Deploy to any server,
zero downtime
A single Go binary. SSH into any server. Three lines of config. Zero-downtime deploys with automatic rollback — no management server, no dependencies.
$ cat teploy.yml
app: myapp
domain: myapp.com
server: 1.2.3.4
$ teploy deploy
Building from Dockerfile...
Starting new container on port 3001
Health check passed (200 OK, 42ms)
Routing traffic via Caddy (HTTPS auto)
Stopping old container
Deployed in 14s. Zero downtime.
macOS, Linux, WSL — or grab the binary from GitHub releases
Deploying is day one. This is the rest.
Dashboards drift out of sync with servers — that's the problem Teploy exists to avoid. The CLI treats your server as the source of truth: preview every change as a diff, verify nothing drifted, and recover unhealthy containers automatically.
- plan a dry-run diff of exactly what a deploy will do
- drift live-vs-declared comparison, CI-friendly exit codes
- heal bounded restart-in-place for unhealthy containers — it yields to deploys, never fights them
$ teploy plan
+ create myapp:41c9e2 (web, 2 replicas)
- stop myapp:9f3c21
accessories: unchanged
$ teploy drift --exit-code
live state matches teploy.yml (exit 0)
$ teploy heal enable myapp
Installed teploy-heal.timer — restart-in-place with backoff
From encrypted env vars to dynamic credentials
Start with age-encrypted secrets and zero infrastructure. When you outgrow static secrets, the same command provisions OpenBao: per-app scoped policies, short-lived database credentials with automatic rotation, KMS or Transit auto-unseal, and multi-node HA.
Secret access streams into Observe's tamper-evident audit trail, so who read what is part of the same chain as who deployed what.
$ teploy secret set API_KEY=sk-...
Encrypted with age. Injected at deploy.
$ teploy secret setup --replicas 3
OpenBao provisioned (3-node Raft, auto-unseal)
$ teploy secret db creds
username v-approle-myapp-4f2c
ttl 1h — auto-revoked, rotated by the agent sidecar
Everything you need to ship
Everything the config-file deploy tools do, plus the pieces you'd otherwise bolt on yourself.
Deploy
Zero-downtime deploys
New container starts, health checks pass, traffic routes, old container stops. Automatic rollback on failure.
Automatic HTTPS
Caddy provisions and renews TLS certificates automatically for every domain.
Accessories
Postgres, Redis, MySQL, MinIO, or any Docker image alongside your app. One-line config, managed by the CLI.
Preview environments
Deploy branches to temporary URLs with auto-expiry. One command.
Operate
Plans & drift detection
teploy plan previews a deploy as a diff. teploy drift compares live state to teploy.yml — with --exit-code for CI.
Bounded self-heal
teploy heal restarts unhealthy web containers in place, with backoff, from a systemd timer. It yields to deploys — recovery, never a scheduler.
Canary rollouts
Staged multi-server deploys: a canary wave first, then the fleet, with a failure budget and best-effort rollback.
Auto-deploy
Webhook listener for CI/CD. Push to main, teploy deploys automatically — GitHub, GitLab, Bitbucket, Forgejo.
Protect
Secrets, local or managed
Age-encrypted secrets by default. Or teploy secret --provider openbao: per-app policies, dynamic DB credentials, Raft HA.
Backups that prove restore
S3-compatible backups (AWS, MinIO, B2, R2) with retention and cron. verify-backup restores into a scratch container and proves it's usable.
Vulnerability gate
scan: true runs Trivy server-side and blocks the deploy on fixable CRITICAL findings in your image.
Edge firewall & mesh
Per-app IP rules, UA blocking, and an inbound auth gate via teploy.yml. Tailscale/Headscale mesh with just-in-time access grants.
How teploy compares
| teploy | Kamal | Coolify | Dokploy | |
|---|---|---|---|---|
| Management server required | No | No | Yes | Yes |
| Single binary | Yes | No (Ruby) | No | No |
| Config lines to deploy | 3 | ~20 | GUI | GUI |
| Auto HTTPS | Caddy | Kamal Proxy | Traefik | Traefik |
| Preview environments | Yes | No | Yes | Yes |
| Deploy plans & drift detection | Yes | No | No | No |
| Self-heal | Yes | No | No | No |
| Canary rollouts | Yes | No | No | No |
| Managed secrets (OpenBao) | Yes | No | No | No |
| No UI desync | Yes | N/A | No | No |
| Uptime monitoring | Via teploy-dash | No | No | No |
Ship something today
Install the CLI, point it at a server, and deploy in the next ten minutes.