returns true if any specified header name is missing or if any header value does not match its respective regular expression .

Configuration

Case sensitive: Whether to enable case sensitivity during the comparison. When disabled, the condition performs a case-insensitive match for both the header names and the values against the defined patterns.
Name: The exact name of the request header to inspect. Multiple headers can be added to the list.
Pattern: The RE2 regular expression used to evaluate the specific header’s value.
Defined patterns: The list of all active name-pattern pairs for this condition. The condition returns true if the request fails to match the entire set defined in this list.

Measurement

The condition resolves the specified headers from the incoming request and evaluates them against the Defined patterns as a collective set.

Request method is

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the HTTP method of the incoming request and returns true if it matches any of the methods in the selected list.

Configuration

Available request methods: A list of standard HTTP methods available for selection, including CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT, and TRACE.
Selected methods: The specific methods that trigger the condition. The condition returns true if the request uses any method present in this list.

Measurement

The condition extracts the method name from the incoming request and performs a lookup against the Selected methods list. It returns true as soon as a match is found. If the request method is not in the list, or if the request context is unavailable during evaluation, the condition returns false.

Request method is not

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the HTTP method of the incoming request and returns true if it does not match any of the methods in the selected list.

Configuration

Available request methods: A list of standard HTTP methods available for selection, including CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT, and TRACE.
Selected methods: The list of methods that the request must not use for the condition to return true. If a request uses a method present in this list, the condition returns false.

Measurement

The condition extracts the method name from the incoming request and compares it against the Selected methods list. It returns true only if the request method is absent from that list. If the request method is found in the list, or if the request context is unavailable, the condition returns false.

Response headers match

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the outgoing response to verify the presence of a specific set of header names and their corresponding values. It returns true if any defined header name is present and contains a value that matches its respective regular expression .

Note:

This web control condition is only available on Response web controls.

Configuration

Case sensitive: Whether to enable case sensitivity during the comparison. When disabled, the condition performs a case-insensitive match for both the header names and the values against the defined patterns.
Name: The exact name of the response header to inspect. Multiple headers can be added to the list.
Pattern: The RE2 regular expression used to evaluate the specific header’s value.
Defined patterns: The list of all active name-pattern pairs for this condition. The condition returns true only if the response matches every entry in this list.

Measurement

The condition resolves the specified headers from the outgoing response and evaluates them against the Defined patterns as a collective set.

Response headers do not match

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the outgoing response to verify if a specific set of header names and their corresponding values is absent. It returns true if any specified header name is missing or if any header value does not match its respective regular expression .

Note:

This web control condition is only available on Response web controls.

Configuration

Case sensitive: Whether to enable case sensitivity during the comparison. When disabled, the condition performs a case-insensitive match for both the header names and the values against the defined patterns.
Name: The exact name of the response header to inspect. Multiple headers can be added to the list.
Pattern: The RE2 regular expression used to evaluate the specific header’s value.
Defined patterns: The list of all active name-pattern pairs for this condition. The condition returns true if the response fails to match the entire set defined in this list.

Measurement

The condition resolves the specified headers from the outgoing response and evaluates them against the Defined patterns as a collective set.

Status code matches

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the HTTP status code returned in the response to determine if it matches a specified value or category. It returns true if the status code matches the codes or shorthand classes defined in the configuration.

Note:

This web control condition is only available on Response web controls.

Configuration

Enter status code(s): The values used to evaluate the response status code. This field supports specific codes, shorthand classes, and comma-separated lists.
- Specific codes: Enter the exact three-digit number (e.g., 200).
- Code classes: Use shorthand notation to match an entire range of codes (e.g., 2xx matches any 200-level success code).
- Multiple entries: Separate multiple values with a comma (e.g., 200,404,5xx).

Measurement

The condition extracts the numerical HTTP status code from the response and converts it into a string representation (e.g., 200 becomes "200"). It then evaluates this string against a regular expression pattern generated from your input. The condition returns true only if the status code string matches the pattern.

User agent matches

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the User-Agent header of the incoming request to determine if it matches a regular expression . It returns true if the header value satisfies any of the defined patterns.

Configuration

Case sensitive: Whether to enable case sensitivity during the comparison. When disabled, the condition performs a case-insensitive match against the User-Agent string.
Enter your pattern(s): The RE2 regular expression used to evaluate the User-Agent string. Entries should be separated by a new line.
Defined patterns: The list of all active patterns for this condition. The condition returns true if the User-Agent header matches any pattern in this list.

Measurement

The condition extracts the User-Agent header from the incoming request and evaluates it against the Defined patterns.

User agent does not match

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the User-Agent header of the incoming request to determine if it does not match a regular expression . It returns true if the header value does not satisfy any of the defined patterns.

Configuration

Case sensitive: Whether to enable case sensitivity during the comparison. When disabled, the condition performs a case-insensitive match against the User-Agent string.
Enter your pattern(s): The RE2 regular expression used to evaluate the User-Agent string. Entries should be separated by a new line.
Defined patterns: The list of all active patterns for this condition. The condition returns true only if the User-Agent header fails to match every pattern in this list.

Measurement

The condition extracts the User-Agent header from the incoming request and evaluates it against the Defined patterns.

Essentials environment reference

Mon, 01 Jan 0001 00:00:00 +0000

Lookup-style reference for Essentials environments.

1. Service management

These services can be managed with systemctl (no password) by allowed users:

Unit	Description
`rabbitmq`	Message queue
`opensearch`	Search backend
`valkey-persistent`	Persistent key-value store
`valkey-volatile`	Volatile cache
`vinyl`	Vinyl (Varnish) HTTP Cache
`php-fpm`	PHP application processes
`mysql`	MySQL database
`relay`	HTTP relay / reverse proxy

Examples

systemctl status php-fpm
systemctl restart rabbitmq
systemctl restart mysql

2. Helper commands

Available to users in the adm group:

URL matches

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the incoming request URL to determine if it matches the specified criteria. It supports a segmented wildcard interface for common URL structures or a list of regular expressions for complex matching logic.

Configuration

Case sensitive: Determines if the comparison ignores character casing. When disabled, the system performs a case-insensitive match against all URL components.
Use regular expressions: Whether to enable regular expression matching. When enabled, the input mode switches from segmented wildcard fields to a list of regex patterns.
- Disabled: Provides separate fields for Scheme, Domain, Path, and Query.
- Enabled: Provides a list of regex patterns evaluated against the full, normalized, and unescaped unicode URL string.
Defined patterns: The list of URL objects. The condition returns true if the request matches any single entry in this list.

Wildcard patterns

When Use regular expressions is disabled, you define a URL structure using these components:

URL does not match

Mon, 01 Jan 0001 00:00:00 +0000

This condition inspects the incoming request URL to determine if it does not match the specified criteria. It supports a segmented wildcard interface for common URL structures or a list of regular expressions for complex matching logic.

Configuration

Case sensitive: Determines if the comparison ignores character casing. When disabled, the system performs a case-insensitive match against all URL components.
Use regular expressions: Whether to enable regular expression matching. When enabled, the input mode switches from segmented wildcard fields to a list of regex patterns.
- Disabled: Provides separate fields for Scheme, Domain, Path, and Query.
- Enabled: Provides a list of regex patterns evaluated against the full, normalized, and unescaped unicode URL string.
Defined patterns: The list of URL objects. The condition returns true only if the request fails to match every single entry in this list.

Wildcard patterns

When Use regular expressions is disabled, you define a URL structure using these components:

Components

Mon, 01 Jan 0001 00:00:00 +0000

Data volume

To ensure data durability and architectural flexibility, all application file data in the V4 platform is allocated separately from the compute layer and stored on an independent, persistent cloud data volume.

Because this data volume exists independently of the core server instance, the compute layer can be destroyed, upgraded, or reconfigured without any risk to the underlying data.

In single-server configurations, this volume acts as the local storage for the application’s stateful files. As you scale to multi-server tiers (Standard, Pro, HA Pro), this same volume serves as a centralized file database, exported via an NFS shared filesystem to feed the horizontally autoscaling web nodes.

Essentials V4 Architecture Overview

Mon, 01 Jan 0001 00:00:00 +0000

Webscale Essentials V4 is a next-generation e-commerce hosting environment built on a Decoupled Plane Architecture. By utilizing a “Three-Plane” model, we separate administrative overhead and security processing from your core storefront, ensuring that your customer experience remains fast and resilient.

Essentials V4 architecture

1. The Design Philosophy

Decoupling for Performance

In traditional hosting, the “Control” of the server (backups, logging, analytics) happens on the same resources as the “Traffic.” If your logs grow too fast or a backup kicks off during a sale, your site slows down.

Essentials v4 Plan Specifications

Mon, 01 Jan 0001 00:00:00 +0000

Purpose: This page lists resource and feature specifications for Webscale Essentials v4 plans (S, M, L, XL).

Architecture overview

All Essentials tiers operate under a single-server architecture.
Infrastructure remains constant; resource allocation scales between S, M, L, and XL.

Plan comparison

The table below summarizes resource and major feature allocations across Essentials tiers.

Feature	Specification	S	M	L	XL
Proxy Service	Webscale Dataplane	Shared	Shared	Shared	Shared
Cloud Hosting	Managed AWS EC2	✓	✓	✓	✓
Compute	vCPU	8	16	16	32
Memory	RAM (GB)	32	32	64	64
Storage	EBS (GB)	140	140	140	140
Backups	Daily Backup Retention (days)	7	7	7	7
CDN	Amazon CloudFront	✓	✓	✓	✓
	Data Transfer Egress (GB)	50	50	50	50
Security	Web Application Firewall	Basic	Basic	Basic	Basic
	Origin Protection (App Shield)	Level 1	Level 1	Level 1	Level 1
Performance	Dynamic Site Cache (GB)	1	1	1	1
	Image Optimization	20K/mo	20K/mo	20K/mo	20K/mo
Observability	Traffic Viewer	✓	✓	✓	✓
	Traffic Viewer Retention	1 Day	1 Day	1 Day	1 Day
	Monitoring & Alerts	✓	✓	✓	✓

Notes:

Standard V4 Architecture Overview

Mon, 01 Jan 0001 00:00:00 +0000

Webscale Standard V4 is a next-generation e-commerce hosting environment built on a Decoupled Plane Architecture. By utilizing a “Three-Plane” model, we separate administrative overhead and security processing from your core storefront, ensuring that your customer experience remains fast and resilient.

1. The Design Philosophy

Decoupling for Performance

Standard v4 Plan Specifications

Mon, 01 Jan 0001 00:00:00 +0000

Purpose: This page lists resource and feature specifications for Webscale Standard v4 plans (Small, Medium, Large, X-Large).

Architecture overview

Standard v4 is built on a Decoupled Plane Architecture — a three-plane model that separates administrative overhead and security processing from the core storefront.
The Control Plane handles management tasks (backups, logging, analytics), freeing the Data Plane to dedicate 100% of its resources to serving customers.
Container orchestration uses Podman, so every service runs as an isolated, rootless process — providing self-healing stability without cross-service impact.
Unlike Essentials, Standard v4 uses a split Data Server / App Cluster model — the data server and application cluster are separate, dedicated instances that scale independently.

Plan comparison

Pro V4 Architecture Overview

Mon, 01 Jan 0001 00:00:00 +0000

Webscale Pro V4 is a next-generation e-commerce hosting environment built on a Decoupled Plane Architecture. By utilizing a “Three-Plane” model, we separate administrative overhead and security processing from your core storefront, ensuring that your customer experience remains fast and resilient.

1. The Design Philosophy

Decoupling for Performance

Pro V4 HA Architecture Overview

Mon, 01 Jan 0001 00:00:00 +0000

Webscale Pro V4 HA is a next-generation e-commerce hosting environment built on a Decoupled Plane Architecture. By utilizing a “Three-Plane” model, we separate administrative overhead and security processing from your core storefront, ensuring that your customer experience remains fast and resilient across multiple Availability Zones.

1. The Design Philosophy

Decoupling for Performance

Access

Mon, 01 Jan 0001 00:00:00 +0000

Whether you are a system administrator making configuration changes, an engineer actively debugging a node, or maintaining a CI/CD pipeline deploying code, the V4 platform provides secure, role-specific pathways for accessing your servers and the Webscale Control Plane.

Interactive User Access

For direct shell access to a target server, utilize either SSH Connect or the SSH Gateway .

When you authenticate and drop into a shell, your user session is automatically assigned to the dev group. Membership in this group grants access to run commands to maintain the environment and to update files in the /var/www directory.

Hosting V3

Mon, 01 Jan 0001 00:00:00 +0000

Webscale Pro V3

Container shell helpers

Webscale Pro V3 environments run your application in containers. To open a shell inside the application container from the NFS host, use the shell helper script:

shell

This script opens an interactive shell inside the container with the site code mounted (/var/www/html) and all the shared folders (media, var, etc).

Deployment helper scripts

The following helper scripts are available for deployments on Webscale Pro V3 environments:

Deployments

Mon, 01 Jan 0001 00:00:00 +0000

The method of deploying code depends on the stack tier used.

Essentials

Code is deployed directly to the server in the /shadow/www directory.

All others

CodeDirect is used to build and deploy a container image to a cluster. Builders can be configured to deploy code automatically on completion of a successful build, triggered externally using the Webscale API , or launched using the Webscale Control Panel.

Protecting Your Site with a Captcha

Mon, 01 Jan 0001 00:00:00 +0000

Web Controls enable you to use pre-defined security and performance rule sets. Rule sets minimize the need to discover, define, and maintain a large number of individual rules. Instead, you can create rule sets that match individual request or response conditions and execute a set of actions predefined in the Webscale Control Panel. Based on the conditions, Web Controls automatically execute a set of pre-defined actions after all conditions are met. Through Web Controls, you can create complex sequences of actions.

Configuring WMA

Mon, 01 Jan 0001 00:00:00 +0000

The Webscale Monitoring Agent (WMA) is a multipurpose program that can be installed on a VM host to facilitate communication with Webscale. It consists of three independent processes—metric monitoring, log collection , and SSH connectivity —which you can enable or disable in the configuration file.

Configuration reference

Configure the Webscale Monitoring Agent using the file /etc/webscale/wma-config.json. The Webscale control plane automatically supplies some configuration values for VMs it creates. The file is in JSON format with the following fields.

How to Customize Webscale's Autoscaling

Mon, 01 Jan 0001 00:00:00 +0000

Webscale autoscaling has a diversity of rulesets used to scale dynamically. Webscale monitors the following metrics on each of the application servers and then uses the returned value in combination with a manually defined value over time to decide if and when to scale the cluster in/out:

CPU % Utilization
I/O Wait %
Kilobytes/second
Load Average
Memory Usage %
Requests/Second

Some examples of autoscaling triggers are “Scale out when Load Average of the system has been greater than 1.25 for 1 minute”, or conversely, “Scale in when Load Average of the system has been less than 0.50 for 1 minute”.

Setup

Mon, 01 Jan 0001 00:00:00 +0000

Once you have set up your user account as described below, you will be able to access any host that is registered with SSH Connect .

To set up your user account for SSH Gateway, two pieces of information are needed:

An SSH username. This name will identify you to Webscale, and must be globally unique among Webscale users.
One or more SSH public keys. These keys are used to verify your identity.

Username

You already have an SSH username that is automatically assigned. You can see it on your profile page .

Connecting to Hosts

Mon, 01 Jan 0001 00:00:00 +0000

Once a host is registered with Webscale, it will be accessible to access over SSH using the Webscale Control Plane as long as the following requirements are met:

Webscale Monitoring Agent (WMA) is running on the host with SSH enabled.
The host’s network allows connections over port 22 from the SSH Connect middleware

On the SSH Connect page, a drawer will list the hosts that have been registered and approved. Clicking a host will initiate a connection with that host and launch a terminal window.

Log Collection

Mon, 01 Jan 0001 00:00:00 +0000

The Webscale Monitoring Agent can be configured to aggregate logs in the Webscale Control Panel for easy filtering, searching, and viewing. This is done by enabling log collection in the WMA configuration file.

Logs are aggregated as “Custom Logs” and can be viewed in the Webscale Control Panel. For more information, see Configuring and Viewing Custom Logs .

Log streams

A log stream is simply a collection of logs, aggregated for easy filtering and searching

Connecting to Hosts

Mon, 01 Jan 0001 00:00:00 +0000

Once you have set up an SSH username and public key and you have registered hosts in SSH Connect , you are ready to connect using SSH Gateway.

Examples below are written for the OpenSSH suite of command-line tools (ssh, scp, and sftp). These tools are installed by default on Mac, Linux, and Windows WSL2 .

Connection basics

When connecting to SSH Gateway, you will use a connection string that incorporates your SSH username, the name of the SSH connect host you are trying to connect to, and ssh.webscale.com, joined together with @ symbols.

Connecting with FileZilla

Mon, 01 Jan 0001 00:00:00 +0000

This guide shows you how to configure FileZilla to access your application files through the Webscale SSH Gateway.

Prerequisites

An SSH Key pair added to your Webscale user profile.
The SSH Gateway hostname - ssh.webscale.com.
Your Application HOSTNAME (e.g., myapp-staging).

Step 1: Configure General Connection Settings

Open FileZilla and navigate to File > Site Manager.
Click New Site and name it (e.g., “Webscale SSH Gateway”).
Set Protocol to SFTP - SSH File Transfer Protocol.
Set Host to your assigned gateway address (e.g., ssh.webscale.com).
Set Logon Type to Key file.

Step 2: Set the User String and Key

In the User field, you must use the specific gateway format: <your_username>@<application-hostname>

Registering Hosts

Mon, 01 Jan 0001 00:00:00 +0000

In order to access a host through SSH Connect, the host must first be registered with Webscale in the appropriate account. This is a two step process (registration followed by approval).

Registering SSH hosts

The first of these steps can be done either through the API directly or via the Webscale Monitoring Agent (WMA) running on the host with SSH enabled.

Note:

To allow SSH access through private networks the IP of the SSH Connector middleware is 3.217.2.82

SSH Connect

Mon, 01 Jan 0001 00:00:00 +0000

The Webscale Monitoring Agent can be used to facilitate easy SSH access to authorized users directly via the Webscale Control Plane. Enabling SSH Connect within WMA will register the host with the Webscale Control Plane and allow the WMA to manage Webscale users on the host.

Registration

In order to connect to a host via SSH Connect, that host must be registered with Webscale. (See SSH Connect documentation for more details on registration .) When WMA is started with ssh enabled, the WMA will attempt to register the host automatically. Upon successful registration, it will then subscribe to Webscale’s Pub/Sub API to receive any user updates for the host. This allows users to be created and removed on the host as needed by the SSH Connect facility. (See Connecting to Hosts

Building images

Mon, 01 Jan 0001 00:00:00 +0000

This guide shows you how to build a container image from source code stored in a repository using Webscale CodeDirect. The resulting image will be pushed to your configured image registry. You will also learn how to manually trigger a build and view its logs.

Prerequisites

Before you begin, ensure you have:

A source repository that contains a Dockerfile
An image registry configured under Providers

Note:

Follow the steps below to configure an AWS ECR registry:

Files and template substitution

Mon, 01 Jan 0001 00:00:00 +0000

This guide will show you how to provide files to your CodeDirect container build context. These files may include secret references to secrets securely stored with Webscale and substituted at build time.

Prerequisites

Before you begin, ensure you have:

A builder created and saved
The file you want included in your build context uploaded to Webscale Files

Add file to build context

Click the Edit icon for the Builder you would like to modify.
Expand the Build context panel and select the File archive and Path for the specific file you would like to include in the build context.
Enter a relative mount path. This is where the file will be mounted in the container. This must not start with a /.
If the file is a template file and you would like the value template references to be substituted at build time, check the Template substitution box.

How to use template substitution

If there are secure values that are not safe to store in the Webscale File directly, but need to be injected into the build context, you can utilize value templates in your file and specify that template substitution should occur during the build. This allows you to securely inject secrets into your build context.

Builders

Mon, 01 Jan 0001 00:00:00 +0000

This document describes the configuration attributes available for CodeDirect Builders. A Builder is responsible for performing builds based on the configuration provided. It defines the source context, build resources, build triggers, and target destination for building and storing a container image.

Build context

These settings define the source materials and file inputs used during the build process.

Source repository

The source repository that contains the Dockerfile from which the image will be built.

Deploy egress proxy

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Before you begin, ensure that the environment that you want to use an egress proxy in has an NFS server, and you have access to ssh to it.

1. Check the version of the NFS server

From the command line on the NFS server, run the following cat command to check the version. If the /etc/webscale/image file is not exist, the NFS is running an older version.

$ cat /etc/webscale/image
nfs-server-2026.6

If the version of the NFS server is less than 2026.6, open a support ticket to have the NFS server upgraded.

Configure web servers

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Before you begin, ensure you have setup an NFS server with egress-proxy.

1. Configure web server cluster

Configure metadata that tells the system where the proxy is located and which hostnames are proxied.

Using the control panel clusters editor, add the following metadata to your cluster configuration:

Key	Example Value	Description
`PROXY_ADDRESS`	`10.40.4.42`	The IP address of your NFS server.
`PROXY_HOSTNAMES`	`app1.com app2.com`	A space-separated set of hostnames using the proxy.

If your cluster is managed, adding metadata will cause automatic deployment. For an un-managed cluster, a manual deployment is necessary.

How to Contact Support

Mon, 01 Jan 0001 00:00:00 +0000

There are multiple ways to contact Webscale Support if you have queries or need help resolving an issue with Webscale products.

Normal support requests, such as information or changes to production systems, should be sent to support@webscalenetworks.com .
Critical requests, such as issues that are impacting your users’ ability to checkout or purchase items through your site, should be sent to critical@webscalenetworks.com .

There is also a Support Portal . Log in to the Support Portal to open new tickets or manage existing tickets.

How to Complete the Onboarding Questionnaire

Mon, 01 Jan 0001 00:00:00 +0000

A new application needs to be integrated to the Webscale network in order to be added properly. This integration is customized to each application for the best performance. To ensure the integration is done accurately, Webscale’s onboarding team must gather some information about the application. To ensure communication flows properly, some information about your organization is also needed. Webscale’s onboarding team will send you a spreadsheet to gather this information.

Webscale Go-live Process

Mon, 01 Jan 0001 00:00:00 +0000

What to expect from the go-live process

Once your application has been fully integrated into Webscale’s network and tested, it will be ready to go live. Before the final go-live process can take place, there are some checks both you and Webscale will do to ensure a smooth transition.

Before go-live

Before the site goes live, perform some testing to ensure the application works as expected. You will also work with Webscale’s team to ensure that important information and dates are agreed on to avoid any miscommunication, possible delays, or unforeseen downtime of the application.

How to Deploy Your Code on Webscale

Mon, 01 Jan 0001 00:00:00 +0000

The Webscale deployment process is a modern CI/CD pipeline, with your code being managed by source control and then deployed using Docker containers. This removes the majority of downtime associated with deploying the code for a new application or website. In the past, it was necessary to set your Magento application to maintenance mode while the build processes were run, often resulting in downtimes of at least 1-2 hours. Using this modern CI/CD pipeline not only ensures little to no downtime, but also allows you to fix any problems with the site much more quickly.

Webscale Application Architecture

Mon, 01 Jan 0001 00:00:00 +0000

Webscale manages (and optionally, hosts) applications running on hyperscale cloud providers with its established architecture guidelines. This document provides insight into the Application architecture managed by Webscale.

We deploy the code to a centralized server where it’s then horizonally scaled across multiple servers based on configuration set by the customer. This collection of servers is also known as an Application Cluster. Several commands help manage this sync process and the symbolic links that allow all application servers to log to the centralized server, also called a dataserver.

The Webscale Control Panel Dashboard

Mon, 01 Jan 0001 00:00:00 +0000

The dashboard is the home page of the Webscale Control Panel and is displayed when you first log in. The dashboard contains links to other important areas of the control panel and includes some essential information about your Webscale account and applications.

The main navigation bar contains a dropdown menu at the name of the current account - this allows you to choose from the accounts you have with Webscale if you have more than one. Next to this is the gear, which is where you will find the following links:

How to Create Roles and Invite Users

Mon, 01 Jan 0001 00:00:00 +0000

After completing the Webscale onboarding process, you will have your own Webscale account. Access to this account is controlled via roles. By default, your new account includes a few important roles to help you get started: Editor and Reader. In general, editors will have access to view, create, modify and destroy resources in the account while readers will only be able to view those resources. A user’s access in the account is determined by the roles to which they have accepted invitations. This guide details how to create your own custom roles and how to invite users to them.

How to Create Groups and Invite Users

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Webscale groups consolidate multiple roles so they can be managed as one entity. Generally, the encapsulated roles are expected to be related in some way or share similar responsibilities, though this is not a requirement.

Create a group


	1. Login to the Webscale Control Panel and click the three bars in the upper left. Select Groups from the menu.
	2. Here you view existing groups on the Groups page in the Control Panel.
	3. Clicking Roles lists the roles encapsulated by the group.
	4. Clicking Users lists the users invited to assume the group and whether they have accepted, declined or vacated that invitation.
	5. Click Group in the lower left part of the page to create a new group. In the wizard that appears, you’ll be walked through the steps to configure the group.
	6. It is recommended to use an informative name and description to ease the management of multiple groups.
	7. Select the roles the group should encapsulate. Via the Control Panel, only roles configured in the current account will be listed. Via the API, any role to which the user has access can be configured.
	8. Lastly, invite users to the group. Confirm the changes you’ve made, then click Save to save the changes. This action creates the group and sends invitations to any users invited to the group. If the user invited does not exist, this action will send an email to the user with a link to sign up. Once they complete sign-up (create a password) and log in, they will be taken to the User Profile and can accept the group.

Invite users to an existing group


	1. Login to the Webscale Control Panel and click the three bars in the upper left. Select Groups from the menu.
	2. On this page you see existing groups. To invite a user to the group, click the Users button for the group, then click the pencil in the upper right of the expanded panel.
	3. Enter the user’s email address, and click the + button. A comma-separated list of email addresses can be inputted at a single time. This will send invitations to all the added email addresses.
	4. The user receives an email from Webscale with a link to the User Profile , where they can accept the role. If the user invited does not exist, this action will send an email to the user with a link to sign up. Once they complete sign-up (create a password) and log in, they will be taken to the User Profile and can accept the group.
	5. In the User Profile the user can manage their password and their multi-factor authentication settings. The user will also see some information about their user account, such as: Any existing roles and groups to which the user belongs. The user’s name. The user’s email address. Webscale API access keys. Users can leave a group. In such an event, they must be re-invited to the group if they wish to regain access. If the role the user was invited to does not permit Webscale Control Panel access, the user will only have access to their User Profile. This may be the case if you only want the role to apply to the Webscale Secure Access web control, for example.

