# Self-hosted PaaS on Proxmox: push to deploy with Hosbah

> Hosbah is an open-source (AGPL-3.0) control plane that turns your own servers or Proxmox into a push-to-deploy platform: builds, health-gated releases, rollback, databases, backups and tunnels.

*2026-10-19T12:49:05Z*

# Self-hosted PaaS on Proxmox: push to deploy with Hosbah

A self-hosted PaaS on Proxmox should feel like a push-to-deploy platform: you push to git, it builds, it checks health, it switches traffic, and you can roll back. Hosbah is an open-source (AGPL-3.0) control plane that does this on servers you own.

![Hosbah push to deploy](/uploads/sites/f6cc082a-cbb8-4310-ae77-ef4e334be56e/media/hosbah-push-to-deploy-en.png)

## The problem

Running apps on your own servers usually means a pile of scripts: SSH in, pull, build, restart, hope. Hosted platforms hide that, but you give up the machines. Hosbah keeps the machines yours and adds the control plane on top.

## How it works

You connect a server with a one-line install or one SSH session. A small static Go binary, `hosbah-agent`, runs on it. The agent dials out to the control plane, so the server needs no inbound port for management. Enrolment uses a one-time token that expires after 15 minutes, and the agent then identifies itself with an ed25519 key and a heartbeat every 15 seconds.

A deploy runs these steps:

1. Provision the app on the server.
2. Build from your `Dockerfile`, or with Railpack/BuildKit when there is none.
3. Start the new release on an ephemeral local port.
4. Wait for the health check.
5. Start background workers.
6. Switch the Caddy upstream through its admin API.
7. Drain the old containers.

The newest five images stay on the server, so a rollback switches to an image that already exists and does not rebuild. Custom domains get TLS from Caddy, and only domains whose DNS TXT record you verified are approved.

On Proxmox, Hosbah can create a VM from a cloud-init template or an unprivileged LXC, then install the agent on it.

Other parts of the same control plane: Postgres, MySQL and Redis style databases with MinIO and restic backups, proxy hosts, and frp or Tailscale tunnels. Teams have four roles (owner, admin, deployer, viewer). AI agents connect over MCP with team-bound tokens, and each tool declares a scope.

## Screenshots

![Push to deploy](/uploads/sites/f6cc082a-cbb8-4310-ae77-ef4e334be56e/media/hosbah-gallery-02-feature.png)

![Rollback](/uploads/sites/f6cc082a-cbb8-4310-ae77-ef4e334be56e/media/hosbah-gallery-03-feature.png)

![Your servers](/uploads/sites/f6cc082a-cbb8-4310-ae77-ef4e334be56e/media/hosbah-gallery-04-feature.png)

## Getting started

The commands below are from the README. You need Docker with Compose v2.

```bash
git clone https://github.com/fadymondy/hosbah.git && cd hosbah
cp .env.selfhost.example .env.selfhost
# fill in POSTGRES_PASSWORD, HOSBAH_APP_DB_PASSWORD, AUTH_SECRET and HOSBAH_KEK
# (generate each with: openssl rand -base64 32) and back up HOSBAH_KEK
docker compose -f docker-compose.selfhost.yml --env-file .env.selfhost up -d --build
```

Open `http://localhost:3710` and sign up. Back up `HOSBAH_KEK`: it wraps the per-team keys that encrypt your secrets. To get the admin pages and the admin MCP server, promote yourself:

```bash
docker compose -f docker-compose.selfhost.yml --env-file .env.selfhost exec api /app/hosbah-admin promote you@example.com
```

For a public install, put a TLS reverse proxy in front and set `APP_URL`, `HOSBAH_AGENT_URL` and `COOKIE_SECURE=1`.

## Honest limits

- The Proxmox driver is tested against a fake Proxmox API. The test against a real node is opt-in, so try it on a non-critical node first.
- Builds currently need a public git URL. The GitHub App integration is coded but not configured by default.
- MinIO backups are not point-in-time, and a live copy can be inconsistent.
- One MCP connection is bound to one team.
- `hosbah.toml` is optional, and the project kept the `cloudy.toml` and `cld_` names from before the rename.

## FAQ

### Does Hosbah work with Proxmox?
Yes. It detects Proxmox VE and can create a VM from a cloud-init template or an unprivileged LXC. See the limits above.

### How do rollbacks work?
Hosbah keeps the newest five images per app, so a rollback switches back to an existing image and does not rebuild.

### Can I deploy private repositories?
Builds currently need a public git URL.

### Is Hosbah open source?
Yes, under AGPL-3.0, at [github.com/fadymondy/hosbah](https://github.com/fadymondy/hosbah).

## Next steps

- Read how it is built: [Hosbah on ToGO, the case study](https://to-go.dev/en/blog/hosbah-togo-case-study)
- Read the story: [Why I built Hosbah](https://fadymondy.com/en/blog/why-i-built-hosbah)
- Source: [GitHub](https://github.com/fadymondy/hosbah)
- Product Hunt: [Hosbah](https://www.producthunt.com/products/hosbah)
- Site: [hosbah.com](https://hosbah.com)

---

Source: https://hosbah.com/en/blog/self-hosted-paas-proxmox-push-to-deploy