DeployLite：面向小团队的开源 AI 原生自托管部署控制平面

DeployLite is an open-source, community-oriented, self-hosted deployment control plane for small teams and independent builders. It is intentionally lightweight and AI-native: AI can inspect a redacted operational view, while infrastructure changes remain explicit and authorized.

What is implemented on `main`

The following capabilities are available in the current main branch:

Capability	Current boundary
VPS installation	HTTP-first installer and local runtime setup
Access control	First-owner setup, cookie sessions, and role-based access control (RBAC)
Project configuration	Create, edit, and delete project metadata
Environment values	Encrypted-value foundation and masked value handling
Control-plane views	Deployment and log metadata with Server-Sent Events (SSE) log inspection
Model Context Protocol (MCP)	Read-only, non-executing server status, deployment, and log inspection
Runtime port contract	Project runtime ports are bounded and covered by tests; this does not start a production executor
Baseline verification	Hosted quality, PostgreSQL integration, Compose/supply-chain, and aggregate gates run under strict `main` protection
Dependency and image security	Filesystem and API/web image Trivy scans, CycloneDX SBOMs, digest evidence, and hardened small runtime images
Local CI evidence	Explicit local check execution and GitHub Issue-comment publication for advisory evidence only

The current deployment-control and agent surfaces are Alpha/early access, not a finished production deployment platform. Real production execution, privileged host mutation, provenance/signing, VPS smoke, routing, certificates, and release approval remain pending. See the platform support policy and release-evidence contract for the current boundary.

What is planned

DeployLite does not yet provide a production deployment executor, multi-service applications, Docker Compose or Swarm workloads, networks, volumes, backups, managed databases, service-level secrets, registries, deployment CI/CD integrations, webhooks, observability, healthchecks, functional rollback, remote build servers, or MCP writes.

See the community roadmap for the incomplete planned P0–P8 phases and their acceptance boundaries. Planned work is not a product commitment or an implemented capability.

Work with the community

Read how to contribute before proposing code, documentation, or roadmap work. Report security concerns through the security policy, not through public issues or logs.

Architecture

DeployLite is a TypeScript monorepo with separate control-plane and agent boundaries:

apps/api: Fastify control-plane API
apps/web: Next.js web interface
apps/agent: deployment-agent surface; real executor work remains gated
apps/mcp: read-only MCP adapter
packages/config: configuration, encryption, and redaction helpers
packages/contracts: shared Zod contracts
packages/db: PostgreSQL schema, migrations, and repositories
packages/domain: domain ports and use-case types

VPS source handoff boundary

The exact-SHA bootstrap validates the GitHub tarball before extraction and passes only its verified source bundle and non-secret repository, commit, archive, and digest metadata to the installer. The installer stages that bundle atomically at /opt/deploylite/source, writes a root-owned provenance marker, and uses stable ./source Compose build contexts. Direct invocation from an arbitrary checkout never persists that checkout and reports runtime handoff as unavailable. Runtime handoff rechecks the marker, required Dockerfiles/workspace inputs, entry types, and tree identity before any Docker mutation; an installed handoff works without network access.

The bootstrap requires GNU tar on supported Ubuntu/Debian hosts. macOS local tests explicitly skip GNU-tar-only real archive fixtures when neither gtar nor GNU tar is installed; Linux tests fail instead of silently skipping them.

The existing runtime-contract path-case behavior is pre-existing and intentionally outside the #241 source-bundle hardening scope; it remains covered by its unchanged contract test.

Validate changes

Run the workspace checks before submitting a change:

pnpm check

PostgreSQL integration checks are opt-in because they require a local database. See package scripts for the relevant commands.