How to View Users and Remove Their Access

Mon, 01 Jan 0001 00:00:00 +0000

Access to Webscale accounts are controlled via Roles and Groups . For users with admin type permissions, the Users page facilitates easy viewing of the users that have a role or group defined in an account. In addition, the Users page allows easy resetting of a user’s MFA, removal of all a user’s access to an account, and revoking an individual invitation from a role or group.

The table on the Users page displays information about each user: their email which functions as their unique identifier, their name, when they were created, and the last time they changed their password. Click on a user’s row to display the roles and groups that user has been invited to as as well as when the invite was sent and accepted.

Working with Labelers

Mon, 01 Jan 0001 00:00:00 +0000

A labeler applies a label to all future logs that match the labeler’s configuration. These labels can be a powerful tool in analyzing logs. For example, you can create a labeler using a complex filter query, allowing you to simply search for that label in the traffic viewer and refine the query as needed.

Note:

These labels differ from labels applied using Web Controls in that the labels are applied to the logs just before they are written, instead of when the request is received.

Configuring General Application Settings

Mon, 01 Jan 0001 00:00:00 +0000

The General page enables you to modify basic settings for an application, including its name, labels, default hostname, and aliases.

Access the General page

To access general application settings

Click the three vertical dots menu icon on the upper right corner of the application box and select Edit.

-or-

On your application page, click the Actions menu icon and select Edit.

The General page displays.

Managing Maintenance Mode

Mon, 01 Jan 0001 00:00:00 +0000

Maintenance mode provides the ability to temporarily replace your application with a simple microsite in order to perform maintenance or otherwise make changes to your site. A microsite displays to inform users that the site is in maintenance mode and temporarily unavailable.

Microsites are standalone websites that display for your application. A microsite package file (also known as a microsite file) contains the files for one or more microsites. There are five microsites that can display for standard usages, including maintenance mode. For more information about microsites, see Working with Microsites .

Working with Address Sets

Mon, 01 Jan 0001 00:00:00 +0000

An address set is a list of IP addresses that Webscale manages and uses in features like Trusted Proxies , Traffic Viewer , Web Controls , and Allowed and Blocked lists. For instance, you must select address sets for the trusted proxies to enable and use the Trusted Proxies feature.

All applications for the account can use the address sets. The Address sets tab of the account settings page enables you to work with address sets through the Webscale Control Panel page. Each address set is listed in the table as a separate entry.

Working with Files

Mon, 01 Jan 0001 00:00:00 +0000

Through the Files page, you can work with files. After you upload files for your account, they are available for all of the account applications.

The CloudEDGE Workers and microsite features both use uploaded files. Information specific to working with handler and microsite files, including previewing files, is located in Working with CloudEDGE Handlers and Workers and Working with Microsites .

CloudEDGE Workers enables you to easily extend your application’s functionality through custom JavaScript without changing your application code. For more information about the CloudEDGE Workers feature, see CloudEDGE Workers Overview .

How to View Events

Mon, 01 Jan 0001 00:00:00 +0000

The Events Viewer will show recent events that have taken place for your application on the platform, and some information about those events.

Note:

The events displayed will differ depending upon the privileges of the Control Panel user role .

View Events

To view events, log in to the Webscale Control Panel and click the three bars on the upper left, then select Events from the menu. From here you will see a list of events on the left. To see more information about a specific event, click the event in the list. The right pane will show the information, including the following:

Events Logs Attributes

Mon, 01 Jan 0001 00:00:00 +0000

The account Events page enables you to view events information for all account applications. The Events section on the Webscale Control Panel page displays recent events for the applications.

You can also view events for a specific application through the application’s Events page. The Events section on the application dashboard displays recent application events.

For more information on viewing events, see Viewing Events .

The following table provides Events logs attribute information. You can view the name, display name, and a description for each attribute.

How to Enable Notifications

Mon, 01 Jan 0001 00:00:00 +0000

You can subscribe to alert notifications in the Webscale Control Panel. These notifications provide real-time alerts to various conditions that affect site performance. Find these alert settings in the Alert Notifications tab under Account Settings.

Configure Notifications


	1. Log in to the Webscale Control Panel and click the gear on the upper right, then select Account Settings from the menu.
	2. Click Alert Notifications from the top menu bar to view the cluster information.
	3. You have the option to subscribe to all alerts or just specific alerts. To subscribe to all alerts, enter the email address you want to receive the alerts in the email address box in the All Alerts section. Click the Add Email button, then click the Save button.
	4. If you only want to subscribe to specific alerts, enter the email address you want to receive the alerts in the email address box in the appropriate section. For example, enter your email address in the Application Down section to only receive notifications for Application Down events.
	5. Any alert notifications that you haven’t configured show minimized on the list. To enable these alerts, click on the alert name, then enter your email address and click the Save button.
	6. To disable alert notifications, click the Delete button for the email address you wish to remove from notifications. You should not delete any `webscalenetworks` or `victorops` email addresses for any alerts as the Webscale support team uses these.

Viewing Reports

Mon, 01 Jan 0001 00:00:00 +0000

You can access reports on your system through the main Reports page, including usage and performance information.

The Outbound data transfer report presents a consolidated view of the amount of outbound data transferred for your account and applications. Outbound data transfer, measured in gigabytes (GB), consists of responses from Webscale to site user requests.

(The data transfer monitor uses the same information as this report. It tracks data transfer usage for all account applications. You can configure it to generate events when it detects activity that matches or exceeds conditions that you define. This monitor can send email notifications when the events occur.)

Working with Providers

Mon, 01 Jan 0001 00:00:00 +0000

Webscale uses external services, such as cloud providers and Docker registries, to provide functionality and implement features. To connect to an external service, you must create a provider. External services require authentication to access them. Each provider has a set of credentials to authenticate to the corresponding service.

You can define providers for your account through the Webscale Control Panel. After you create a provider, you can use them in blueprints for data planes and clusters. You can also use providers to implement features such as Webscale CDN.

Creating Clusters

Mon, 01 Jan 0001 00:00:00 +0000

A cluster is a collection of servers or containers that can be used to scale an application horizontally. Webscale supports both Virtual Machine (VM) based clusters as well as Amazon Elastic Kubernetes Service (EKS) clusters. In order to create a cluster, you must first add your provider via the Providers tab. For more information, check out Working with Providers .

Cluster types

Webscale supports two different types of clusters: VM and Kubernetes.

VM Clusters

Mon, 01 Jan 0001 00:00:00 +0000

A Virtual Machine (VM) cluster is a server based cluster that scales horizontally in response to increasing or decreasing traffic. VM Clusters are composed of cluster servers which are created based on one or more user provided server blueprints.

Prerequisites

In order to create a VM cluster, you must first add your Provider via the Providers tab. For more information, check out Working with Providers . Creating a provider will automatically create the VM service necessary to create VM clusters.

Kubernetes Clusters

Mon, 01 Jan 0001 00:00:00 +0000

A Kubernetes targeted cluster is a container based cluster that scales horizontally in response to increasing or decreasing traffic. The cluster is composed of up to two instances defined by blueprints: a web-server instance and optionally, a cron instance. The web-server instance consists of Pods managed by a Kubernetes Horizontal Pod Autoscaler and routable through a Service in the Kubernetes cluster. Users can specify scaling conditions, an init job, init container, and other container specific parameters when setting up their web-server blueprint. The optional cron instance consists only of a single Pod and any ConfigMaps necessary for successful cron execution.

How to Enable Application Uptime Monitoring

Mon, 01 Jan 0001 00:00:00 +0000

Webscale allows you to enable uptime and error rate monitoring for your application. You can either enable passive monitoring or active monitoring.

To follow these instructions, log into Webscale Control Panel and click the three vertical dots menu of the application box.

On the menu that appears, click Edit. Then, click the Monitoring button on the left menu.

Monitoring modes

None

No monitoring of client error rate or application up/down state is done. Note that all other alerts are independent of this setting.

Testing Your Application

Mon, 01 Jan 0001 00:00:00 +0000

Through the optional application testing feature, you can perform load tests for your application. The test results can help you find possible problems like performance bottlenecks. You can use this feature to test your application after making changes to it.

The application testing feature provides the means to run load tests. Webscale or your developer will create customized tests to meet your needs. The test design specifies the application test paths, what to test, and test methodology.

Configuring Application Shielding

Mon, 01 Jan 0001 00:00:00 +0000

Application shielding protects application servers from unauthorized traffic. Shields are implemented by utilizing cloud provider networking capabilities, eg. firewalls in Google or security groups in AWS. More information about application shielding is available on the Application Shielding reference page .

Configuring a shield will update inbound/ingress rules to permit http and https traffic from Webscale control and proxy servers as well as from whitelisted addresses configured for the application. Traffic from other addresses may be dropped once the shield is selected unless explicitly allowed by higher priority rules.

Webscale CLI Reference Guide

Mon, 01 Jan 0001 00:00:00 +0000

The webscale-cli command is the Swiss army knife of Webscale commands. Use it to fix permissions, restart servers, check the health of the cluster, and many other things.

Note:

The command usage is: sudo webscale-cli <some-command>

Some of the most common uses of this command are to check server health, gather information about clusters, or fix permissions on the filesystem. Note that you must use sudo with this command, or it fails.

Managed Deployments

Mon, 01 Jan 0001 00:00:00 +0000

Managed deployments allow for new cluster configurations to be deployed systematically and efficiently following the blue-green release model. Deployment configurations are grouped in the UI in reverse chronological order so users can easily see their deployment configuration history as well as the state of their current deployment.

Enabling Managed Deployments

Note:

Managed deployments are an optional feature that must be enabled per account through an entitlement. Contact Webscale Support if you do not have access to this feature and would like it.

Working with Microsites

Mon, 01 Jan 0001 00:00:00 +0000

A microsite is a standalone website that displays for your application. A microsite package file (also known as a microsite file) contains the content files for one or more microsites. At a minimum, each microsite will consist of a single html file.

Additionally, a microsite can include assets, such as images or CSS files and files for additional pages. The Files page enables you to upload and work with microsite package files. After you have uploaded microsite files for your account, they are available for all account applications.

Configuring Trusted Proxies

Mon, 01 Jan 0001 00:00:00 +0000

The Trusted Proxies feature enables you to designate proxy IP addresses for providers that you trust. You can add trusted proxies through the Webscale Control Panel. To use this feature, select address sets with provider IP addresses and choose to enable it.

Trusted proxies can add the X-Forwarded-For header to HTTP requests that they send to your Webscale applications. When Webscale receives a message from a trusted proxy, it will use the encoded client IP address as the request address.

Logs on Webscale

Mon, 01 Jan 0001 00:00:00 +0000

Log files are plain text files with messages written to them by a server’s operating system and other installed software. These messages help explain the current state of the system and trace any changes made to the system. For instance, error logs contain any error messages the system has encountered, while access logs contain information about when specific files or programs were accessed.

The logs maintained by Webscale include:

Audit logs
Server access logs
Web server access and error logs
Custom logs (Magento, Wordpress, WooCommerce, etc)
MySQL logs (if applicable)
Event logs
Content Security Policy logs
Logs for all services that make up the operating system

In some Webscale environments, your application will send its logs to a data server. Once these logs are sent they are retained on that data server, and this is the central log server for your entire environment.

Configuring and Flushing the Site Cache

Mon, 01 Jan 0001 00:00:00 +0000

If you have enabled the Dynamic Site Cache feature, Webscale caches static web pages and resources, such as media assets, scripts, and API responses, according to rules that define how and when your application servers cache content. If the Site Cache contains the content, Webscale directly delivers cached pages and resources to site users, bypassing your web servers.

You can configure Site Cache rules so Webscale only caches content that can be served to any site user and the resources have a low Time-to-Live (TTL) value. Webscale automatically removes cookies from responses that it sends from the cache.

Configuring and Viewing Custom Logs

Mon, 01 Jan 0001 00:00:00 +0000

Webscale has developed a log monitoring agent called the Webscale Monitoring Agent (WMA) that can be configured to send application or any application related logs (referred to as Custom Logs) to the Webscale Traffic Viewer and the Webscale Logs Viewer for viewing, debugging, and troubleshooting.

The WMA logging service can be configured through the Cluster blueprint editor for both VM and Kubernetes based cluster deployments.

The WMA will monitor specified files for write events and will send the contents of those logs to Webscale. These logs can then be filtered and viewed in the Webscale Control Panel via the Traffic Viewer and Logs Viewer.

Configuring Rate Limiting

Mon, 01 Jan 0001 00:00:00 +0000

Rate limiting enables you to control access to a page on your website, using Web Controls. For rate limiting, the configuration of Web Controls creates varying experiences for site visitors depending upon criteria that you specify.

Working with Monitors

Mon, 01 Jan 0001 00:00:00 +0000

The monitoring feature enables Webscale to track potential problems or system changes. Monitors generate events when they detect activity that matches or exceeds conditions that you define. They can send email notifications when these events occur.

For example, you can create monitors that notify you about website security violations or when the data transfer for outbound traffic exceeds a threshold.

The monitor type determines the activities that monitors can track.

How to View Webscale Application Server Information

Mon, 01 Jan 0001 00:00:00 +0000

The Webscale Control Panel displays application server information and status. In the control panel you can find out how many servers are currently active, what are those servers’ IPs, if any additional servers are being scaled, and more.

View Application Server Information


	From the Webscale Control Panel’s main page (called the Dashboard , each application section shows the following: Server status and uptime Scaling for the last 24 hours The number of servers
	Click the Zoom button to see more details for the specific application.
	On the application page, the Application Diagram section shows the currently active servers, as well as any servers currently scaling in or out. A list of the IP address for each server is below the server icon. Hover your mouse over the server icon for additional info.
	The Performance section shows the following for the timeframe you have selected: Response time in seconds Responses per second Server count Data transfer in megabytes
	The Events section shows a running log of all events, including scaling in and scaling out events. Click the Zoom button for more details and calendar options.

Using Traffic Viewer

Mon, 01 Jan 0001 00:00:00 +0000

Traffic Viewer presents logs information about your application network traffic. You can drill down to specific logs based on logs type and date range. Additionally, you can filter results based on specific attribute values. The viewer for Traffic Viewer functions as the wrapper for all four types: CDN, CSP reports, Pageview, and Proxy (also known as the Traffic viewer logs type). As such, it displays views for them through a dedicated page for each logs type.

Graphing Metrics

Mon, 01 Jan 0001 00:00:00 +0000

The Traffic Viewer graph provides a visualization of your application traffic. While the Records table offers a granular, line-by-line view of individual log records, the graph transforms this data into aggregated metric series. By mapping these metrics over a specified time range, you can quickly identify traffic spikes, service dips, or unusual patterns that warrant further investigation.

Traffic Viewer overview

To graph a single metric, select your log type and metric preference from the Type and Metric dropdowns in the Records table filter bar. For more advanced analysis—such as overlaying multiple metrics, comparing different log types, or applying unique filters to individual series—click the Configure icon in the top-right corner of the graph.

Building Traffic Viewer Filters

Mon, 01 Jan 0001 00:00:00 +0000

You can use the Traffic Viewer Filter field to create filters for the logs search query. Along with the time range and logs type option, the filter defines the query.

The filter builder enables you to easily navigate records to find specific logs interactions. There are many ways to build filters; some methods depend on how you are viewing logs (records or groups view). For information on the records and groups views as well as how to use Traffic Viewer, see Using Traffic Viewer .

CDN Logs Attributes

Mon, 01 Jan 0001 00:00:00 +0000

The Traffic Viewer page in the Webscale Control Panel enables you to view CDN logs information for an application within a specified time period. For more information on accessing Traffic Viewer, see Access Traffic Viewer .

The following table provides CDN logs attribute information. You can view the name, display name, alias, and a description for each attribute.

CDN logs attributes

Name	Display Name	Alias	Description
arrival	Arrival	arrival	ISO 8601-formatted date for when the request arrived at the CDN service
aws_edge_error_type	AWS edge error	aws_edge_error aws_edge_error_type	Error that occurred while the CDN service processed the request
aws_edge_result_type	AWS edge result	aws_edge_result aws_edge_result_type	How the CDN service classified the response
bytes_in	Bytes in	bytes_in	Bytes that the CDN service received, including request line and headers
bytes_out	Bytes out	bytes_out	Bytes that the CDN service sent out, including response headers
completed	Completed	completed	ISO 8601-formatted date when processing the request was completed
content_length	Content length	content_length	Contents of the Content-Length response header
edge_location	AWS edge location	aws_edge_location edge_location	Three-letter IATA code for an airport near the edge node that received the request
elapsed	Elapsed	elapsed	Interval between when the CDN service received the request and sent the complete request
peer_address	Peer address	peer_address	IP address of the immediate peer connecting to the proxy. If the peer is a trusted proxy, the remote IP address of the user agent that made the request is used.
range_end	Range end	range_end	End value of the Content-Range response header
range_start	Range start	range_start	Start value of the Content-Range response header
referrer	Referrer	referrer	Contents of the Referer request header
request_address	Request address	request_address	Remote IP address of the user agent that made the request
host	Request host	host request_host	Contents of the Host request header
request_id	Request ID	request_id	Unique ID for each request that the CDN service serves
request_method	Request method	request_method	HTTP request method
request_path	Request path	request_path	Virtual path of the request (latter portion of the request URL separated by backslashes after the main website name)
request_port	Request port	request_port	Port number that received the request
protocol	Request protocol	protocol request_protocol	HTTP protocol version
request_query	Request query	request_query	URL request query parameters (located in the latter sections of the request URL)
content_type	Response content type	content_type response_content_type	Contents of the Content-Type response header
response_status_code	Status code	response_status_code status_code	Response status code that indicates if a specific request has successfully completed
tls_cipher	TLS cipher	tls_cipher	Encryption algorithms for transport layer security
tls_protocol	TLS version	tls_version tls_protocol	Highest version of the transport layer security protocol that the client supported
time_to_first_byte	TTFB	ttfb time_to_first_byte	Interval between when the browser sent the request and received the first byte of the response
useragent	User agent	useragent user_agent	Contents of the User-Agent request header
useragent_device	User agent device	useragent_device user_agent_device	Device type used to make the request (e.g., smartphone, desktop, etc.)
useragent_name	Browser	browser useragent_name user_agent_name	Browser type used to make the request (e.g., Google Chrome, Safari, etc.)
useragent_os	User agent OS	useragent_os user_agent_os	Operating system type used to make the request (e.g., Android, Mac, etc.)
x_forwarded_for	X-Forwarded-For	x_forwarded_for	Contents of the X-Forwarded-For request header

CSP Reports Attributes

Mon, 01 Jan 0001 00:00:00 +0000

The Traffic Viewer page of the Webscale Control Panel enables you to view CSP reports information for an application within a specified time period. For more information on accessing Traffic Viewer, see Access Traffic Viewer .

The following table provides CSP reports attribute information. You can view the name, display name, alias, and a description for each attribute.

CSP reports attributes

Name	Display Name	Alias	Description
arrival	Arrival	arrival	ISO 8601-formatted date when the request arrived at the Webscale proxy
blocked_uri	Blocked URI	blocked_uri	URI of the resource that the Content Security policy blocked from loading. If the blocked URI has a different origin than the document URI, the blocked URI is truncated to contain just the scheme, host, and port.
country	Country	country	Two-letter ISO 3166-1 country code for the origin of a request
disposition	Disposition	disposition	“enforce” if the Content-Security-Policy response header was used. “report” if the Content-Security-Policy-Report-Only response header was used.
document_uri	Document URI	document_uri	URI of the document in which the violation occurred
effective_directive	Effective directive	effective_directive	Directive whose enforcement caused the violation
host	Request host	host request_host	URL of the application that was requested
original_policy	Original policy	original_policy	Original policy as specified by the Content-Security-Policy response header
peer_address	Peer address	peer_address	IP address of the immediate peer that reported the violation
referrer	Referrer	referrer	Referrer of the document in which the violation occurred
request_address	Request address	request_address	Remote IP address of the user agent that made the request
script_sample	Script sample	script_sample	First 40 characters of the inline script, event handler, or style that caused the violation
session_id	Session ID	session_id	ID of the Webscale session that attempted to load the resource
status_code	Status code	response_status_code status_code	Response status code that indicates the response to a specific request
useragent	User agent	useragent user_agent	Contents of the User-Agent request header
violated_directive	Violated directive	violated_directive	Name of the violated policy section

Pageview Logs Attributes

Mon, 01 Jan 0001 00:00:00 +0000

The Traffic Viewer page of the Webscale Control Panel enables you to view Pageview logs information for an application within a specified time period. For more information on accessing Traffic Viewer, see Access Traffic Viewer .

The following table provides Pageview logs attribute information. You can view the name, display name, alias, and a description for each attribute.

Pageview logs attributes

Name	Display Name	Alias	Description
arrival	Arrival	arrival	ISO 8601-formatted date when the request arrived at the Webscale proxy
completed	Completed	completed	ISO 8601-formatted date when processing the request was completed
country	Country	country	Two-letter ISO 3166-1 country code for the origin of the request
dom_content_loaded	DOM content loaded	dom_content_loaded	Interval between when navigation started and the page loaded the DOM
dom_interactive	DOM interactive	dom_interactive	Interval between when navigation started and the page was ready for user interaction
elapsed	Elapsed	elapsed	Interval between when the proxy received the request and sent out the complete response
first_contentful_paint	First contentful paint	first_contentful_paint	Interval between when navigation started and the first element on the page rendered
labels	Labels	labels	List of user-defined labels used to track traffic with the Add Labels web control action
largest_contentful_paint	Largest contentful paint	largest_contentful_paint	Interval between when navigation started and the largest element on the page rendered
load_id	Load ID	load_id	Unique ID that identified a user-initiated pageload. All resource requests shared the ID to render the page.
peer_address	Peer address	peer_address	IP address of the immediate peer connecting to the proxy. If the peer is a trusted proxy, the remote IP address of the user agent that made the request is used.
ready_state_interactive	Ready state interactive	ready_state_interactive	Time taken for the loading state of the browser to become interactive. It is interactive when the browser document has finished loading and has been parsed but sub-resources such as scripts, images, stylesheets and frames are still loading.
request_address	Request address	request_address	Remote IP address of the user agent that made the request
request_host	Request host	host request_host	Contents of the Host request header
request_path	Request path	request_path	Virtual path of the request (latter portion of the request URL separated by backslashes after the main website name)
request_port	Request port	request_port	Port number that received the request
request_protocol	Request protocol	protocol request_protocol	HTTP protocol version
request_query	Request query	request_query	URL request query parameters (located in the latter sections of the request URL)
request_url	Request URL	request_url	String with the host, scheme, path, and query parameters for the request
session_id	Session ID	session_id	Unique number that a server assigned to a specific user for a session
threat	Threat	threat	“y” if the IP address was a potential attacker. “n” otherwise.
time_to_first_byte	TTFB	ttfb time_to_first_byte	Interval between when the browser sent the request and received the first byte of the response
tls_cipher	TLS cipher	tls_cipher	Encryption algorithms for the transport layer security
tls_version	TLS version	tls_version tls_protocol	Highest version of the transport layer security protocol that the client supported
useragent	User agent	useragent user_agent	Contents of the User-Agent request header
useragent_device	User agent device	useragent_device user_agent_device	Device type used to make the request (e.g., smartphone, desktop, etc.)
useragent_name	Browser	browser useragent_name user_agent_name	Browser type used to make the request (e.g., Google Chrome, Safari, etc.)
useragent_os	User agent OS	useragent_os user_agent_os	Operating system type used to make the request (e.g., Android, Mac, etc.)

Proxy Logs Attributes

Mon, 01 Jan 0001 00:00:00 +0000

The Traffic Viewer page of the Webscale Control Panel enables you to view Proxy logs attribute information for an application within a specified time period. For more information on accessing Traffic Viewer, see Access Traffic Viewer .

The following Proxy logs attributes table provides Proxy logs attribute information. You can view the name, display name, aliases, and a description for each attribute. Specific codes, presented in the Cache source codes and Delivery status codes tables, are returned for the cache_source and delivery_status proxy logs attributes.

CloudEDGE CDN Overview

Mon, 01 Jan 0001 00:00:00 +0000

Content Delivery Networks (CDN) enhance a website’s performance and page load time by caching assets across multiple edge locations in the cloud. (The edge is the network location closest to where the user’s browser connects to Webscale.) These locations are geographically distributed for a quicker delivery of static assets and cacheable API content to users from the location that is closest to them.

Assets include static content, such as images, CSS, and JavaScript as well as media content like videos. When a user wants to access assets, their web browser generates an HTTP request. If the assets are cached and available, the CDN serves them directly, forgoing a request to the application servers and reducing response time.

Introduction to Configuring CloudEDGE CDN

Mon, 01 Jan 0001 00:00:00 +0000

CloudEDGE CDN (also known as Webscale CDN) offloads cachable assets from web servers to CDN providers. In addition, it provides advanced security and near real-time logging to track performance and ensure Webscale CDN is running smoothly.

Configuring Webscale CDN for an application consists of the following stages.

Fulfill pre-requisites
[Enable Webscale CDN](](/docs/how-tos/CloudEDGE/cdn-config-finalsteps/#enable-webscale-cdn)
[Configure accelerators](](/docs/how-tos/CloudEDGE/cdn-config-finalsteps/#configure-accelerators)
[Set up caching policies](](/docs/how-tos/CloudEDGE/cdn-config-finalsteps/#set-up-caching-policies)
[Validation](](/docs/how-tos/CloudEDGE/cdn-config-prereqs/#pre-requisite-validation)

If you change your mind about enabling Webscale CDN, you can roll back the configuration.

Pre-requisites for Configuring CloudEDGE CDN

Mon, 01 Jan 0001 00:00:00 +0000

Before enabling CloudEDGE CDN (also known as Webscale CDN) ensure that you meet the following pre-requisites in the order presented below.

