Self-hosted deploy console

From image to HTTPS, on your own servers.

Draw the stack on a canvas, let each image’s recipe configure itself, pick hostnames, and deploy with docker compose. DNS, nginx, certificates, secrets and auto-deploys are handled for you.

docker composenginxLet’s Encryptyour registry

projects / dash / stackDeployed · healthy

BACKEND_API_URLDATABASE_URLCACHE_URL

web

dash.example.com

api

:8080 · job migrate

postgres

17 · PostGIS 3.6

redis

7 · :6379

data

volume · /data

built-in services, picked by version: 5
kinds of connection on the canvas: 4
hostname shapes per member: 4
file per image: kcd.yml: 1

How it works

Four steps from a registry image to a live address

1
Pick a recipe
Start from an image or a whole stack. Its kcd.yml fills in ports, health checks, variables and databases.
Recipes page · product cards
2
Shape the stack
Adjust members, connections and variables on the canvas. Secrets and keys make themselves.
Canvas · Variables step
3
Choose addresses
Name the hostnames. DNS records, nginx and certificates are set up and checked for you.
Addresses step · provisioning
4
Deploy, then forget
docker compose runs on your server. New images on a linked tag redeploy on their own.
Deploys · auto-deploy

Capabilities

Everything between the registry and the browser

Stack canvas

Draw a project’s containers and how they connect; the console writes the docker-compose.yml and an env file per service. Edit the compose file by hand when you need to.

PostgreSQL 16 · 17
PostGIS 3.6
MySQL 8.4
Redis 7
MongoDB 7
RabbitMQ 3
NATS 2.12 · JetStream
Mailpit
MinIO · S3
any image

Connections fill DATABASE_URL, REDIS_URL and the rest; links pass a member’s internal or public address
Each member that needs Postgres gets its own server, or its own database and role
Members can borrow a sibling’s volume, read-write or read-only

Hostnames, DNS and TLS

Every exposed member gets an address with HTTPS. You choose the shape per project; the recipe only suggests.

dash.example.com: {project}
dash-admin.example.com: {project}-suffix
api.dash.example.com: label.{project}
dash.example.com/api: path on a member

DNS waits the TTL once, then checks every host at once
One nginx file per project; certificates from Let’s Encrypt
Adopt existing hostnames; deleting a project releases them

Variables, secrets and keys

Generated secrets are write-only. Shared secrets and key sets (x25519, ed25519, p256, aes-256) are made per project and sealed at rest, with rotate and retire. Values shared across members are asked once.

Deploys

Jobs like migrate up run first, every deploy. Each service is checked on its own health path: three 200s in a row. Live status and logs, and the reason when one fails.

Servers

A dashboard of every host the agent runs on, with stack cards that include containers the console doesn’t manage. Hosts are logged in to your registry for you.

Import

Bring in hosts and registry repositories that already exist, and reconcile them with the console’s projects instead of starting over.

Auto-deploy

Push an image. The project follows, unless it needs you.

registryNew image on a linked tagdash-api:main, revision a1f9c2

consoleRead and compare its kcd.ymlDiffed against the recipe each member was applied from

Same or safe change → deployedJobs, then services, then health checks. Release named from the image’s revision.

Secrets, keys, databases or volumes → heldYou get a notice and review the diff before anything changes.

Recipes

One file per image

kcd.yml is a simple YAML recipe that tells the console what to deploy and how.

Put a kcd.yml in your image and it arrives on the canvas already set up: port and health check, variables with secrets generated, the databases it needs with their URLs filled in, and the images it runs with.

Tracked by digest: Every member remembers the recipe it was applied from.
Whole stacks in one drop: Drop one member, and its siblings, links and jobs come with it.
Product cards: Icon, cover and screenshots from the image, on the palette and the Recipes page.

/kcd.ymldash-api

name: Dash API
port: 8080
health: /api/v1/health

env:
  ENCRYPTION_KEY: { required: true, secret: true, generate: hex32 }
  SVC_CLIENT_SECRET: { generate: hex32, shared: svc-client, secret: true }

needs:
  postgres: { version: "17" }   # gets DATABASE_URL
  redis: { env: CACHE_URL }

volumes: [/data]

stack:
  id: dash
  service: api
  members:
    web: { repository: dash-web }
  jobs:
    migrate: { command: migrate up }

No fixed cloud provider

Any server, any DNS, any registry

Provider-agnostic means the console never depends on one cloud’s API. It reaches your infrastructure through four small, open contracts, so each piece can come from whoever you choose, and you can change your mind later.

ServersAny Linux host with Docker and the keter-agent: a VPS, bare metal, or a box at home. Reached over mutual TLS, no SSH.keter-agent · mTLS
DNSA script you choose. Wrap any provider’s API in a few lines; a freedns.afraid.org example ships with the console.create <fqdn> <ip> · delete <fqdn>
RegistryAny Docker registry with the standard API. Images, labels and recipes are read from it.Docker Registry API v2
CertificatesLet’s Encrypt through certbot, an open standard, not a provider’s certificate service.ACME · certbot --nginx

Why not a hosted platform?

Hosted platforms run your apps on their cloud, at their prices and under their limits. The console gives you the same push-to-deploy flow on machines you control.

No lock-in. What runs on your server is plain docker-compose.yml, env files and nginx config. Stop using the console and your apps keep running.
Mix and move. Hosts from different providers sit side by side on the Servers page; pick the one that fits each project.
Your costs, your data. Pay plain server prices, and keep data in the place and country you choose.

Access and safety

Careful by default

Read-only mode onA new console changes nothing until you turn it off.
Secrets never come backWrite-only through the API, sealed at rest.
Server-side sessionsSeveral admins, listed in one env file.
Your templatesDomains, subdomain patterns, nginx templates, DNS script and certbot are settings.