Skip to content
Nearzero
Star us

Install Nearzero. Then take Git to HTTPS.

These guides put the control plane on a Linux VPS you operate, then connect servers, domains, and a locked-down Agent.

01

Start with the control plane

Install Nearzero on a dedicated Linux host. Then add workload servers and public hostnames. Read the security notes before you expose management ports or turn the Agent on for production.

01

Architecture

Your servers run the apps. Nearzero is the control plane.

Open guide → 02

Self-host Nearzero

Verify the installer, set DNS, claim the first owner

Open guide → 03

Remote servers

Add a Linux VPS and send traffic straight to it

Open guide → 04

Domains and HTTPS

Point the hostname at the server that runs the app

Open guide → 05

Agent safety

It can see your infra. Production writes start off.

Open guide →
02

Your servers run the apps

Nearzero is the control plane. Docker, Traefik, and databases run on Linux you operate. One host can do both jobs. When you add another VPS, workloads move there. Projects, deploys, DNS, and Agent policy stay on the control plane.

Nearzero deployment model from control plane to runtime hosts and public routing.
Control planeConsole + APIProjects, policy, DNS
Runtime hostsLocal or remoteApps, data, Compose
Public edgeDNS + TraefikHostnames and HTTPS
Control-plane host

Runs Nearzero: console, API, monitoring, and optional CoreDNS.

Workload servers

Run Traefik and the apps you place on them. They do not run Nearzero DNS.

Managed zones

Nearzero writes an A record to the server selected for that service.

Agent

Can read deploys, logs, and servers. Production writes stay off until you turn that gate on.

See the full control-plane diagram

03

Lock the management plane down first

  • 1
    Use a dedicated control-plane host.

    Its Docker socket and stored credentials are privileged infrastructure.

  • 2
    Verify the installer checksum.

    Download the versioned script and published SHA-256 file before execution.

  • 3
    Restrict SSH and management access.

    Allow only administrative source ranges and protect the dedicated server key.

  • 4
    Back up Postgres and privileged configuration.

    Encrypt off-host backups and test restoration before production use.

Questions this page answers

Where should I start with Nearzero?

Install the Community control plane on a dedicated Linux VPS. Then read architecture, remote servers, and domains before you expose production traffic.

Is this documentation for self-hosting?

Yes. These guides cover installing Nearzero on infrastructure you own: the control plane, workload servers, Traefik HTTPS, and Agent policy.