# just.locker

[just.locker](https://specus.ai/en/just-locker)

State: Beta

> A self-hosted control plane and PaaS. It adopts servers you already own rather than renting you someone else’s.

A self-hosted control plane and PaaS. It adopts your own servers over SSH, hardens them, and gives you deployments, networking, secrets, backups and billing on infrastructure you continue to own.

## Your servers, under a control plane.

just.locker is a self-hosted control plane and PaaS. It adopts servers you already own rather than renting you someone else’s: the machines, the provider accounts and the domains stay yours, and the control plane runs on top of them.

## A fresh machine, taken over properly.

### Takeover over SSH

Takes over a fresh machine from any provider over SSH.

### Its own key

Generates its own ed25519 key, installs it, and disables password authentication.

### Hardened on arrival

Hardens the box with ufw, fail2ban, unattended-upgrades and Docker.

### Credentials in the vault

Every credential produced during adoption lands in the vault.

## From a Git remote or an image.

### Sources

Link a Git remote or an existing OCI image. Build via Dockerfile, Compose, Railpack, Nixpacks or the static path.

### Auto-deploy on push

Through HMAC-verified webhooks, with a git-poll fallback when a webhook cannot reach the control plane.

### Operate the container

Live build logs, one-click rollback, container start, stop, restart, logs and exec, and an interactive terminal.

### Detached builds

Builds run detached so they survive an API restart, and the worker re-attaches to the running build.

## Public where it must be, private by default.

### Ingress

Per-domain Traefik with Let’s Encrypt, or Cloudflare Tunnel.

The managed Traefik is digest-pinned and speaks to a filtered read-only Docker API proxy rather than the socket.

### VPN

Multi-tenant WireGuard with default-deny policies by user, project role and resource, and private application VIPs.

A hybrid mode keeps public ingress alongside VPN-only access.

## Encrypted envelopes, recorded releases.

### What is backed up

Scheduled age-encrypted backups of Docker volumes and logical database dumps, with a deterministic authenticated manifest.

### Where it goes

To a mounted Storage Box or S3-compatible storage. Credentials stay vault-scoped, and only encrypted envelopes leave the server.

### Replace Server

Restores databases and volumes, then redeploys the recorded immutable release.

## Revealing one is an event.

An AES-256-GCM vault with a per-secret ACL. Credential-sensitivity secrets are revealable only by a superadmin, and only with a stated reason.

## Two layers, kept separate.

### Your own book

Clients, recurring services and invoices, with an MRR view.

### The projects you deploy

SaaS billing with provider-neutral products and prices, hosted checkout, subscriptions, refunds and entitlements, over Stripe Connect or Paddle.

## It updates itself, or it goes back.

### Self-updates

ECDSA-signed and digest-pinned, behind preflight checks, a database backup, a health gate and automatic rollback.

### Coming from Coolify

A two-phase migration normalises an existing Coolify installation and then cuts over.

## What it will not do yet.

### Greenfield projects only

Production with critical data is gated on a representative canary and soak, an agreed RPO and RTO, and periodic restore drills.

### No builds from source

Builds from source are refused until an ephemeral rootless builder exists, so images are supplied pre-built.

## What it is built on.

- .NET 10
- Angular 22
- ASP.NET Core BFF with YARP
- Flutter
- PostgreSQL
- Redis

## Start a project.

[Start a project](https://specus.ai/en#contact)

[hello@specus.ai](mailto:hello@specus.ai)