Open SourceMIT

Harden a server,
then deploy anything

A self-hosted PaaS that secures your server and gives every client true isolation — in one ~30 MB Go binary. Deploy Laravel, Django, Rails, Next.js, a static site, or any Docker image. Where Coolify and Dokploy are single-tenant panels, Orbita is built for running many clients on one box.

Terminal
$ curl -sSL https://raw.githubusercontent.com/MUKE-coder/vps-harden/main/vps-harden.sh -o h.sh \
  && sudo bash h.sh --no-dokploy

Two commands, zero config

Harden the box, install Orbita, then ship any containerised app — from the dashboard or the terminal, whichever you prefer.

  • True multi-tenancy

    Per-org Docker networks, AES-256 keys, cgroup v2 CPU/RAM quotas, and 4-role RBAC. Run every client on one cheap box — they never see each other.

  • Secure by the first command

    orbita init hardens the server — deploy user, SSH keys, locked-down root, UFW, Fail2ban — then installs Orbita on your HTTPS subdomain.

  • Any app, no Dockerfile

    Nixpacks builds Laravel/Django/Rails/Node/static with no Dockerfile — or bring a Dockerfile, a Compose stack, or a raw image. Grit apps get a zero-config fast path on top.

  • Migrations under a lock

    Deploys build, then run migrations under a Postgres advisory lock before cutover. A failed migration aborts — never a schema-mismatched cutover.

Provision
on your laptop
$ orbita init
  ✔ Server hardened (score 94/100)
  ✔ Orbita live at https://orbita.example.com
Deploy
in your Grit app
$ orbita deploy --host prod
  ✔ Migrations applied (advisory lock)
  ✔ Live
    App:  https://rental.example.com
    API:  https://api.rental.example.com
  git push → auto-deploys via webhook

How it fits together

Your CLI and browser talk to one Go binary. It drives Traefik, Postgres, Redis, and Docker Swarm on the host — every org fully isolated.

Internet
Your usersBrowser + CLI
GitHubgit push → webhook
Your VPS
Docker Swarm
Reverse proxy
Traefik v3Routing + TLS
Let's EncryptAutomatic HTTPS
Orbita — one Go binary
Control plane
Go API
Dashboard
Postgresmetadata
Rediscache / RL
Your apps — isolated per org
Next.js
Laravel
Django
Node.js
Postgresprovisioned
Redisprovisioned

Each org runs on its own Docker network, cgroup slice + AES-256 key — tenants never see each other.

Entry points

The grit CLI (over an orb_ token) and the embedded dashboard both hit the same REST API — nothing else is exposed.

One control plane

A single ~30 MB Go binary: Gin router → services → GORM, plus the orchestrator that speaks the Docker SDK and writes Traefik config.

Backing services

Postgres holds metadata + encrypted secrets, Redis handles cache and rate limits, and Swarm runs every workload with rolling updates.

How it works

From a bare VPS to a live app on HTTPS in five steps — the same flow whether you use the dashboard or the CLI.

  1. Step 01

    Harden + install

    One command provisions a deploy user, SSH keys, UFW, and Fail2ban, then installs Orbita on your HTTPS subdomain.

  2. Step 02

    Connect your source

    Point Orbita at a Git repo (GitHub token) or a Docker image. Grit apps are detected automatically from grit.json.

  3. Step 03

    Orbita builds it

    Nixpacks auto-detects the language — no Dockerfile needed — or Orbita builds the Dockerfile you already ship. Multi-service Compose stacks deploy whole. It all lands on Docker Swarm.

  4. Step 04

    Traefik routes + TLS

    Add a domain and Traefik fetches a Let’s Encrypt certificate on first request. Your app is live over HTTPS.

  5. Step 05

    Push to deploy

    Every git push redeploys via webhook with a health-checked, zero-downtime rollout. A bad deploy rolls back to the previous image instantly.

  6. Step 06

    Watch it run

    Live logs, CPU/memory metrics, and an in-browser terminal per app — each org fully isolated on its own network and quota.

Built for one box, many clients

True isolation, automatic HTTPS, and observability — without a heavy control plane.

One ~30 MB binary

The Go control plane embeds the React dashboard and idles under 50 MB of RAM — leaving nearly all of your server for the apps you run.

HTTPS by default

Traefik v3 with automatic Let’s Encrypt, HTTP→HTTPS redirect, and per-app routing generated from orbita.yaml. Only the proxy binds the public host.

Observable from day one

Live logs, metrics and an in-browser terminal for every app. Grit apps additionally get Pulse and Sentinel mounted automatically.

Push to deploy

After the first deploy, every git push to your branch redeploys via webhook. The CLI becomes optional — the platform keeps shipping.

Isolated secrets

Each org’s secrets are encrypted with an AES-256 key HKDF-derived from a master key + org ID — never the master key directly.

The CLI is optional

Deploy from the dashboard or by pushing to git — no install needed. Prefer a terminal? The optional orbita CLI does it all from your machine.

Orbita vs Coolify vs Dokploy

Coolify and Dokploy are excellent single-tenant panels. Orbita is built for isolation and density — many clients on one box, each sealed off, on a fraction of the RAM.

How it comparesOrbitaDokployCoolify
True multi-tenancy (per-org isolation)
Per-tenant AES-256 encryption keys
Per-client CPU / RAM quotas (cgroup v2)
Hardens the server for you
Idle RAM footprint~50 MB~200 MB~500 MB
Written inGo — 1 binaryNode.jsPHP / Laravel
Zero-config framework fast pathGrit
DB migrations under an advisory lock
Deploy Docker images + Dockerfile repos
Nixpacks build (no Dockerfile)
Docker Compose stacks
Automatic HTTPS (Let’s Encrypt)
Push-to-deploy + CLI
4-role RBAC + teams
Built-in observabilityPulse + SentinelBasicBasic
Open source

Rows highlighted in coral are where Orbita is designed differently. Everything else the three tools share — Orbita just does it in a 30 MB binary.

Secure a VPS and run many clients on it — from one binary.

True per-tenant isolation, automatic HTTPS, migrations under a lock, and built-in observability — self-hosted on a box that costs a few dollars a month.