Real ports 80 and 443
A signed system service owns public HTTP and HTTPS directly. Hostname bindings, redirects, HSTS, and a default site route traffic where it belongs.
Private beta · Build 26
Run real websites
on your Mac.
macIIS combines a native management app with a hardened web engine for static sites, PHP applications, reverse proxies, TLS, diagnostics, and safe in-place updates.
Now running: Build 26 is serving the owner-operated beta on ports 80 and 443. The product is in active qualification while we finish onboarding, public distribution, and broader clean-machine testing.
App build 26
Engine 0.5.16
Schema 7
HTTP + HTTPS
Working today
The familiar parts of IIS, rebuilt for macOS.
Static, PHP, and proxy sites
Serve files, isolate PHP applications in managed PHP-FPM pools, or forward to Node, ASP.NET, and other loopback services.
Certificates in one place
Assign public certificates, use a local CA for development, inspect hostname coverage, and keep private keys outside site content.
Application pools
Start, stop, recycle, and observe managed workloads with health, resource, restart, and failure information attached to the owning site.
Safe content publishing
Publish a staged generation through the authenticated engine. macIIS validates it, switches atomically, and keeps executable content readable but not writable by PHP.
Purpose-built writable data
Give a PHP site a private writable data directory without placing mutable files under its document root or making them reachable by URL.
Diagnostics that agree
Dashboard, sidebar, pools, and Diagnostics now share one evaluation of service, schema, certificate, and configuration health.
Preserving updates
Signed updates replace the app and engine together while preserving site content, private application data, configuration, certificates, and logs.
Current beta
Build 26 is installed, serving, and accepted live.
Apple verified
The app, engine, and installer are Developer ID signed, notarized by Apple, stapled, and checksum-bound to one source commit.
Update committed
The Build 25 to 26 transaction completed through Apple Installer with no recovery residue and one engine process listening on both public ports.
Customer roots preserved
Sites, private data, persistent state, and logs retained their exact outer identities. The updater never opened or inventoried their customer-owned children.
Still a private beta
Build 26 is qualified on the owner server. A wider beta still requires clean-Mac testing, simpler onboarding, public update delivery, and more fault evidence.
One product, protected boundaries
The manager and engine update together. Your websites do not.
The macIIS app is the native control surface. Its root-owned engine serves traffic, supervises pools, guards configuration, and exposes an authenticated local control socket. They are versioned as one product even when a release changes only the interface.
Site folders, application databases, private update payloads, certificates, and logs are installation state—not installer payload. Normal updates authenticate and preserve those boundaries without assuming which sites a customer runs.
- Developer ID signed and Apple-notarized product binaries
- Root-owned engine with direct HTTP and HTTPS listeners
- Authenticated local administration instead of a public control port
- Read-only executable website content for the
_wwwworker - Separate private writable storage for applications that need it
- Maintenance-fenced, recoverable app-and-engine updates
Website and API foundation
Updates and licensing will live behind this site.
The existing account and activation API source already has identity-gated SQL access, signed license-token support, customer sessions, CSRF protection, rate limits, and administrator audit records. Production service packaging is intentionally deferred until its identity, secrets, loopback route, logs, upgrade behavior, and recovery procedure form one tested contract.
Portal deployment is not public yet
The customer and administrator screens are being prepared now. They will be enabled only after the new site, API identity, TLS route, database credential, and recovery procedure pass together.
API tests passing
Public routes closed
Next build
Build 27 starts with a clean boot for every PHP site.
The Build 27 source now holds PHP routing behind an explicit readiness gate so a reboot cannot expose a dynamic site before its exact socket accepts connections. It remains unreleased until the complete build, update, and reboot gates pass.
Also on the Build 27 track
Actionable installer admission errors, automatic GUI closure, the dedicated macIIS website, and versioned update discovery. API service packaging, backup/restore, and full generation rollback remain later, isolated scopes.
Update feed
Public updates will remain closed until every byte is authenticated.
Stable endpoint
https://maciis.thetwistedsquid.me/downloads/update.json
The endpoint now uses manifest contract version 1 with an exact product and private-beta channel identity. Its downloads object remains empty, so defining the contract does not silently publish an installer.
Artifact verification
A future entry must bind the exact version, build, source commit, byte size, SHA-256, package identity, Developer ID team, notarization, and supported upgrade path.
Sites stay independent
Update packages contain macIIS—not customer websites. The updater preserves configured sites and private data without knowing their names or contents.