Lorem ipsum dolor sit amet consectetur. Posuere nunc scelerisque pharetra suspendisse ut interdum consectetur semper bibendum.
Every task in Deplo, from the first deploy to a restore or a server upgrade, is done from the dashboard. You never need to know Docker, SSH or YAML to get full value out of it.
Deplo is open source and you pay your host, not Deplo. No seats, no build minutes, no bandwidth tiers, no lock-in.
One command on a fresh Linux server installs Docker, the reverse proxy, Postgres, the control plane and the server agent, and prints the address to open. Nothing to configure before the first login.
Install Deplo on the machine that already runs another panel. It brings your projects across on the same disk, takes ports 80 and 443, inherits the certificates and removes the old panel when you type its name. Or start clean.
A wizard reads an existing installation of another self-hosted panel over its API and recreates it in Deplo: apps, databases, volumes byte for byte, variables, domains, basic auth, cron jobs and backup schedules. Every app that needs a look is named in the report, on its own line, before you deploy anything.
Every release runs the migration against live installations of the other panels, with real apps and real data, and checks each app five ways: a record made through the app's own UI, the same HTTP answers, the same database checksums, the same files with permissions and owners, and everything visible in the dashboard.
The control plane is the dashboard: it holds the data, renders the deployment and decrypts secrets. A small agent on every server is the only thing that ever runs Docker. The two talk over mutual TLS with a pinned certificate.
The control plane is not in the request path. Your containers and the proxy live on the servers and keep answering traffic if the dashboard is down, being upgraded or gone.
Everything belongs to a team, the URL names it, and every mutating action is gated server-side by one of forty-four capabilities, one action each. Deleting an app and deploying it are two different capabilities, because an admin may want them apart.
Every feature names its audience. The non-expert path is on by default, obvious and zero-config. The expert options live behind an Advanced affordance and never on the first-run path.
Five sources: a GitHub repository, any other Git host, a prebuilt Docker image, an uploaded archive, or a Compose stack. Plus a catalogue of templates that fills the wizard in for you.
Pick a source, fill it in, deploy. Deplo has already read the repository, so the last card arrives filled in: the app name, the framework it recognised, the port, and the build and start commands spelled for your package manager.
Every app answers on a generated public hostname the moment it is running, before you own a domain or touch DNS. Previews and imported apps get one too.
The framework, the port and the build and start commands are re-derived from the repository on every deploy, never stored. Upgrading your framework changes the build without editing anything.
Deploy on push to the tracked branch, or only when a new tag appears for release-only deploys. Deplo registers the webhook itself and shows whether the provider is actually reaching it.
Go back to a deployment that worked in seconds. Deplo re-runs the exact image that build produced, with no clone, no dependency resolution and no chance the tree resolves differently than it did months ago.
Every open pull request gets its own running copy of the app at a deterministic URL, posted as a comment on the pull request and torn down when it closes. Previews can run on a cheaper server than production.
One-click deploy of more than a hundred preconfigured applications: pick it, name it, choose a server, and it comes up with sensible defaults and generated passwords. Every one of them is deployed and checked before it reaches the catalogue.
Paste a docker-compose.yml and Deplo runs it, adding routing, HTTPS, variables, storage and backups on top. The editor lints as you type and says what will be rewritten, what needs a permission and what is refused.
Add a hostname, and Deplo tells you the exact DNS record to create, checks it on a schedule and on demand, and only routes it once the check comes back usable. Certificates are issued and renewed for you.
Encrypted at rest, injected at build and run time, layered: instance-wide, the app's own, a linked shared variable, a preview override. Paste a whole .env file to add it in bulk. Each row records who created it and who last changed it.
A secret is never returned by the API, never rendered back to you, and has no reveal button anywhere in the product. It is immutable: changing one means deleting it and adding it again, which is what rotating a credential is.
Postgres, MySQL, MariaDB, MongoDB, Redis or ClickHouse, provisioned on one of your servers with a generated password and a connection string. Apps in the same environment reach it by name, with no port, firewall rule or IP.
Scheduled, encrypted copies of a database or an app, sent to an S3 bucket or to another server's disk, with a restore that puts them back. The stream is encrypted with age before it leaves the process, one key pair per destination.
Any cheap machine becomes a backup destination with one command. It runs no Docker, no proxy and no apps, only the agent that receives artifacts.
Every destination has a private key you download once and keep. With it, any artifact decrypts anywhere with a single standard command, with no Deplo installed.
Three things to keep: the instance secret, a database dump and the recovery keys. Lose the panel's machine, install Deplo on a new one, restore those, and the agents reconnect because they trust a certificate authority derived from the same secret.
Name a set of capabilities, tick the ones it needs, and every member holding it updates together. Three editable defaults plus your own. A search box and categories, sensitive ones flagged, and Reset to default when you want the original back.
Give somebody one corner of the fleet: a grant inside a single folder that replaces their team role there and may exceed it. Someone on Viewer can deploy and configure everything inside Marketing without gaining anything anywhere else.
Who did what and when, on one timeline, with filters for person, date, event and resource that live in the address bar so a filtered view is a link. Every app, database and member has its own already-narrowed page.
