Open-source, developer-first, zero-trust. Piper turns any box you own into a real deploy target with a public HTTPS URL — a cloud VM, an old laptop, a home server, even a Raspberry Pi behind CGNAT — without exposing your network to anyone, including the relay.
The relay only ever sees ciphertext — L4 SNI passthrough, TLS terminates on your box. Route through a relay you don’t own, safely.
SQLite for state, embedded Caddy for TLS, one lightweight daemon. No Kubernetes, no sprawl — light enough to run on a Pi, happy on anything bigger.
A scriptable CLI and a full-screen TUI, Dockerfile-based builds, and git-push deploys. On the box itself, no login needed.
TLS terminates on your box; the relay splices ciphertext by SNI over an outbound tunnel — so it works behind CGNAT and never sees plaintext.
Installs on a real upgrade channel — apt on Debian/Ubuntu/Raspberry Pi OS, Homebrew on macOS. Verified binaries either way.
GitHub sign-in, and it claims this box on the public relay. piperd applies the enrollment itself — no sudo, no restart.
Builds the Dockerfile, health-checks it, and serves it at https://<hash>-<you>.public.getpiper.dev — no port forwarding, no domain required.
Every push builds your Dockerfile, health-checks it, and serves it at your domain.