Your cloud. PaaS speed.
dFlow is for three teams: startups sitting on credits with no DevOps hire, enterprises juggling vendors with different processes, and CTOs who can ship features but still pay more than $200 a month just to keep a site online.
Stack
Designed for the stack you already run
Railpack reads the repo. Dockerfile if you bring one. Static if it is a folder.
detecting
Next.js
runtime
runtimes
data
Your bill
Who this is for
01
Startup
AWS, GCP, or Azure credits are sitting unused. You do not have a platform engineer, and you should not hire one to ship v1. Connect the cloud you already have, push the repo, and go live on those credits — PaaS speed, no PaaS landlord.
02
Enterprise
Agencies, contractors, and internal teams each bring their own deploy ritual. That is how you get five ways to ship, five ways to break, and no single owner. dFlow is one control plane on infrastructure you control — SSO, roles, and a process every vendor actually shares.
03
Team lead / CTO
Your team can ship features. Infrastructure has not caught up. If Railway, Render, or Heroku is charging more than $200 a month just to stay online, you are renting keep-alive on a box you could already own. dFlow keeps the git-push workflow and puts that invoice back on your cloud.
How it works
Connect a server you already pay for, push code, get a URL. The invoice stays on your cloud account.
01 · connect
Any VPS, AWS instance, or on-prem machine. dFlow installs a scoped agent. Credentials stay yours.
agent scoped · credentials stay yours
02 · build
Git push, or prompt Cursor via MCP. We detect the stack, build on your node, and return a preview URL.
stack detected · preview URL ready
03 · live
Zero-downtime deploys, databases beside the app, custom domains. You are not paying a second landlord to keep the site up.
invoice · your cloud account
Application
That is where the wizard starts. An application holds environments. An environment is bound to compute. Services — apps, databases, images — live under it, on machines that stay yours.
You push
Git push
GitHub · GitLab · Bitbucket
Docker image
Any registry
Archive upload
zip · tar · tar.gz
AI editor
MCP over OAuth
no agent daemon left behind · credentials stay in your account
It runs here
Any VPS
Hetzner · Contabo · bare metal
Your cloud account
AWS · Azure · DO
On-prem box
SSH or Tailscale
Worker nodes
Attach a server over SSH or Tailscale. dFlow installs the runtime, watches the metrics, and keeps versions pinned.
12 services · region fra
8 services · region iad
5 services · region lan
Guided onboarding
Preparation, Dokku install, default domain, monitoring, build tools, backup tools.
Monitoring built in
Beszel by default, Netdata when you want deeper metrics.
Plugin management
Postgres, MySQL, Mongo, MariaDB, Redis, ClickHouse, RabbitMQ, Let’s Encrypt.
Deploy concurrency
Cap parallel builds per node so a release never starves the box.
Ship anything
dFlow reads the project and picks the builder. Override any of it when you need to.
Builders
GitHub and GitLab connect as full integrations, so Auto Deploy ships every push. Turn on Require Approval Before Deploy when a human should sign off first.
Data layer
Databases run on the same worker node as the service that needs them, on a private network, wired in by reference.
Image version
Any service in the environment can reference this key instead of copying the credentials.
Keep backups on the node, or push them to object storage you own. ClickHouse backups are not available yet.
Deploy pipeline
Builds run on your worker node, on your bill. Every line is streamed back while it happens.
Triggered by
4f1c9ae
checkout: retry failed payment intents
priya pushed to main
You stay in control
Variables
Static values, references to other services, and generated secrets. Written as templates, resolved on the node at release time.
production
production
{{ orders-db.POSTGRES_URI }}
postgres://acme:••••••@orders-db:5432
{{ storefront-api.DFLOW_PUBLIC_DOMAIN }}
https://api.acme.com
{{ secret(64, "aA1!") }}
•••••••••••••••••••••
1000
1000
Encrypted at rest
Values are encrypted in the database and never live in your repo.
Redacted for agents
An MCP client reads the key. It does not read the resolved secret.
Generated once
A secret() value is kept across later edits while its template is unchanged.
Applied on release
Changing a variable prompts a redeploy or a restart to take effect.
Domains and SSL
Point DNS at your node. dFlow validates the record, issues the certificate, and keeps it renewed.
Add the domain
api.acme.com attached to storefront-api
DNS checked
CNAME resolves to node-fra-01
Let's Encrypt issued
Auto-regenerate enabled
Serving traffic
Nginx routing, zero-downtime swaps
Awaiting issuance
renews without a reminder
Free default domain
service.node.up.dflow.sh
Wildcard dev domains
nip.io · sslip.io
Proxy
Per-app Nginx config
Domains per service
Unlimited, one default
Scale
Presets cover most services. When one needs more, set CPU, memory, and replicas per process type.
CPU limit
Memory limit
Replicas
2 of 5 running
HTTP traffic
Background jobs
Timed work
Limits and reserves are set per process type, then applied on the next release.
Templates
A template describes services, builders, variables, and wiring. Deploy it into any environment, or compose your own and publish it.
Beszel Agent
1 service
Bytebot
4 services
Ollama
1 service
Restic Backups
1 service
Rocket Chat
2 services
components
3 services
Deploy flow
Compose your own template from services you already run, keep it private to the workspace, or publish it to the community.
Operating layer
dFlow sits on the worker you already pay for. Drive it from the dashboard, git, or MCP in the editor you already use.
+ bare metal · VPS · on-prem
control plane
on the worker you already pay for
+ any Docker image · templates
From the editor
Ask Cursor, Claude, or Copilot to deploy. The agent calls the same tools you would click in the dashboard — on the server you already pay for.
import type { Metadata } from 'next'import { Geist, Geist_Mono } from 'next/font/google'import { ThemeProvider } from '@/providers/theme'import { QueryProvider } from '@/providers/query'import { Toaster } from '@/components/ui/sonner'import './globals.css'const geist = Geist({ subsets: ['latin'] })const mono = Geist_Mono({ subsets: ['latin'] })export const metadata: Metadata = { title: 'dFlow', description: 'Ship from your IDE.',}export default function RootLayout({ children }) { return ( <html lang='en'> <body> <ThemeProvider>{children}</ThemeProvider> </body> </html> )}deploy my ecommerce site on AWS EC2 using dflow MCPdflow MCP
AI workflow
dFlow ships an MCP server behind OAuth. Cursor, Claude, or any MCP client gets the same scoped tools your team has — nothing more.
Applications
6 tools
Environments
5 tools
Services
24 tools
Deployments
6 tools
Git providers
6 tools
Templates
5 tools
Docker registries
3 tools
Worker nodes
2 tools
Guardrails
Teams and vendors
Custom roles start read-only. Grant create, update, and delete exactly where a contractor needs it, and take it back when the engagement ends.
| Resource | Create | Read | Update | Delete |
|---|---|---|---|---|
| Applications | ||||
| Services | ||||
| Deployments | ||||
| Worker nodes | ||||
| Backups | ||||
| Roles |
Example: an agency role scoped to one application.
Enterprise SSO
OIDC and SAML — Entra, Okta, Auth0, Google Workspace, Keycloak.
Invitations
Invite by email with pending, accepted, revoked, and expired states.
Gated deploys
Require approval before a vendor push reaches production.
Encrypted variables
Values are encrypted at rest and redacted from agent reads.
The whole surface
No add-on tier for the basics. This is what a workspace can do on day one.
58
included
Deploy
Run
Data
Infrastructure
Edge
Team
ready