Note:

While the Webscale Provisioning team has most likely already handled some of these tasks, verify that your system meets the pre-requisites.

Set up DNS

Create aliases for all domains under the application. For information on how to view, add, and delete application aliases, see [Application aliases](](/docs/how-tos/general/app-general-settings/#application-aliases) in Configuring General Application Settings .

Note:

For aliases that you would like to include in your CloudFront CDN installation, select the corresponding CDN checkbox for each alias. For aliases exclusive to Webscale, make sure the corresponding checkboxes are cleared.

Completing CloudEDGE CDN Configuration

Mon, 01 Jan 0001 00:00:00 +0000

After you fulfill the configuration pre-requisites, complete the final steps for configuring CloudEDGE CDN (also known as Webscale CDN).

The final steps consist of the following tasks.

If you decide to roll back Webscale CDN, doing so is a simple process.

Enable Webscale CDN

You can enable Webscale CDN through the CDN page for the application. The CDN delivery options determine how Webscale will use CDN.

Configuring CloudEDGE CDN Caching Policies

Mon, 01 Jan 0001 00:00:00 +0000

After you enable CloudEDGE CDN (also known as Webscale CDN) for your application, you can use the Webscale Control Panel to configure caching policies through CDN controls. These policies define how Webscale CDN processes requests and responses, including what happens when Webscale CDN forwards requests to your application.

CDN controls allow you to run custom JavaScript at key points of the traffic pipeline via the CloudEDGE Workers feature, including as traffic transits to your application and after your application generates a response. This allows for easy extension to the capability of your application without changing your deployed code. For more information about the CloudEDGE Workers feature, see CloudEDGE Workers Overview .

CloudEDGE Workers Overview

Mon, 01 Jan 0001 00:00:00 +0000

The Webscale CloudEDGE platform is a distributed cloud computing platform. It enables fast, personalized commerce and application content delivery to the edge. (The edge is the network location closest to where the user’s browser connects to Webscale). The platform includes CloudEDGE CDN and CloudEDGE Workers, which you can manage through the Webscale Control Panel.

The caching policies for your application specify how CloudEDGE CDN (also known as Webscale CDN) caches resources. They determine what resources are cached, how long they are cached, and how Webscale CDN processes requests for cache misses. The CloudEDGE Workers feature expands the functionality of Webscale CDN for your application by executing custom JavaScript code on the edge.

CloudEDGE Workers Usage Example

Mon, 01 Jan 0001 00:00:00 +0000

CloudEDGE Workers is a feature that expands the functionality of CloudEDGE CDN for your application by executing custom JavaScript code on the edge. It is part of the CloudEDGE distributed computing platform along with CloudEDGE CDN.

Webscale CDN enhances a website’s performance and page load time by caching assets across multiple edge locations in the cloud. Webscale CDN also processes requests unrelated to caching. Since all requests pass through the Webscale CDN, CloudEDGE workers are able to execute on both cached and uncached requests.

Working with CloudEDGE Handlers and Workers

Mon, 01 Jan 0001 00:00:00 +0000

The CloudEDGE Workers feature adds programmability and on-arrival code execution to CloudEDGE CDN (also known as Webscale CDN). It extends your application’s functionality using custom JavaScript without changing your application code. When you use CloudEDGE Workers, it augments a request that Webscale CDN forwards to origin after a cache miss or a response that origin returns to Webscale CDN.

The CloudEDGE Workers feature uses the following components.

Handler files that include custom JavaScript source files
Handlers that incorporate the handler files
Workers that run the JavaScript code according to CloudEDGE CDN caching policies

Configuring CloudEDGE workers (also known as workers) involves the following process.

Creating CloudEDGE Handler Files

Mon, 01 Jan 0001 00:00:00 +0000

CloudEDGE workers provide a way to augment your application by modifying the requests that it handles and the responses that it generates without the need to change your existing, deployed application code.

Handlers run your custom JavaScript code in a serverless execution environment that is agnostic to your cloud provider. They provide a uniform development environment and deployment flexibility. Additionally, handlers can run at the CDN edge, closer to your users, which allows for improved response times.

Creating Web Controls

Mon, 01 Jan 0001 00:00:00 +0000

Managing Web Controls

Mon, 01 Jan 0001 00:00:00 +0000

Using URL Maps to Redirect URLs

Mon, 01 Jan 0001 00:00:00 +0000

The URL mapping feature enables you to redirect requests from one URL (from) to another URL (to). A comma-separated values (CSV) file specifies the from and to URLs. If desired, you can bulk import matching pairs of URLs.

One example of when you might use URL mapping is when you revise your website. This can lead to orphaned URLs. When site visitors use an orphaned URL, a web page with a 404 error code displays rather than a viewable page. A URL map enables you to avoid this potential problem.

How to Set Pagespeed Options

Mon, 01 Jan 0001 00:00:00 +0000

Enforcing a Content Security Policy

Mon, 01 Jan 0001 00:00:00 +0000

Using Image Manager

Mon, 01 Jan 0001 00:00:00 +0000

The Webscale Image Manager product is an image processing service that uses a JavaScript library called Sharp to automatically manipulate images. The library filters change image compression, size, and format according to your specifications.

Image Manager offers a one-stop, automated image optimization and management solution to dynamically optimize delivery, significantly improve page load times, and reduce spending. Improvement in the size and bandwidth usage of delivered images can result in higher Core Web Vitals scores. The main objective of Image Manager is to replace web page images with smaller optimized versions for better website performance.

How to Create a Site Splice

Mon, 01 Jan 0001 00:00:00 +0000

Introducing Application Shielding

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Application Shielding is an opt-in product feature for all Webscale customers that allows a controlled isolation of the application servers in a customer’s cloud account from Internet traffic. We developed this feature in response to requests from a handful of Webscale customers who wanted to configure their application servers so that all traffic reaching their application is from the Webscale proxy servers. Application Shielding makes it possible to eliminate direct HTTP/HTTPS traffic to the application servers from the Internet unless they are explicitly allowed by firewall settings or whitelists. It forces all other traffic to be routed through the Webscale proxies, better insulating the application from malicious attacks.

Webscale Shared Responsibility Security and Operational Model

Mon, 01 Jan 0001 00:00:00 +0000

The Webscale Managed Platform follows a shared responsibility model. This structure ensures that while Webscale manages the underlying infrastructure, security, and performance at the platform layer, the Merchant and their Systems Integrator (SI) retain control over the application code, custom logic, and business configurations.

1. Executive Summary & Strategic Recommendations

Summary: This section outlines the overarching goal of the shared model: maximizing uptime and security by clearly defining boundaries. Webscale handles the “plumbing” (Infrastructure/PaaS), while the Merchant/SI handles the “storefront” (Application/Code).

Webscale Shared Responsibility Security and Operational Model - Shopware

Mon, 01 Jan 0001 00:00:00 +0000

Last Update: March 4, 2026

The Webscale Managed Platform for Shopware is a platform-as-a-service (PaaS) designed to support the unique architecture of Shopware 6. This model ensures that while Webscale handles the high-performance infrastructure and Symfony-optimized environment, the Merchant and Systems Integrator (SI) manage the application logic and customer experience.

1. Executive Summary & Strategic Recommendations

Summary: For Shopware merchants, the shared model focuses on the stability of the Symfony framework and the performance of the Shopware Storefront/Admin. Webscale manages the underlying stack (Linux/PHP/MySQL), while the Merchant/SI manages the Shopware core and third-party extensions.

Shutdown hooks

Mon, 01 Jan 0001 00:00:00 +0000

This page describes how to configure and use Webscale’s shutdown hook mechanism so your application servers can finish in-flight work cleanly before they are destroyed.

The goal: when Webscale needs to terminate a server (scale in, rolling deploy, or manual destroy), your application gets a clear signal, some time to react, and the platform waits (up to a limit) before terminating the server.

Scope: This applies to managed or unmanaged clusters running a web-server image of version 2025.44 or later.

Ubuntu Package Security & Backporting Policy

Mon, 01 Jan 0001 00:00:00 +0000

Core Strategy

Webscale utilizes official Ubuntu-packaged software for all core infrastructure components. While upstream developers frequently release new “mainline” versions with higher version numbers, Webscale prioritizes the stable versions maintained and vetted by Canonical (the publishers of Ubuntu).

The Backporting Mechanism

The primary reason for staying on a specific Ubuntu package version is the process of backporting.

Definition: Backporting is the practice of taking a specific security fix (CVE patch) from a newer version of software and applying it to an older, more stable version.
Canonical’s Role: Canonical’s security team monitors upstream vulnerabilities. When a vulnerability is found in a tool like Nginx, they apply the fix to the version of Nginx currently shipping with the Ubuntu LTS (Long Term Support) release.
Result: The version number of the package remains the same (e.g., 1.18.0), but the security posture is identical to the latest upstream version (e.g., 1.25.x).

Technical Comparison: Nginx Security Case Study

A common customer request is to upgrade to the latest “mainline” version of Nginx to address specific CVEs. The table below illustrates how Webscale/Ubuntu addresses these concerns:

Content Security Policy Directives

Mon, 01 Jan 0001 00:00:00 +0000

The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS ).

Webscale’s Set Content Security Policy action for Web Controls allows you to set the following directives. Click the name of each directive for more detailed information.

Introducing HTTP Headers and Status Codes

Mon, 01 Jan 0001 00:00:00 +0000

Overview

HTTP requests and responses include HTTP headers, which contain additional information that the client and server pass on to each other. Request and response bodies are located at the bottom of the message. Depending on the method, not all requests require bodies. Requests with methods that pertain to fetching resources like GET, HEAD, DELETE, and OPTIONS usually don’t need them.

Requests with methods that send data to servers to update them do need bodies. One example is the POST method.

Introducing Webscale Account Hierarchies

Mon, 01 Jan 0001 00:00:00 +0000

Note:

Webscale account hierarchies are an advanced feature.

Overview

Webscale accounts (parent accounts) can optionally be configured with one more sub-accounts to create account hierarchies. This hierarchial relationship naturally matches the structure Webscale Partners use to manage their various eCommerce clients. In concert with Webscale role-based access , this hierarchy allows Partners to grant a user access to multiple sub-accounts while also being able to limit their access in each account.

Introducing Webscale Role-based Access

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Webscale role-based access (RBAC) uses the permissions of the roles to which a user has accepted invitations to determine their Webscale API access. Account owners can configure roles with granular Webscale API permissions, allowing administrators to deploy to users the least amount of API access needed for the user to complete their task.

This overview will focus on the concepts and mechanisms necessary to understand RBAC.

Permissions

Roles used for RBAC are configured with permissions. These permissions describe exactly the parts of the API the user can access. Permissions are defined using three pieces of information:

Introducing Webscale service users

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Webscale service users are a special type of Webscale user. Instead of representing a particular person, service users encapsulate a persistent Webscale API access key, useful for completing long-standing tasks, typically in an automated environment like deployment scripts. Service users are scoped to the account and, as a result, can be managed like any other account-level resource.

Note:

Service users can be granted access to multiple accounts by inviting them to roles in each account.

Magento 1 EOL Support - FAQ

Mon, 01 Jan 0001 00:00:00 +0000

What is M1 Support?

Webscale M1 Support is a comprehensive, security-focused SaaS solution for digital commerce merchants planning to remain on Magento 1.x beyond its end-of-life (EOL) in June 2020.

There are two options to Webscale M1 Support:

Webscale Cloud M1 Support for customers whose hosting environment is in the cloud and managed by Webscale (and typically hosted by Webscale as well).
Webscale On-Prem M1 Support for customers whose hosting environment is not managed by Webscale (maybe hosted in the cloud or in a private data center).

Does Webscale support M1 Commerce (formerly known as Enterprise) and M1 Open-source (formerly known as Community)?

Yes! Webscale’s M1 On-Prem and Cloud Support protects M1 commerce and Open-source customers.

Magento 1 EOL Patches

Mon, 01 Jan 0001 00:00:00 +0000

Patches to fix discovered vulnerabilites in Magento 1 are made available to customers who have a Magento 1 EOL Support plan. A list of these patches is maintained here, including patch date, description, and a link to download the patch. For more information on Magento 1 EOL Support, please read the FAQs .

Note:

M1 Commerce patches will be available within 60 days from date mentioned below.

Date	ID	Description	Open Source	Commerce
Aug 07 2020	12	Improves PCI-DSS compliance by forcing login form to disable autocompletion.	Download	Download
Aug 07 2020	13	(HIGH) Re-release of Adobe’s SUPEE-11346 (originally released on 06/22/2020) for Magento 1.9.4.5.	Download
Aug 07 2020	14	Prevents parallel logins for the same user account (session attack for backend and frontend).	Download	Download
Aug 19 2020	15	Adds new configuration option to enable “secure” marker for all cookies.	Download	Download
Aug 28 2020	16	Adds compatibility for PHP 7.3.	Download	Download
Aug 28 2020	17	Improves clearing of session data with parallel logins.	Download	Download
Oct 01 2020	18	(CRITICAL) This patch is based on a backport for CVE-2020-9690 of Magento 2.	Download	Download
Oct 01 2020	19	(CRITICAL) Prevents admin users from using soap access w/product attributes and a product to upload and execute executable files to the server.	Download	Download
Oct 01 2020	20	Prevents admin users with access to `System > Permissions > Variables` from adding config paths for encrypted config fields.	Download	Download
Oct 29 2020	21	Improves compatibility of 3rd party integrations by flagging cookies as `SameSite=None`.	Download	Download
Oct 29 2020	22	(HIGH) Prevents access to the `/downloader` directory.	Download	Download
Oct 29 2020	23	Replaces the news feed URL in Magento so you receive patch notifications in your admin panel.	Download	Download
Oct 29 2020	24	Avoids incorrect form keys creating an error log entry. This is an improvement for patch ID 18.	Download	Download
Oct 29 2020	25	(CRITICAL) Fixes an issue whereby an administrator with permission to update product data was able to store an executable file on the server and load it via layout xml.	Download	Download
Dec 09 2020	26	Improves cookie handling.	Download	Download
Dec 09 2020	27	(HIGH) Prevents admin users with permission to import/export data and to create widget instances from loading an executable file via layout xml.	Download	Download
Dec 09 2020	28	(HIGH) Prevents admin users with permission to create products from injecting an executable file on the server via wishlist functionality.	Download	Download
Dec 09 2020	29	(HIGH) Prevents admin users with permission to import/export data and to edit cms pages from injecting an executable file on the server via layout xml.	Download	Download
Dec 09 2020	30	Improves patch 20.	Download	Download
Dec 09 2020	31	Improves patch 21.	Download	Download
Dec 09 2020	32	Fixes an issue with patch 23.	Download	Download
Jan 21 2021	33	Fixes an issue with patch 31: Cookie secure flag wasn’t `boolean` in JavaScript.	Download	Download
Jan 21 2021	34	Adds `samesite` setting to PHP based session cookies.	Download	Download
Apr 05 2021	35	Fixes a core bug when using prepare data for redirecting. Note: This patch is also required for patch 39 to operate properly.	Download	Download
Apr 05 2021	36	(HIGH) Fixes a bug in Zend Framework’s Stream HTTP Wrapper - CVE-2021-3007	Download	Download
Apr 05 2021	37	Support for PHP 7.4 and PHP 8. In order to switch to PHP 7.4 or PHP 8 you also have to make sure any custom code and third party extension is compatible with these PHP versions! Known Issue: Applying this patch might fail because there are versions of Magento in circulation that use `\r\n` line breaks instead of `\n` line breaks for certain files. Option 1: If you encounter errors when applying the patch, you can use the command line utility dos2unix to correct the line breaks. You can use the following command: ```find . -type f -print0	xargs -0 dos2unix`</div> <div>Option 2: If you cannot install or use dos2unix, you can also use sed on the command line to correct the line breaks:`find . -type f -name *.php -print -exec sed -i ’’ ’s/\r//’ {} ;```	Download
Apr 05 2021	38	Changes the content-type in json responses from text/html tot application/json to prevent XSS attacks	Download	Download
Apr 05 2021	39	The wishlist sharing function has been subject to intensive SPAM abuse. We added a switch to the Magento configuration to disable the sharing functionality. Please note that patch #35 is required for this patch to work properly. Please make sure to configure the setting according to your needs: The behavior of the Wishlist Sharing functionality can be controlled via a new config option in System > Config > Wishlist > Share Options > Enable Sharing	Download	Download
Apr 05 2021	40	We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. CVE-2021-21024	Download	Download
May 28 2021	41	Updates Zend_Http_Response to support HTTP/2	Download	Download
May 28 2021	42	(HIGH) This patch adds improved security to unserialize() calls to avoid unexpected object creation. Attention: This patch changes almost every unserialize() call throughout the core code to prevent unwanted object creation. It touches many code aspects we’re unable to cover with tests. It might also affect functionality you intentionally wanted to create objects via unserialize(). It’s therefore crucial to test all your integrations and customizations before you apply it in your live environments!	Download	Download
May 28 2021	43	(HIGH) We fixed a vulnerability that allowed users with admin access to inject code (RCE) using session manipulation.	Download	Download
May 28 2021	44	(HIGH) Due to missing sanitation in data flow it was possible for admin users to upload arbitrary executable files to the server.	Download	Download
May 28 2021	45	(HIGH) Layout XML enabled admin users to execute arbitrary commands via block methods.	Download	Download
May 28 2021	46	(HIGH) We fixed a vulnerability in Magento’s package manager which lead to a RCE via race conditions.	Download	Download
May 28 2021	47	Zend_Validator wasn’t able to validate emails with uptodate TLDs. The list of TLDs has been updated.	Download	Download
May 28 2021	48	Adds array_key_first() and array_key_last() with a polyfill.	Download	Download
May 28 2021	49	This fixes a bug introduced with patch #47. Magento uses a copy of Zend’s original file with modified paths. While updating the file’s content, these modified paths have been replaced with their originals. So Magento wasn’t able to find the correct files anymore.	Download	Download
Aug 9 2021	50	Improves PHP5.6 compatibility for unserialization. Please Note: We do not recommend to use anything older than PHP7.3. There’s no support available for older PHP Versions!	Download	Download
Aug 9 2021	51	Updates phpseclib to version 2.0.32 to fix CVE-2021-30130.	Download	Download
Aug 9 2021	52	Fixes a persisted XSS vulnerability.	Download	Download
Aug 9 2021	53	(CRITICAL) Restores missing .htaccess files from core automatically. In some Magento installations merchants or developers or agencies accidentally removed .htaccess files from regular core directories and thus exposed security vulnerabilities. To regain protection for these directories we automatically check for deleted .htaccess files and reinstate them in the following locations: `/app/.htaccess /dev/.htaccess /downloader/lib/.htaccess /downloader/Maged/.htaccess /downloader/template/.htaccess /includes/.htaccess /lib/.htaccess /media/downloadable/.htaccess /media/customer/.htaccess /shell/.htaccess /skin/frontend/rwd/default/scss/.htaccess /var/.htaccess`	Download	Download
Aug 9 2021	54	Improving PHP8 compatibility.	Download	Download
Aug 9 2021	55	Prevent DoS attack via passwords larger than 4k.	Download	Download
Aug 9 2021	56	(HIGH) An administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml.	Download	Download
Aug 9 2021	57	(HIGH) Arbitrary command execution in Custom Layout Update via block method.	Download	Download
Aug 9 2021	58	(HIGH) Arbitrary file delete in customer media allows remote code execution.	Download	Download
Aug 9 2021	59	This patch adds brute force attack prevention to customer login via Frontend and API as well as admin panel login. If enabled this feature prevents brute force login attacks by disabling the login feature once the failed login attempts limit is reached. With every failed login attempt the login retry time increases. This time is respecting the max_execution_time setting. The failed login attempts counter will be reset if a successful login is detected before it reaches the login attempt limit. Customer Login: To enable this feature, go to `System > Configuration > Customer Options > Password Options`. The Switch is called ‘Enable brute force protection’. The number of failed logins defaults to 10 and can be configured in the field Maximum number of failed attempts. If an account has too many failed logins, an error message will appear. The customer can then send an unlock link via email to the account’s address. The email template is called ‘Customer Account Unlock Notification’. Admin Login: To enable this feature, go to `System > Configuration > Admin > Security`. The switch is called ‘Enable brute force protection’. The number of failed logins defaults to 10 and can be configured in the field ‘Maximum number of failed attempts’. If an account has too many failed logins, an error message will appear. The administrator can then send an unlock link via email to the account’s address. The email template is called ‘Admin Account Unlock Notification’. API: To enable this feature, go to `System > Configuration > Magento Core API > General Settings`. The switch is called ‘Enable brute force protection’.	Download	Download
Sep 8 2021	60	Some of our customers are using netz98’s magerun tool to maintain their stores. With this patch we add additional compatibility for our last patch #59 features with magerun by adding a reload() Method to the Mage_Customer_Model_Customer.	Download	Download
Sep 8 2021	61	(HIGH) An administrator with privileges to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. The fix applies to the Zend_Db::factory().	Download	Download
Nov 4 2021	62	Improves deserialization performance for PHP 5.6. Please Note: We do not recommend to use anything older than PHP7.3. There’s no support available for older PHP Versions!	Download	Download
Nov 4 2021	63	Fixes an issue with brute force protection (patch #59) and requesting reset password link.	Download	Download
Nov 4 2021	64	(CRITICAL) An administrator with the right to create or edit CMS pages was able to upload and execute arbitrary code using the wysiwyg editor.	Download	Download
Jan 20 2022	65	(CRITICAL) Improves security checks for patch #64 and adds compatibility with symlinked media directories.	Download	Download
Jan 20 2022	66	Improves compatibility for third party code and patch #61.	Download	Download
Jan 20 2022	67	(CRITICAL) Improves compatibility for import file uploads to ./var directory and patch #64.	Download	Download
May 12 2022	68	(CRITICAL) Fixes to prevent RCE attacks via Varien_Convert_Adapter_Zend_Cache and Mage_Dataflow_Model_Convert_Adapter_Zend_Cache. These classes were not used in Magento core code, thus we decided to remove them completely. We did not see any valid use case to change cache entries via import/export. Attention: If you use any of theses classes in your customization, please be aware that you have to change your custom code in order to stay compatible.	Download	Download
May 12 2022	69	(HIGH) This patch prevents sending passwords in emails in plain text. Passwords in emails will all be replaced with asterisks. One exception: If an administrator sets a new customer password via the admin panel, in this case you’ll now see a note on the input field that this password is sent in plain text. You now have a button to force sending a ‘Forgot Password’ email via the admin panel.	Download	Download
May 12 2022	70	This patch fixes a JavaScript issue with Import/Export.	Download	Download
May 12 2022	71	Fixes a session handling issue for downloadable products, introduced in SUPEE-11314.	Download	Download
May 19 2022	72	This patch fixes a bug of patch #69 which stopped account confirmation emails to work. With patch #69 we introduced code to redact the customer password from the customer object. This patch fixes a bug that caused the customer account confirmation email to stop working.	Download	Download
Jul 25 2022	73	This patch fixes an issue with the JS and CSS merge and sets the Content-Type on an educated guess basis.	Download	Download
Jul 25 2022	74	This patch disables the phar:// protocol to open and/or execute content of phar files (e. g. in the context of including templates). Many of the found vulnerabilities use phar:// files to exploit the system. Forbidding the opening of phar files and preventing the unserialization on them hardens Magento.	Download	Download
Jul 25 2022	75	This patch improves handling of admin passwords and makes sure to implement PCI security measures. You can now configure admin password strength settings in System > Configuration > Admin > Security > Admin Password Strength. You can set it to any of these values: Default Password must contain at least 7 characters. Password must contain at least one number and one letter. PCI All of the rules above. Change password every 90 days. No repetition of the last 4 passwords. If password is set by another admin, it is forced to be changed. All admin passwords are forced to be changed on activation. PCI Advanced All of the rules above. Password must contain special characters.	Download	Download
Jul 25 2022	76	(CRITICAL) This patch fixes an issue where an admin could use the password forgot feature to escalate their privileges. This patch contains the SQL Formatter which is licensed under the MIT License.	Download	Download
Jul 25 2022	77	This patch reduces deprecated messages with PHP 8.0/8.1.	Download	Download
Aug 10 2022	78	Patch (#75) introduced a new feature to harden administrator passwords with forced PCI compliance. Unfortunately this patch interfered with our previously introduced brute force protection (Patch #59). Patch #78 fixes compatibility of admin password PCI compliance (#75) with brute force protection (#59).	Download	Download
Oct 27 2022	79	This patch fixes a XSS vulnerability in Mage_Dataflow_Model_Convert_Adapter_Http::save() which allows the display of content via $this->getData() on the page using echo().	Download	Download
Oct 27 2022	80	This patch replaces rand() with mt_rand() since PHP 7.1 mt_rand() has superseded rand() completely, and rand() was made an alias for mt_rand().	Download	Download
Oct 27 2022	81	This patch improves Patch #78: If a user lacks permission to change his password, he is informed about it. This patch fixes the current redirect loop.	Download	Download
Oct 27 2022	82	This patch improves Patch #76: Read-Query detection is extended by DESCRIBE, TABLES, VALUES, and PREPARE.	Download	Download
Oct 27 2022	83	This patch adds a message ID to outgoing emails, because especially Google hardened their spam filter for emails without message ID.	Download	Download
Oct 27 2022	84	This patch provides support for MySQL 8.	Download	Download
Mar 16 2023	85	This patch improves PHP8 compatibility for Zend_Registry.	Download	Download
Mar 16 2023	86	This patch improves PHP8 compatibility for report.php.	Download	Download
Jun 2 2023	87	This patch improves password security by checking if password equals email address for customers and if password equals username or email address for admin users.	Download	Download
Jun 2 2023	88	This patch improves PHP8 compatibility for the catalog product action attribute form.	Download	Download
Jun 2 2023	89	This patch improves PHP8 compatibility for Mage_Api_Model_Wsdl_Config_Element.	Download	Download
Jun 2 2023	90	This patch fixed an login loop issue caused by missing setOrigData(). This patch also hardens bruteforce password protection.	Download	Download
Jun 2 2023	91	This patch fixes an issue with rejected mails due to incompatible line endings. After upgrading to PHP8, we noticed that all emails were rejected by some mail systems. As of PHP8, the mail() function separates all parts of an email using CRLF instead of LF. However, the Zend_Mail_Transport_Sendmail wrapper class still uses LF as line separator. This resulted in mails being sent with mixed line endings.	Download	Download
Jun 2 2023	92	This patch prevents javascript execution in email template previews in admin panel.	Download	Download
Oct 30 2023	93	This patch improves compatibility with PHP 8 and MySQL. Enables ATTR_STRINGIFY_FETCHES in MYSQL-PDO to avoid integer string problems in json encode.	Download	Download
Oct 30 2023	94	This patch improves MySQL compatibility by adding data type support for unsigned integers.	Download	Download
Dec 20 2023	95	(HIGH) This patch improves protection against bruteforce attacks to view guest orders. New protect codes are much longer now. This patch adds a new configuration option to System > Configuration > Sales > General > Block short guest order protect codes to blocks access for guest orders with short protect codes. Ref: CVE-2023-41879	Download	Download
Dec 20 2023	96	This patch fixes a typo for patch #94 where we misspelled unsigned with unsinged.	Download	Download
Feb 15 2024	97	tinyMCE uses iFrame to show its content, which lead to an XSS vulnerability. By sandboxing the iFrame no XSS is possible anymore. Known Issue: Applying this patch might fail because there are versions of Magento in circulation that use \r\n line breaks instead of \n line breaks for certain files. Option 1 If you encounter errors when applying the patch, you can use the command line utility dos2unix to correct the line breaks. You can use the following command: ```find . -type f -print0	xargs -0 dos2unix`</div> <div>Option 2 If you cannot install or use dos2unix, you can also use sed on the command line to correct the line breaks:`find . -type f -name *.php -print -exec sed -i ’’ ’s/\r//’ {} ;```	Download
Feb 15 2024	98	Forgot Password feature now uses formkey protection to prevent CSRF attacks.	Download	Download
Feb 15 2024	99	This patch improves compatibility for PHP8. In the reports section, total for each column will be calculated with additions. It also covers the name column, which does not contain numbers. The patch will make sure that all value are converted to numbers first. Warning! If e.g. product names start with a number, this will lead to wrong column totals!	Download	Download
Feb 15 2024	100	This patch improves include file handling in environments with multiple symlinked directories.	Download	Download
Jul 30 2024	101	This patch updates phpseclib to version 2.0.47, fixes DoS (denial of service) vulnerability.	Download	Download
Jul 30 2024	102	(HIGH) This patch fixes XSS vulnerability in admin panel when uploading files.	Download	Download
Jul 30 2024	103	This patch improves PHP 8 compatibility for modules when methods such as call_user_func_array are used.	Download	Download
Jul 30 2024	104	This patch improves USPS compatibility.	Download	Download
Aug 29 2024	105	This patch adds in-app rate limiting for specific URLs. ⚠️ We do highly recommend to use fail2ban for larger shops as it is much faster and provides more configuration. This feature here is meant to protect smaller shops with less sophisticated hosting setups. We do protect the following URLs by default with a limit of 10 requests per 10 seconds: `/customer/account/login` `/sales/guest/form` Rate limits will be tracked in the table `mageone_ratelimit_log`. A cron job at 1.30 am will remove outdated entries. Further URLs can be added by custom modules. Use your `config.xm`l file to add new entries to the `global` section like so: `<mageone_ratelimit>` `<custom_identifier>` `<route>/path/of/url</route>` `<enabled>true</enabled>` `<max_queries_in_time_window>10</max_queries_in_time_window>` `<time_window_in_seconds>10</time_window_in_seconds>` `</custom_identifier>` `</mageone_ratelimit>`	Download	Download
Aug 29 2024	106	(HIGH) This patch fixes a file content extraction vulnerability in dataflow.	Download	Download
Aug 29 2024	107	(HIGH) This patch fixes a stored XSS vulnerability in dataflow.	Download	Download
Aug 29 2024	108	This patch updates UPS integration to work with OAuth2.0. ⚠️ Please note that we were unable to get access to the official UPS Test API. This patch therefore is given without warranty. Please make sure to test it thoroughly in your own setup!	Download	Download
Aug 29 2024	109	This patch fixes a missing translation helper for Patch #105.	Download	Download
Aug 29 2024	110	This patch fixes dataflow realpath problems concerning Patch #107.	Download	Download
Aug 29 2024	111	This patch improves PHP5.6 compatibility for UPS carrier update from Patch #108.	Download	Download
Dec 23 2024	112	This patch fixes the wrong rate limit model instantiation from patch #105.	Download	Download
Dec 23 2024	113	(HIGH) This patch fixes a stored XSS in admin system configs CVE-2024-41676.	Download	Download
Dec 23 2024	114	This patch improves compatibility with PHP 8 and only closes files that have been opened before.	Download	Download
Dec 23 2024	115	This patch fixes the wrong rate limit column name in the cleanup cron in patch #105.	Download	Download
Feb 12 2025	116	(CRITICAL) This patch fixes an RCE (remote code execution) vulnerability, which allowed a low privileged admin panel user to upload a PHP file and gain full access to database and backend via custom product options file upload.	Download	Download
May 21 2025	117	(HIGH) This patch fixes a Cross-Site-Scripting vulnerability in theme configuration fields. This patch will escape HTML content in the ‘Welcome’ message field. HTML from this field must be removed.	Download	Download
Jan 15 2026	118	(HIGH) This patch fixes a XSS vulnerability in Magento’s URL processing system. Usage of getBaseUrl() is now protected by solid validation and encoding. Ref: CVE-2025-27400	Download	Download

