01
Takeover over SSH
Takes over a fresh machine from any provider over SSH.
P—02 — ProductBeta
A self-hosted control plane and PaaS. It adopts servers you already own rather than renting you someone else’s.
01 — What it is
just.locker is a self-hosted control plane and PaaS. It adopts servers you already own rather than renting you someone else’s: the machines, the provider accounts and the domains stay yours, and the control plane runs on top of them.
02 — Server adoption
02
Its own key
Generates its own ed25519 key, installs it, and disables password authentication.
03
Hardened on arrival
Hardens the box with ufw, fail2ban, unattended-upgrades and Docker.
04
Credentials in the vault
Every credential produced during adoption lands in the vault.
03 — Deployments
01
Sources
Link a Git remote or an existing OCI image. Build via Dockerfile, Compose, Railpack, Nixpacks or the static path.
02
Auto-deploy on push
Through HMAC-verified webhooks, with a git-poll fallback when a webhook cannot reach the control plane.
03
Operate the container
Live build logs, one-click rollback, container start, stop, restart, logs and exec, and an interactive terminal.
04
Detached builds
Builds run detached so they survive an API restart, and the worker re-attaches to the running build.
04 — Exposure & networking
01
Ingress
Per-domain Traefik with Let’s Encrypt, or Cloudflare Tunnel.
The managed Traefik is digest-pinned and speaks to a filtered read-only Docker API proxy rather than the socket.
02
VPN
Multi-tenant WireGuard with default-deny policies by user, project role and resource, and private application VIPs.
A hybrid mode keeps public ingress alongside VPN-only access.
05 — Backups & recovery
01
What is backed up
Scheduled age-encrypted backups of Docker volumes and logical database dumps, with a deterministic authenticated manifest.
02
Where it goes
To a mounted Storage Box or S3-compatible storage. Credentials stay vault-scoped, and only encrypted envelopes leave the server.
03
Replace Server
Restores databases and volumes, then redeploys the recorded immutable release.
06 — Secrets
An AES-256-GCM vault with a per-secret ACL. Credential-sensitivity secrets are revealable only by a superadmin, and only with a stated reason.
07 — Billing
01
Your own book
Clients, recurring services and invoices, with an MRR view.
02
The projects you deploy
SaaS billing with provider-neutral products and prices, hosted checkout, subscriptions, refunds and entitlements, over Stripe Connect or Paddle.
08 — Continuity
01
Self-updates
ECDSA-signed and digest-pinned, behind preflight checks, a database backup, a health gate and automatic rollback.
02
Coming from Coolify
A two-phase migration normalises an existing Coolify installation and then cuts over.
09 — Current limits
Limit 01
Greenfield projects only
Production with critical data is gated on a representative canary and soak, an agreed RPO and RTO, and periodic restore drills.
Limit 02
No builds from source
Builds from source are refused until an ephemeral rootless builder exists, so images are supplied pre-built.
10 — Stack
- .NET 10
- Angular 22
- ASP.NET Core BFF with YARP
- Flutter
- PostgreSQL
- Redis
Questions about just.locker? Write to us.