Introduction

Self Host Layer turns one Linux server into a place to deploy your Node apps and static sites from GitHub, with a web panel running on that same server. Push to GitHub and your app is live with HTTPS. Add a domain, a database, a cron job or a backup from the panel.

There's no Docker. Every app is a folder, a Linux user, a systemd unit and a Caddy site: plain files you can read over SSH. If you ever remove the panel, your apps keep running.

#How it works

Two small programs run on your server:

• The panel (layer-panel) is the web UI. It runs as its own unprivileged user and holds no privileges.
• The agent (layer-agent) does the work: it creates apps, runs builds, writes units and Caddy sites. It runs as root, but takes only a fixed list of actions from the panel, over a local socket. There's no "run this command" action.

Each app you deploy gets:

• Its own Linux user, with no password and no shell. Its builds run as that user too.
• A sandboxed systemd unit, using the same kernel features Docker uses (namespaces, cgroups, seccomp), with a memory limit so one app can't freeze the server.
• A Caddy site, which serves its domains with certificates from Let's Encrypt that renew on their own.
• Zero-downtime deploys: a new build starts next to the old one, and traffic switches once it answers.

#What you get

• Deploys from GitHub on every push, with live build logs and one-click rollbacks.
• Your own domains, checked against public DNS before they go live, with HTTPS.
• PostgreSQL, MySQL, MongoDB, Redis and SQLite, each app with its own credentials, and a read-only viewer for their data.
• Encrypted backups to any S3-compatible storage, with one-click restore.
• Cron jobs, environment variables, live logs, request logs, and CPU and memory charts.
• Alerts on Telegram, Discord, a webhook or email.
• The layer command, for all of it from an SSH session.

The panel, the agent and Caddy together use about 130 MB of memory at rest, so a small server has room for many apps.

#Who it's for

One owner hosting their own projects on their own server: products, side projects, landing pages and the tools around them. It isn't built for running other people's code. Security explains how apps are kept apart and the honest limits.

#Where to start

1. Check the requirements.
2. Install it with one command.
3. Deploy your first app.