You don't hold the passwords
People type them into Astrodock, never into your app. Passkeys and two-factor are already there if you want them on.
Illustration: a coding agent is asked to build an on-call tracker with sign-in. It reads
the Astrodock contract, writes the app, runs astrodock apply and
astrodock deploy:watch, and the deploy succeeds. The finished app then
appears at its own address, first asking the visitor to sign in and then showing who is
currently on call.
Self-hosted app platform · open source
The hard part was never the app.
Your agent can write a working tool before lunch. Finding it a database, a domain, an HTTPS certificate and somewhere for people to log in is what eats the rest of the week. Astrodock is one install that has all of that ready, and hands your agent the keys.
One command, one machine, ten minutes.
What people actually run on one
The tools that never make it past localhost.
Not startups. The small, specific, genuinely useful things — the ones that die on your laptop because putting them online was never worth an afternoon of DNS and a monthly bill. This is somebody's dock about a month in:
oncall
Who's on this week, and who's next
oncall.yourdomain.com
invoices
Hours in, invoice out, chasing included
invoices.yourdomain.com
standup
Six people, one page, no meeting
standup.yourdomain.com
snap
Somewhere to put the family photos that isn't a cloud account
snap.yourdomain.com
runbooks
The internal wiki you're not paying per seat for
runbooks.yourdomain.com
leads
A form on the website that lands somewhere useful
deploying…
Six apps, one machine, one bill. Adding the seventh costs a subdomain.
Sign-in you don't write
Real accounts, on the first day.
Any app you deploy can ask people to log in, and none of that is your code. Astrodock runs the sign-in page, keeps the accounts, and tells your app who just arrived — so the thing you built in an afternoon gets a login you'd put in front of a customer.
One login for everything
Sign in once and every tool you're allowed into is already open. Nobody keeps six sets of credentials.
You decide who gets in
Give someone the rota and not the invoices. They don't get told the other one exists.
Built to be handed over
Your agent already knows how to use it.
Point Claude Code or Cursor at AGENTS.md and it has the rules: how to
lay an app out, what it will be handed at runtime, and one command that streams the
deploy until it can say succeeded or failed. An agent that gets a
straight answer can fix its own mistake instead of telling you it's probably fine.
It works on its own key, too. That key can ship apps and set secrets. It cannot touch your users, and it cannot let itself do more.
The whole agent story →## 2. App layout contract app/ frontend, builds to app/dist/ server/ Express, entry server/server.js ### Hard rules for the server 1. Bind ASTRODOCK_PORT 2. Namespace routes under /api 3. GET /health → 200 4. Read config from injected env. Never hardcode. Never commit secrets.
What every app gets
Four vendors' worth of plumbing.
You name what you want in one file. It exists the first time you deploy — and it's yours to swap for a service you pay for the day you outgrow it.
Sign-in
Real user accounts, and not one line of auth code in your app.
How sign-in works →Databases & storage
Its own Postgres and its own bucket. Or point it at your Neon or R2.
How resources work →Deploys & runtimes
Push, upload or let an agent do it. Node needs no config; anything else ships a Dockerfile.
How deploying works →Secrets & config
Your repo holds names. The values live on the platform, encrypted.
How config works →Domains & HTTPS
A subdomain the moment an app exists, and certificates that renew themselves.
How addresses work →Monitoring & backups
Live logs, health checks that email you, and nightly dumps to your disk.
How running it works →From bare server to live app
Ten minutes, start to finish.
1
Install it
curl -fsSL https://raw.githubusercontent.com/astrodock/astrodock/main/scripts/install.sh | sh
On a fresh Linux box. It fetches the stack, generates every secret, and starts it.
2
Finish in the browser
Point a wildcard DNS record at the machine. Astrodock shows you the exact record to create, checks it for you, and turns on HTTPS when it lands.
3
Hand it to your agent
Make a scoped key, give it the docs, and ask for the thing you actually wanted.
Being straight with you
What it isn't.
You should know what you're taking on before you point an install script at a machine. Four things this is not:
What self-hosting actually involves →It isn't Kubernetes. One machine, one stack, no cluster. If you need to survive a region going dark, this is the wrong tool.
It isn't built for scale. It's built for the dozens of small things a person or a team actually runs — internal tools, side projects, the thing your agent wrote on Tuesday.
It isn't a plan you're on. There's no per-seat price, no per-app price and nothing that grows with your traffic, because there's nobody to pay but whoever rents you the box. If this project stopped tomorrow, the machine would keep running.
It isn't magic. The machine, the backups and the updates are still yours. Astrodock makes each of those one command.
Give it a machine and ten minutes.
Rather not run a server? Tell us you want hosted Astrodock and we'll let you know when it's ready.