Sites - frontend hosting

Sites hosts your project's frontend in the EU, next to the database. Upload a finished build (dist/, .zip) or your source code - we build it in an isolated gVisor container - and serve it over HTTPS. Supported: Vite/React/Vue/Svelte, Create React App, Astro, SvelteKit (adapter-static), Next.js with output: 'export' (static), plus Next.js and any Node.js app (npm start) as SSR.

URLs

• Production: https://<site>-<ref>.host.ulewicz.space
• Every deployment: https://<site>-d3-<ref>.host.ulewicz.space (an immutable preview)
• Pull request: https://<site>-pr12-<ref>.host.ulewicz.space
• Custom domain: add it in the Domains tab and set a CNAME to <site>-<ref>.host.ulewicz.space. The Let's Encrypt certificate is issued and renewed automatically.

Site names: lowercase letters, digits and "-", up to 41 characters; must not end in -d<number> or -pr<number> and cannot be db, cache or search.

Deploying

# CLI
hostbase sites deploy ./dist --site shop            # a finished build (dist mode)
hostbase sites deploy . --site shop --mode source   # source code, built on our side
hostbase sites deploy . --site shop --preview       # a preview, production untouched
hostbase sites rollback shop d11                    # instant rollback
hostbase sites logs shop --build --deployment d12

• Dashboard - a wizard: upload a .zip or folder, pick the framework, set variables.
• GitHub - once a repository is connected (Integrations → GitHub) link the site to a branch: a push deploys production, a PR from the same repository gets a preview, a hostbase/sites/<site> commit status and a comment with the URL. Fork PRs are never built.
• Deploy hook - POST https://host.ulewicz.space/api/hooks/sites/<token> triggers a new production deployment (from CI or a CMS). Rotate it in the dashboard or with hostbase sites hook shop --rotate.
• API / MCP - POST /api/v1/projects/{ref}/sites/{name}/deployments with archive_base64; MCP tools deploy_site, promote_site_deployment and more.

Builds and environment variables

The framework is detected from package.json (or set it manually, together with the install command, build command and output directory). A build runs for at most 15 minutes in a gVisor container with 2 vCPU and 3 GB RAM, with an npm cache kept between builds. These are injected automatically into builds and SSR: NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY, PUBLIC_SUPABASE_*, REACT_APP_SUPABASE_*, SUPABASE_URL, SUPABASE_ANON_KEY, HOSTBASE_SITE_URL. The service_role key and DATABASE_URL reach running SSR apps only - never the build or static files. Your own variables override the automatic ones; build-time changes apply from the next deployment (sites redeploy).

Static server

• SPA fallback (index.html), clean URLs (/about → about.html or about/index.html), a custom 404.html.
• Brotli and gzip (files are compressed at deploy time), ETag/304, Range.
• Assets with a hash in the name (/assets/index-Ab12Cd34.js, /_next/static/…) get Cache-Control: immutable for a year; HTML is always revalidated.
• _redirects in the output directory:

/old-page       /new-page      301
/blog/:slug     /articles/:slug  302
/api/*          /index.html    200
/shop/*         /products/:splat  301!
/gone           /404.html      404

Rules apply when no file exists at the path; an exclamation mark after the status forces the rule even if a file exists. 200 is a rewrite (the URL does not change).

# _headers
/*
  X-Frame-Options: DENY
  Referrer-Policy: same-origin
/assets/*
  Cache-Control: public, max-age=31536000, immutable

Deployments, rollback and SSR

Every deployment is immutable and has its own URL. Promote and rollback switch production to any ready deployment without a rebuild and without downtime. We keep the last 10 deployments plus production. A failed deployment never changes production and a failure notification lands in your notification center. SSR apps run in containers (gVisor, unprivileged user, read-only filesystem, a private network to your database); production and the two newest previews are running, older ones sleep and can be woken up.

Analytics and limits

The Analytics tab shows requests, bandwidth, status codes and top paths from the edge access log. Bandwidth counts toward the plan's egress; builds toward the minutes allowance (Free 100, Pro 1,000, Team 6,000 / month, 0.12 PLN / min beyond); SSR containers are billed like Workers hours (Small/Medium/Large) and need the Pro plan or higher. Limits: 10 sites per project, 10 domains per site, 24 MB archives, 500 MB and 20,000 files per site.

Management API

GET    /api/v1/projects/{ref}/sites
PUT    /api/v1/projects/{ref}/sites/{name}                      # settings
POST   /api/v1/projects/{ref}/sites/{name}/deployments           # {mode, target, archive_base64, settings}
POST   /api/v1/projects/{ref}/sites/{name}/deployments/{id}/promote
GET    /api/v1/projects/{ref}/sites/{name}/logs?build=1&deployment=d3
PUT    /api/v1/projects/{ref}/sites/{name}/env                   # {env: {K: "v"}}
POST   /api/v1/projects/{ref}/sites/{name}/domains               # {hostname}
GET    /api/v1/projects/{ref}/sites/{name}/analytics?range=7d
POST   /api/v1/projects/{ref}/sites/{name}/hook