Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

https://github.com/wpexpertinbd/bhserve

A free, self-controlled local web-server for macOS (PHP/nginx/Apache/MariaDB/Redis/Node) — your own ServBay/Herd/Laragon alternative. By BiswasHost.
https://github.com/wpexpertinbd/bhserve

apache homebrew local-development macos mariadb nginx php servbay-alternative swiftui web-server

Last synced: 2 days ago
JSON representation

A free, self-controlled local web-server for macOS (PHP/nginx/Apache/MariaDB/Redis/Node) — your own ServBay/Herd/Laragon alternative. By BiswasHost.

Awesome Lists containing this project

README 

          
# BHServe — your own free local web server



A native, self-controlled local development stack by **BiswasHost** — a free alternative

to ServBay / Herd / Laragon. Multiple PHP versions, nginx + Apache, MySQL/MariaDB/PostgreSQL,

Redis, Memcached, phpMyAdmin/Adminer/Mailpit and Node.js — with automatic `*.test` domains,

trusted local HTTPS, one-click WordPress sites, managed Node apps, and public sharing via

Cloudflare Tunnel. 100% open-source.



**Available for:**



| Platform | Status |

|----------|--------|

| 🍎 **macOS** | ✅ **Stable** — native menu-bar app (Apple Silicon + Intel) |

| 🪟 **Windows** | ✅ **Stable** — native WinUI app (Windows 10/11) |

| 🐧 **Linux** | 🚧 **Coming soon** |



> 🟢 Runs the author's daily dev work — WordPress, OpenCart, WHMCS, Blesta, Laravel, Next.js.



---



## ✨ Features (all platforms)



- **Multiple PHP versions** — 7.4 and 8.1 → 8.6, **per site**, each with its own pool.

  ionCube + the common extensions for WordPress / OpenCart / WHMCS / Blesta are enabled.

- **nginx _and_ Apache** — pick per site. Apache mode gives full **`.htaccess`** support

  (nginx → Apache reverse proxy); nginx is the fast default.

- **Databases** — MariaDB / MySQL + PostgreSQL. Create/drop databases, set passwords, all

  from the GUI. (Default login is **root with no password** — see below.)

- **Caching** — Redis + Memcached.

- **Web tools** — **phpMyAdmin · Adminer · Mailpit**, each with a one-click on/off

  (phpMyAdmin allows **uploads up to 2 GB**).

- **Trusted HTTPS** — one click issues a locally-trusted certificate (mkcert) for any site.

  No browser warnings.

- **Automatic `*.test` domains** — every site is reachable at `name.test`.

- **Site types when you add a site:**

  - **WordPress** — creates the database, downloads the latest WordPress, pre-fills `wp-config.php`.

  - **PHP** — creates a database named after the site.

  - **Others** — just the domain (static / your own app), no database.

  - **Node app** — run a **frontend (e.g. Next.js) + optional backend/API (e.g. Laravel)**;

    BHServe supervises both and reverse-proxies them at your domain. Manage start/stop/restart,

    edit `.env`, run `npm install`, all from the app.

  - **Python app** — run a **Flask / Django / FastAPI / Gunicorn / Uvicorn** app; BHServe creates a

    virtualenv, supervises the process, and reverse-proxies it at your domain. Start/stop/restart and

    `pip install` from the app.

- **Per-site custom root folder** — default folder, or point a site at any folder on disk.

- **Node.js** — multiple versions via `fnm`. **Python** — managed interpreter for Python apps.

- **Share a site publicly** — one-click **Cloudflare Tunnel** gives a temporary public

  `https://…trycloudflare.com` URL. No account, no port-forwarding.

- **Live dashboard** — CPU / RAM / disk / network + per-service status cards.

- **Tray / menu-bar resident** — starts your services at login and sits quietly in the

  **menu bar** (macOS) / **system tray** (Windows). Open the dashboard whenever you want.

- **In-app auto-updater** — Settings ▸ Updates.



*(The engine differs per OS — Homebrew on macOS, portable downloads on Windows — but the app,

the features, and your sites work the same everywhere.)*



---



## ⬇️ Download & Install



Grab the latest build for your OS from the

[**Releases**](https://github.com/wpexpertinbd/BHServe/releases) page.



> BHServe owns ports **80/443** and the `*.test` domain — quit any other local stack

> (ServBay / Herd / Laragon / XAMPP) before first run.



### 🍎 macOS



Download **`BHServe-x.y.z.pkg`** (installer) or **`.dmg`** (drag to Applications).



**⚠️ First launch — "unidentified developer" / "damaged" (read this):** BHServe is free and

open-source but **not notarized by Apple** (that needs a paid Apple Developer account), so

macOS shows a one-time warning the **first** time you open it. You only do this **once**:



- **`.pkg`:** if macOS says *"unidentified developer"* → **right-click the `.pkg` → Open → Open**.