A token is a principal with its own capabilities, its own scope tree of teams, projects, folders or apps, and an expiry that defaults to ninety days. Start from a template or from scratch, and edit what it can do without reissuing it.
Let an AI agent deploy an app, read logs, check why a build failed or restart a database, over the Model Context Protocol. Pick the agent, create a token, paste the printed configuration, and the page lights up on the agent's first call.
A web-based AI assistant cannot take a pasted token, so Deplo has an OAuth consent screen. You see what it asks for, approve, and the access it gets is a token like any other, listed and revocable under your account.
Authenticator-app codes with recovery codes, set up in four steps. A team, or a single role, can require it: a member who has not met the policy resolves nothing in that team, in the dashboard and over the API alike.
A passkey is a full sign-in method that replaces the password, and a session that presented one satisfies a two-factor requirement. Each one shows what is holding it, as the authenticator reported it.
Every password a person chooses is checked against the Have I Been Pwned breach database, k-anonymously, so only a hash prefix ever leaves the instance. It runs on account creation, changes, admin resets, basic auth and database passwords, and fails open on an instance with no outbound access.
Everything that lets a container reach outside its sandbox, from a bind mount to privileged mode, kernel capabilities, host namespaces, foreign volumes and foreign networks, sits behind a single grant an admin gives to a person.
Each environment gets its own private network. Apps and databases in it reach each other by name, and nothing outside reaches in: not another project, not another team, not a preview. You never create or pick a network.
A hostname, and a preview base domain across its whole DNS zone, belongs to the team that claimed it. Another team cannot add it, rename onto it, or claim a parent or child of it.
Every published image is signed at build time by the release workflow, with no long-lived key to leak or rotate. One command verifies that the tag you are about to run was built from Deplo's own repository.
Sign-in is rate-limited per account and per address, backed by the database so it survives a restart and works across instances. A suspended account is refused, repeated failures raise an alert.
See every device you are signed in on and sign out everywhere else with one click. Changing a password does not sign out other devices by accident; you do that deliberately.
Add someone who already has an account by username and give them a role. Someone new gets a single-use registration link that expires in a day, which you send however you like.
Users across every team, suspend, reset a password, promote to admin, delete with an impact preview because a person owns things. Instance settings, updates and the panel's own address live on one page.
Live CPU, memory, disk and network for every server, app and database, with a rolling history. Each agent pushes one telemetry stream for the whole host, so charts are full the instant a page opens and per-app monitoring has no switch to turn on.
What the dashboard shows is a live probe, not a stored column. An app whose containers are restarting reads restarting, degraded, unhealthy or down. Error means the last deploy failed, not that the app is down, because a failed redeploy leaves the previous version serving.
Live container output and every build's output, streamed from the server, in a fullscreen view with an instance picker, search and a level filter. Build logs are persisted with a cap, so a runaway build cannot fill the disk.
Twelve kinds of channel, from chat rooms and email to push services and browser push, each with its own selection of thirty-five alerts. A team chat that wants every deploy and an on-call phone that wants only failures is the normal case.
Run a command on a schedule inside one of your containers, per app or per database, each job in its own timezone. Runs are tracked by the agent on the server, so a panel restart or an upgrade never kills a run in flight.
A real terminal inside a running container, over the agent, with a proper pseudo-terminal so top, vim and an interactive psql all behave. A database's console is the engine's own client.
Define an HTTP path or a command with interval, timeout, retries and start period, per app. The verdict shows on the app's status and in the container breakdown.
The dashboard prints a command with a one-time token. Pasted on the new machine, it installs Docker if missing, verifies the agent's checksum, installs it as a system service and calls home. Deplo never connects to the machine itself, so no SSH key is ever shared.
A server is installed as one of four things: Everything, Build only, Backups only, or Migration source. The role decides what gets set up on the host and where the machine shows up in the interface.
Compile on a dedicated machine and ship the image to the server that runs the app. Builds stop starving production of CPU, and several small servers can share one big builder.
One schedule for the whole instance reclaims disk on every server: build cache, dangling images, orphaned caches, old app images and leftover app directories. Individual hosts opt out, so a server added tomorrow is never silently unswept.
A deletion refuses to report success unless the host proves the container and its volume are gone, with a force option for a dead host shown only after a refusal. A teardown that fails is queued and retried with backoff instead of silently orphaning containers.
Pick a new server and Deplo copies the app's volumes host to host, redeploys there and tears the old one down. A failed copy rolls back, and a dead old host is called out instead of blocking you forever.
Restart, redeploy, rebuild from scratch, resize, rotate credentials, expose a host port, move to another environment. Engine config files are edited in the browser and applied with a reroute.
Three kinds, named exactly this way: a Volume Deplo creates and looks after, a File you write in the browser and place inside the container, and a Bind to a folder that already exists on the server.
Test connection is a real probe run by an agent: a write, a read and a delete on a bucket, a write and a free-space check on a folder. A read-only key is correctly reported as failed, and the connection log shows every step.
