PodHull
GitHub

Features

A complete platform,
in one careful panel.

Everything you need to run real applications on your own server, from the first deploy to the backup you hope you never need.

Traffic path

Understand an application at a glance.

Each application page opens with a live diagram drawn from the units that actually run: which service is public and under which domain, which ones stay private, which have no internet at all, and which volumes they share.

  • Public, private and internal services told apart by colour and line
  • Shared volumes drawn once, connected to every service that mounts them
  • Select any block to open that service
The Traffic path of an application with four services.

Deploys

Ship without a maintenance window.

A new version starts beside the one that serves traffic. The proxy moves to it only once its health check passes; if it fails, nothing changes for your visitors. Earlier images stay on the server, so a rollback starts one beside the current version too.

  • Blue-green rollout for public services
  • Every deploy keeps its full log
  • Retained images for one-click rollback
  • Optional check for newer versions of the image
A service page with the serving version, the last deploy and retained images.

Git builds

Push to your repository. PodHull does the rest.

Point a service at a Git repository and a branch. PodHull fetches it, builds the image from your Containerfile with Podman and rolls it out. Webhooks are verified with each forge's own signature scheme, and a replayed delivery is refused.

  • GitHub, GitLab, Gitea and Forgejo, plus a generic signed hook
  • Always builds the head of the branch, never an older commit by accident
  • Private repositories through a per-service deploy key
  • Build output lands in the deploy log
Webhook deliveryverified
POST /hooks/shop/web/…
X-GitHub-Event: push
X-Hub-Signature-256: sha256=9f2c…e41a
X-GitHub-Delivery: 4d7e…b210

fetching https://git.example.com/shop.git main
building Containerfile
deploy succeeded

Proxy and certificates

HTTPS everywhere, without a second thought.

The PodHull proxy listens on ports 80 and 443 through systemd sockets, obtains certificates through ACME and renews them well before they expire. Routes are generated from each service's access settings, never edited by hand.

  • Automatic certificates for every domain
  • Public TCP ports when a service is not HTTP
  • A read-only overview of every domain and route
The proxy page with managed certificates and routes.

Volumes and backups

Your data, kept where you can see it.

Named volumes belong to their application and can be shared between its services. Back them up on demand or on a schedule driven by systemd timers, keep as many copies as you choose, then download or restore any of them.

  • Scheduled local backups with retention
  • Download a backup or restore it in place
  • Volumes go only when you purge the application
A service settings form with source, runtime, data and options.

And more

The details that make it dependable.

Secrets

Stored as Podman secrets owned by the application's own user and handed to the container at start. Values are never shown again in the panel.

Logs and metrics

Service logs straight from the journal, CPU and memory metrics, and a live event stream for every application.

Audit log

Every change is recorded with who made it and from where, in a hash chain that shows any later edit to the file.

Unit files

See the exact Quadlet unit of every service. Advanced users can edit it; each change is validated and kept as a revision you can restore.

Resource limits

Memory and process limits per service, read-only root filesystems and dropped capabilities as the default.

A real API

Everything the panel does goes through a documented JSON API under /api/v1, with the same checks and the same audit trail.

See it on your own server.

Get started →How it works