Severity Categories

(CRITICAL)

Critical severity issues allow an attacker to read or write arbitrary resources (including but not limited to the file system, registry, network, etc.) on the underlying platform, with the user’s full privileges.

Glossary

Mon, 01 Jan 0001 00:00:00 +0000

Platform & products

Webscale One

Definition. Webscale’s managed hosting platform for eCommerce. It’s the umbrella offering that bundles infrastructure, the Webscale proxy, CDN, and security services into a single managed environment. Customers migrating onto the platform are migrating onto Webscale One.

Aliases. None canonical. Avoid “the Webscale platform” in customer-facing materials when you specifically mean Webscale One.

Example. “After your Webscale One environment is provisioned, the migration team will request your domain list and current host paths.”

Pagespeed Options

Mon, 01 Jan 0001 00:00:00 +0000

By default, Webscale enables the following filters with the default settings as specified by Add_head .

This filter exists primarily to ensure that other filters have a place to insert new tags in the head, or that trigger on the closing-tag of the head to perform some other action.

Pagespeed Options List

Option	Description
`canonicalize_javascript_libraries`	Identifies popular JavaScript libraries and replaces them with ones hosted for free by a JavaScript library hosting service (Google Hosted Libraries by default), which has several benefits, including: Most importantly, first-time site visitors can benefit from browser caching, since they may have visited other sites making use of the same service to obtain the libraries. The JavaScript hosting service acts as a content delivery network for the hosted files, reducing load on the server, and improving browser load times. There are no charges for the resulting use of bandwidth by site visitors. Third-party minification tools generally optimize the hosted versions of library code. These optimizations can make use of library-specific annotations or minification settings that aren’t portable to arbitrary JavaScript code, so the libraries benefit from more aggressive optimization than can be provided by PageSpeed.
`combine_css`	Seeks to reduce the number of HTTP requests made by a browser during page refresh by replacing multiple distinct CSS files with a single CSS file, containing the contents of all of them. Particularly important in old browsers that were limited to two connections per domain. In addition to reduced overhead for HTTP headers and communications warm-up, this approach works better with TCP/IP slow-start, increasing the effective payload bit-rate through the browser’s network connection.
`convert_meta_tags`	Adds a response header that matches each meta tag with an `http-equiv` attribute. For example, the HTML `<meta http-eqiv=”Content-Type” content=”text/html; charset=UTF-8″>` Adds this HTTP header in the response: `Content-Type: text/html; charset=UTF-8` The original tag is left unchanged. Certain `http-equiv` meta tags, specifically those that specify content-type, require a browser to reparse the HTML document if they do not match the headers. This avoids reparsing delays by ensuring that the headers match the meta tags.
`extend_cache`	Seeks to improve the cacheability of a web page’s resources without compromising the ability of site owners to change the resources and have those changes propagate to users’ browsers. The `extend_cache` filter rewrites the URL references in the HTML page to include a hash of the resource content (if `rewrite_css` is enabled, then image URLs in CSS are also rewritten). Thus if the site owners change the resource content, then the URL for the rewritten resource changes also. Since the old content in the user’s browser cache does not match the new name, the browser does not reference it again.
`flatten_css_imports`	Parses linked and inlined CSS and flattens it by replacing all `@import` rules with the contents of the imported file, repeating the process recursively for each imported file. Works on CSS found in `<style>` blocks and `<link>` references.
`inline_css`	Reduces the number of requests made by a web page by inserting the contents of small external CSS resources directly into the HTML document. Reduces the time it takes to display content to the user, especially in older browsers.
`inline_import_to_link`	Converts a `<style>` tag consisting of only @import statements into the corresponding `<link>` tags. This conversion does not itself result in any significant optimization; rather, its value lies in that it enables optimization of the linked-to CSS files by later filters, in particular the combine_css, rewrite_css, inline_css, and extend_cache filters.
`inline_javascript`	Reduces the number of requests made by a web page by inserting the contents of small external JavaScript resources directly into the HTML document.<br ?> Reduces the time it takes to display content to the user, especially in older browsers.
`insert_dns_prefetch`	Reduces DNS lookup time by providing hints to the browser at the beginning of the HTML, which allows the browser to pre-resolve DNS for resources on the page. DNS resolution time varies from <1ms for locally cached results to hundreds of milliseconds due to the cascading nature of DNS. This can contribute significantly towards total page load time.
`rewrite_css` and `fallback_rewrite_css_urls`	Parses linked and inline CSS, rewrites the images found and minifies the CSS. Wroks on CSS found in `<style>` blocks and `<link>` refs. Many images are referenced from CSS rather than HTML. If `rewrite_images`, `recompress_images`, `recompress_jpeg`, `recompress_png`, `recompress_webp`, `convert_gif_to_png`, `convert_jpeg_to_webp`, `convert_png_to_jpeg`, or `extend_cache` are enabled this filter finds and rewrites those images, saving bytes and extending cache lifetimes. The CSS parser cannot parse some CSS3 or proprietary CSS extensions. If `fallback_rewrite_css_urls` is not enabled, these CSS files are not rewritten at all. If the `fallback_rewrite_css_urls` filter is enabled, a fallback method attempts to rewrite the URLs in the CSS file, even if the CSS cannot be successfully parsed and minified. Minification can drastically reduce the byte count in standard CSS by stripping all comments and most whitespace and shortening color names. Use this filter to avoid the extra step of minifying CSS by hand when constructing and maintaining a site. This practice reduces the payload size.
`rewrite_javascript`	Minifies JavaScript code, using an algorithm similar to that in Douglas Crockford’s popular JSMin program . At present, the filter strips all comments and most whitespace and works only on JavaScript found in `<script>` blocks (either as the target of the src attribute or within the body of the block). Minification can drastically reduce the byte count in common JavaScript code. Use this filter to avoid the extra step of minifying JavaScript code by hand when constructing and maintaining a site. This practice reduces the payload size.
`rewrite_style_attributes_with_url`	Rewrites CSS inside elements’ style attribute. Requires `rewrite_css` to also be enabled. See the settings for `rewrite_css` to control CSS minification, image rewriting, image recompression, and cache extension. The `rewrite_style_attributes` filter enables the filter for all style attributes, whereas `rewrite_style_attributes_with_url` enables it only for style attributes that contain the text `url()`, for which you generally want to enable one or more image optimization filters. `rewrite_style_attributes_with_url` is more efficient because it does not always parse the CSS, but it does not optimize CSS that doesn’t reference any URLs. `rewrite_style_attributes` always parses the CSS and optimize everything possible. Since images are generally the source for most significant improvement and `url()` encloses them, `rewrite_style_attributes_with_url` is a good balance for most uses, while `rewrite_style_attributes` is available for more aggressive optimization.

The two options below specify groups of image optimizations that help to make sure images are high quality and load fast. Please refer to the Pagespeed site for details.

The Webscale STRATUS Stack

Mon, 01 Jan 0001 00:00:00 +0000

Webscale STRATUS is built on top of a micro-services architecture powered by Kubernetes . Through micro-services, we can assign resources dynamically and provide your environment exactly what it needs. This saves money compared to traditional dedicated hosting solutions where you pay for a limited amount of resources whether you use them or not. The STRATUS stack combined with our dynamic pricing plans means you only pay for what you use it, and it is provided for your store as needed.

Stratus Architecture — AWS

Mon, 01 Jan 0001 00:00:00 +0000

The important consideration is that you are not required to do any direct management of the AWS environments used. In other words, you get the full benefit and power of a global cloud services infrastructure without any intervention or configuration. Our STRATUS system works on top of AWS to give you the highest performing technology stack for hosting Magento in a cloud environment.

Amazon EC2

EC2 is the flagship product of AWS and provides the raw hardware needed to run Webscale STRATUS. The underlying physical nodes for all Webscale STRATUS environments are EC2 instances. The micro-services running your environment run on EC2 instances, as well.

Stratus High Availability Strategies

Mon, 01 Jan 0001 00:00:00 +0000

What is High Availability?

By definition, High Availability (HA) is the ability of a system to operate continuously without failing for a designated period of time. HA works to ensure that a system meets an agreed level of operating performance. Data backup and fail-over capabilities play an important role in ensuring that HA systems meet their availability targets. MageMojo currently uses multiple backup strategies to ensure system stability and availability. In addition to back up concerns, system designers need to pay close attention to the data storage and access technology they use. Highly available systems must be well designed and thoroughly tested before they are used. The good news is, the experienced and knowledgeable MageMojo team has devised a system that will protect your data and grant you the peace of mind that accompanies knowing your site is stable.

Stratus Environment Types

Mon, 01 Jan 0001 00:00:00 +0000

For more on Magento modes, see the Magento 2 documentation

Production Environment

Your STRATUS account allows for one Production Environment for hosting your live store. Live stores may only be accessed on Production Environments.

For autoscaling plans (as opposed to our Resource-Based plans), Default Session billing can be switched to collect sessions from Google Analytics if preferred.

Development Environment

Based on your plan, you are entitled to create one or more Development Environments. These Environments can be used for programming, staging, or testing purposes.

Access for Developers & Authorized Users to Stratus

Mon, 01 Jan 0001 00:00:00 +0000

Authorized users are generally people for which Webscale STRATUS access is necessary to help you build or maintain your Magento installation. (developers, 3rd party, qa)

Contacts with access can request changes such as server upgrades/downgrades, software installation, and admin panel access. Users with access may also submit support tickets. They cannot update or see your billing information.

Developers/Authorized User Access

Please have your developer or contact create a Customer Account .

Stratus Email

Mon, 01 Jan 0001 00:00:00 +0000

Webscale STRATUS does not include a mail server component for providing POP and IMAP email service. However, using Amazon’s Simple Email Service (SES), STRATUS can deliver your transactional store emails, such as invoice receipts, shipping notifications, etc.

For SES to work with your STRATUS environment,

Your domain must be live and validated with Google Analytics sessions. This allows the cron services to launch and run. Cron services are responsible for handling most email sent by Magento stores.
Your domain must have its Domain Name Server (DNS) updated to use the [MageMojo Route 53 implementation][2] or the proper SES DNS records have been added to your 3rd party DNS management provider. The necessary DNS records are visible in the Status Control Panel or you may contact Webscale STRATUS Support for assistance.

Since cron services may not work in development or test environments, you may find that emails may not work in these instances, as well.

Stratus Resource Limits

Mon, 01 Jan 0001 00:00:00 +0000

Autoscaling (production) environments & Development environments.

Autoscaling environments are the default and recommended production environments for STRATUS. The autoscaling environments will scale out your website frontend horizontally and automatically in response to surges in traffic.

Autoscaling environments have two types - Single tenant and Multi tenant.

Multi tenant - Starter, Lite, Plus and Select, have all services running across the shared STRATUS platform. The limits in the services are aggregated as a total.

Stratus TOS — Magento Requirements

Mon, 01 Jan 0001 00:00:00 +0000

To host Magento on STRATUS, installations must adhere to our Terms of Service and Acceptable Use Policy .

All STRATUS live Magento environments must:

Be in Production Mode .

Have all caches enabled .

Have session storage set to Redis or Memcache . Sessions cannot be stored in files or the database.

Install and active the MageMojo Cron extension on Magento 2 store installs.

Have indexers set to Manual Mode for Magento 1.x and Scheduled for Magento 2.x.

Ensure that static assets are not stored in the database.

Enable Autoscaling on autoscaling plans.

Accessing the Legacy Stratus panel

Mon, 01 Jan 0001 00:00:00 +0000

[All access](/docs/reference/stratus/about-webscale-stratus/access-for-developers/ “Developer Access”/) is controlled through customer accounts.

To access Webscale Stratus Admin Panel:

Log into MageMojo . This is the account you used to purchase STRATUS services or to register as a free user account.

Click STRATUS.

Click the STRATUS environment you wish to access.

Stratus Panel - General > Info

Mon, 01 Jan 0001 00:00:00 +0000

Account Name - Assigned to your environment upon initial provisioning. Cannot be changed.

Stratus Template - Pre-configured Nginx server template. Is assigned based on the version of your software.

PHP Version - Active version of PHP running in the environment.

Docroot - The root directory in which the Magento store code is located.

Environment Type - Production or Development. Not to be confused with the production and development Magento modes.

Environment SSL - The type of Secure Socket Layer certificate applied to the environment.

Varnish Status - Indicates if Varnish caching is enabled.

Elasticsearch Status - Indicates if Elasticsearch is running.

Sphinx Status - Indicates if Sphinx search is enabled.

Autoscaling - Indicates is Autoscaling is enabled.

Status Indicators

When you come into the Info Panel, you will notice a colored circle in the upper left of the sidebar menu, just to the left of your Environment Name.

Stratus Panel - General > Pods

Mon, 01 Jan 0001 00:00:00 +0000

In the very least, there is a PHP-FPM pod and a Service pod running for each environment.

As a site auto-scales, copies of the PHP-FPM pod are created to handle the increased traffic.

Within each pod, are listed any containers with their current status.

Stratus Panel - Account > Usage

Mon, 01 Jan 0001 00:00:00 +0000

Please note storage used on your development environments is calculated in the total.

Base fee - A regular monthly payment of a base price depending on the plan.

Sessions - Sessions used during the current billing period.

Storage - An average of the daily storage space used during the current billing period.

Stratus Panel - Account > Authorized Users

Mon, 01 Jan 0001 00:00:00 +0000

Enter the email address of the person you wish to give access to the selected STRATUS environment.

Click the plus sign.

For further details, please read over Access for Developers & other Authorized Users

Stratus Panel - Account > Alerts

Mon, 01 Jan 0001 00:00:00 +0000

Plan Limit Alerts

When these limits are reached, you may wish to contact stratus-sales@webscalenetworks.com to analyze your ongoing plan needs.

Note: Reaching these thresholds will not interrupt your service.

Plan Overage Alerts

Specify maximum overages allowed for unanticipated traffic and storage usage. You will receive a notification when these limits are reached. When overage are reached, please contact stratus-sales@webscalenetworks.com to analyze usage needs.

Stratus Panel - General > DNS Panel

Mon, 01 Jan 0001 00:00:00 +0000

See more at DNS Best Practices .

Viewing your zones

Zones associated with a STRATUS environment can be viewed in your STRATUS Admin panel.

Select Domains->DNS from the STRATUS sidebar menu.

All zones are created with the following settings:

4 records for validating Amazon SES - 3 CNAME and 1 TXT record.

Pointed to the CloudFront distribution CNAME for your STRATUS environment xxxxxxxx.cloudfront.net

Creating a new zone

Go to DNS in the STRATUS sidebar menu.

Click Add New DNS Zone.

In the text box to the right, add your domain without any prefix. If your site is example.com, then add example.com, but not www.example.com .

Click CREATE to save the change.

Route 53 will update within a few minutes.

Stratus Panel - General > Urls Panel

Mon, 01 Jan 0001 00:00:00 +0000

At the server level, this list shows:

Domains enabled in the CloudFront distribution

Domains listened for in the Nginx configuration

Domains for Let’s Encrypt and SSL configuration

Any domain not shown in this list will not properly work.

Adding a domain

By default, the domain issued at checkout is included in the Urls list alongside temporary mojostratus.io subdomains. The temporary subdomains are for testing only and MageMojo Support uses them for site migrations.

Stratus Panel - Autoscaling

Mon, 01 Jan 0001 00:00:00 +0000

Configuration of Webscale STRATUS Autoscaling does require some initial configuration. In order to fully benefit from this feature, we recommend that you contact support for assistance .

How does autoscaling work?

When high traffic occurs on a Magento store, the code that is processed by PHP — the core Magento code — quickly becomes the bottleneck. Autoscaling resolves these bottlenecks by replicating the PHP code as “containers” across additional physical hardware instances in the AWS cloud.

Stratus Panel - SSL > Settings

Mon, 01 Jan 0001 00:00:00 +0000

Click SSL in the left-hand navigation menu to reveal the SSL panels.

The SSL settings panel provides controls for the type of Secure Socket Layer (SSL) certificate applied to a Webscale STRATUS environment. Certificates are applied to the CloudFront distribution for the environment. STRATUS provides five options for installing an SSL certificate:

Auto — attempts to select the best certificate option given the settings available. Defaults to Let’s Encrypt certificate generation.

Customer Provided Certificate — uses a third-party certificate entered into the Customer Cert panel.

*mojostratus.io certificate — uses the MageMojo wildcard for temporary domains during initial setup or testing or development. Enabling this will cause any URLs/domains set in the URLs section to stop working if they are not a mojostratus.io subdomain

Let’s Encrypt Certificate — for valid domains (using Route53 nameservers /), will apply a Let’s Encrypt certificate, once generated.

The CloudFront Force SSL setting will add a forced redirect to HTTPS for all content if set to On, the default setting. The redirect will preserve paths (i.e. http://mystore.com/page.html will be directed to https://mystore.com/page.html) .

Stratus Panel - SSL > Customer Cert

Mon, 01 Jan 0001 00:00:00 +0000

It’s not unusual for a single Magento environment to be configured for multistore. In this configuration, the Magento installation can host multiple storefronts powered by the same Magento backend. Each store would have its own unique domain. If a third-party SSL certificate is desired, it must cover all domains used in the multistore environment.

Installing a certificate

The easiest way to install your certificate is to send a request to Support . However, a custom certificate can be installed manually:

Stratus Panel - SSL > Let's Encrypt Cert

Mon, 01 Jan 0001 00:00:00 +0000

For a Let’s Encrypt certificate to be generated, your domain must be in the URLs and Domains list and be pointed to the MageMojo Route 53 name servers.

To enable the use of a Let’s Encrypt Certificate:

Go to SSL > Settings in the STRATUS sidebar menu.

Select Let’s Encrypt Certificate in Environment SSL.

Click UPDATE to confirm the change.

A certificate will be generated that matches all the valid domains, creating a multi-domain certificate if needed, and pushed to your CloudFront distribution. The update may take up to 30 minutes.

Stratus Panel - SSL > CSR

Mon, 01 Jan 0001 00:00:00 +0000

To create a CSR:

Go to SSL > CSR in the Webscale STRATUS sidebar menu.

Choose either existing New Domain or Existing Domain Make sure you have included all domains listed in the URL section including www versions.

Fill out the remaining sections fully. If you do not have an entry for Department, you may enter N/A

Click CREATE to create the CSR. A private key is created at the same time that you create the CSR and saved in the panel. You only need to provide the CSR to your SSL provider. The private key will be used during your SSL installation once ready.

Note: If you generate a wildcart certificate, make sure you also add the root domain. Example - Domain: *.mystore.com, SAN Domain: mystore.com

Stratus Panel - SSH > Info

Mon, 01 Jan 0001 00:00:00 +0000

Configuring for SSH Access

To use SSH on a Webscale STRATUS environment, there are three important components:

Info — see below for viewing the hostname and port number to access Webscale STRATUS via SSH.

[User](/docs/reference/stratus/control-panels/ssh-panel/users/ “Create and edit SSH users”/) — Users are individually created and managed for security access.

[Whitelist](/docs/reference/stratus/storage/whitelist/ “Manage whitelist IPs”/) — Additional security for access is managed by allowing only certain IPs to access a Webscale STRATUS environment.

Info Panel

To view your SSH access information, go to SSH > Info in the sidebar menu.

Stratus Panel - SSH > Users

Mon, 01 Jan 0001 00:00:00 +0000

It is highly recommended that individual SSH user accounts for each person who needs SSH access be created. This allows for access logging and the ability to remove a user if they no longer need access. Sharing SSH access among users can complicate future security issues related to personnel changes. Sharing also reduces accountability.

Create a SSH User

Go to SSH > Users in the sidebar menu.

Click + ADD SSH USER. * Username — Enter the login username. Do not use spaces or other special characters. * Enabled — Select “Yes” if you wish to make the new user active. Select “No” to keep them from logging into the STRATUS environment. * Password — Enter a password for the new user. Click on Generate Password to have the system create a random password. To View the password entered, click the Eye icon in the password field to reveal the hidden password. * Confirm Password — The created password must be entered into this field to confirm its accuracy. The Generate Password function will automatically fill this field. * Authorized Keys — If a generated Authorized Key is preferred, enter it in this field. See ssh.com article for more on Authorized Keys.

Whitelisted IPs — Each SSH user created can only be allowed access if their Internet Protocol (IP) address is whitelisted .

Click CREATE.

Once the user is created, the connection information used for the shell access can be easily copied on the Edit SSH User panel.

Stratus Panel - Access > Controlling Access

Mon, 01 Jan 0001 00:00:00 +0000

Since your Webscale STRATUS pricing is based on user sessions, it is prudent to restrict users to only those that should be visiting a Magento environment. For example, if a environment is not shipping or selling to customers in Russia, then visitors from Russia can be blocked.

