StrongArm
Bicep infrastructure as code: private networking, Entra ID-only SQL, Key Vault, zone-redundant App Service and reviewable deployments.
Product · Included in support agreements
Umbraco Hosting Kit
The Umbraco Hosting Kit is Crumpled Dog's product for running Umbraco securely. It goes deepest on Microsoft Azure, with StrongArm infrastructure as code to build the environment and packages for Umbraco 17 LTS, 18 STS and 19 (beta) that give you keyless connections to Azure services, Key Vault secrets, least-privilege backoffice controls and one dashboard for every server. Many of the packages also work on Umbraco Cloud, and those that do not depend on Azure services can be used on private VMs and other platforms.
What is in the Hosting Kit?
StrongArm infrastructure templates plus modular packages for Umbraco 17 LTS, 18 STS and 19 (beta). Use only what your site needs.
Core
Server roles, hides developer settings on live sites, time-limited super-admin access and a Server Information panel.
Backing Services
Blob media, Managed Redis and SignalR via managed identity; encryption keys protected by Key Vault; expiry warnings.
Application Insights
OpenTelemetry telemetry with Entra ID-authenticated ingestion and controls to keep sensitive SQL out of logs.
App Service
Per-instance health in the backoffice and an audited restart action, with Reader-only access.
Examine
Index health for every server in the Server Information panel, with a per-server rebuild, plus checks that Examine suits a load-balanced Azure setup.
Shhh
Loads secrets from Azure Key Vault at startup, so no secrets live in code or on developer machines.
Front-End Lockdown
Restricts non-production and preview sites by IP allowlist, token or backoffice session.
Maintenance
Scheduled maintenance windows with countdowns, editor announcements and automatic health-check alerts.
WatchDog
Alerts to Slack or a webhook when the site stops responding or an instance is heading for a crash.
Domain Mapper
Multi-site domain mapping that keeps the CMS domain separate from the public site.
Azure Common
One consistent Azure identity setup, with an Azure Identity panel showing what is in use.
Disk Housekeeping
Scheduled or on-demand clean-up of Umbraco logs and, on Azure App Service, the NuGet cache and temp folder, with a dashboard of every server's runs. Dry-run by default.
Server-Side Minification
HTML minification and Brotli/Gzip compression for faster pages.
The Hosting Kit dashboard
Infrastructure and application, together
StrongArm provisions the Azure environment as code; the Umbraco packages connect to it without passwords and show its health in the backoffice.
Questions about the Hosting Kit
What is the Umbraco Hosting Kit?
It is Crumpled Dog's product for running Umbraco securely. It goes deepest on Microsoft Azure, where StrongArm provides the infrastructure as code to build the environment and a set of NuGet packages for Umbraco connect your site to it and show its health in the backoffice. It also supports Umbraco Cloud and, to a lesser extent, other platforms such as private VMs.
Which versions of Umbraco does it support?
The packages support Umbraco 17 LTS, 18 STS and 19 (beta). Examine is included by default in Umbraco 19, but from Umbraco 19 it can be removed or replaced, which is not possible in earlier versions. Install the Examine package on any site that still uses Examine.
Do I have to use all of it?
No. The packages are modular, so you install only what your site needs. The Core package is the one the other Umbraco packages depend on, so it comes with them.
Does it work on Umbraco Cloud, private VMs or AWS?
Yes on Umbraco Cloud, with some differences. StrongArm builds Azure environments, so you do not need it on Umbraco Cloud. Umbraco Cloud is fully managed and cannot be given a managed identity, so keyless connections to Azure services are not available there. Instead, Data Protection can use Umbraco Cloud's own blob storage and encrypt keys with a certificate. Maintenance can show Umbraco Cloud's upcoming upgrade notices, Front-End Lockdown can let the Cloud upgrade process through, and Disk Housekeeping cleans up the Cloud disk.
On private VMs, containers and other clouds such as AWS, the Azure-specific packages and StrongArm do not apply. The packages that do not use Azure services can still be used: Core, Domain Mapper, Front-End Lockdown, Maintenance, WatchDog, Server-Side Minification and Disk Housekeeping have no dependency on Azure. Data Protection can keep its keys on disk for VM-hosted sites, or in Redis, and Disk Housekeeping can clean up the Umbraco logs on any host. Our experience is deepest on Azure, so ask us what applies to your hosting.
How does it keep secrets out of code?
The packages connect to Azure services with Azure Identity, such as managed identities, rather than keys or passwords. For local development, the Shhh package loads secrets from Azure Key Vault at startup, so no secrets live in code or on developer machines. It does nothing outside the Development environment.
Can it stop staging and preview sites being seen?
Yes. The Front-End Lockdown package restricts front-end access by IP allowlist, an authentication token or a backoffice session.
Will it tell us when something goes wrong?
The WatchDog package sends an alert to a webhook or Slack when the site stops responding or an instance is heading for a crash. It is off until you enable it, and it needs a distributed cache such as Redis so the instances can see each other. The Server Information panel also shows each server's health, and Disk Housekeeping can clean up the logs and caches that fill a web app's disk.
Will Disk Housekeeping delete files without asking?
Not by default. Scheduled clean-up is off, and when you turn it on it starts in dry-run mode, so it reports what it would delete. Clean-ups you start from the dashboard always run.
Talk to us about hosting
Want the Hosting Kit on your Umbraco site?
The licence is included in our support agreements. Tell us about your Umbraco site and hosting infrastructure setup and we will reply within one working day.