Operations, made simple

Use the tools you like.
We connect the stack.

Operations is how your code reaches a server, how secrets stay protected, and how you recover when something goes wrong. Teploy makes those jobs simpler without replacing the tools you already trust.

Your Git - your CI - your servers - your credentials

What operations means

A short path from code to server

You do not need to adopt a new platform for every step. Keep the tools that work and let Teploy handle the last mile.

1
Git holds your code
Forgejo, GitHub, GitLab, Bitbucket, or any Git remote.
2
Your CI runs
Build and test with the runner you already use.
3
Teploy deploys
The CLI connects directly to your servers over SSH.
4
You stay in control
State, credentials, and infrastructure remain yours.

The recommended stack

Bring your favourite. Start here if you want our pick.

Teploy is provider-friendly. These recommendations are the open-source tools we design and document as first-class companions.

Git

Use your favourite Git host

Teploy deploys checked-out code and container images. It does not care where the repository lives.

GitHubGitLabBitbucketGiteaAny Git remote

Teploy recommended

Forgejo

A lightweight, self-hosted Git service that keeps your source, CI, packages, and issue workflows under your control.

Forgejo Actions recipes for build, test, and deploy
Push webhooks work with Teploy auto-deploy
Issue webhooks work with Teploy Ship

Explore Forgejo Teploy CLI reference →

Secrets

Start with encrypted files

Teploy's built-in secret store uses age encryption and needs no service to run. It is the simplest choice for a solo developer, a small team, or a single server.

teploy secret set DATABASE_URL=...

You do not need OpenBao to get started.

Teploy recommended

OpenBao

Move to OpenBao when secrets become a team or production concern. Teploy treats it as the first-class path beyond local encrypted files.

Give each app access only to its own secrets
Rotate database credentials automatically
Add high availability and an access audit trail

teploy secret setup --provider openbao

Explore OpenBao Secrets guide →

Forgejo to production

Two ways to deploy on push

The instant setup we have today is Teploy's webhook auto-deploy. Forgejo Actions is the test-gated path and uses a drop-in workflow.

Open the Forgejo setup guide →

Fastest

Webhook auto-deploy

One command installs the listener and prints the Forgejo webhook URL and generated secret. No runner or SSH key in CI.

teploy autodeploy setup --branch main

Test-gated

Forgejo Actions

Use the documented workflow when tests must pass before deployment. It builds an image, pushes it, then runs the same Teploy deploy over SSH.

Bring an existing Forgejo runner; Teploy does not install or operate the runner.

Private networking

Use the mesh that fits your team

Teploy installs the client and joins your servers. Your chosen provider remains the authority for identity, policies, and access.

Fastest setup

Tailscale

The easiest managed option. Create an auth key and Teploy installs and joins each server to your tailnet.

network:provider: tailscaleVisit Tailscale

Self-hosted control

Headscale

A self-hosted coordination server for Tailscale clients. A strong fit when the network control plane must remain yours.

network:provider: headscaleVisit Headscale

Managed or self-hosted

NetBird

A WireGuard-based mesh with identity and access controls, available as a hosted service or on your own infrastructure.

network:provider: netbirdVisit NetBird

Why add a private mesh?

Keep internal services off the public internet, connect several servers without hand-written VPN rules, and grant time-limited access instead of permanent keys.

teploy network setup

Access control

Put any app behind a login

The access: block renders an authentication gate in Caddy before a request reaches your app. Basic auth is built in; forward_auth delegates to the identity stack you choose. These are the two we recommend.

Lightweight gate

Authelia

A small self-hosted authentication portal with two-factor and per-app access policies. It speaks the forward-auth protocol natively, so one container puts a login in front of any app.

access.forward_auth:url: authelia:9091Visit Authelia

Full identity provider

Zitadel

A modern self-hosted identity platform with OIDC, SSO, passkeys, and organisations. Run it as the identity authority behind an oauth2-proxy gate when logins become a product concern.

access.forward_auth:url: oauth2-proxy:4180Visit Zitadel

Which one?

Start with Authelia when you need a login in front of internal tools. Reach for Zitadel when users, organisations, and single sign-on become part of the product. Any forward-auth compatible proxy works the same way.

Read the access: reference →

Teploy's job

The operational work around a deploy

Once you choose the tools, Teploy gives the common production tasks a direct, repeatable command.

Safe deploys

Health checks, zero-downtime releases, canary rollouts, failure limits, and rollbacks.

teploy deploy

Server hardening

Firewall defaults, key-only SSH, Fail2ban, audit logging, and unattended security updates.

teploy setup $HOST --harden

Drift and health

See what changed, check whether services are healthy, and restart unhealthy containers with limits.

teploy drift

Verified recovery

Back up accessories, restore into a safe scratch environment, and prove the backup works.

teploy accessory verify-backup db

The boundary

Teploy connects the stack. It does not own it.

Your Git host owns source control. Your CI runs builds. Your mesh controls access. Your secret store protects credentials. Teploy deploys and operates your applications across those systems, directly on infrastructure you control.

Start with the simple stack

Pick a Git host, keep your current CI, and deploy directly to your first server. Add OpenBao or private networking when you need them.

Deploy your first app Browse CLI commands

Use the tools you like. We connect the stack.