Harden a server,
then deploy anything
A self-hosted PaaS that secures your server and gives every client true isolation — in one ~30 MB Go binary. Deploy Laravel, Django, Rails, Next.js, a static site, or any Docker image. Where Coolify and Dokploy are single-tenant panels, Orbita is built for running many clients on one box.
$ curl -sSL https://raw.githubusercontent.com/MUKE-coder/vps-harden/main/vps-harden.sh -o h.sh \
&& sudo bash h.sh --no-dokployTwo commands, zero config
Harden the box, install Orbita, then ship any containerised app — from the dashboard or the terminal, whichever you prefer.
True multi-tenancy
Per-org Docker networks, AES-256 keys, cgroup v2 CPU/RAM quotas, and 4-role RBAC. Run every client on one cheap box — they never see each other.
Secure by the first command
orbita init hardens the server — deploy user, SSH keys, locked-down root, UFW, Fail2ban — then installs Orbita on your HTTPS subdomain.
Any app, no Dockerfile
Nixpacks builds Laravel/Django/Rails/Node/static with no Dockerfile — or bring a Dockerfile, a Compose stack, or a raw image. Grit apps get a zero-config fast path on top.
Migrations under a lock
Deploys build, then run migrations under a Postgres advisory lock before cutover. A failed migration aborts — never a schema-mismatched cutover.
$ orbita init
✔ Server hardened (score 94/100)
✔ Orbita live at https://orbita.example.com$ orbita deploy --host prod
✔ Migrations applied (advisory lock)
✔ Live
App: https://rental.example.com
API: https://api.rental.example.com
git push → auto-deploys via webhookHow it fits together
Your CLI and browser talk to one Go binary. It drives Traefik, Postgres, Redis, and Docker Swarm on the host — every org fully isolated.
Each org runs on its own Docker network, cgroup slice + AES-256 key — tenants never see each other.
Entry points
The grit CLI (over an orb_ token) and the embedded dashboard both hit the same REST API — nothing else is exposed.
One control plane
A single ~30 MB Go binary: Gin router → services → GORM, plus the orchestrator that speaks the Docker SDK and writes Traefik config.
Backing services
Postgres holds metadata + encrypted secrets, Redis handles cache and rate limits, and Swarm runs every workload with rolling updates.
How it works
From a bare VPS to a live app on HTTPS in five steps — the same flow whether you use the dashboard or the CLI.
- Step 01
Harden + install
One command provisions a deploy user, SSH keys, UFW, and Fail2ban, then installs Orbita on your HTTPS subdomain.
- Step 02
Connect your source
Point Orbita at a Git repo (GitHub token) or a Docker image. Grit apps are detected automatically from grit.json.
- Step 03
Orbita builds it
Nixpacks auto-detects the language — no Dockerfile needed — or Orbita builds the Dockerfile you already ship. Multi-service Compose stacks deploy whole. It all lands on Docker Swarm.
- Step 04
Traefik routes + TLS
Add a domain and Traefik fetches a Let’s Encrypt certificate on first request. Your app is live over HTTPS.
- Step 05
Push to deploy
Every git push redeploys via webhook with a health-checked, zero-downtime rollout. A bad deploy rolls back to the previous image instantly.
- Step 06
Watch it run
Live logs, CPU/memory metrics, and an in-browser terminal per app — each org fully isolated on its own network and quota.
Built for one box, many clients
True isolation, automatic HTTPS, and observability — without a heavy control plane.
One ~30 MB binary
The Go control plane embeds the React dashboard and idles under 50 MB of RAM — leaving nearly all of your server for the apps you run.
HTTPS by default
Traefik v3 with automatic Let’s Encrypt, HTTP→HTTPS redirect, and per-app routing generated from orbita.yaml. Only the proxy binds the public host.
Observable from day one
Live logs, metrics and an in-browser terminal for every app. Grit apps additionally get Pulse and Sentinel mounted automatically.
Push to deploy
After the first deploy, every git push to your branch redeploys via webhook. The CLI becomes optional — the platform keeps shipping.
Isolated secrets
Each org’s secrets are encrypted with an AES-256 key HKDF-derived from a master key + org ID — never the master key directly.
The CLI is optional
Deploy from the dashboard or by pushing to git — no install needed. Prefer a terminal? The optional orbita CLI does it all from your machine.
Orbita vs Coolify vs Dokploy
Coolify and Dokploy are excellent single-tenant panels. Orbita is built for isolation and density — many clients on one box, each sealed off, on a fraction of the RAM.
| How it compares | Orbita | Dokploy | Coolify |
|---|---|---|---|
| True multi-tenancy (per-org isolation) | |||
| Per-tenant AES-256 encryption keys | |||
| Per-client CPU / RAM quotas (cgroup v2) | |||
| Hardens the server for you | |||
| Idle RAM footprint | ~50 MB | ~200 MB | ~500 MB |
| Written in | Go — 1 binary | Node.js | PHP / Laravel |
| Zero-config framework fast path | Grit | ||
| DB migrations under an advisory lock | |||
| Deploy Docker images + Dockerfile repos | |||
| Nixpacks build (no Dockerfile) | |||
| Docker Compose stacks | |||
| Automatic HTTPS (Let’s Encrypt) | |||
| Push-to-deploy + CLI | |||
| 4-role RBAC + teams | |||
| Built-in observability | Pulse + Sentinel | Basic | Basic |
| Open source |
Rows highlighted in coral are where Orbita is designed differently. Everything else the three tools share — Orbita just does it in a 30 MB binary.
Secure a VPS and run many clients on it — from one binary.
True per-tenant isolation, automatic HTTPS, migrations under a lock, and built-in observability — self-hosted on a box that costs a few dollars a month.