Wharf
Self-hosted PaaS control plane: Go Agents talk Docker on each VPS, a NestJS Hub owns desired state over outbound WSS, and a React UI operates projects without mounting the Docker socket on the control plane.
About
Wharf is a self-hosted PaaS for managing portfolio apps across one or more servers with a strict Agent / Hub / UI trust split.
Architecture
- Agent (Go) — only component that touches Docker; dials out to the Hub over WebSocket with a per-server token
- Hub (NestJS + SQLite) — central control plane for auth, audit, and desired-state commands; never mounts or calls Docker directly
- UI (React + Vite) — operator console against the Hub API (optional Cloudflare Access at the edge)
Security model Agents dial out (no inbound management port on the VPS). Socket proxies allow-list Engine API calls and can deny EXEC. Hub compromise cannot issue Docker calls directly — only whitelisted commands to already-connected Agents.
Operator flow Create a managed project in the UI → Hub records desired config → dispatches compose.apply (and optional registry/provision commands) to the Agent → Agent applies on the host.