- **`.dmg`:** drag **BHServe** to Applications and open it. If it says *"can't be opened…"*

  or *"is damaged"* → **System Settings → Privacy & Security**, scroll down to

  *"BHServe was blocked…"* → **Open Anyway** → **Open**. *(Older macOS: right-click → Open → Open.)*



The "damaged"/"can't be checked" message is just the download-quarantine flag on an

un-notarized app — nothing is actually wrong. After the first launch, **Settings ▸ Updates**

handles future versions.



### 🪟 Windows



1. **Download and run `BHServe-Setup-x.x.x.exe`.**

2. It's **unsigned**, so Windows SmartScreen shows *"Windows protected your PC"* →

   click **More info → Run anyway**. (One-time; signing certs are costly — the code is all here.)

3. Finish the installer and launch BHServe.



**🛡️ Recommended FIRST — add an antivirus folder exclusion (do this *before* installing).**

BHServe is unsigned and downloads server binaries (PHP, nginx, MariaDB, redis, memcached…), so

some antivirus engines false-positive and quarantine them — sometimes *after* a clean install

(on the next scan), which silently breaks things. Excluding BHServe's two folders avoids this

entirely, and you can **leave your antivirus on**. Add **both**:



```

C:\Program Files\BHServe

```

```

C:\Users\\AppData\Local\BHServe

```



The first is the app + CLI; the second is BHServe's data dir (config, downloaded server binaries,

your site vhosts, certs). Replace `` with your Windows username.



How to add a **folder exclusion** in common antivirus:



- **Windows Security (Defender):** Virus & threat protection → **Manage settings** → Exclusions →

  **Add or remove exclusions** → **Add an exclusion → Folder** → pick each folder above.

- **ESET** (NOD32 / Internet Security): Advanced setup (**F5**) → **Detection engine → Exclusions →

  Performance exclusions → Edit → Add**, and enter each folder path (e.g. `C:\Program Files\BHServe`).

  (For on-execute blocks also check **HIPS / Detection engine → Real-time file system protection**.)

- **Avast / AVG:** Menu → Settings → **General → Exceptions → Add exception** → paste each folder.

- **Bitdefender:** Protection → Antivirus → **Settings → Manage exceptions → Add an exception** → folder.

- **Kaspersky:** Settings → **Security settings → Exclusions / trusted apps → Manage exclusions → Add**.

- **Malwarebytes:** Settings → **Allow list → Add → Allow a file or folder** → pick each folder.

- **Other AVs:** look for **Exclusions / Exceptions / Allow list / Trusted folders** and add the two

  paths above.



> ⚠️ An exclusion tells your antivirus to skip those folders — only do this because you trust

> BHServe (the full source is in this repo). If you ever uninstall BHServe, remove the exclusions.



If BHServe was already installed and a server won't start (its binary got quarantined), add the

exclusions above, **restore** the quarantined file from your antivirus, then reinstall that service

(Services tab) or relaunch BHServe.



**🚫 "An Application Control policy has blocked this file" / "we can't confirm who published

BHServe.App.exe"** — this is **Smart App Control** (a Windows 11 feature), not a virus. It blocks

**unsigned** apps it doesn't recognize. Two cases:



- **SmartScreen** (*"Windows protected your PC"*, blue dialog) — click **More info → Run anyway**.

  You can also right-click the downloaded `BHServe-Setup-x.x.x.exe` → **Properties** → tick

  **Unblock** → **OK**, then run it.

- **Smart App Control** (the *"Application Control policy has blocked this file"* error) — unlike

  SmartScreen, SAC has **no per-app "allow"**. To run an unsigned app you have to turn it off:

  **Settings → Privacy & security → Windows Security → App & browser control → Smart App Control

  settings → Off**.

  > ⚠️ **This is a one-way change** — once Smart App Control is **Off**, it can only be turned back

  > **On** by resetting/reinstalling Windows. It's a security trade-off; only do it if you understand

  > that. If you'd rather not, wait for a signed build.



> **Why this happens:** BHServe is currently **unsigned** (code-signing certificates are an ongoing

> cost). Each new release is a fresh unsigned file with no reputation yet, so SmartScreen/Smart App

> Control can flag it. A signed build (planned) removes this entirely.



### 🐧 Linux



🚧 **Coming soon.** (The engine is largely portable; the GTK app + packaging are in

progress — see `docs/LINUX-PORT.md`.)