STRATUS provides the following methods for controlling access:

[Protect Website](/docs/reference/stratus/control-panels/access-panel/protect-website/ “Configure website protection”/) — Set a sitewide username and password in order to access any part of the environment.

[Protect URL](/docs/reference/stratus/control-panels/access-panel/protect-url/ “Configure website URL protection”/) — Restrict access to specific URL paths in a Magento environment by setting a username and password.

[Restrict By IP Address](/docs/reference/stratus/control-panels/access-panel/restrict-ip/ “Configure IP restrictions”/) — Restrict access to an environment by allowing or denying specific IP addresses.

[Block Countries](/docs/reference/stratus/control-panels/access-panel/block-countries/ “Configure country blocking”/) — Block users who are trying to access a Magento environment based on their country location of access.

[Block Bots](/docs/reference/stratus/control-panels/access-panel/block-bots/ “Configure bots blocking”/) — Block unnecessary “bots” from indexing a Magento environment.

Stratus Panel - Access > Protect Website

Mon, 01 Jan 0001 00:00:00 +0000

Create Website Protection

To restrict access to the entire website:

Go to Access > Protect Website in the STRATUS Admin panel left sidebar menu.

Select Enabled.

Login — Enter a username.

Password — Enter a password. To create a random password, click Generate Password. To view the password, click the Eye Icon at the right of the password field.

Click UPDATE to save your new login.

You can only have one HTTP authorization password for a STRATUS environment.

Stratus Panel - Access > Protect URL

Mon, 01 Jan 0001 00:00:00 +0000

Create a Protection Rule

To create a path specific authorization rule:

Go to Access > Protect URL in the STRATUS left sidebar menu.

Choose + Add New Rule

Label — Enter a name for the rule.

Restricted URL — Enter the path to be restricted. If the store uses “.html” suffixes, include the suffix with the path. Entering a path ending in a slash ("/") will restrict all files within the directory.

Login — Enter a login username.

Password — Enter a password. To create a random password, click Generate Password. Once saved, passwords cannot be later seen; to view a password before saving, click the Eye Icon at the right end of the password field.

Click Create to save your new restriction.

Edit a Protection Rule

To edit an existing rule:

Stratus Panel - Access > Restrict by IP

Mon, 01 Jan 0001 00:00:00 +0000

Create a Restriction Rule

To create an IP restriction rule:

Go to Access > Restrict by IP Address in the STRATUS sidebar menu.

Select Redirect Visitor To URL Below If IP Doesn’t Match Rules if you wish to send a restricted user to a special webpage. This page can be on any website; it does not have to be on your STRATUS server. Enter the entire URL, including domain.

Select Deny IP Access To The Website, Except Allowed Below if you wish to apply a website-wide restriction to all visitors except any that are allowed by subsequent rules.

Click ADD IP RULE. * Label — Enter a name describing the rule for your use. * IP Address Or Subnet — Enter the IP number or subnet to be used for the rule. * Rule — Select “Allow” or “Deny” to the action preferred for visitors from the IP added to the rule.

Repeat Step 3 for each rule to be created.

Click UPDATE to apply the rules to the STRATUS environment.

Restriction Scenarios

To illustrate how to use this feature, the following are example scenarios.

Stratus Panel - Access > Block Countries

Mon, 01 Jan 0001 00:00:00 +0000

The location of the accessing IP is determined by lookups in databases that match IP numbers with known locations of IP address blocks. GeoIP is not perfect but it will block most of the traffic from a given country.

Country blocks, unlike the other access restrictions in the Access section, apply their block directly to your CloudFront distribution. All traffic is stopped before it reaches your STRATUS environment.

Create Country Blocks

To create blocks:

Stratus Panel - Access > Block Bots

Mon, 01 Jan 0001 00:00:00 +0000

Edit Bots List

Remember, user-agents added to this list will be blocked from accessing the website.

Go to Access > Block Bots in the Webscale STRATUS sidebar menu.

Add any user-agent you wish to the list. Each agent should be on a separate line. Each user-agent listed will block any user-agent that contains the name in the list.

Click UPDATE to save changes.

A user-agent value of “baidu” will block any user-agent containing “baidu” such as “baidu-agent,” “baiduuserfromsomewhere,” or “somebaiduagent.”

Stratus Panel - Cron > Info

Mon, 01 Jan 0001 00:00:00 +0000

Checking Cron Status

To check the status of the Cron service Go to Cron > Info in the Webscale STRATUS sidebar menu. Webscale STRATUS will check the status of the Cron service.

The Status will show “Running” if the Cron service is active and show “Stopped” if it is not running.

Note that the Cron service does not run on development environments .

The Cron service may also be stopped by clicking DISABLE.

Stratus Panel - Cron > Schedule

Mon, 01 Jan 0001 00:00:00 +0000

WARNING: do NOT add Cron tasks using the Crontab -e command via SSH. Your entries will be overwritten.

All Magento stores require a basic set of cron jobs to be set. Each cron job is a task executed according to a schedule. Additional cron tasks may be added as needed.

Create a Cron Task

To create a new Cron task:

Go to Cron > Schedule in the Webscale STRATUS sidebar menu.

Click + Add New Cron. * Label — Enter a name for the cron task for your use. * Enabled — Select “Yes” to set the taks to active or “No” for inactive. * Command — Enter the shell command to run at regular intervals. Be sure to use full paths to binaries and other files.

E.g., to run “mytask.php,” the command might look like /usr/bin/php /srv/mytask.php. * Common Cron Settings — Select one of the common interval settings or “Custom” to allow manual entry of interval values. For help in creating manual interval settings, see Crontab Guru .

Stratus Panel - Application > Stratus Template

Mon, 01 Jan 0001 00:00:00 +0000

Current options include:

Magento 2.2 (for Magento 2.2 and above)

Magento 2.1

Magento 2.0

Magento 1.X

Change Template

Go to Application > Stratus Template in the STRATUS sidebar menu.

Select the template most appropriate for the version of Magento installed.

Click UPDATE to save the change.

NOTE: Updating the template will relaunch STRATUS services, resulting in 1-2 minutes of downtime.

Stratus Panel - Application > Frontend URL

Mon, 01 Jan 0001 00:00:00 +0000

Frontend URLs must begin with https:// or http:// and end with a /.

Example: https://mysite.com/

Update Store Base URL

To update the Store Base URL:

Go to Application > Frontend URL in the Webscale STRATUS sidebar menu.

Enter the desired store base URL.

Click UPDATE to save the changes.

Using HTTP only (no SSL)

Using non-secure, http only protocol is not possible on Stratus as it is a requirement by CloudFront.

Stratus Panel - Application > Multisite and Multistore

Mon, 01 Jan 0001 00:00:00 +0000

Store domains can point to a Magento Website or Store scope depending on your needs.

Configuration of the Nginx server requires the following items:

Domain names used.

Website, Store, or Store View Codes for each domain, found in Stores > Manage Stores in the Magento Admin.

With the gathered information, compose each directive by a combination of domain-code-scope, with each component separated by a space, comma, or semicolon.

Stratus Panel - Application > Maintenance Mode

Mon, 01 Jan 0001 00:00:00 +0000

This function is the same as running php bin/magento maintenance:enable

Enable Maintenance Mode

To enable Magento Maintenance Mode,

Go to Application > Maintenance Mode in the Webscale STRATUS sidebar menu.

Select “Maintenance Mode Enabled”

Click UPDATE to save the change.

Disable Maintenance Mode

To disable Maintenance Mode,

Go to Application > Maintenance Mode in the Webscale STRATUS sidebar menu.

Deselect “Maintenance Mode Enabled”

Click Update to save the change.

Stratus Panel - Application > Deployment Mode

Mon, 01 Jan 0001 00:00:00 +0000

Changing the mode here is equivalent to the php bin/magento deploy:mode:set <mode> command.

To set the deployment mode for the Magento installation,

Go to Application > Deployment Mode in the STRATUS sidebar menu.

Select the desired deployment mode.

Click UPDATE to save and inact the changes.

Depending on the chosen mode, changes may take some time to complete. Production mode will initiate a compilation and other processes that will set a Magento 2 store into Maintenance mode until completed.

Stratus Panel - Application > Clear Cache

Mon, 01 Jan 0001 00:00:00 +0000

Equivalent to running php bin/magento cache:clean.

To clear the Magento and Varnish caches,

Go to Application > Clear Cache in the STRATUS sidebar menu.

Click CLEAR CACHE

The results of the operation will be displayed in the Result field when completed.

Stratus Panel - Application > CLI Commands

Mon, 01 Jan 0001 00:00:00 +0000

NOTE: Take caution when using these commands, as some may temporarily disable a Magento store or result in unfavorable results.

Some commands require arguments in order to properly work. For each selected command, Help about each command can be accessed for guidance on any required arguments.

To run any command,

Go to Application > CLI Commands in the Webscale STRATUS sidebar menu. * Step 1. — Select the desired command. * Step 2. — Enter any command arguments if applicable for the chosen command.

Click RUN COMMAND.

Results of the command will appear in the Result field.

Stratus Panel - CloudFront > Info

Mon, 01 Jan 0001 00:00:00 +0000

To fully understand how CloudFront operates within AWS, see the AWS CloudFront documentation .

To view and manage CloudFront for an environment, go to CloudFront > Info in the Webscale STRATUS sidebar menu.

Click ENABLE to turn on CloudFront caching.

Click DISABLE to turn off CloudFront caching. No assets will be cached. Traffic to the server is still directed through the CloudFront WAF.

Click FLUSH CACHE to reset the cache by invalidating the current CDN cache. Subsequent requests will rebuild the CloudFront cache.

Stratus Panel - CloudFront > HTTP2

Mon, 01 Jan 0001 00:00:00 +0000

To change the HTTP2 setting, go to CloudFront > HTTP2 in the STRATUS sidebar menu.

CloudFront HTTP2 — Select to enable.

Click UPDATE to save changes.

Stratus Panel - CloudFront > SSL

Mon, 01 Jan 0001 00:00:00 +0000

By default Force SSL is set to redirect all HTTP requests to HTTPS. This is the preferred setting. Paths are preserved (e.g. http://store.com/about-us will be automatically redirected to https://store.com/about-us) .

To change the SSL setting, go to CloudFront > SSL in the STRATUS sidebar menu.

CloudFront Force SSL — Select to enable.

Click UPDATE to save changes.

Stratus Panel - CloudFront > Compression

Mon, 01 Jan 0001 00:00:00 +0000

If you would like to use Brotli instead, you may switch this under Cloudfront->Compression.

Note: Changing the compression format from gzip to brotli for the first time will trigger the restart of nginx container.

Stratus Panel - Nginx > Info

Mon, 01 Jan 0001 00:00:00 +0000

To view or reload the Nginx configuration, go to Nginx > Info in the Webscale STRATUS sidebar menu.

Click RELOAD to reload the Nginx configuration after any update and change has been made in its configuration.

Copy the Nginx configuration for review and use by clicking the copy icon in the Nginx Configuration field.

Stratus Panel - Nginx > Document Root

Mon, 01 Jan 0001 00:00:00 +0000

For both Magento 1 and 2, this is where the index.php file is located.

On a Magento 1 site, the following are common files found in the document root directory:

index.php

media

skin

js

For Magento 2, the following are found in the document root directory:

index.php

pub

generation (Magento 2.2)

NOTE: changing the document root directory can have unexpected consequences to your environment. Changes to this setting should be carefully considered. Webscale STRATUS can only support one document root.

Stratus Panel - Nginx > Redirects

Mon, 01 Jan 0001 00:00:00 +0000

The formate of a redirect is /From_Path=To_Path_URL

To configure redirects,

Go to Nginx > Redirects in the STRATUS sidebar menu.

Enter the desired redirects in the field. Put each redirect on a separate line.

Click UPDATE to save changes.

Stratus Panel - Nginx > Includes

Mon, 01 Jan 0001 00:00:00 +0000

Nginx includes are easy to add in Webscale STRATUS, but can be difficult to master. Incorrectly coded includes can result in undesirable results and should never be added to a Production environment without fully testing on another environment.

The following are two examples provided by Stratus customers. Do not use these as-is on a Production environment and always test all includes on a non-Production environment before deploying.

WordPress

Add this to get WordPress working in a subdirectory of your web-root, substituting the blog path for the particular sub-directory.

Stratus Panel - PHP > Info

Mon, 01 Jan 0001 00:00:00 +0000

To view the PHP information, go to PHP > Info in the Webscale STRATUS sidebar menu.

Click RELOAD to reload the PHP configuration. The Status value (Enabled/Disabled) refers to the PHP status service.

To copy any of the fields shown, click the Copy Icon in the upper-right of the field.

Webscale STRATUS provides additional tools related to managing PHP on a server:

Version allows the changing of the PHP version used.

Options provides for manually setting certain PHP parameters.

Blackfire for enabling the Blackfire service.

Xdebug for enabling Xdebug profiling.

Stratus Panel - PHP > Version

Mon, 01 Jan 0001 00:00:00 +0000

Please note that PHP 5.6, 7.0, and 7.1 are End Of Life

PHP Version

To change the version of PHP used:

Go to PHP > Version in the Webscale STRATUS sidebar menu.

Select the version of PHP desired.

Click UPDATE to save changes.

Composer Version

To change the version of Composer used. (This option is only available for PHP 7.3+)

Go to PHP > Version in the Webscale STRATUS sidebar menu.

Select the version of Composer desired. note: Composer 2 is required for Magento 2.4.3+ Release Date: April 27 2021

Click UPDATE to save changes.

Stratus Panel - PHP > Options

Mon, 01 Jan 0001 00:00:00 +0000

To update PHP configuration values:

Go to PHP > Options in the STRATUS sidebar menu.

Edit the PHP values in the field.

Click UPDATE to save changes.

Stratus Panel - PHP > Blackfire

Mon, 01 Jan 0001 00:00:00 +0000

To enable Blackfire:

Go to PHP > Blackfire in the Webscale STRATUS sidebar menu. * Blackfire Service — Click ENABLE. * Server ID — Enter the Server ID value provided by Blackfire. * Server Token — Enter the Server token provided by Blackfire.

Click UPDATE to save changes.

Stratus Panel - PHP > Xdebug

Mon, 01 Jan 0001 00:00:00 +0000

To enable Xdebug:

Go to PHP > Xdebug in the Webscale STRATUS sidebar menu. * Xdebug Service — Click ENABLE. * Trace File Output Format — Select the format for the debugging output. * Trace Enable Trigger Value — Used for triggering the tracer using a browser plugin. * Profiler Enable Trigger Value — Used for enabling profiling with a browser plugin. * IDE Key — Enter a default IDE Key value, such as “xdebug.atom” for Atom IDE.

Click UPDATE to save changes.

Stratus Panel - PHP > Datadog

Mon, 01 Jan 0001 00:00:00 +0000

To enable Datadog:

Go to PHP > Datadog in the Webscale STRATUS sidebar menu

License Key — Enter license key provided by Datadog

Click UPDATE to save changes.

Under Service — Click ENABLE.

Stratus Panel - PHP > Tideways

Mon, 01 Jan 0001 00:00:00 +0000

To enable Tideways:

Go to PHP > Tideways in the Webscale STRATUS sidebar menu. * Tideways — Click ENABLE. * API Key — Enter a the API Key value given to you by Tideways.

Click UPDATE to save changes.

Stratus Panel — NodeJS > Info

Mon, 01 Jan 0001 00:00:00 +0000

Webscale STRATUS includes the ability to enable NodeJS for headless environments like PWA Studio and Vue Storefront .

NOTE: before enabling the NodeJS container, complete the initial configuration .

To manage the NodeJS service, go to NodeJS > Info in the STRATUS sidebar menu.

To enable NodeJS, click ENABLE.

To disable NodeJS, click DISABLE.

There may be 1-2 minutes of downtime why the Webscale STRATUS environment restarts.

Stratus Panel — NodeJS > PWA

Mon, 01 Jan 0001 00:00:00 +0000

Here you will see all the domains applied to your headless environment.

You may choose to set them to PHP or NodeJS. Selecting either changes the fastcgi backend proxy in the Nginx configuration. If a domain is set to PHP, it will forward to PHP-FPM. (/srv/public_html/ or custom docroot /) If NodeJS is selected, the requests will be routed to NodeJS. (/srv/pwa/)

This way you can host normal Magento 2 or PHP views alongside separate PWA applications for your store. Select and configure each domain as needed for your application.

Stratus Panel - MySQL > Info

Mon, 01 Jan 0001 00:00:00 +0000

There is currently no phpMyAdmin or other visual DB editor available on Webscale STRATUS. It is recommended to utilize mysql-cli, or remote MySQL connection

To restart the MySQL server instance, click RESTART.

To copy any field, click the copy icon in the upper-right of any field.

Using MySQL Commands

The database on Webscale STRATUS can be accessed directly via the mysql command or the n98-magerun and n98-magerun2 (Magento 2) tools can be used with credentials already set in local.xml or env.php of the Magento store.

Stratus Panel - MySQL > Process List

Mon, 01 Jan 0001 00:00:00 +0000

To view MySQL processes, go to MySQL > Process List in the Webscale STRATUS sidebar menu.

To copy the process list for use elsewhere, click the copy icon in the upper-right of the field.

To refresh the process list, click Refresh in the lower left corner.

Stratus Panel - MySQL > Databases

Mon, 01 Jan 0001 00:00:00 +0000

Adding a database: To add a database, type the database name and click the + symbol.

Removing a database: To remove a database, click the trashcan symbol next to the database name.

NOTE: The main database and user that is provided to you for your environment will not be listed here. This section is dedicated only for additional databases. You may view the details for your main database under Mysql -> Info

Stratus Panel - MySQL > Users

Mon, 01 Jan 0001 00:00:00 +0000

Adding a user: To add a database user, type the user name, hostname and password then click the CREATE button. % (wildcard) may be used as a default for the hostname.

Removing a user: To remove a database user, click the user in question then click the DELETE button.

Once a database user is created, you will find permission settings at the bottom of that user’s screen per database.

Stratus Panel - Memcache

Mon, 01 Jan 0001 00:00:00 +0000

If the environment is using Memcache, go to Memcache > Info.

To flush the cache, click FLUSH CACHE.

To copy any field value for other use, click the copy icon in the upper-right of any field.

Stratus Panel - Redis > Full Page Cache

Mon, 01 Jan 0001 00:00:00 +0000

To view and flush the Redis cache, go to Redis > Redis Full Page Cache in the Webscale STRATUS sidebar menu.

To flush the cache, click FLUSH CACHE.

Choose the version of Redis.

Click UPDATE to commit the version change.

To copy any field value, click the copy icon in the upper-right of any field.

Stratus Panel - Redis > Config Cache

Mon, 01 Jan 0001 00:00:00 +0000

To enable Redis caches on STRATUS, go to Redis > Config Cache in the Webscale STRATUS sidebar menu.

To enable Redis cache, click ENABLE.

To disable Redis cache, click DISABLE

To flush the cache, click FLUSH CACHE

To set the version you wish to use, choose the version, then click UPDATE.

Stratus Panel - Redis > Sessions

Mon, 01 Jan 0001 00:00:00 +0000

To enable Redis sessions on STRATUS, go to Redis > Sessions in the Webscale STRATUS sidebar menu.

To enable Redis sessions, click ENABLE.

To disable Redis sessions, click DISABLE

To flush the cache, click FLUSH CACHE

To set the version you wish to use, choose the version, then click UPDATE.

Stratus Panel - Varnish > Info

Mon, 01 Jan 0001 00:00:00 +0000

For more on configuration for Varnish, see Enabling Varnish on Stratus

To access Varnish controls, go to Varnish > Info in the Webscale STRATUS sidebar menu.

To enable Varnish, click ENABLE.

To disable Varnish, click DISABLE

To flush the varnish cache, click FLUSH CACHE

To copy any field value for other use, click the copy icon in the upper-right of any field.

Stratus Panel - Varnish > Version

Mon, 01 Jan 0001 00:00:00 +0000

Magento 2.3.3+ supports Varnish version 6.

To change your version,

Go to Varnish > Version in the STRATUS sidebar menu.

Select the version of Varnish you wish to run.

Click UPDATE to save changes.

NOTE: changing the version will cause a reboot of your installation.

Stratus Panel - Varnish > VCL

Mon, 01 Jan 0001 00:00:00 +0000

To add a custom VCL,

Go to Varnish > Info in the Webscale STRATUS sidebar menu.

Select Custom VCL.

Enter the configuration in the VCL field.

Click UPDATE to save changes.

NOTE: there will be a short downtime as the system restarts with the new Varnish configuration.

For more on configuration for Varnish, see Enabling Varnish on Stratus

Stratus Panel - Varnish > URL Cache

Mon, 01 Jan 0001 00:00:00 +0000

To purge specific items in the Varnish cache,

Go to Varnish > URL Cache in the Webscale STRATUS sidebar menu.

Select the Base URL for the items to be purged.

Enter a directory or file path in Subpath. Directory paths will purge all items in the target directory including sub-directories.

Click CLEAR CACHE.

Stratus Panel - Elasticsearch > Info

Mon, 01 Jan 0001 00:00:00 +0000

Elasticsearch indexes a Magento store and provides rapid search results for customers.

With Magento 2.3+, Elasticsearch is available to Magento Community stores. Magento 1.x stores can use Elasticsearch through third-party extensions.

You can change the version of Elasticsearch under Elasticsearch -> Version.

You must also configure Magento to use Elasticsearch.

To view the status of Elasticsearch in Webscale STRATUS, go to Elasticsearch > Info in the STRATUS sidebar menu.

Stratus Panel - Elasticsearch > Version

Mon, 01 Jan 0001 00:00:00 +0000

Older extensions for Magento 1 will require version 2.x (e.g. version 2.3, version 2.4) depending on the requirements of the extension.

For Magento Community 2.3+, please check the supported version here: System Requirements

To change the Elasticsearch version,

Go to Elasticsearch > Version in the Webscale STRATUS sidebar menu.

Select the desired Elasticsearch version from the dropdown.

Click UPDATE to save the changes.

You must also configure Magento to use Elasticsearch.

Stratus Panel - Elasticsearch > Configuration

Mon, 01 Jan 0001 00:00:00 +0000

To access the Elastricsearch configuration panel, go to Elasticsearch > Configuration in the Webscale STRATUS sidebar menu.

After entering configurations, click UPDATE.

Stratus Panel - Sphinx > Info

Mon, 01 Jan 0001 00:00:00 +0000

NOTE: before enabling Sphinx, complete the initial Sphinx configuration .

To manage the Sphinx service, go to Sphinx > Info in the Webscale STRATUS sidebar menu.

To enable Sphinx, click ENABLE.

To disable Sphinx, click DISABLE.

There may be 1-2 minutes of downtime why the Webscale STRATUS environment restarts.

Stratus Panel - Sphinx > Configuration

Mon, 01 Jan 0001 00:00:00 +0000

Configure the Mirasvit extension with the following settings:

Set the Engine to “External Engine”

Set the path to “/usr/bin/searchd” on port 9312

Set the host/ip to “sphinx”

Under Additional Configuration > Custom Base Path, add “/srv/public_html/var/sphinx”

Save the configuration

This will generate a sphinx.conf in var/sphinx in the Magento document root. This file must be generated before enabling Sphinx in the Sphinx Info panel .

The location of the configuration file should be set in the Sphinx Configuration panel.

Stratus Panel - RabbitMQ > Info

Mon, 01 Jan 0001 00:00:00 +0000

To manage the RabbitMQ service, go to RabbitMQ > Info in the Webscale STRATUS sidebar menu.

To enable RabbitMQ, click ENABLE.

To disable RabbitMQ, click DISABLE.

To reset all RabbitMQ data, click RESET DATA.

To copy the report information, click the copy icon in the upper-right of the Report field.

NOTE: changing the service status will reploy all Webscale STRATUS services, resulting in a momentary downtime.

Stratus Panel - RabbitMQ > Version

Mon, 01 Jan 0001 00:00:00 +0000

To change the RabbitMQ version, go to RabbitMQ > Version in the Webscale STRATUS sidebar menu.

Select the correct version of RabbitMQ according to the Magento System Requirements .

Click UPDATE.

NOTE: changing the service status will redeploy all Webscale STRATUS services, resulting in a momentary downtime.

Stratus Panel - RabbitMQ > Configuration

Mon, 01 Jan 0001 00:00:00 +0000

These credentials are only used during the initial deployment of RabbitMQ. If these credentials are changed after starting RabbitMQ, the change will not affect an existing user. See Configuring RabbitMQ for more information.

To update the RabbitMQ credentials,

Go to RabbitMQ > Configuration in the Webscale STRATUS sidebar menu.

Enter the RabbitMQ credentials.

Click UPDATE to save changes.

Stratus Panel - Vitals

Mon, 01 Jan 0001 00:00:00 +0000

Alerts

Uptime: Uptime based as probe success within the chosen time frame. Only monitored if your environment is considered live.

Autoscaling Status: This reports if Autoscaling is ON or OFF. If you are on a legacy Resource Based Plan (RBP), this will be N/A.

Status Codes: HTTP Status Codes per domain within the chosen time frame. Only monitored if your environment is considered live.

Response Time: Response time in seconds within the chosen time frame. Only monitored if your environment is considered live.

Stratus Guides - Deploying

Mon, 01 Jan 0001 00:00:00 +0000

Despite the incredible sophistication of the Webscale STRATUS cloud platform, Webscale STRATUS deployments are fairly straightforward and familiar.

Pre-checks:

Make sure that all symlinks are using absolute paths.

Note that CloudFront may take up to 15 minutes to clear.

Deployment Examples

To deploy code to Webscale STRATUS, use SSH and push the code, move symlinks, and flush caches. The built-in CLI commands provided in the Webscale STRATUS Control panel can also be used to assist.

Stratus Guides - Zero Downtime Deployment

Mon, 01 Jan 0001 00:00:00 +0000

Autoscaling must be enabled to use Zero Downtime Deployment (ZDD). Learn more about Autoscaling .

How it works

ZDD consists of two Webscale STRATUS CLI commands, the zerodowntime.init command followed by the zerodowntime.switch command.

Prior to running any of the commands, you should enable Autoscaling and the Zero Downtime Deploy option on the Autoscaling page in the Webscale STRATUS panel. Enabling ZDD may take up to a minute of downtime.

