Skip to content
Nearzero
Star us

Your servers run the apps. Nearzero is the control plane.

Install Nearzero on a Linux host. Console, API, and the Agent all call one guarded API. Docker, Traefik, and databases run on that host — or on remote servers you add over SSH.

01

Operating model

The control plane keeps projects, environments, deploys, domains, RBAC, and Agent policy together. Workload hosts run Docker, Traefik, and the databases you place on them. That can be the same machine, or another VPS you connect over SSH.

Control-plane host

Runs Nearzero: console, monitoring, schedule jobs, and optional CoreDNS.

Workload servers

This host, or remote Linux nodes over SSH. Each service targets one server for routing and DNS.

Intents

Console, CLI/API, and the Agent all call the same API. Production Agent writes stay off until an administrator turns that gate on.

Your infrastructure

Nearzero does not replace your cloud account. It deploys onto hosts you already pay for.

02

Control-plane diagram

You send an intent on the left. Nearzero applies deploy paths, policy, and access control in the center. The work lands on your servers on the right.

Nearzero control plane: operators and Agent intents flow through guardrails onto servers you bring.
Console

deploy api to remote-1 and attach api.example.com

Agent

spin up a preview env for PR 412

CLI / API

scale worker to 6 on the edge host

Agent

drop the prod database

Blocked · outside agent scope
Nearzero Control plane
  • Bring your servers SSH-connect local and remote Linux hosts you already run
  • Deterministic deploys Same intent → same deploy, route, and DNS path
  • Guardrails Unsafe Agent ops blocked before they run
  • Audit trail Every action logged and attributable
  • Access & governance RBAC, org policies, scoped Agent permissions
one API · optional Agent · your infrastructure
Operated via Nearzero Your servers
  • Your hosts
    Control planeRemote SSHDockerSwarm
  • Edge & DNS
    TraefikCoreDNSLet's Encrypt
  • Workloads
    AppsComposePostgresMySQLRedisMongo
  • Day-two
    MetricsBackupsLogsDeployments

+ the rest of your toolchain on hosts you control

03

Trust boundaries

Remote servers are root-equivalent

SSH setup accounts with Docker access can control the host. Use a dedicated identity and verify the first host-key fingerprint.

DNS vs app servers

Authoritative CoreDNS belongs on the control-plane host. Remote app servers expose Traefik on 80/443, not Nearzero DNS.

Agent scope

The Agent cannot invent privileged paths. It uses scoped tools under your role and org policy. Production writes stay off until you enable them.

04

Next steps

01

Self-host Nearzero

Verify the installer, set DNS, and claim the first owner.

Open guide → 02

Connect remote servers

Add a Linux VPS over SSH. Send public traffic to Traefik on that box.

Open guide → 03

Domains and HTTPS

Point the hostname at the server that runs the app.

Open guide → 04

Agent safety

The Agent can see your infra. Production writes start off.

Open guide →

Questions this page answers

What is the Nearzero control plane?

The software you install: console, API, policy, deploy state, and optional CoreDNS. It is not the public edge for your applications.

Where do Nearzero workloads actually run?

On Linux servers you operate. That can be the same host as the control plane or remote servers you connect over SSH.

Can the Agent bypass the control plane?

No. Console, CLI/API, and the Agent all call the same guarded API. Production mutations stay off until an administrator enables that gate.