Cap memory, CPU, processes, open files, swap and disk per app or database. Quick size presets the two that matter, and every dimension is independently optional.
The panel has its own changelog: the version you run, whether a newer one exists, and every release with its notes. A banner and a dot in the sidebar say when there is something new. Nothing updates itself.
Removing a server clears its pinned certificate, and the control plane never talks to it again. It works even when the machine is dead, which is exactly when you need it.
Servers are shared across teams, and an admin decides which teams may deploy to each one. A team only ever sees the servers it may use when it adds an app.
Restart, timezone, the server's address, how many deploys run at once, the proxy dashboard and the certificates a host holds are all on the server's page. Nothing needs a terminal.
Where the dashboard answers, the certificate it uses and HTTPS for the panel itself are all settings. Changing the address shows an impact preview first, because webhooks and agents name it.
The machine running Deplo enrols its own agent like every other server and is reached over the network like every other server. There is no in-process shortcut for "local".
The rendered Compose file, the routing labels and every build log are readable from the dashboard. What Deplo sends to a server is exactly what you can read, with secrets masked on the way out.
One grid of everything the team runs: projects, folders and apps, with live status on every card, search, filters and drill-ins that are all in the URL. Drop an archive on it and the wizard opens.
A project is an advanced folder whose contents are scoped per environment. Each environment owns its own apps, its own shared variables, its own branch, its own URLs and its own private network. Production and Staging cannot see each other.
Group apps on the Overview with a name, a colour and an owner. Folders nest. Nothing is mandatory: a flat list of apps is a perfectly normal instance.
Ctrl K anywhere reaches every app, database, server, domain, member, role, cron job, template, page and setting by typing its name, across every team you can reach. Name a page and an app together and you land on that app's page.
One variable, owned by the team, that several apps link to. Change it once and every linked app gets the new value on its next deploy. Scopes suggest it to teams, projects or apps, and the per-app link is what actually injects it.
An instance admin sets a variable once and every team and every app receives it at the lowest priority, so any app's own value still wins.
The Variables page lists every app's variables grouped by app, expandable and filterable, next to the team's shared ones.
GitHub connects as a GitHub App through its own manifest flow: click, approve, done, with no client id or private key to copy. GitLab, Bitbucket and Gitea (Forgejo included), cloud or self-hosted, connect once per team.
Each app names the sub-folder it builds from, and watch paths make a push deploy only when it touched a matching file. Four apps in one repository each rebuild only when their own code changes.
An app with no repository connection gets a URL instead. Anything that can send a POST can deploy it: a CI pipeline, a cron job, another provider's webhook.
Nixpacks by default, so most apps need no Dockerfile. Railpack as an alternative builder, your own Dockerfile used exactly, or Static for a build that produces plain files, with a single-page-app fallback for client-side routers.
One build cache per server, shared by every app on that host, on by default. The first build is the slow one, later ones are not. Per app you can switch it off or arm a one-shot clear for the next build.
Every resolved variable reaches the build as well as the running container, so frameworks that inline configuration at build time work with no extra toggle.
Deploy lands you on the build, streaming live. Build output is persisted, so it survives a page reload and a control plane restart, and closing the tab never cancels anything.
Every build is a row with its commit, branch, logs and outcome, and Redeploy, Rollback and Delete beside it. A running deploy shows its queue position and can be cancelled.
Drop an archive of your project and Deplo builds it exactly like a clone, framework detection included. Drag it anywhere onto the Overview and the wizard opens with the file already in hand and the name filled in.
Run an image that is already built. The reference field autocompletes from public registries and from the private registries you have added, and the app is named after the image.
Connect a private registry once per team. Every image pull the team makes uses it: a Docker image app, every image in a Compose stack, and the base image a Dockerfile starts from.
A domain is a hostname plus an optional path, so one app can serve example.com/api while another serves example.com/. Path routers always win over whole-host ones, longest prefix first.
Install a certificate you already hold on a server and pick it on any domain: wildcards, a company CA, or names no HTTP challenge can reach.
Put an app behind a username and password at the proxy, without the app knowing. Passwords are checked against the breach database and hashed with bcrypt before they land on the host.
Bind a port of the server straight to a port of the container, TCP or UDP, for anything that is not a website: a game server, an SMTP relay, a cache.
Select several apps on the Overview and start, stop, restart or redeploy them together. The result says how many ran, how many were skipped and why.
Hand a whole app, with its history, domains, variables and volumes, to another team from the danger zone. The dialog shows what is about to move and refuses if the destination team may not use the server it runs on.
A single GraphQL endpoint with a published schema, subscriptions for live state, and a handful of REST exceptions for uploads and log streams. Session cookie, API token or OAuth token all resolve to the same identity and team scope.
An app's icon is read from the running app itself, a template's logo is copied in at creation, and a person picks a generated face, an upload or initials. Gravatar is off by default because it sends a hash of the email to a third party.
The interface is shaped by a dedicated UX team and uses the labels every user has already seen a hundred times. Select all, Save, Cancel, Delete, Sign in. Nothing is renamed to sound tidier.
Install takes one command on a server you already pay for. What you do with the money you get back is your business.
