Implementation status

Deployed control plane

OwnServa is deployed at https://ownserva.com on the owner's VPS. Production images, migrations through 016, HTTPS, administrator authentication, workspace access and logout were verified on 21 October 2026. The public field guide explains current features and setup limits. Service terms are available as a review draft until the operator completes and publishes the full policy package. SMTP, merchants, registrar services and customer gateways remain unconfigured; control-plane hosting does not establish acceptance of those integrations. See production hosting.

Latest additions: account security controls, team invitations/membership, owned authoritative DNS, Git automation, private GitHub credentials, scheduled cold backups, optional authenticator MFA, and legal/privacy workflows. Apply migrations 010-016 and upgrade agents to 0.7.0. See completion work and remaining requirements, MFA setup and acceptance, and compliance readiness and launch blockers.

Phases 3 and 4 — implemented in source; live acceptance required

Applications support public GitHub Dockerfile builds through a separate constrained rootless BuildKit service, public Docker Hub/GHCR images, encrypted runtime environments, immutable release history, health-gated loopback Caddy promotion, rollback, role-protected streamed logs and runtime health reports. The agent journals deployments and reports uncertain interrupted outcomes. A restricted Asynq worker handles maintenance and DNS/HTTPS reconciliation. See Phase 3 setup and limits.

Networking includes tenant-scoped tunnel creation/revocation, explicit public-access confirmation, per-tunnel encrypted credentials, TLS-verified FRPC supervision, a separate Ownserva Edge authorization/proxy service, mandatory FRP plugin authorization, generated hostname routing, DNS-restricted PowerDNS integration and Caddy on-demand certificate authorization. A route becomes active only after public DNS, trusted HTTPS and the current release header are verified. Customer gateways are provisioned by the operator; no US/UK/ZA gateway, domain delegation or customer application certificate has been created. The control plane has its own deployed HTTPS certificate. See Phase 4 setup and acceptance.

Automated database, protocol, Go and build checks do not replace real Ubuntu/Docker/FRP/ACME acceptance. Automatic buildpacks, ZIP/Compose imports, application deletion/GC UI, IPv6 gateways and billable bandwidth metering remain deferred. Private GitHub and typed customer-owned DNS are implemented; see the completion guide for limits.

Phases 5 and 6 — source implementation, live acceptance pending

Billing has operator-editable USD 9/29 defaults, matching native Paystack/PayPal plans, verified hosted checkout, idempotent payment receipts, cancellation and grace periods. Domains have Openprovider quotes, verified operator registrants, separate one-time payments, registration/renewal/transfer/name-server/auto-renew workflows and TXT-proven custom routing. Uncertain provider outcomes require reconciliation. See Phase 5 for configuration and limits, including refunds, tax, auto-renew funding and plan replacement.

Advanced pages expose twelve operator-pinned application recipes, private Ollama/Open WebUI and a bounded model catalog, historical server metrics and authenticated Prometheus output, encrypted restic cold backups with isolated recovery volumes, and primary/two-fallback gateway routing. Persistent volumes are supported for compiled template slots. Images start disabled until the operator tests immutable versions. See Phase 6 for acceptance and limits: retention/activation, GPU setup, app replication and GeoDNS remain unavailable. Consent-based cold backup schedules are included in the completion work.

Phase 2 — implemented

Ubuntu 22.04/24.04/26.04 LTS agent (amd64/arm64), mandatory pinned-checksum installer, boot-persistent hardened systemd service, single-use ten-minute pairing tokens, durable local Ed25519 identity, signed HTTPS polling with timestamp/nonce replay protection, credential revocation, hardware/CPU/memory/root-disk/network/GPU reports, stale heartbeat detection, opt-in local Docker inventory and label-scoped start/stop/restart, a persisted SQL command queue, single-agent process lock, and a durable command journal with conservative unknown outcomes after interruptions.

My Servers now shows real organization-owned servers, searchable inventory, online/offline/connecting/revoked states, hardware details, confirmation-based command controls, result history, and admin revocation. Migration 003_servers.sql adds server/credential/pairing/nonce/command tables, tenant RLS, command constraints, and narrow pairing/key-discovery functions. The agent never exposes a listener or shell execution endpoint. No customer server has been paired by this development task.

Build the binaries with scripts/build-agent.mjs and follow docs/phase-2.md for upgrade and Ubuntu acceptance checks. This Windows host supports cross-compilation and automated protocol/SQL/fake-Docker tests; it does not provide live Ubuntu/systemd/Docker acceptance verification.

Phase 1 — implemented

Implemented: public routes; responsive auth/dashboard UI with light/dark themes; name editing; transactional organization creation and role-protected member directories; Auth.js Google/GitHub configuration; Argon2id email authentication, SMTP verification, password reset; shared revocable database sessions; origin checks and atomic rate limits; independent Go authentication and authorization; organization RLS; creation audit logs; migration, Compose, and environment templates.

OAuth requires live credentials and email requires SMTP. API failures surface in the dashboard. Workspaces, servers, applications and tunnels use API data. Bandwidth metering is unavailable. Future navigation pages explicitly indicate planned status.

Other remaining work: broader platform administration (billing price editor exists); approved production legal policies; volume deletion/activation UI; agent auto-update/key rotation. Account changes, verified provider linking, session management, invitations and MFA are implemented; deletion pseudonymizes the account and preserves required audit/billing records. The control plane is externally deployed; no live payment or domain purchase was performed.

Account settings list active sessions and can revoke an owned session by ID or all other sessions. Logout revokes the current session; password reset revokes all sessions. Super-admin is modeled with no automatic tenant bypass.

22 October 2026 site and administration update

See Platform Admin for migration 017, user visibility, encrypted OAuth configuration, contact intake, consent-based visits and public-page SEO. Single-link server setup serves verified versioned binaries and keeps the pairing secret out of HTTP URLs. Optional analytics are off until consent; policy publication remains an operator review step.