Getting started
What is this PaaS?
This platform is a self-hosted, Heroku-style PaaS built on
Dokku 0.38.31, running on a single IPv4-only Hetzner
Cloud server with Ubuntu 24.04.
You push code with git push; the platform builds it into a container,
deploys it with zero downtime, and serves it at its own URL. You never
manage servers, containers, or web servers — just your code.
What the platform gives every application out of the box:
- Git-push deployments. Pushing to the platform's git remote builds
your code with Heroku-compatible buildpacks (or your own
Dockerfile) and rolls it out with zero downtime — traffic only switches once the new version is verified up. - A URL per public app. Public apps use
https://<app-name>.prototype.imeme.name. TheterminalAPI stays private. - Automatic HTTPS via Let's Encrypt. A post-deploy hook issues certificates for every public app, including apps you add yourself; cron renews them. Certificate failures are explicit. HTTPS terminates at the platform edge and your app keeps speaking plain HTTP internally.
- Managed datastores. A Postgres 18.6 service (
demo-db) and a Redis 8.10.2 service (demo-cache) run on the platform. Link one to your app and its connection URL appears as an environment variable. Both are backed up daily to root-only local storage under/var/backups/dokku, with 7-day retention by default. These backups are lost with the host or disk. - Configuration as environment variables. Set, change, and unset config without touching code; the platform restarts your app to apply. Apps also automatically receive a shared credential for the private Open Terminal API. Never log it: it grants access to the common workspace, not an app-isolated workspace (see Web shell).
- Logs. Everything your app writes to stdout/stderr is captured; stream it live with one command.
The mental model
- An app is a git repository plus a name. You create the (empty) app on the platform, add it as a git remote, and push.
- A push is a deploy. The platform detects how to build your code
(buildpack or
Dockerfile), builds a container image, starts the new version alongside the old, verifies it stays up, then switches traffic and retires the old version. - Everything specific to an environment lives in environment variables — set on the platform, never committed to your repo.
- The platform owns routing, TLS, and process supervision. Your app's only jobs: listen on the port the platform assigns, stay stateless, and log to stdout.
Who does what
- Developers hold the deploy key (an ed25519 SSH key). With it you create apps, push code, set config, link datastores, and read logs — all over SSH, no Hetzner account needed. Registered keys have broad permissions across all apps, not per-app authorization.
- Platform operators hold host access and the Terraform automation. They troubleshoot automatic HTTPS, manage the datastore services, and keep the platform patched and backed up.
Ask your operator to register your public key and provide this platform's
prototype.imeme.name / <public-ip> values if you don't have them yet.
If you run the automation yourself, both come from Terraform:
bash scripts/terraform.sh output -raw platform_domain and
bash scripts/terraform.sh output -raw instance_public_ip.
Operator SSH keys are local files, not Terraform-generated private-key
outputs; never print or share a private key in chat.
Your first deploy in five commands
Use your registered key (shown here as ~/.ssh/dokku-deploy.pem):
chmod 600 ~/.ssh/dokku-deploy.pem
# 1. create the app (any valid name, e.g. my-first-app)
ssh -i ~/.ssh/dokku-deploy.pem dokku@<public-ip> apps:create my-first-app
# 2. in your project's git repo, add the platform as a remote
git remote add dokku dokku@<public-ip>:my-first-app
# 3. push your code to the platform's deploy branch (master)
GIT_SSH_COMMAND='ssh -i ~/.ssh/dokku-deploy.pem' git push dokku HEAD:master
# 4. watch the build output, then check it live
curl https://my-first-app.prototype.imeme.name/
# 5. stream its logs
ssh -i ~/.ssh/dokku-deploy.pem dokku@<public-ip> logs my-first-app -t
That's a full deploy: build, release, health check, routing, and logs.
If HTTPS fails, do not claim success. Check deploy output and ask the operator
to fix DNS/port 80, then retry sudo paas-enable-https my-first-app on the
host (see Deploy your first app, step 10).
The custom platform domain needs both apex and wildcard A records targeting
the Primary IPv4, without AAAA records for this IPv4-only platform.
Tip — save the key in SSH config so
git pushfinds it without flags:Host dokku-paas HostName <public-ip> User dokku IdentityFile ~/.ssh/dokku-deploy.pemThen
git remote add dokku dokku-paas:my-first-appand plaingit push dokku main:masterjust work.
What your app must look like
Any app that satisfies a short list of requirements can deploy here —
any language with a Heroku-compatible buildpack (Node.js, Python, Ruby,
Go, Java, PHP, …) or anything you can express as a Dockerfile. The
full checklist is on the next page:
Application requirements.
Optional browser workspace
The browser frontend at https://shell.prototype.imeme.name/ opens the shared,
ephemeral terminal app by default. It provides git, SSH, PaaS guidance,
and Copilot configured for OpenRouter directly at
https://openrouter.ai/api/v1, model ~deepseek/deepseek-v4-flash-latest;
use ?app=<name> to open another app's own container instead.
To open the frontend-only shell container itself use ?app=shell. Browser
access requires an app-scoped approval (see Web shell).
Keep source in a separate durable Git remote. The private API uses a shared
key available to all apps, and the workspace deploy key can administer every
app: browser scoping does not isolate tenants.
Where to go next
- Application requirements — the deployability checklist every app must satisfy.
- Deploy your first app, step by step — a complete walkthrough from an empty directory to a live URL, including config, a database, and HTTPS.