With autoscaling enabled, you can now perform zero downtime deploys. An example flow:

Stratus Guides - Going Live

Mon, 01 Jan 0001 00:00:00 +0000

Each store is unique and may require slight variations from the sequence shown. Developers may contact Stratus support for assistance. Webscale Stratus provides free migration to a new STRATUS environment. Please consult how migrations work .

The following is a typical, example launch sequence on a Webscale STRATUS environment based on a an existing application that is migrated to STRATUS.

Prepare the Webscale STRATUS Environment

Before any go-live, test a copy of the store for all functionality.

Stratus Guides - STRATUS CLI

Mon, 01 Jan 0001 00:00:00 +0000

The following commands are accessible via SSH access. See the SSH > Info Webscale STRATUS Control panel for access parameters.

Help

Run /usr/share/stratus/cli help for a list of viewable commands with descriptions.

Command Format

CLI commands are entered as /usr/share/stratus/cli <command>. For example, to use the command database.config run /usr/share/stratus/cli database.config

Common Commands

autoscaling.reinit

If autoscaling is enabled, this command will issue a redeploy of PHP-FPM services and update the code copied out to the various physical nodes. This is a rolling redeployment for zero environment downtime and minimal site downtime. The command executes asynchronously and will return before all the redeployment is completed. It is for legacy deploys only. This command should not be used if you are using Zero-Downtime Deployment

Stratus Guides - Default Cron Configurations

Mon, 01 Jan 0001 00:00:00 +0000

Use the following as a guide for configuring production environments in the Webscale STRATUS Cron > Schedule panel.

Magento 1

Magento 1 requires cron.sh to run every minute to update and execute it’s internal schedule. On a default Webscale STRATUS environment that configuration would be:

To configure the cron using crontab via shell access, enter:

* * * * * /bin/bash /srv/public_html/cron.sh >> /srv/public_html/var/log/cron.log 2>&1

Magento 2

Magento 2.x requires three cron tasks. By default, these are already configured on every new Webscale STRATUS environment. If the document or web roots are changed, the tasks will need updated to show the correct file paths.

Stratus Guides - New Relic

Mon, 01 Jan 0001 00:00:00 +0000

When purchasing or obtaining a New Relic license, please choose the option “Self-Hosted Environment.” Stratus currently supports New Relic APM only. (NRAL KEYS) Once a license key is received, open a support ticket to have the key added to the Webscale STRATUS environment.

Adding your own license will populate trace data for any transactions over 2 seconds to your New Relic account, so you may need to wait 24 hours after adding the license to analyze any findings.

Stratus Guides - Cloudflare DNS Setup

Mon, 01 Jan 0001 00:00:00 +0000

NOTE: when using Cloudflare for DNS, Webscale cannot assign or install a Let’s Encrypt certificate; LE certficates can only be installed when using the Webscale Route 53 nameservers. Furthermore, certificates issued and signed by Cloudflare cannot be installed on Webscale STRATUS. Certificates must be issued by a publicly trusted Certificate Authority (CA), such as ACM or those listed by the Mozilla Foundation . For more information, see “Continually Enhancing Domain Security on Amazon CloudFront” .

Stratus Guides - Backup Strategies

Mon, 01 Jan 0001 00:00:00 +0000

Backup to Amazon S3 Bucket

The AWS CLI comes preinstalled on Stratus. Run aws configure and follow the prompts entering the appropriate region and access key for your AWS account.

Example:

$ aws configure AWS Access Key ID [None]: ABCDEFGHIJKLMNOPQRSTUVWXYZ AWS Secret Access Key [None]: FaK3S3Cr3tAcc3SSK3yF0rFun Default region name [None]: us-east-1 Default output format [None]: text
Run aws s3 ls to show your existing buckets and manage other AWS resources.

Stratus Guides - Debugging Cron Errors

Mon, 01 Jan 0001 00:00:00 +0000

NOTE: All Magento 2 stores hosted on Webscale STRATUS are required to have installed the [MageMojo Cron extension](/docs/reference/stratus/guides/magento-2/magemojo-cron/ “MageMojo Magento 2 Cron extension information”/). This extension helps prevent many of the cron issues inherent with Magento 2.

Debugging Magento Cron Tasks

Magento has its own default cron that runs and executes internal jobs and schedules. The best way to confirm these are running is using the [n98-magerun(2) utility][1].

To confirm any jobs have ran recently, do the following:

Stratus Guides - Other CDNs

Mon, 01 Jan 0001 00:00:00 +0000

When using other proxy services you introduce routing complexities. A request to an environment will first route through your proxy provider’s edge location, then to the CloudFront edge location and on to the AWS home region.

In these cases, STRATUS has no control of the full request flow. Support becomes more difficult due to a lost of visibility and diagnostics for systems outside of Webscale STRATUS.

In some cases, these services develop technical issues of their own, from routing/request failures or customer misconfigurations. Adding the additional proxy increases latency on every request to your environment.

Stratus Guides - Rotating Magento Logs

Mon, 01 Jan 0001 00:00:00 +0000

To setup Logrotate to automatically rotate Magento logs:

Create a directory outside of the webroot to hold the config files:

mkdir /srv/etc/ mkdir /srv/etc/logrotate

Create a logrotate.conf file with the following content:

/srv/public_html/var/log/*.log { su magemojo magemojo daily missingok rotate 30 compress delaycompress notifempty olddir /srv/scaled/var/log/old/ }

su magemojo magemojo — Ensures that permissions stay correct

daily – Run once a day at time set by cron job

missingok — Don’t panic if empty

rotate 30 — Retain for 30 days

compress — Compress 2nd most recent file

delaycompress — Do not compress newest rotated log

notifempty — Do not rotate empty files

Add a [cron job](/docs/reference/stratus/control-panels/cron-panel/schedule/ “Cron Schedule Control Panel”/) to run once a day at the correct time:

Stratus Guides - Using Symlinks

Mon, 01 Jan 0001 00:00:00 +0000

Good Example:

env.php -> /srv/shared/app/etc/env.php
Bad Example:

env.php -> ../../../../env.php

Stratus Guides - Blackfire.io

Mon, 01 Jan 0001 00:00:00 +0000

NOTE: XDebug and Blackfire can never be used together.

Log into a Blackfire.io account.

Set up an environment or profile to obtain a Server ID and Server Token. To get started, first make sure you have an account with Blackfire.io. Set up an environment or profile so that you have a Server ID and Server Token.

Go to the [PHP > Blackfire][2] Admin panel.

Enter the [information as indicated](/docs/reference/stratus/control-panels/php-panel/blackfire/ “Blackfire Control Panel”/).

Using the Chrome or Firefox browser extensions, start profiling the Webscale STRATUS site direct from a browser.

Stratus Guides - Using Xdebug

Mon, 01 Jan 0001 00:00:00 +0000

While a powerful tool, Xdebug can drastically slow down a store if used in production, even when not actively tracing or profiling anything. It is highly advised to not use Xdebug on a Production environment unless absolutely necessary.

Xdebug has a variety of settings. By default Xdebug is configured in Webscale STRATUS to cover most situations. There are three ways to use Xdebug:

Profiling — outputs cachegrind files on the Webscale STRATUS file system to evaluate request performance

Tracing — outputs trace files on the file system with full output of all function calls with function processing times

Debug — connects a local IDE via SSH tunnel on Webscale STRATUS to step through code when called via browser request

Setup

Install the Chrome extension to trigger the profiling and tracing in Xdebug.

Stratus Guides - Configuring RabbitMQ

Mon, 01 Jan 0001 00:00:00 +0000

Consumers

To see a list of available consumers that you can set to run, use:

php bin/magento queue:consumers:list

Please note the following:

In a production environment the host will be rabbitmq

In a development environment the host will be 0.0.0.0, unless Autoscaling is enabled then the host will remain rabbitmq.

Below is an example configuration of the env.php file.

'cron_consumers_runner' => [ 'cron_run' => true, 'max_messages' => 0, 'consumers' => [ 'async.operations.all', 'codegeneratorProcessor', 'product_action_attribute.update', 'product_action_attribute.website.update', 'exportProcessor' ] ], 'queue' => [ 'amqp' => [ 'host' => 'rabbitmq', 'port' => '5672', 'user' => 'username', 'password' => 'yb2sovjbaa4atsbbn0s0ccm9uddekh6i', 'virtualhost' => '/', 'ssl' => 'false', 'ssl_options' => [] ] ],

A simple one-line command to add RabbitMQ queue to env.php file is:

Stratus Guides - Node.js Node Version Manager

Mon, 01 Jan 0001 00:00:00 +0000

Documentation for NVM can be found in Github .

Helpful Commands

To show available versions:

$ nvm ls-remote

To install a specific version:

$ nvm install v13.10.0

To confirm installed versions:

$ node -v v14.2.0 $ npm -v 6.14.4

To switch through installed versions nvm provides the nvm use command. This works similarly to the install command.

For example, to switch to Node.js version 13.6.0:

Stratus Guides - Updating Base URLs

Mon, 01 Jan 0001 00:00:00 +0000

Base URLs are one of the most important parts of Magento and they can cause serious trouble if not entered correctly. The following is a remedy you can use to easily correct Base URLs that have been incorrectly entered.

Within the Magento Admin, Base URLs exist within the Stores > Configuration > General > Web panel.

Note that only two fields have an actual URL, the rest have placeholder variables that file in the domain automatically. This is typical of every Magento install, though some configurations have custom media/skin/js values for use with CDNs or other customizations.

Stratus Guides - Multistore Subfolder Configuration Method

Mon, 01 Jan 0001 00:00:00 +0000

Create the desired folder within the /pub/ directory in your root directory (for this example, we will use “en”). mkdir /srv/public_html/pub/en

Create the required symlinks within the new folder. Make sure they are absolute to prevent any issues with [autoscaling](/docs/reference/stratus/control-panels/autoscaling/ “Autoscaling control panel”/). For example:

cd /srv/public_html/pub/en ln -s /srv/public_html/app app

Once completed, the `/en` directory should appear like this: lrwxrwxrwx 1 www www 10 Mar 23 14:07 app -> /srv/public_html/app/ lrwxrwxrwx 1 www www 19 Mar 23 14:08 index.php -> /srv/public_html/pub/index.php lrwxrwxrwx 1 www www 10 Mar 23 14:08 lib -> /srv/public_html/lib/ lrwxrwxrwx 1 www www 27 Mar 23 17:13 media -> /srv/public_html/pub/media/ lrwxrwxrwx 1 www www 28 Mar 23 17:13 static -> /srv/public_html/pub/static/ lrwxrwxrwx 1 www www 10 Mar 23 14:08 var -> /srv/public_html/var/

Add the following code to the [Nginx includes](/docs/reference/stratus/control-panels/nginx-panel/includes/ “Nginx Includes control panel”/). Adjust the subfolder name, “/en”, in each occurence (7) to the actual subfolder you prefer, and the store code, “en_store_view”, in the one occurence.

`location /en/ { index index.php index.html index.htm; try_files $uri $uri/ /en/index.php?$args ; location ~* .php$ { expires off; fastcgi_pass php-fpm; fastcgi_keep_conn on; fastcgi_buffer_size 128k; fastcgi_buffers 4 256k;

Stratus Guides - Magento Optimal Configuration

Mon, 01 Jan 0001 00:00:00 +0000

Make sure to review the Magento configuration if there are performance issues, as it could turn out to be a simple toggle in the Magento Admin, saving valuable developer time.

Please see our Magento Requirements for a full list of items STRATUS requirements for hosting Magento stores.

Magento 1.x Recommended Settings

Enable all caches (System > Cache Management)

Enable flat products and categories (System > Configuration > Catalog > Frontend)

Disable and clear the Magento compiler (Note, the compiler does not run properly on PHP > 5.3)

Enable merged CSS/JS (be aware that this can break some sites)

Install an FPC module and use Redis (Lesti FPC is a good free option)

Redis cache

Redis sessions

Keep your log tables clean (e.g., log_url, log_url_info, log_visitor,log_visitor_info)

Set indexing mode to “manual.”

Magento 2.x Recommended Settings

Enable all caches.

Beginning with Magento 2.1, enabling flat catalogs is NOT recommended as a best practice.

Deploy static files (automatic with production mode deploys)

Enable production mode and compilation.

Enable the Varnish FPC instead of the built-in FPC .

Use [Elasticsearch for search (2.3+ and EE)][4].

Disable merged CSS (can cause performance issues on some stores).

Redis cache

Redis sessions

Set indexing mode to “Schedule.”

Install MageMojo Cron

Further optimization

For even more site speed, a skilled developer may be able to uncover additional speed gain possibilities:

Stratus Guides - PWA and Headless Commerce

Mon, 01 Jan 0001 00:00:00 +0000

What are PWAs?

PWAs utilize some of the latest technologies that can load blazingly fast. Along with incredible speed, PWAs (otherwise referred to as headless ecommerce) deliver a highly-customized and consistent user experience across the plethora of device types and interfaces used by online consumers. Not to mention, PWAs compliment MageMojo’s industry defining hosting to give you websites that load in the blink of an eye. Developers can use static site generators to launch highly engaging PWA storefronts that can then be connected to ecommerce platforms on the backend.

Stratus Guides - SSH Tunnels

Mon, 01 Jan 0001 00:00:00 +0000

Before you can connect, you need several pieces of information:

A working SSH login to your Webscale STRATUS environment.

The IP address that will connect to the Webscale STRATUS MySQL (i.e., the same IP allowed for SSH access)

Your database credentials. In your Webscale STRATUS management panel, expand the MySQL section and click Info to see your database username and password

If you have the above, you can proceed.

Creating a Tunnel with PuTTY

Open PuTTy on your computer.

Enter the SSH Host address shown SSH > Info.

Stratus Guides - SFTP

Mon, 01 Jan 0001 00:00:00 +0000

Secure FTP (SFTP) access is provided by automatically by using the same [hostname](/docs/reference/stratus/control-panels/ssh-panel/info/ “Find your hostname and port number”/), [port](/docs/reference/stratus/control-panels/ssh-panel/info/ “Find your hostname and port number”/), [user](/docs/reference/stratus/control-panels/ssh-panel/users/ “Create and manage users”/), and [whitelist](/docs/reference/stratus/storage/whitelist/ “Create and manage allowed IPs”/) information for accessing via SSH.

When accessing the Webscale STRATUS environment, SFTP may need to be specifically chosen as the “protocol” in the FTP access software.

Stratus Guides - DNS Recommendations

Mon, 01 Jan 0001 00:00:00 +0000

With Webscale STRATUS, there are three options for configuring your DNS.

Preferred — [Route 53][12] is provided with Webscale STRATUS and can host domains through the STRATUS DNS management system. Domains configured using the MageMojo Route 53 instance are pointed to a CloudFront distribution directly and will take full advanted of CloudFront Global Edge Node caching.

Acceptable — DNS solutions that support CNAME ALIAS for flattening may be used. This method is supported by Cloudflare as well as Route 53. When using Cloudflare do not use the Cloudflare CDN alongside STRATUS.

For Temporary Use Only — A DNS A record may be used to point to a particular CloudFront edge note. However, this IP is very likely to change and would require updates to A records. This method is not supported or guaranteed to work.

NOTE: Free Let’s Encrypt SSL Certificates provided by Webscale will only work with the Preferred method.

Stratus Guides - Sucuri DNS Setup

Mon, 01 Jan 0001 00:00:00 +0000

While entering a domain, there will be no need to select the other options provided. Click Add Site to add the domain to Sucuri.

Sucuri will automatically grab the IP address for a specific CloudFront edge server. While workable, it does introduce a single point of failure. To avoid this, provide Sucuri with the CNAME for the CloudFront Endpoint. This can be retrieved from the DNS panel of STRATUS.

Stratus Guides - Cloudflare DNS Setup

Mon, 01 Jan 0001 00:00:00 +0000

NOTE: when using Cloudflare for DNS, Webscale cannot assign or install a Let’s Encrypt certificate; LE certficates can only be installed when using the Webscale Route 53 nameservers. Furthermore, certificates issued and signed by Cloudflare cannot be installed on Webscale STRATUS. Certificates must be issued by a publicly trusted Certificate Authority (CA), such as ACM or those listed by the Mozilla Foundation . For more information, see [“Continually Enhancing Domain Security on Amazon CloudFront”][3].

Stratus Guides - MySQL Queries Gone Wild

Mon, 01 Jan 0001 00:00:00 +0000

Accessing MySQL on Webscale STRATUS

To access your Magento MySQL instance on Webscale STRATUS:

Access your Magento install via SSH.

Navigate to the Magento web root (typically, public-html/).

Run n98-magerun db:console (Magento 1) or n98-magerun2 db:console (Magento 2).

Run the query you desire.

To Get Table Sizes

SELECT CONCAT(table_schema, '.', table_name), CONCAT(ROUND(table_rows / 1000000, 2), 'M') rows, CONCAT(ROUND(data_length / ( 1024 * 1024 * 1024 ), 2), 'G') DATA, CONCAT(ROUND(index_length / ( 1024 * 1024 * 1024 ), 2), 'G') idx, CONCAT(ROUND(( data_length + index_length ) / ( 1024 * 1024 * 1024 ), 2), 'G') total_size, ROUND(index_length / data_length, 2) idxfrac FROM information_schema.TABLES ORDER BY data_length + index_length DESC LIMIT 10;

To “Blackhole” Magento 1 Log Tables

There are a number of log-related tables that get bloated very quickly. These tables are rarely referred to by Magento store owners. If you don’t anticipate needing the data from these tables, then you should empty and “blackhole” them.

Stratus Guides - Redis Cache Configuration

Mon, 01 Jan 0001 00:00:00 +0000

Webscale STRATUS does not allow cache to be stored in files or the database.

Redis caches are controlled and configured in the Redis section of the Webscale STRATUS Control panel.

Accessing Redis Cache via SSH

The Webscale STRATUS Redis services are accessible directly via SSH :

redis-cli -h redis -p 6379 redis-cli -h redis-config-cache -p 6381 redis-cli -h redis-session -p 6380
In addition to the Webscale STRATUS Control panel, Redis commands can be used to control the Redis cache on the STRATUS install. With exception to Varnish for the Magento 2 FPC, Redis is recommended for all caches on Webscale STRATUS.

Stratus Guides - Session Cache Configuration

Mon, 01 Jan 0001 00:00:00 +0000

NOTE: All Magento stores on STRATUS are required to use either Redis (recommended) or Memcache for session storage. Sessions cannot be stored in files nor in the database. See [Magento Requirements](/docs/reference/stratus/about-webscale-stratus/magento-requirements/ “STRATUS Magento Requirements”/) for the full list of requirements.

Redis

Redis can be enabled, disabled, or flushed in the [Redis > Config Cache][2] STRATUS Control panel.

Using CLI commands:

To view: redis-cli -h redis-session info | tail -4

To flush sessions: redis-cli -h redis-session -p 6380 FLUSHALL

NOTE: Sessions do NOT clear with the /usr/share/stratus/cli cache.all.clear command nor do they clear during a redeploy.

Stratus Guides - Clearing Opcache

Mon, 01 Jan 0001 00:00:00 +0000

The Webscale STRATUS CLI can also be used to clear the opcache instead of this method.

On all Webscale STRATUS sites, the hostname:port is phpfpm:9000.

To use Cachetool , configure these settings in .cachetool.yml:

adapter: fastcgi fastcgi: php-fpm:9000 temp_dir: /srv/tmp
For PHP 7.0.x, download the following file:

wget -c https://github.com/gordalina/cachetool/raw/gh-pages/downloads/cachetool-3.2.1.phar

For PHP 7.1 or 7.2, download:

wget -c http://gordalina.github.io/cachetool/downloads/cachetool.phar

The file must be renamed .cachetool.yml. CacheTool will look for this file in the current directory.

Stratus Security Guides - Blocking Countries

Mon, 01 Jan 0001 00:00:00 +0000

Webscale STRATUS gives you the ability to block traffic from selected countries.

To block certain countries from accessing a Webscale STRATUS install, use Access > Block Countries in the Webscale STRATUS Control panel.

Stratus Security Guides - Securing a Magento Store

Mon, 01 Jan 0001 00:00:00 +0000

Regardless of these efforts, an e-commerce store remains accessible by the public-at-large and therefore can be subject to additional attempts to compromise security.

To give your store additional protections,

Don’t use the default admin or backend login path. Using /admin is a common path too often used by hackers to make repeated attempts to gain access. Magento 2 automatically creates an obscure admin path. For Magento 1.x stores, the default “admin” path should be changes to a obscure value resembling a very secure password (e.g., “Uy49kkT” or “j87PenM”).

Install all updates and patches. The Magento Security Center is a Magento resource for recent and past updates. The community site, magesec.org , has open source scanning and patching tools.

Many sites hosted on Mojo STRATUS use WordPress for their blog feature. Using Nginx Includes or the built-in STRATUS panel access restriction , restrict the WordPress login by IP and prevent brute-force attacks.

location ~* /wordpress/wp-login.php$ { allow 1.1.1.1; try_files $uri $uri/ /index.php?$args; location ~* \.php$ { try_files /dummy @proxy; } deny all; }

Remove all extraenous files from the Magento web root. Extra database dumps, un-needed files and test scripts, and other code that isnt necessary for production is often left exposed.

Use strong passwords!

Block countries for which shipping is not available.

Stratus Security Guides - Traffic Limits

Mon, 01 Jan 0001 00:00:00 +0000

Certain services are restricted in terms of how much CPU and memory they can use to prevent memory leaks and other issues from affecting your site. Services that need fluid limits, like PHP, are handled differently.

The Redis, memcache, Nginx and Elasticsearch services all have lower memory limits with less than 4GB as a maximum. A majority of stores do not exceed them and our team can adjust them if needed.

SStratus Security Guides - Securing Magento 1.x against malware and brute force attacks

Mon, 01 Jan 0001 00:00:00 +0000

Our support team at Webscale can help implement any of the changes below to help protect your store.

To help protect your store against attacks, do the following:

Change the admin path from /admin to something less obvious. This is adjusted in the local.xml file near the bottom. Change the frontName variable and clear the Magento cache.

Password or IP restrict the downloader using the Webscale STRATUS [Access > Protect URL][2] panel access restrictions or a .htaccess file. The downloader can also be moved out of the Magento web root completely when not actively using Magento Connect.

Update Magmi, as older versions of Magmi are unsecure and can allow remote users to upload files for remote execution.

Keep any WordPress installations up to date within the Magento web root. WordPress plugins can often be found to introduce or allow malware.

Apply any missing patches for your store. Our support can help apply these for you. Most Magento 1.x patches are **critical **to security

Further securing your Magento admin

If changing the admin path is not sufficient, it is also possible to IP restrict it entirely. Contact stratus-support@webscalenetworks.com for details on how to restrict this.

Stratus Security Guides - External CDNs and Firewalls

Mon, 01 Jan 0001 00:00:00 +0000

Whitelisting Validation for Sucuri

When using Sucuri’s firewall that adds a JS protector in front of the site, whitelist a specific path for our validation to work properly. Whitelisting this path will not compromise the protection on the rest of your site. Our validator uses a simple curl request and cannot process Sucuri’s JS.

Note the UUID of your Webscale STRATUS instance.

Go to Info panel in the Webscale STRATUS Admin panel.

Account Name is the UUID of the install.

Log into the Sucuri.net account

Stratus Security Guides - OSCP Stapling

Mon, 01 Jan 0001 00:00:00 +0000

According to Amazon Web Services:

When a viewer submits an HTTPS request for an object, either CloudFront or the viewer must confirm with the certificate authority (CA) that the SSL certificate for the domain has not been revoked. OCSP stapling speeds up certificate validation by allowing CloudFront to validate the certificate and to cache the response from the CA, so the client doesn’t need to validate the certificate directly with the CA.

Stratus Magento 1 Guides - Cache Management

Mon, 01 Jan 0001 00:00:00 +0000

After clicking that link, you should see a full list of your caches, similar to below. The types of caches may vary depending on what extensions/FPCs or even Varnish modules you have enabled.

In the above case, we see this site is using the standard Magento caches alongside Varnish through the Turpentine module. Caches that are invalidated with show up as Invalidated in a red bubble under the Status column. Invalidated is not necessarily bad, it just means the caches are out of date and could be serving older content.

Stratus Magento 1 Guides - Change Index Mode

Mon, 01 Jan 0001 00:00:00 +0000

The Magento 1.x indexer has two settings Update on Save and Manual update. There are several ways to adjust this setting, but the easiest is via the Magento Admin.

You can set it on Stratus by running this command via SSH from within the docroot of your Magento 1 install:

$ php shell/indexer.php --mode-manual
To avoid problems when multiple updates are being performed that trigger automatic reindexing, set all indexers to manual. Otherwise, every time an object is saved, a full reindex will be triggered and any affected objects with dependencies might cause a deadlock. Symptoms of a deadlock include high CPU usage and MySQL errors. As a best practice, schedule indexing as a cron job or run it manually to prevent deadlocks from occurring. Setting indexers to manual is a requirement under our TOS.

Stratus Magento 1 Guides - Invoicing printing blank or 500 error

Mon, 01 Jan 0001 00:00:00 +0000

If you Googled this, you probably found yet another StackOverflow link – http://stackoverflow.com/questions/17022829/magento-blank-empty-page-whene-printing-invoice-on-backend

From the above link:

Make a core override:

Copy – [magento root]/lib/Zend/Pdf/FileParserDataSource.php

To – [magento root]/app/code/local/Zend/Pdf/FileParserDataSource.php

Fixed it by commenting out __construct() and __destruct() methods in lib/Zend/Pdf/FileParserDataSource.php // abstract public function __construct(); /** * Object destructor. Closes the data source. * * May also perform cleanup tasks such as deleting temporary files. */ // abstract public function __destruct();

Then clear Magento cache and test.

Stratus Magento 1 Guides - Log Cleaning

Mon, 01 Jan 0001 00:00:00 +0000

Log Cleaning

A few of these tables are:

log_url

log_url_info

log_visitor

log_visitor_info

If these tables get very large, they can slow down your frontend and backend considerably (when you hit several hundred thousand rows). To clean these manually, you can do so via the MYSQL command line with a query like this –

delete from log_url;delete from log_url_info;delete from log_visitor;delete from log_visitor_info;
With these cleared, you should lower the retention period via System->Advanced->System

Stratus Magento 1 Guides - Magento 1.9 Unknown cipher in list

Mon, 01 Jan 0001 00:00:00 +0000

This is fixed by adjusting one line of code.

