Open-source, developer-first, zero-trust. Piper turns any box you own into a real deploy target with a public HTTPS URL — a cloud VM, an old laptop, a home server, even a Raspberry Pi behind CGNAT — without exposing your network to anyone, including the relay.
The relay only ever sees ciphertext — L4 SNI passthrough, TLS terminates on your box. Route through a relay you don’t own, safely.
SQLite for state, embedded Caddy for TLS, one lightweight daemon. No Kubernetes, no sprawl — light enough to run on a Pi, happy on anything bigger.
A scriptable CLI and a full-screen TUI, Dockerfile-based builds, and git-push deploys. On the box itself, no login needed.
TLS terminates on your box; the relay splices ciphertext by SNI over an outbound tunnel — so it works behind CGNAT and never sees plaintext.
Enroll your box on the public relay (or your own). One outbound tunnel, no ports opened.
Link a repo through your own per-user GitHub App — the private key never leaves your box.
Builds the Dockerfile, health-checks the container, and publishes it live at https://myapp.your-domain.
Every push builds your Dockerfile, health-checks it, and serves it at your domain.