DeployLite is an open-source, community-oriented, self-hosted deployment control plane for small teams and independent builders. It is intentionally lightweight and AI-native: AI can inspect a redacted operational view, while infrastructure changes remain explicit and authorized.
The following capabilities are available in the current main branch:
| Capability | Current boundary |
|---|---|
| VPS installation | HTTP-first installer and local runtime setup |
| Access control | First-owner setup, cookie sessions, and role-based access control (RBAC) |
| Project configuration | Create, edit, and delete project metadata |
| Environment values | Encrypted-value foundation and masked value handling |
| Control-plane views | Deployment and log metadata with Server-Sent Events (SSE) log inspection |
| Model Context Protocol (MCP) | Read-only, non-executing server status, deployment, and log inspection |
| Runtime port contract | Project runtime ports are bounded and covered by tests; this does not start a production executor |
| Baseline verification | Hosted quality, PostgreSQL integration, Compose/supply-chain, and aggregate gates run under strict main protection |
| Dependency and image security | Filesystem and API/web image Trivy scans, CycloneDX SBOMs, digest evidence, and hardened small runtime images |
| Local CI evidence | Explicit local check execution and GitHub Issue-comment publication for advisory evidence only |
The current deployment-control and agent surfaces are Alpha/early access, not a finished production deployment platform. Real production execution, privileged host mutation, provenance/signing, VPS smoke, routing, certificates, and release approval remain pending. See the platform support policy and release-evidence contract for the current boundary.
DeployLite does not yet provide a production deployment executor, multi-service applications, Docker Compose or Swarm workloads, networks, volumes, backups, managed databases, service-level secrets, registries, deployment CI/CD integrations, webhooks, observability, healthchecks, functional rollback, remote build servers, or MCP writes.
See the community roadmap for the incomplete planned P0–P8 phases and their acceptance boundaries. Planned work is not a product commitment or an implemented capability.
Read how to contribute before proposing code, documentation, or roadmap work. Report security concerns through the security policy, not through public issues or logs.
DeployLite is a TypeScript monorepo with separate control-plane and agent boundaries:
apps/api: Fastify control-plane APIapps/web: Next.js web interfaceapps/agent: deployment-agent surface; real executor work remains gatedapps/mcp: read-only MCP adapterpackages/config: configuration, encryption, and redaction helperspackages/contracts: shared Zod contractspackages/db: PostgreSQL schema, migrations, and repositoriespackages/domain: domain ports and use-case types
The exact-SHA bootstrap validates the GitHub tarball before extraction and passes only its verified source bundle and non-secret repository, commit, archive, and digest metadata to the installer. The installer stages that bundle atomically at /opt/deploylite/source, writes a root-owned provenance marker, and uses stable ./source Compose build contexts. Direct invocation from an arbitrary checkout never persists that checkout and reports runtime handoff as unavailable. Runtime handoff rechecks the marker, required Dockerfiles/workspace inputs, entry types, and tree identity before any Docker mutation; an installed handoff works without network access.
The bootstrap requires GNU tar on supported Ubuntu/Debian hosts. macOS local tests explicitly skip GNU-tar-only real archive fixtures when neither gtar nor GNU tar is installed; Linux tests fail instead of silently skipping them.
The existing runtime-contract path-case behavior is pre-existing and intentionally outside the #241 source-bundle hardening scope; it remains covered by its unchanged contract test.
Run the workspace checks before submitting a change:
pnpm checkPostgreSQL integration checks are opt-in because they require a local database. See package scripts for the relevant commands.