← Pritthish Nath

Meshploy

Self-hosted deploys across your own servers, on any provider

Servers on any provider or in a home lab join over WireGuard with one outbound connection. Workers expose no public ports; only the gateway faces the internet.

meshploy.comOpen the live demoRead the source
AN EXAMPLE MESH · 10 CONNECTEDHETZNER-FSNLINUX · WORKERHOME-LABLINUX · WORKERAWS-MUMBAILINUX · WORKERAZURE-PUNELINUX · WORKERDO-BLRLINUX · WORKERPI-CLUSTERLINUX · WORKERORACLE-FREELINUX · WORKEROFFICE-NASLINUX · MESH ONLYMACBOOKMACOS · MESH ONLYWIN-DESKWINDOWS · MESH ONLYEDGE-VPSLINUX · OFFLINEYOUR-SERVERLINUX · OFFLINEGATEWAYEDGECADDY · PROXY · COREDNSTHE ONLY PART FACING THE INTERNETK3S SERVER · API · CONTROL PLANEHEADSCALEWIREGUARD MESH SWITCHCLUSTER PORTS · MESH + K3S WORKERMESH-ONLY PORTS · NO WORKLOADSINTERNET

Drag a plug into a cluster port or a mesh-only port, or out to unplug it. Every cord is live.

K3S CLUSTERThe control plane on the gateway, and every machine in a cluster port7 workers · 10 pods
  • gateway: control planek3s server
  • hetzner-fsnwebredis
  • home-labwebbuilder
  • aws-mumbaiapibackup
  • azure-puneapi
  • do-blrworker
  • pi-clusterpostgres
  • oracle-freeclickhouse
On the mesh, not in the clusteroffice-nasmacbookwin-deskReaches internal routes over WireGuard, runs no workloads.

One command to install

One command sets up the gateway and the whole stack (Caddy, Headscale, CoreDNS, k3s, PostgreSQL) on a Linux server. Workers join with a single-use token, and a Mac or a Windows machine can join the mesh too.

Gateway installInstalling

Gateway
  • Caddy
  • CoreDNS
  • Proxy
  • API + console
  • Headscale
  • PostgreSQL
  • k3s server
  • On the mesh
  • Then join
  • Linuxcluster worker or mesh only
  • macOSmesh only
  • Windowsmesh only

Edge config is generated

Caddy, CoreDNS zones and Headscale are rendered from one versioned snapshot, with golden-file tests. Several domains, a DNS mode per domain and a movable primary need no hand-edited config.

One snapshot, every configexample.com is primary
STATE/EDGE.JSONexample.comPRIMARYDELEGATEDsecond.testON-DEMANDMAKE PRIMARYGOLDEN-FILE TESTS PASSCADDYcaddy/Caddyfile*.example.comwildcard cert*.second.teston-demand certsCOREDNScoredns/zones/internal.example.comexample.com_acme-challenge.example.com_acme-challenge.internal.example.cominternal.second.testHEADSCALEheadscale/config.yamlserver_url: headscale.example.comsplit: internal.example.commesh DNSsplit: internal.second.testmesh DNSbase_domain: mesh.example.compinned

Staging to production, the same image

Environment levels promote the exact image staging ran. Each level can clone its own database from a backup, and a level is never allowed to read from one below it.

Staging, builds here
web:sha-4a1b9c2
Production
Staging runs the build.

Watch it happen

Builds run as Kubernetes Jobs on build nodes, and their logs stream to the console live. A WebSocket terminal opens a shell in any node or pod from the browser.

Build log, webStreaming

RBAC for people and agents

Role-based access with per-resource grants covers people and AI agents alike. Agents get their own identities with hashed tokens, and a remote MCP server of about 100 tools lets one work the platform with exactly the access a person gave it.

Calling asAgent · magt- token
Grants held by deploy-bot
Grantsviewdeploycreateupdatedelete
projectshop
serviceweb
serviceapi
jobnightly-report

An agent is a member like any person, with its own token and only the grants it was given.

MCP calls

    The real console

    Levels, promotion, routes, databasesTry the live demo
    Meshploy's console: the project overview, with web built in staging from develop and promoted to production, and the databases each level uses.

    Write to me

    I work at Plutonapps and build Meshploy in my own time. Always glad to talk about platforms, meshes and running your own servers.

    hi@pnath.in

    This site runs on Meshploy, on my own gateway.