Passkeys and 2FA
Both are the platform's problem. Turn them on for everyone without touching an app.
Open source · self-hosted · MIT
The hard part was
never the app.
Your agent can write a working tool before lunch. Giving it a database, a domain, HTTPS and real user accounts is what eats the rest of the week. Astrodock is one install that deletes all of that — then hands your agent the keys.
One command, one machine, ten minutes.
Sign in to On-call
Continue
Passkeys and two-factor included. Your app never sees a password.
On-call
priya@
On now
Priya Raman
until Fri 09:00
- Marcus OyelaranFri — Mon
- Ines DelacroixMon — Thu
- Tomás FerreiraThu — Fri
Sign-in you don't write
Your app never sees
a password.
Send people to Astrodock to sign in and they come back with a one-time code your server trades for their identity. Accounts, passkeys and two-factor come with the platform instead of with your code — so the tool you threw together on Tuesday has login you'd be happy to put in front of customers.
One session, every app
Sign in once and you're signed in to everything you have access to.
Access per app
Grant someone the rota tool and not the invoicing one. They only see what's theirs.
Built to be handed over
Your agent already
knows how to use it.
Astrodock ships a contract, not a tutorial. Point Claude Code or Cursor at
AGENTS.md and it has what it needs: the manifest schema, the
environment it will be handed, and a deploy command that streams until it can say
succeeded or failed — so your agent knows whether it worked
instead of guessing.
It gets its own scoped key, too. It can ship apps and set secrets. It cannot touch your users.
How the agent contract works →## 2. App layout contract app/ frontend, builds to app/dist/ server/ Express, entry server/server.js ### Hard rules for the server 1. Bind ASTRODOCK_PORT 2. Namespace routes under /api 3. GET /health → 200 4. Read config from injected env. Never hardcode. Never commit secrets.
Getting code onto it
Three ways in. Two ways to run.
However the code arrives, the rest is the same: install, build, publish, health-check, and a log you can read while it happens.
Push to a branch
Connect a repository and every push to the watched branch rebuilds and goes live.
From your machine
astrodock deploy uploads the working directory. No repository required.
From an agent
The same CLI with a scoped key, streaming until the deploy reaches a verdict.
Node, with nothing to configure
Drop in a frontend and a server and the runtime works out the shape. The frontend
is built and served as static files; the server gets its own process, and requests
under /api go to it. Same origin, so no CORS to fight.
Or a Dockerfile, for anything else
Python, Go, Rust, a binary you were handed. Ship a Dockerfile and Astrodock builds it, runs it alongside everything else, and routes the whole subdomain to it.
{
"slug": "oncall",
"subdomain": "oncall",
"runtime": { "type": "node" },
"auth": { "mode": "platform" },
"database": { "mode": "internal" },
"storage": { "mode": "none" }
}
A database and storage, per app
Internal, external,
or not at all.
Every app declares what it needs. Ask for a database and Astrodock creates one just for that app and hands it over as a connection string. Ask for storage and it gets its own S3-compatible bucket.
Point an app at your own Neon or RDS or R2 instead and nothing in the app changes — it reads the same variable either way. Moving from the one on the box to a managed one later is a config change, not a rewrite.
Bringing your own database →Configuration
Secrets that were
never in the repo.
An app declares the names of the variables it needs. The values live on the
platform, encrypted, and arrive as environment variables at deploy — so there is no
.env to leak and nothing sensitive in the source your agent just wrote.
Miss one and the deploy stops before it starts, naming exactly what's missing. A half-configured app never reaches your users.
You declare
STRIPE_SECRET_KEY · required · secret
The platform injects
ASTRODOCK_DATABASE_URL
ASTRODOCK_APP_URL · ASTRODOCK_PORT
Missing a value
Deploy blocked — STRIPE_SECRET_KEY has no value
After it's live
You can see what it's doing.
A platform you host yourself is only worth it if you can tell what's happening on it without opening a terminal.
Every build, kept
Full logs for every deploy, so you can read what happened long after it happened.
Live logs
What your app is printing right now, in the dashboard, without an SSH session.
Health, watched
Every app checked continuously — and an email when one stops answering.
Backups
Scheduled dumps of the databases and the platform's own state, on your disk.
Addresses
Certificates you
never think about.
Every app gets a subdomain of your domain the moment it exists, with a real certificate that renews itself. Put a custom domain in front of any of them and Astrodock shows you the exact DNS record, watches for it, and turns on HTTPS the moment it lands.
There's a lighter option too: Pages publishes a document or a small static site straight from a folder, with no app to build and the same access control if you want it locked down.
Custom domains and DNS →From bare server to live app
Ten minutes, start to finish.
1
Install it
curl -fsSL https://raw.githubusercontent.com/astrodock/astrodock/main/scripts/install.sh | sh
On a fresh Linux box. It fetches the stack, generates every secret and starts it.
2
Finish in the browser
Point a wildcard DNS record at the machine. Astrodock shows you the exact record to create, checks it for you, and turns on HTTPS when it lands.
3
Hand it to your agent
Make a scoped key, give it the docs, and ask for the thing you actually wanted.
Being straight with you
What it isn't.
It isn't Kubernetes. One machine, one stack, no cluster. If you need to survive a region going dark, this is the wrong tool.
It isn't built for scale. It's built for the dozens of small things a person or a team actually runs — internal tools, side projects, the thing your agent wrote on Tuesday.
It isn't magic. You still own the machine, the backups and the updates. Astrodock makes each of those one command, not zero.
Give it a machine
and ten minutes.
Hosted Astrodock is coming — the same platform and the same apps, without the setup.