Self-hosted PaaS

Your own Vercel,
on your own hardware.

Cargo is a self-hosted platform-as-a-service: one install script, then ship apps from a GitHub repo or container registry to a running HTTPS URL — no SSH, no YAML, no proxy config. Exactly three containers on a server you own.

$ curl -fsSL https://usecargo.vercel.app/install.sh | sh

Read the docs

Architecture

Exactly three platform containers

controlplane

Single Go binary: API, embedded React UI, job queue, deploy engine.

db

Postgres 16 — platform state, job queue, migrations at startup.

traefik

Reverse proxy. The only container publishing host ports (80/443); automatic Let’s Encrypt certificates.

+ one container per app you deploy.

How it works

Bare metal to HTTPS in three moves

Install
One script checks dependencies, prompts for your domains, generates mode-0600 secrets, and starts the stack.
Connect
Authorize the GitHub App and pick a repo + branch — or deploy any registry image directly.
Ship
Cargo builds, deploys, and serves your app at https://<app>.<apps-domain> with automatic SSL.

Manifest

Everything a team needs to ship

Push to deploy

GitHub App webhooks (HMAC-validated) redeploy on every push to the tracked branch. Manual deploys too.

Bring a Dockerfile or don’t

Builder auto-detected: your Dockerfile, a generated multi-stage image for Node/Go/Java, or Nixpacks. Custom context, Dockerfile path, and build args supported.

Automatic HTTPS

Wildcard DNS-01 or per-domain HTTP-01 via Let’s Encrypt. Custom domains attach in one click.

Live logs & metrics

Build and container logs streamed over SSE, plus CPU, memory, request rate, and p50/p95 latency charts per app.

Encrypted env vars

AES-256-GCM at rest. Values are write-only after saving.

One-click rollback

Redeploy any previous deployment’s retained image in seconds — no rebuild.

Managed databases

Provision Postgres, MySQL, MongoDB, or Redis per org; attaching injects the connection URL with per-app credentials.

Teams & roles

Organizations with owner/admin/member/viewer roles, email invites, and shareable links.

Runs unattended

Daily control-plane backups, a disk guardrail, deploy/disk/backup alerts, per-app resource caps, and an append-only audit log.

Install

One script. Ten minutes.

deploy/ — bash

$ ./install.sh
==> Platform domain: cargo.example.com
==> Apps domain suffix: apps.example.com
==> Email for Let's Encrypt certificates: ops@example.com
==> DNS provider for wildcard certs (empty = per-domain HTTP-01):
==> wrote .env (mode 0600)

  BACK UP CARGO_MASTER_KEY FROM .env SOMEWHERE SAFE.

==> starting Cargo…
[+] Running 3/3  ✔ traefik  ✔ controlplane  ✔ db
==> done. Open https://cargo.example.com and register —
    the first account becomes the instance admin.

Ship your first app in ten minutes.

One Linux host, one command, and your team has its own platform.