---



## ✅ Before you start — install & turn these on



Before adding a site, install these from the **Services** tab (the first run usually installs

the core set for you) and make sure each shows **running / active**, or just click **Start All**:



| Service | Why | Needed for |

|---------|-----|-----------|

| **nginx** | the web server | every site |

| **PHP** (≥ one version, e.g. 8.4) | runs your PHP code | every PHP/WordPress site |

| **MariaDB / MySQL** | the database | WordPress + any DB-backed site *(skip for static "Others")* |

| **DNS** (dnsmasq) | makes `*.test` resolve | every site *(macOS — Windows handles this via the hosts file automatically)* |

| **mkcert** *(optional)* | trusted local HTTPS | only if you want `https://` |



> If a site shows **"This site can't be reached" / `DNS_PROBE_FINISHED_NXDOMAIN`**, the **DNS**

> service isn't running — open **Services** and **Start dnsmasq** (it asks for admin once). If you

> see **502 Bad Gateway**, the site's **PHP version or nginx** isn't running — start them.



---



## 🚀 Quick start



1. **Add a site** — Sites ▸ **+**. Enter a name (e.g. `myshop`), pick the **type**

   (WordPress / PHP / Others / **Node app**), PHP version, and web server.

2. Open **`http://myshop.test`** in your browser.

3. Want HTTPS? The site's **"…"** menu ▸ **Enable HTTPS** (trusted, no warnings) → `https://myshop.test`.

4. Building WordPress? Pick **WordPress** → BHServe downloads WP, creates the DB, and pre-fills

   the config. Just finish the title + admin step in the browser.



Each site row has quick actions: open in browser, open folder, view logs, start/stop, share

publicly, a **"…"** menu (change PHP / root folder / switch nginx↔Apache / enable HTTPS / delete),

and — for Node apps — start/stop/restart, edit `.env`, and `npm install`.



---



## 📦 Moving sites from XAMPP / Local / Laragon / ServBay / Herd



Already have sites in another local stack? Bringing them into BHServe is three steps — copy the

files, import the database, point the app at BHServe — and works the same on macOS and Windows.

See the **[Migration guide → `docs/MIGRATING.md`](docs/MIGRATING.md)** for per-stack file

locations, database export/import, WordPress URL search-replace, and troubleshooting.



---



## 🗄️ Databases & phpMyAdmin — important for new users



For convenience on a local machine, **all databases use the `root` user with _no password_**

(blank). Nothing is reachable from outside your machine (see Security), so this is safe.



| Setting   | Value                          |

|-----------|--------------------------------|

| Host      | `localhost` (or `127.0.0.1`)   |

| Port      | `3306`                         |

| User      | `root`                         |

| Password  | *(leave blank — no password)*  |



- **phpMyAdmin** (`http://phpmyadmin.test`) / **Adminer** (`http://adminer.test`): log in as

  **`root`** with an **empty password**. WordPress and other sites BHServe sets up are already wired this way.

- Open these from the **Web tools** card — each has an on/off switch.

- **Want a password?** Set one anytime in **Databases ▸ Root password** (then update your app configs to match).



---



## 🌍 Share a site publicly (Cloudflare Tunnel)



Each site has a **Share** button → BHServe starts a **Cloudflare quick tunnel** and gives you a

temporary public **`https://…trycloudflare.com`** URL to send a client or open on your phone.

No Cloudflare account, no router config. **Stop sharing** when done. (cloudflared installs on first use.)



---



## 🔒 Security



BHServe is a **local development** tool, hardened accordingly:



- **Loopback-only:** nginx, Apache, MySQL, Mailpit, and your Node apps listen on **`127.0.0.1`**

  — your sites, phpMyAdmin/Adminer, and Mailpit are **never exposed to your network**.

- **DBs use `root` / no password by design** — safe because nothing is reachable off this machine.

- Site / DB / log names are validated (no path traversal or config injection); DB inputs are

  SQL-escaped; passwords pass via environment, never on the command line.

- Privileged steps are minimal and explicit — binding `:80/:443` and `*.test` DNS (macOS sudo /

  Windows UAC). On macOS the optional password-less helper grants `sudo` to **only** the `nginx` binary.

- The one exception to loopback-only is a **Cloudflare Tunnel you start yourself** — that

  intentionally exposes that one site publicly while it's running.



---



## 🛠️ Build from source



Everything is in this repo:



- **macOS** — Bash engine (`engine/bhserve`) + SwiftUI app (`app/`). `cd app && ./build-app.sh`

  then `./make-dist.sh` → `.dmg` + `.pkg`.

- **Windows** — C# / .NET + WinUI (`windows/`). See **`windows/README.md`** (`build.ps1`).

- **Linux** — in progress; see `docs/LINUX-PORT.md`.



Data lives in `~/.bhserve/` (macOS) / `%LOCALAPPDATA%\BHServe` (Windows); sites default to

`~/BHServe/www/`. The engine is usable directly too (`bhserve doctor`, `site add`, `secure`, `status`, …).



---



— BiswasHost · 



## ☕ Support



BHServe is free and open-source. If it saved you time, you can **buy me a coffee** — it

genuinely helps me keep building and maintaining free tools like this. 🙏



- **bKash** (Personal · *Send Money*): **`01710378396`**



ধন্যবাদ! / Thank you!