The private PaaS
you self-host.

A routes table, not an Ingress controller.

Routes live in Postgres. The proxy caches in memory and refreshes every 30s. Adding a route is a single API call, no deploy step needed.

AES-encrypted columns, not k8s Secrets.

Secrets are stored as encrypted columns in the database. Application code never handles encryption directly. No external key management service needed.

K8s Jobs, not external CI.

Build pipelines run as ephemeral K8s Jobs on nodes labelled role=builder. Logs stream back over the same API. No GitHub Actions runners to maintain.

Caddy handles TLS. Your DNS stays yours.

Caddy renews certificates automatically. A built-in DNS server handles the domain verification challenge. No extra operators or config files to manage.

WireGuard mesh, not VPC lock-in.

Every node (Hetzner, AWS, your home laptop) joins the Headscale-managed mesh. Stable IPs in 100.64.0.0/10. Cross-cloud by default.

Authorization is explicit, not hidden.

Every protected endpoint calls requireUser() directly. Access control is visible at the point where it matters, not tucked away in a router group you have to go looking for.

// explicit auth at every protected call site
func (h *Handler) GetNode(ctx, input) (...) {
  if _, err := requireUser(ctx); err != nil {
    return nil, err
  }
  return h.svc.GetNode(ctx, input.ID)
}