To correct this, in downloader/lib/Mage/HTTP/Client/Curl.php, change:

$this\-\>curlOption(CURLOPT_SSL_CIPHER_LIST, 'TLSv1');

to

$this->curlOption(CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);

Stratus Magento 1 Guides - Patching Magento 1

Mon, 01 Jan 0001 00:00:00 +0000

The community patching tool applies EVERYTHING for you – https://github.com/magesec/magesecuritypatcher

Stratus Magento 1 Guides - Product image uploader does not work

Mon, 01 Jan 0001 00:00:00 +0000

To fix this, you must patch your store. There are no exceptions. The malware involved has been compromising store security and leading to credit theft. Security outweighs convenience in this case, unfortunately.

You may encounter issues such as –

broken forms, getting to patch 8788 requires all previous patches will cause issues with form keys on custom templates, this can break things like the customer login or registrations, which we cannot support fixing, though our patch attempts to add them to all the forms we can detect

the image uploader may remain broken after patching if there are core overrides, certain modules, or custom admin templates that affect it or rely on the old flash uploader. This is something else we cannot support fixing unfortunately

Roughly 10% of patched stores run into some issue that we have seen. Let us know if you need assistance applying the latest patches.

Stratus Magento 1 Guides - Recommended Cookie Settings

Mon, 01 Jan 0001 00:00:00 +0000

In Magento 1 under **System->Configuration->Web **then Session Cookie Management you will see a form like this:

In general, we recommend the following settings –

Lifetime at least 86400 (1 day)

Path /

Cookie domain exactly matches your domain or is .example.com if you are using www in your domain name

HTTP Only Yes

Cookie Restriction Mode No

Cookie domain issues

The cookie domain can cause problems such as

Failed customer logins

Broken carts (products won’t add)

Cart empties on page load

Cart empties at checkout

Cannot log into the Magento backend/admin

Because of this, you may need to try various cookie domain settings depending on your exact site URL. For example, a sub-domain typically requires the cookie domain to match the sub-domain i.e. mysite.example.com exactly

Stratus Magento 1 Guides - Sales Reports are blank

Mon, 01 Jan 0001 00:00:00 +0000

This section requires generating the lifetime stats. Do this via Reports → Refresh Statistics.

Then Select All and in the Actions drop-down refresh lifetime stats. This may take a while and once complete your reports should work.

Stratus Magento 2 Guides - Improving the Cron

Mon, 01 Jan 0001 00:00:00 +0000

NOTE: All Magento 2 stores hosted on STRATUS are required to install the MageMojo Cron extension.

MageMojo’s (now Webscale Stratus) engineers have completely rewritten the Magento 2 cron functionality to fix the inherent bugs and to be much more resistant to failure.

The MageMojo Cron extension is free to install and may be installed by the store owner or developer, or Webscale Stratus support will install the extension at no additional cost.

Stratus Magento 2 Guides - Configure Elasticsearch

Mon, 01 Jan 0001 00:00:00 +0000

Log into the Magento 2 Administration backend.

Go to Stores > Configuration.

Go to Catalog > Catalog in the sidebar menu.

* De-select* Search Engine : Use system value. * Elasticsearch Server Hostname — Enter “elasticsearch”.

Click Test Connection to validate the settings.

Click Save Config to save the changes.

After activating Elasticsearch, re-index the catalogsearch_fulltext index using the Magento Admin, SSH access, or the Webscale STRATUS Control panel CLI commands .

Stratus Magento 2 Guides - Composer

Mon, 01 Jan 0001 00:00:00 +0000

Instead of identifying, installing, and configuring a PHP library independently, libraries can be specified in a JSON setup file.

Magento 2 relies on composer (though you can avoid it) through several repositories.

Composer for Magento 2 is pre-installed on MageMojo servers. To install, run:

composer create-project --repository-url=https://repo.magento.com/ magento/project-community-edition

How Composer Works

When Composer is called by this command, it first creates a project and pull in an existing package — in this case, Magento 2. The project will be created, for this example, in the magento/project-community-edition directory.

Stratus Magento 2 Guides - Customer Grid Empty

Mon, 01 Jan 0001 00:00:00 +0000

The customer list in Magento 2 may appear empty despite the fact there are many rows/customers in the customer_entity table. The grid depends on an indexer called the customer_grid index that stores data in the customer_grid_flat table. In this case, the flat table has not been properly populated by the indexer.

By tracing the indexer, it may show a “hang” on a query such as the following:

sendto(5, ",\7\0\0\3SELECT `e`.*, `e`.`entity_id`, TRIM(CONCAT_WS(' ', IF(`e`.`prefix` <> '', `e`.`prefix`, NULL), IF(`e`.`firstname` <> '', `e`.`firstname`, NULL), IF(`e`.`middlename` <> '', `e`.`middlename`, NULL), IF(`e`.`lastname` <> '', `e`.`lastname`, NULL), IF(`e`.`suffix` <> '', `e`.`suffix`, NULL))) AS `name`, `e`.`email`, `e`.`group_id`, `e`.`created_at`, `e`.`website_id`, `e`.`confirmation`, `e`.`created_in`, `e`.`dob`, `e`.`gender`, `e`.`taxvat`, (SELECT `lookup`.`last_visit_at` FROM `customer_visitor` AS `lookup` WHERE (`lookup`.`customer_id` = `e`.`entity_id`) ORDER BY `lookup`.`last_visit_at` DESC LIMIT 1) AS `last_visit_at`, TRIM(CONCAT_WS(' ', IF(`shipping`.`street` <> '', `shipping`.`street`, NULL), IF(`shipping`.`city` <> '', `shipping`.`city`, NULL), IF(`shipping`.`region` <> '', `shipping`.`region`, NULL), IF(`shipping`.`postcode` <> '', `shipping`.`postcode`, NULL))) AS `shipping_full`, TRIM(CONCAT_WS(' ', IF(`billing`.`street` <> '', `billing`.`street`, NULL), IF(`billing`.`cit"..., 1840, MSG_DONTWAIT, NULL, 0) = 1840

The problem, in this case, is the customer_visitor table. By inspection, if the table has several hundred thousands of rows, it should be emptied and reindexing again attempted.

Stratus Magento 2 Guides - Deploying static files

Mon, 01 Jan 0001 00:00:00 +0000

Before deploying static files, remove any files — except the .htaccess file — in pub/static.

The following should also be removed, especially when doing a production deployment.

All folders under pub/static

var/cache

var/composer_home

var/generation

var/page_cache

var/view_preprocessed

var/di (if present)

Then the static files can be deployed using the following command (run from the bin directory in the Magento install).

php bin/magento setup:static-content:deploy

Stratus Magento 2 Guides - Email Sender Incorrect

Mon, 01 Jan 0001 00:00:00 +0000

For example,

2.2.3 — sales@example.com

may become,

2.2.4 — www-data@…mojostratus.io

A github issue is tracking this. MageMojo has tested and confirmed the bug and a fix is to disable all the Amazon modules:

Amazon_Core Amazon_Login Amazon_Payment

To disable these modules, run:

php bin/magento module:disable Amazon_Login php bin/magento module:disable Amazon_Payment php bin/magento module:disable Amazon_Core

Then redeploy production mode for the Magento 2 store.

Stratus Magento 2 Guides - Site Changes Not Appearing

Mon, 01 Jan 0001 00:00:00 +0000

Caches

If product or theme changes on a Magento 2 site are not showing, there are numerous caches that might need to be cleared. In no particular order, check all of these sources:

Re-deploy static files (clear pub/static, then deploy)

Re-compile or reset production mode (this also clears static files)

Flush and clean the Magento 2 cache

Clear the local browser cache or test with an incognito tab in Chrome or private tab in Firefox

Use [/usr/share/stratus/cli cache.all.clear][1]

Clearing Varnish

The easiest way to do clear Vanish without root access:

Stratus Magento 2 Guides - Purge the Varnish FPC

Mon, 01 Jan 0001 00:00:00 +0000

/usr/share/stratus/cli cache.varnish.clear

Curl also works if you are using SSH. The Varnish hostname is varnish:

curl -X 'PURGE' -H'X-Magento-Tags-Pattern: .*' varnish

Magento 2 users should set their http-cache-host accordingly:

php bin/magento setup:config:set --http-cache-hosts=varnish

Once the above is set, a typical cache clear via the Magento 2 admin or Magento commands is possible:

php bin/magento cache:clean

Varnish can also be purged via the Flush Cache button in the Varnish > Info Webscale STRATUS Admin panel.

Stratus Magento 2 Guides - Send store mail via SMTP

Mon, 01 Jan 0001 00:00:00 +0000

While this works fine in most cases, we do recommend using an SMTP module or plugin for either version of Magento to improve deliverability. Especially for high traffic stores. Sending a lot of emails daily runs the risk of having the server blocked by the major email providers such as Gmail or Hotmail due to volume. Sending out through dedicated services like Mandrill or Sendgrid allows the sending of higher volumes without the risk of blacklisting.

Stratus Magento 2 Guides - Set Magento 2 modes

Mon, 01 Jan 0001 00:00:00 +0000

Please read the development documentation on Magento 2 modes for in-depth information.

Default mode

This mode is “halfway” between development and production. Static files are enabled, but compilation is not.

Production mode

All the caching and compilation features are enabled for performance. Updates to your site theme or other content may not appear without re-deploying this mode. Caching will be used for all requests which are why updates are ignored until this content is refreshed via the Magento 2 cache, static files, and compilation.

Stratus Magento 2 Guides - Cron Explained

Mon, 01 Jan 0001 00:00:00 +0000

/usr/local/bin/php /srv/public_html/bin/magento cron:run >> /srv/public_html/var/log/cron.log /usr/local/bin/php /srv/public_html/update/cron.php >> /srv/public_html/var/log/mcron.log /usr/local/bin/php /srv/public_html/bin/magento setup:cron:run >> /srv/public_html/var/log/mcron.log
WARNING: DO not use stdout/stderr redirection “2>&1” as this is already applied with the nice command during execution time. Adding it may prevent the cron from running entirely.

EXAMPLE: If you have set this cron:

/usr/local/bin/php /srv/public_html/bin/magento cron:run >> /srv/public_html/var/log/cron.log
the cron that will actually run at execution time will be:

/bin/bash -c /usr/share/stratus/cron.sh "nice -n 19 /usr/local/bin/php /srv/public_html/bin/magento cron:run >> /srv/public_html/var/log/cron.log" 2>&1
See also MageMojo Cron

Stratus Magento 2 Guides - Upgrade Recommendations

Mon, 01 Jan 0001 00:00:00 +0000

The following are helpful guides for upgrading Magento 2.x.

Support for upgrading Magento 2 is outside the scope of regular support.

Before Upgrading

Perform a local backup of the files and database before upgrading. Test the upgrade first on a development environment before performing the same steps on production.

Disable crons temporarily

Put the site in maintenance mode

Notes about Upgrading higher than Magento 2.4.3+

During setup:upgrade you may get an error related to ServiceManager.php: Service with name "Magento\Setup\Console\Command\DbStatusCommand" could not be created. Reason: Class "Vertex\Tax\Setup\Schema\Triggers\MigrateVertexInvoiceSent" does not exist. This is because the Vertex module does not exist in Magento 2.4.4 & higher. You can solve this issue by clearing caches and running setup:upgrade again.

redis-cli -h redis flushall && redis-cli -h redis-session -p 6380 flushall && redis-cli -h redis-config-cache -p 6381 flushall;stratus cache.all.clear

During setup:upgrade you may get an error in logs related to DataObject.php: main.CRITICAL: Deprecated Functionality: Return type of Magento\Framework\DataObject::offsetExists($offset) should either be compatible with ArrayAccess::offsetExists(mixed $offset): bool, or the #[\ReturnTypeWillChange] attribute should be used to temporarily suppress the notice in /cache/vendor/magento/framework/DataObject.php In this case you will need to do the following:

While PHP version is set to 7.4 : composer require magento/composer-root-update-plugin ~2.0 --no-update

composer update

rm -rf var/cache/* ; rm -rf var/page_cache/* ; rm -rf generated/code/* ; php bin/magento setup:upgrade

composer require-commerce magento/product-community-edition 2.4.4 --no-update

composer update

CHANGE TO PHP 8.1 : rm -rf var/cache/* ; rm -rf var/page_cache/* ; rm -rf generated/code/* ; php bin/magento setup:upgrade

Upgrading to a Major Release

To upgrade to 2.2.7 (in this example), run:

Stratus Magento 2 Guides - Using Baler to Speed Javascript Delivery

Mon, 01 Jan 0001 00:00:00 +0000

The result of this bundling is faster page speed times, which can improve customer experiences and Google rankings.

Bundling can only be activated on a Production environment.

Installing Baler

To install Baler:

Clone the current Baler Repository.

git clone https://github.com/magento/baler.git

Change to the Baler directory and install using npm.

npm install

Check to confirm you have node.js version 10.12.0 or later.

~/baler/bin$ ./baler baler requires a version of node.js >= 10.12.0. You're currently using v8.16.0

Stratus Magento 2 Guides - Using MagePack to Speed JS Delivery

Mon, 01 Jan 0001 00:00:00 +0000

To successfully utilize MagePack , a well-known JavaScript bundling tool on Webscale Stratus, please generate magepack.config.js file on your local computer by running a command.

docker run -t -i --rm nemke82/magepack-generator bash
You can use Play with Docker and run docker image directly in your browser tab to generate magepack.config.js file as well.

Run the following to generate magepack.config.js file (Replace https://mystore.com with your domain url ):

magepack generate --cms-url="https://mystore.com" --category-url="https://mystore.com/category-2/category-2-1/category-2-1-1.html" --product-url="https://mystore.com/category-2/category-2-1/category-2-1-1/simple-product-122.html"
When the file is generated, please upload the file to the docroot of your’s Magento 2 installation, login to the SSH container on Webscale STRATUS environment, and execute:

Stratus Magento 2 Guides - Terser installation

Mon, 01 Jan 0001 00:00:00 +0000

Terser processes JavaScript files as well as the compiled output from other languages like CoffeeScript, and TypeScript and transpilers like Babel.

First, make sure you have installed the latest version of node.js (You may need to restart your computer after this step).

From NPM for use as a command-line app:

npm install terser -g
Output:

$ node -v v17.3.0 $ npm install terser -g added 6 packages, and audited 7 packages in 687ms found 0 vulnerabilities $ whereis terser terser: /usr/local/nvm/versions/node/v17.3.0/bin/terser
Usage is simple: GitHub - terser/terser: JavaScript parser, mangler and compressor toolkit for ES6+

Stratus Magento 2 Guides - Consumer Brokers MySQL to RabbitMQ.

Mon, 01 Jan 0001 00:00:00 +0000

RabbitMQ vs MySQL

Starting with Magento 2.4.5 Queue Consumers are utilizing RabbitMQ automatically. Any previous versions, when possible, Webscale Stratus recommends using RabbitMQ as the broker instead of MySQL. The Magento Dev docs explain how this can be changed in the env.php file. The RabbitMQ broker provides much better performance than MySQL. We recommend that high traffic sites utilize RabbitMQ for the most often used consumers.

Webscale Patch Repo

Please check the Webscale Patch Repo for easy-to-install patches to switch brokers for Magento consumers to RabbitMQ.

Stratus Magento 2 Guides - Manually Uninstalling an Extension or Module

Mon, 01 Jan 0001 00:00:00 +0000

NOTE: Before starting any modification that may affect your store, always [backup your store and database](/docs/reference/stratus/guides/general/backup-strategies/ “Backup Strategies”/) first. Preferably, you will be performing this action on a Development environment before attempting it on a Production environment.

To remove an extension/module manually:

Log into the environment via SSH.

Go to the root of the Magento 2 installation and remove the folder, app/code/<Vendor>/<Module>.

Run n98-magerun2 db:console to access the database.

Drop the module tabels from the database:

Stratus Magento 2 Guides - Configuring a Sitemap

Mon, 01 Jan 0001 00:00:00 +0000

To generate a sitemap in Magento 2:

Go to Marketing > Site Map in the backend of your Magento 2 store.

If you don’t already have a sitemap showing in the list, click Add Sitemap.

Enter the filename you wish to use (e.g. “sitemap.xml”).

Enter the file path from the root of the Magento install you wish to have Magento generate the sitemap. Most will simply enter in “/” for the root directory.

Click Save & Generate to have Magento create your initial sitemap.

To configure the parameters of the sitemap:

Stratus Magento 2 Guides - Magento 2.4.x Media Gallery

Mon, 01 Jan 0001 00:00:00 +0000

You can read more about using the gallery here .

Consumer Setup

Full functionality for new Media Gallery requires media.gallery.synchronization and media.content.synchronization queue consumers to be started for initial synchronization. Configuration in your env.php should look similar to this in order to run these consumers.

'cron_consumers_runner' => [ 'cron_run' => true, 'max_messages' => 0, 'consumers' => [ 'async.operations.all', 'product_action_attribute.update', 'product_action_attribute.website.update', 'exportProcessor', 'negotiableQuotePriceUpdate', 'sharedCatalogUpdatePrice', 'sharedCatalogUpdateCategoryPermissions', 'quoteItemCleaner', 'inventoryQtyCounter', 'media.storage.catalog.image.resize', 'media.content.synchronization', 'media.gallery.renditions.update', 'media.gallery.synchronization', 'codegeneratorProcessor' ] ],

Broker

By default, Magento uses Mysql as a broker for processing consumers. You can gain a significant performance increase by configuring RabbitMQ as the broker for consumers instead. Please see the Webscale patch repo for instructions.

Stratus Guides - AngularJS

Mon, 01 Jan 0001 00:00:00 +0000

server.ts

Locate the server.ts file at the root of AngularJS deployment and edit it to use port 10000. We need port 10000 for anything hosted under the nodejs container.

The block that needs to be modified looks like this. You can comment the default line and simply hard code it.

function run() { //const port = process.env.PORT || 4000; const port = 10000; // Start up the Node server const server = app(); server.listen(port, () => { console.log(`Node Express server listening on http://localhost:${port}`); }); }
After this is done we need to compile. Please run:

Stratus HTTP Monitoring

Mon, 01 Jan 0001 00:00:00 +0000

NOTE: For infrastructure level alerts, please subscribe to the Webscale STRATUS Status page .

Criteria

Webscale STRATUS has active HTTP monitoring for sites if they meet the following criteria:

The domain exists in the [URLs](/docs/reference/stratus/control-panels/domains/urls/ “Urls Control Panel”/) panel of the Webscale STRATUS environment panel.

The domain is on a production Webscale STRATUS environment, i.e. not a development environment. Development domains are not monitored.

A valid [SSL](/docs/reference/stratus/control-panels/ssl-panel/settings/ “SSL Info Panel”/) is applied that covers your domain.

MageMojo have been granted Google Analytics access to validate session usage. Nonvalidated domains are not monitored.

The domain is not behind a proxy service like Cloudflare or Sucuri.

Webscale also monitors the root domain, and accept redirects to avoid duplicate alerts. www.example.com is not directly monitored, but example.com would be and, if redirected to www, the last redirect status code is recorded.

Stratus MySQL Alerts

Mon, 01 Jan 0001 00:00:00 +0000

These queries are proactively killed to protect a store from downtime.

If a store has any query running for over an hour

If there are 5 queries running for more than 10 seconds

The alert will contain the queries that were active at the time.

Common Issues

Below are some common issues seen with Magento databases. Please back up a copy of the database before performing any recommended fixes shown or contact MageMojo Support for assistance.

Stratus Cron Alerts

Mon, 01 Jan 0001 00:00:00 +0000

Excessive crons are proactively killed to protect a store from downtime. If the store is Magento 2, please be sure that the MageMojo Cron module is installed.

Stratus High CPU Alerts

Mon, 01 Jan 0001 00:00:00 +0000

The percentage of the allowed limit will be included. To maintain accessibility to your server, Webscale STRATUS will restart services on your store.

Stratus High Swap Memory Usage Alerts

Mon, 01 Jan 0001 00:00:00 +0000

The amount exceeded will be included in the alert.

To maintain accessibility to your server, Webscale STRATUS will restart services on your store.

Stratus High Load Average Alerts

Mon, 01 Jan 0001 00:00:00 +0000

To maintain accessibility to your server, Webscale STRATUS will restart services on your store.

Stratus High Input/Output (I/O) Volume Alerts

Mon, 01 Jan 0001 00:00:00 +0000

To maintain accessibility to your server, Webscale STRATUS will terminate this activity.

Stratus Billing Breakdown

Mon, 01 Jan 0001 00:00:00 +0000

Although Webscale STRATUS is built on top of many Amazon services, which each have their own individual pricing schemes, our pricing is reduced to only these values.

A regular monthly payment of a base price.

A small charge per session for sessions over the plan limit. See How Sessions are counted for details.

A charge of the average GB of storage used over the allowed storage per month. See Billing Breakdown for details.

The addition of any other addons that have been purchased.

Through this simple system, server costs are reduced to only what is used each month. As a business grows, it can scale predictably and seamlessly.

Stratus Billing - Sessions

Mon, 01 Jan 0001 00:00:00 +0000

How Sessions are Counted

The free sessions based off your plan are deducted from the monthly total, divided by 200, rounded up and then added to the invoice by that quantity.

Sessions are quantified by unique ip address and user agent with the following considerations

Session has at least 2 hits

A new session for a ip / user agent combo has < 1 hour between hits

Excluded from any calculations:

Stratus Environment terms

Mon, 01 Jan 0001 00:00:00 +0000

By committing to a 1-year term, you can save 20% on your current pricing and receive Webscale STRATUS Vitals for 12 months at no extra cost (a $4,200 value!). You may also commit to a 2-year term, save 25% on your monthly bill, and receive Webscale STRATUS Vitals for 12 months.

What does this mean for me?

You will continue receiving the same great price, technology, and support that you know and love. By committing to a 1-year term, you can save 20% on your current pricing and receive Stratus Vitals for 12 months at no extra cost (a $4,200 value!). You may also commit to a 2-year term, save 25% on your monthly bill, and receive Stratus Vitals for 12 months. Both 1-year and 2-year terms are still paid monthly. Month-to-Month is still an option with a 20% price increase.

Stratus - Upgrading and Downgrading

Mon, 01 Jan 0001 00:00:00 +0000

You may not downgrade an environment to a plan that is lower than the original commitment.

You may upgrade to a higher plan level with a minimum 1 month commitment. You may downgrade freely after being upgraded as long as it is to the original or higher level plan

You are free to swap plans, ie you have a starter and a lite, you may move the environments and make the starter the lite and vise versa. You may not downgrade any of your plans in the process.

Stratus Credit card or billing failure

Mon, 01 Jan 0001 00:00:00 +0000

Typically, refused payment is due to the credit card being expired or a fraud hold from the card issuer.

Other than verifying what card was attempted, our system can only see that failed. If the card in your MageMojo.com customer account is correctly entered, please check with the bank or card issuer regarding the failure.

If the bank or issuer says there are no issues, please contact Webscale STRATUS Billing Support.

Stratus - Retrying payment

Mon, 01 Jan 0001 00:00:00 +0000

Log into MageMojo.com.

Go to then go to Billing.

Select the appropriate Service.

Click Retry Payment.

You will receive a message indicating the success or failure of the retry.

Stratus - Update Credit Card

Mon, 01 Jan 0001 00:00:00 +0000

Log into your customer account at webscale.com/stratus/magento/customer/account/login/ .

Go to Billing and scroll down to My Payment Profiles.

Click Add Payment Method.

Note that an existing payment method may not be edited. To update a card, you should add a new payment method, then re-assign the new method to the billing profile).

Enter the card information.

Click Submit to save the card information.

Find the appropriate Service at the top of the Billing screen.

Cancelling Stratus Service

Mon, 01 Jan 0001 00:00:00 +0000

Log into the MageMojo customer account and place a ticket with billing.

Please refer to the Master Services Agreement if you are on a yearly term.

Any cancelled service will be shut down the following night. Data will be immediately eligible for deletion. We make no guarantees of data retention after the moment a cancellation is submitted. Please ensure that all necessary data and backups have been completed before cancelling.

Stratus Billing - Legacy GA Session collection

Mon, 01 Jan 0001 00:00:00 +0000

Configuration for Google Analytics session collection has been discontinued. You may continue to use this method however in place of local session calculation from logs until [July 2023][10] on plans that were purchased before May 9th, 2022

Note: In order for your domains to be validated, the following must be met:

The Domain Name Server (DNS) for the domain must be pointed to STRATUS, either via Route 53 nameservers or the proper CloudFront Distribution CNAME

The domain must load in a browser and it must use an HTTPS SSL certificate as required by Cloudfront

The domain must NOT be protected by HTTP Auth, Full IP restriction or block the country of the United States.

A Google Analytics code must be detected on the domain

Our billing system must be able to access Google Analytics data for the specific domain.

First, create a Google Analytics account , if not already created.

Webscale Stratus Customer Accounts

Mon, 01 Jan 0001 00:00:00 +0000

Customer accounts

Welcome to Webscale STRATUS, the fastest hosting you can find for Magento. But as with Magento, not everything can be simple and there are many things specific to our hosting that may not be obvious at first. Never fear, this guide and KB is here to help, but you can always contact support@magemojo.com to work with our staff directly.

Accounts and access at Webscale STRATUS

After your initial order, we will provision your server, which can take several hours, and longer if there is a site migration involved. Once provisioning is complete, you will see an entry under your customer login at MageMojo.com. This login we will refer to as the account owner or customer account and it uses the same email you ordered your server under. To log into your customer account, go to https://magemojo.com/magento/customer/account/login/

Webscale One - How Migrations Work

Mon, 01 Jan 0001 00:00:00 +0000

Preparation

After a new Webscale One environment is provisioned, an email is sent to the owner requesting information needed for the migration task:

Domain(s) to be migrated

Path to files on current host (e.g. /var/www or /home/username/www)

Control Panel URL

Control Panel Username

Control Panel Password

SSH URL

SSH Username

SSH Password

Depending on the current hosting, store owners may not have immediate access to all the needed information. The owner should consult with their original developers or the hosting provider asssistance.

Stratus Remote MySQL Access

Mon, 01 Jan 0001 00:00:00 +0000

Direct access via hostname:port cannot be made available.

Load Testing Webscale Stratus

Mon, 01 Jan 0001 00:00:00 +0000

Take a look at our Application Load Testing addon.

Customers purchasing the production-level load testing above should be aware that:

Load testing will impact billing. Google Analytics and local session counts may report a large increase in user sessions which will be charged as part of the STRATUS billing.

Production testing will limitlessly auto-scale the environment on the web front end (PHP). The database will quickly become the bottleneck, usually due to row level locks.

Customers will be responsible for any billing charges incurred as a result of the increased traffic demands of the testing scenarios.

Clearing Browser Cache

Mon, 01 Jan 0001 00:00:00 +0000

Some of the files a browser will store are:

Images

HTML

CSS

JavaScript

Cookies

Sometimes, especially when testing for changes on a store, the browser will display content from its cache storage rather than retrieve a new version of the asset files from the server. In these cases, it may be necessary to clear the browser cache.

If Webscale STRATUS Support recommends clearing your browser cache, refer to these instructions.

Taking Screenshots

Mon, 01 Jan 0001 00:00:00 +0000

However, taking a screenshot via a phone camera is not recommended or preferred. These photos are very often blurry or sent to support embedded in a Word document. In either case, they are generally not usable.

Taking a screenshot from a computer desktop is preferred and the improved clarity greatly beneficial to support.

Once you capture a screenshot, you may include it as an attachment to a Support Ticket.

NOTE: do not add the image to a Word or Pages document. Attach only the image file to the support ticket.

Known Magento Patches

Mon, 01 Jan 0001 00:00:00 +0000

RabbitMQ patches

All RabbitMQ patches for Magento 2 are located in the Webscale STRATUS Patch Repo .

Magento2-Import-Export-RabbitMQ:

Convert consumers broker from MySQL to RabbitMQ for:

exportProcessor

Magento2-Catalog-RabbitMQ:

Convert consumers broker from MySQL to RabbitMQ for:

product_action_attribute.update

product_action_attribute.website.update

Magento2-Media-RabbitMQ:

Convert consumers broker from MySQL to RabbitMQ for:

media.content.synchronization

media.storage.catalog.image.resize

media.gallery.synchronization

media.gallery.renditions.update

Magento2-Inventory-RabbitMQ:

Convert consumers broker from MySQL to RabbitMQ for:

inventory.source.items.cleanup

inventory.mass.update

inventory.reservations.cleanup

inventory.reservations.update

inventory.reservations.updateSalabilityStatus

inventory.indexer.sourceItem

inventory.indexer.stock

Patches Affecting Multiple Versions

2.3.3-p1-2.3.7-p2 and 2.4.0-2.4.3-p1

Stratus - Sending Bulk Emails

Mon, 01 Jan 0001 00:00:00 +0000

Transactional emails, such as invoices, shipping updates, etc. are not usually problematic since these do not require marketing permission from customers.

Once an IP is blacklisted by ISPs, it is very difficult to overcome the listing. IP blacklisting is outside of the control or influence of Webscale STRATUS.

Intentional spam is a violation of our Acceptable Use Policy and will result in immediate termination of your account.

Stratus - Changing Account Ownership

Mon, 01 Jan 0001 00:00:00 +0000

Especially when a new Magento store has been set up and configured by an outside agency or contractor, the store owner may find that they cannot access the Webscale STRATUS account. This can be problematic when the relationship with the provider has concluded without a proper transfer of access.

Webscale can only assist with regaining an account for which the store owner is actually the direct payor of Webscale STRAUS fee. For accounts that are resold through partners, the store owner must work with the partner for access issues.

Stratus Logs

Mon, 01 Jan 0001 00:00:00 +0000

Within this directory, there are subdirectories for the following log types:

exim: outgoing transactional mail logs

php-fpm: php access. error and slow logs

mysql: mysql errors logs and slow query logs

sshd: ssh logs. Note these logs are not always complete. Snoopy logs below are reliable.

snoopy: Logs showing CLI history on the system along with the time stamp. Stored location is off-server.

Access and error logs for Nginx are located in the root of the /log directory.

Using MTR

Mon, 01 Jan 0001 00:00:00 +0000

Occasionally, network problems may be local or regional and, therefore, affect the accessibility of the store by developers or store owners.

Use of MTR can confirm that any access issues are or are not a local problem.

Windows

Download WinMTR .

Extract the archive and run the included WinMTR.exe.

Enter the Webscale STRATUS hostname in Host (e.g. www.magemojo.com).

Click Start

After the tests run for a few moments, click Stop.

Click Export Text

Save the text file.

Send the exported text file to Webscale Support as an attachment.

MacOS and Linux

Open a shell on your system (e.g. Terminal for MacOS).

Run mtr example.hostname.com, substituting the Webscale STRATUS account hostname for “example.hostname.com”.

After the test runs for a few momements, exit the command.

Copy the results to Webscale STRATUS Support.

STRATUS Architecture Legacy Limits

Mon, 01 Jan 0001 00:00:00 +0000

Limits for Discontinued plans

Autoscaling environments are the default and recommended production environments for STRATUS. The autoscaling environments will scale out your website frontend horizontally and automatically in response to surges in traffic.

Autoscaling environments have two types - Single tenant and Multi tenant.

Multi tenant - Starter, Lite, Plus and Select, have all services running across the shared STRATUS platform. The limits in the services are aggregated as a total.

Stratus Guides - Install IonCube Loader

Mon, 01 Jan 0001 00:00:00 +0000

Note: ionCube Loader for PHP 8 installation at the server with Webscale Stratus had not been tested, and we cannot guarantee its stability.

To Install IonCube Loader in your Stratus environment, follow these steps:

cd /srv/

wget https://downloads.ioncube.com/loader_downloads/ioncube_loaders_lin_x86-64.tar.gz

tar -xvf ioncube_loaders_lin_x86-64.tar.gz

mkdir php_conf cp -a /usr/local/etc/php/conf.d/* php_conf cd php_conf/ rm zzz_custom.ini ln -s /usr/local/etc/php/conf.d/zzz_custom.ini ./ cp /usr/local/etc/php/php.ini ./

While still in php_conf dir, create a file named 00_ioncube.ini with the following content:

Stratus Guides - Using Varnish

Mon, 01 Jan 0001 00:00:00 +0000

Enable Varnish for Magento 2

To enable Varnish on your store, follow these steps:

Log into your Magento 2 admin panel.

Connect to your store admin panel and go to Stores → Settings → Configuration → Advanced → System → Full Page Cache

In the FPC section, configure it as in the screenshot below

Save the configuration

Now log into your STRATUS Store Panel

Go to the Varnish area from the left-hand navigation menu, click to expand and select the Info section.

Click Enable to start the Varnish service. (Note: this will redeploy all services)

Varnish is now enabled!

Enable Varnish with Turpentine

If you are using Magento 1 and Turpentine, the configuration for Turpentine should use:

Stratus Guides - Install Sourceguardian

Mon, 01 Jan 0001 00:00:00 +0000

Installation

To Install SourceGuardian Loader in your Stratus environment, follow these steps:

cd /srv/

Create a folder: mkdir sourceguardian

Get linux x64 loader using the following command: curl 'https://www.sourceguardian.com/loaders/download/loaders.linux-x86_64.tar.gz' -H 'authority: www.sourceguardian.com' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-GB,en-US;q=0.9,en;q=0.8,hr;q=0.7' -H 'cache-control: no-cache' -H 'cookie: RGTR=40811663063942; SiteSession1=1csd7upu9i6s3jvuss3v3ueuf7' -H 'pragma: no-cache' -H 'referer: https://www.google.com/' -H 'sec-ch-ua: ""' -H 'sec-ch-ua-mobile: ?0' -H 'sec-ch-ua-platform: ""' -H 'sec-fetch-dest: document' -H 'sec-fetch-mode: navigate' -H 'sec-fetch-site: cross-site' -H 'sec-fetch-user: ?1' -H 'upgrade-insecure-requests: 1' -H 'user-agent: Chrome' --output /srv/sourceguardian/loaders.linux-x86_64.tar.gz

Stratus Guides - Using SupervisorD

Mon, 01 Jan 0001 00:00:00 +0000

Supervisor is a client/server system that allows its users to control a number of processes like Magento consumers. Note: this is only possible on PHP 7.4 and above.

Installation

Versions of Python available in your environment will depend on which PHP version you are using. You can see which version is currently running on your system by running python --version Note that installing SupervisorD is only possible on PHP 7.4 and above.

Stratus Guides - Install MailHog

Mon, 01 Jan 0001 00:00:00 +0000

In the SSH container, navigate to ~/bin directory and execute the following command:

wget -c https://go.dev/dl/go1.19.5.linux-amd64.tar.gz

Extract archive:

tar -xvf go1.19.5.linux-amd64.tar.gz

Export PATH:

export PATH=$PATH:/srv/bin/go/bin

Navigate to /srv/pwa directory and execute:

go install github.com/mailhog/MailHog@latest

Adjust start.sh file in the /srv/pwa directory or create it fresh with the following details:

#!/bin/bash export PATH=$PATH:/srv/bin/go/bin /srv/go/bin/MailHog -ui-web-path /mailhog -smtp-bind-addr 0.0.0.0:10000
Note: If you are already running some NodeJS application, adjust the export path accordingly as an add-on to the current NVM settings.

Stratus - PWA Configuration

Mon, 01 Jan 0001 00:00:00 +0000

Currently, Stratus supports PWA Studios and Vue Storefront. Other popular PWA frameworks are available such as Simicart, ScandiPWA, Tigren, BSSCommerce, CedCommerce, and MageDelight. To read more about the benefits of PWA, please read PWA and Headless Commerce

PWA Setup

Stratus supports hosting your frontend through PWA Studio

Before enabling PWA services via your Stratus panel, you should prepare your PWA installation. This requires knowledge of NVM, NodeJS and PWA Studio. Follow the steps below to install and configure the sample PWA Studio frontend provied by Adobe.

Stratus Panel — SSH > Whitelist

Mon, 01 Jan 0001 00:00:00 +0000

Add a Whitelist

To assign one or more allowed IPs to a SSH user:

Go to SSH > Users in the STRATUS sidebar menu.

Scroll down to the bottom of the screen under the “Whitelisted IPs” heading. * IP Address, Subnet Or Valid Hosts. — Enter the IP address the user will be allowed to access the STRATUS environment from then click ADD IP . A subnet range or multiple IP addresses may be included (comma-separated). To quickly determine your IP address (if you wish to allow the computer you are using), click Get My IP Address. Your IP address will be automatically entered. * Label — enter a name for the particular allowance created, such as “Office” or “Home.”

Click UPDATE to save the new entry.

A single user can be assigned to multiple allowed Whitelist entries. However, only one user can be assigned to any given Whitelist entry. With the use of multiple IPs in an entry, labels may be created by user name rather than by location (e.g. Bill, Hans, Maria).

Stratus - Status Page

Mon, 01 Jan 0001 00:00:00 +0000

This can be found at http://status.magemojo.com/

Password Guidance

Mon, 01 Jan 0001 00:00:00 +0000

The Webscale Control Panel requires that you change your password every 90 days. A password must be at least 8 characters, and must contain at least one digit, one uppercase character, and one lowercase character. Webscale recommends using generated passwords and storing them in a secure password manager to avoid easy-to-guess passwords. Ensure that you do not use your Control Panel password for any other services.

Webscale recommends using Multi-Factor Authentication to provide an additional layer of protection to your access.

Security Monitoring

Mon, 01 Jan 0001 00:00:00 +0000

Security Monitoring is an add-on feature that allows for continuous monitoring of cloud resources for malicious activity. Potential security concerns are published to the Webscale Event Log where they can be reviewed and monitored in the Event Log Viewer.

Configuring Security Monitoring

In order to configure security monitoring, your account must be granted access to the Security Monitoring plan. Please contact Webscale Support if you need this feature enabled for your account.

Editing the Blocklist

Mon, 01 Jan 0001 00:00:00 +0000

Add IP addresses to the blocklist to block known-bad IPs from accessing the backend of your application. It’s also possible to add User-Agents to the blocklist by defining a pattern to match. You should add known-good IP addresses to the allowlist to allow them to access your application. For more information on adding IP addresses to the allowlist, see Editing the Allowlist .

Note

To follow these instructions, log into Webscale Control Panel and click the three vertical dots menu of the application box.

Editing the Allowlist

Mon, 01 Jan 0001 00:00:00 +0000

Add your local IP address to the Allowlist to ensure you always have access to the backend of your application. You should also add some IP addresses to the Blocklist to prevent them from accessing your application. You can find those instructions on Editing the Blocklist .

To follow these instructions, log into Webscale Control Panel and click the three vertical dots menu of the application box.

On the menu that appears, click Edit.

How to Configure Multi-Factor Authentication

Mon, 01 Jan 0001 00:00:00 +0000

Multi-factor authentication (MFA) is a way to help increase security by requiring users to authenticate with a device in addition to the standard username and password combination. Some examples of multi-factor authentication include SMS codes and authentication applications such as Google Authenticator or Authy. Multi-factor authentication on Webscale uses authentication applications only.

Configure multi-factor authentication (MFA)

1. To enable multi-factor authentication yourself while logged in, visit your User Profile and click the Enable MFA button.

Otherwise, if the role a user belongs to requires multi-factor authentication, it must be configured when the user initially logs in to the control panel. When they login, the user sees a QR code. Use the authenticator application on the device to scan this QR code.

Some examples of authenticator applications are Google Authenticator, Authy, OnePassword, etc. Please refer to the software installation instructions for your specific device.

2. Once the user scans the QR code, the authenticator application on the user’s device will generate a 6-digit code, called a One-Time Password (OTP).
Enter the generated OTP into the text field on the control panel, and click the Verify button.

To ensure the enrollment was done correctly, the user must confirm by entering their current password in the box that appears after entering the OTP.

3. Multi-factor authentication for the user is now enabled.
For future logins, the user must use the authenticator application on their device to generate an OTP after they’ve successfully authenticated with their password. Note that checking the box for Remember this browser will set a cookie so the MFA code is not needed again if you login from the same browser.

Users follow a similar process, starting at the User Profile, to change or reset their multi-factor authentication application. The user must be able to login using their existing multi-factor authentication device to make changes. If the user changes devices or applications and cannot login, please Contact Support .

Troubleshooting

If the MFA token being generated is not validating and allowing the user to login, it’s possible the time settings for the user’s mobile device and computer do not match. The specifics for resolving this issue differ depending on the mobile device OS and the computer OS in use. Here are some helpful resources:

How to Use Webscale Secure Access

Mon, 01 Jan 0001 00:00:00 +0000

User Roles can be used as an action in an optional web control, called Webscale Secure Access, to protect sections of your application from the general internet. This increases security by ensuring that only users who you’ve invited and assigned to a role can access these sections. As an example, you can require users to use Webscale’s login form before accessing your website’s login form, and can enforce multi-factor authentication (MFA) for these users as well.

Enabling Bot IP Shield

Mon, 01 Jan 0001 00:00:00 +0000

Bot IP Shield is an add-on feature from Webscale that allows you to protect your application from known attack sources. Webscale has partnered with Webroot’s BrightCloud® IP Reputation Service to maintain IP reputation data that is updated every 5 minutes to reflect the latest attack sources.

After enabling this feature, configure shielding for the application that you want to protect. Then, create Web Controls to handle traffic from sources that you consider a threat. For example, you could configure the Web Control to deny requests from a request IP if it is a known threat.

How to Block Countries from Accessing Your Site

Mon, 01 Jan 0001 00:00:00 +0000

It’s possible to use a Web Control to block countries from accessing your application. This is done by using the Country of origin is... condition for the Web Control.

To follow these instructions, log into Webscale Control Panel and click the three vertical dots menu of the application box.

On the menu that appears, click Edit.

Create the Web Control

Click Web Controls on the menu. Then, click the Add A Web Control button to go to the Edit Web Control panel.

Installing SSL Certificates

Mon, 01 Jan 0001 00:00:00 +0000

E-commerce sites require encrypted connections to remain PCI complaint and accept credit card data. Encryption ensures secure transmission of credit card details, which prevents bad actors from intercepting the information. To encrypt connections for your website, you must have an SSL (TLS) certificate installed for your site. (“SSL” and “TLS” are widely-used acronyms for “Secure Sockets Layer” and “Transport Layer Security.” SSL is now deprecated. TLS is the successor of SSL.)

Troubleshooting and Researching a Security Breach

Mon, 01 Jan 0001 00:00:00 +0000

One of the most stressful things that can happen to an ecommerce business is to discover that your site has been hacked or otherwise compromised. Webscale offers protection to known attacks right out of the box, but there are additional steps you can take to increase the security of your site and prevent future attacks. These are accomplished through the usage of Web Controls. There are also some common steps you can take to find out if the site has already been compromised.

About bot attacks

Mon, 01 Jan 0001 00:00:00 +0000

What attackers are trying to do

Most attacks we see on commerce sites are profit-driven, not purely destructive.

Broadly, attackers want to:

Test stolen payment cards to see which ones are still valid (carding).

Abuse business logic such as coupons, loyalty points, or free-trial flows.

Harvest data from product catalogs or customer accounts.

The goal is nearly always to turn someone else’s infrastructure and payment flows into cheap testing infrastructure for stolen data.

build-php-image

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis

build-php-image

Description

This command applies only to the Essentials tier. Higher tier environments use CodeDirect to create container images and deploy them on clusters.

This command takes no arguments and uses /etc/php/image/Dockerfile to build a custom image for the stack. Once complete, the dev command will utilize the custom image, as will php-fpm after a restart.

crontab-edit

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis

crontab-edit

Description

On an essentials or core server, allows editing the crontab for the user www-data. Ensure that the following lines are in the crontab before any commands are specified, which will cause the crons to run in an application environment by using the dev shell. Logs are written to /var/log/php-fpm/cron.log.

SHELL=/opt/webscale/bin/dev DEV_LOG=/var/log/php-fpm/cron.log

dev

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis

dev [-i] [-c command]

Run an interactive shell or command in a temporary container.

dev -w [-i] [-c command]

Run an interactive shell or command in the live web server container of an Essentials server.

Options

-c

Command. Runs a specified command.

-i

Interactive. This maps standard input to the created process. This is the default if no arguments are given.

-w

Web server container. Connect to the currently live web server container. This works on an Essentials server where a web server container is running or on a web server cluster server.

Description

Run an interactive shell or a specified command in an application container. When not attaching to an existing web container, the environment is established exactly as when starting the web container. Shared entries from the shared file system (/var/www for a core server and /share/www for a web server), are mounted at /var/www in the created container. Changes that are made to the filesystem that are not shared will be lost when the shell exits.

Image monitor

Mon, 01 Jan 0001 00:00:00 +0000

To configure the image monitor, provide values in /etc/image-monitor.env and issue the command sudo systemctl enable --now image-monitor. Logs are in /var/log/image-monitor.log.

# Set the cluster id whose CONTAINER_IMAGE_URI metadata setting is used to # update the local variables.php.image_uri stacker variable that is propagated # to PHP_IMAGE_URI in the /etc/php/php-fpm.env on each update. CLUSTER_ID="" # The token used must be allowed to GET /v2/clusters in the account whose image # is being monitored. WEBSCALE_API_TOKEN=""

MySQL

Mon, 01 Jan 0001 00:00:00 +0000

Stack variables

mysql.variant

Default: mysql. One of mysql or mariadb.

The service is always named mysql, even when a mariadb variant is used.

mysql.version

Default: 8.4 for variant mysql. 10.11 for variant mariadb.

This version can be any version published as an Docker Official Image.

OpenSearch

Mon, 01 Jan 0001 00:00:00 +0000

Stack variables

opensearch.memory

Default 512m. Specifies amount of heap allocated to the OpenSearch process with -Xms and -Xmx.

PHP-FPM

Mon, 01 Jan 0001 00:00:00 +0000

The php-fpm service is started to serve a PHP application for all PHP stack types: magento, shopware, and wordpress. It runs in a container with a tiny built-in HTTP <-> FastCGI proxy that configures its behavior according to the stack type.

Stack variables

php.version

When a custom image is not used, sets the PHP version of the php container image used.

php.image_uri

Specifies a custom image to run in a PHP-FPM web container and the dev command. This should usually not be configured in the stack variables directly and is automatically set when a custom image for a cluster or Essentials server is used. For Standard stacks and higher, the use of CodeDirect allows for custom images to automatically be configured on a web server, and when combined with the image monitor , on the core server.

RabbitMQ

Mon, 01 Jan 0001 00:00:00 +0000

This server utilizes the latest version published in the image catalog .

rabbitmqctl

Mon, 01 Jan 0001 00:00:00 +0000

This is has identical options and behavior to the RabbitMQ rabbitmqctl command.

Security Stance On Unbutu Package Versions

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

At Webscale, we prioritize the long-term stability and security of our customer environments. A frequent question arises: “Why is Webscale using an older version of Nginx instead of the latest mainline release?” To understand our stance, one must understand the trade-off between feature velocity and proven stability, and how the Linux ecosystem manages security through a process called “Backporting.”

The “Latest” vs. “Secure” Myth

In the world of consumer software (like phone apps), a higher version number almost always means better security. In enterprise server infrastructure, this isn’t always the case.

Supervisor

Mon, 01 Jan 0001 00:00:00 +0000

Configuration files

Configuration files may be placed on the core server host in directory /etc/supervisor or in the container image in directory /etc/supervisor/conf.d. Configuration files must have the suffix .conf. Host configuration will override container image configuration.

Enabling

This is an optional service, enable it with sudo systemctl enable --now supervisor.

Control

The supervisorctl may be run on the core server host.

supervisorctl

Mon, 01 Jan 0001 00:00:00 +0000

This has identical options and behavior to the Supervisor supervisorctl command.

Understanding Agentic Commerce OS

Mon, 01 Jan 0001 00:00:00 +0000

Webscale Agentic Commerce OS is a connected operating model for AI-native commerce. It combines three layers of capability: a Customer Data Platform (CDP) that structures first-party behavioral data, AI Segmentation that turns that data into usable audience intelligence, and an AI Shopping Assistant that applies that intelligence in customer-facing storefront experiences. The name is deliberate. Each layer operates as an agent: observing behavior, making decisions, and taking action without waiting for manual instruction. That means segments update as shoppers act. Recommendations adjust to what a buyer is doing right now. And customer-facing interactions, from product discovery to order management to returns support, happen inside a single, continuously learning system rather than across disconnected tools.

Understanding AI Segmentation

Mon, 01 Jan 0001 00:00:00 +0000

What AI Segmentation is

AI Segmentation is Webscale’s intent refinement layer. It sits on top of the Webscale Customer Data Platform (CDP), where first-party commerce behavior is already captured and structured, and makes that data usable through plain-language questions instead of manual query building.

A marketer, analyst, or commerce operator can describe an audience in everyday language, and the system translates that intent into the right query against structured behavioral data. The result is an audience, answer, or insight grounded in actual shopper activity rather than a disconnected report or a manual rules workflow. That audience can then be pushed directly to Klaviyo, Magento, or connected marketing platforms for campaign activation. And because the segment is built on the same behavioral data that continues to update as shoppers interact with the storefront, campaign effectiveness can be tracked against real activity rather than estimated after the fact.

Valkey persistent

Mon, 01 Jan 0001 00:00:00 +0000

The persistent service persistently stores its contents to disk at /var/lib/valkey.

Stack variables

valkey.version

Default: 8. The version of Valkey used. This is any valid tag for an official image .

valkey.persistent.maxmemory

Default: 100mb. The Valkey configuration for maxmemory.

valkey.persistent.maxmemory_policy

Default: allkeys-lru. The Valkey configuration for maxmemory-policy.

Valkey volatile

Mon, 01 Jan 0001 00:00:00 +0000

Stack variables

valkey.version

Default: 8. The version of Valkey used. This is any valid tag for an official image .

valkey.volatile.maxmemory

Default: 1gb. The Valkey configuration for maxmemory.

valkey.volatile.maxmemory_policy

Default: volatile-lru. The Valkey configuration for maxmemory-policy.

Vinyl

Mon, 01 Jan 0001 00:00:00 +0000

Stack variables

vinyl.cache_size

When set, enables a Vinyl cache. This is any value taken for the size of a Vinyl pool. For example: 1G.

Standard vinyl parameters

Variable Vinyl parameter Default

vinyl.workspace_client workspace_client 131072

vinyl.workspace_backend workspace_backend 229376

vinyl.http_resp_size http_resp_size 131072

vinyl.http_resp_hdr_len http_resp_hdr_len 131072

vinyl.thread_queue_limit thread_queue_limit 100


	1. To enable multi-factor authentication yourself while logged in, visit your User Profile and click the Enable MFA button. Otherwise, if the role a user belongs to requires multi-factor authentication, it must be configured when the user initially logs in to the control panel. When they login, the user sees a QR code. Use the authenticator application on the device to scan this QR code. Some examples of authenticator applications are Google Authenticator, Authy, OnePassword, etc. Please refer to the software installation instructions for your specific device.
	2. Once the user scans the QR code, the authenticator application on the user’s device will generate a 6-digit code, called a One-Time Password (OTP). Enter the generated OTP into the text field on the control panel, and click the Verify button. To ensure the enrollment was done correctly, the user must confirm by entering their current password in the box that appears after entering the OTP.
	3. Multi-factor authentication for the user is now enabled. For future logins, the user must use the authenticator application on their device to generate an OTP after they’ve successfully authenticated with their password. Note that checking the box for Remember this browser will set a cookie so the MFA code is not needed again if you login from the same browser. Users follow a similar process, starting at the User Profile, to change or reset their multi-factor authentication application. The user must be able to login using their existing multi-factor authentication device to make changes. If the user changes devices or applications and cannot login, please Contact Support .

Variable	Vinyl parameter	Default
vinyl.workspace_client	workspace_client	131072
vinyl.workspace_backend	workspace_backend	229376
vinyl.http_resp_size	http_resp_size	131072
vinyl.http_resp_hdr_len	http_resp_hdr_len	131072
vinyl.thread_queue_limit	thread_queue_limit	100