▲ skiff

Connect to your control plane

Paste the API token printed by skiff server (or shown by the installer).

▲ skiff
auto-refreshes every 3s · token stays in this browser

Overview

connecting…
Deploy from a Git repo, spin up a Postgres HA cluster, or run a compose stack.

Live trends

this session · 3s samples

Nodes

Recent activity

Apps

Git-built, load-balanced container apps. Replicas are scheduled onto worker nodes.

new app

Public repo → leave “none”. Private repo / CI-CD clone → pick a git-token secret, or add one. No GitHub OAuth needed.
Sealed in the keeper. Name it git-token to make it the cluster-wide default for every private repo.
Build & runtime auto-detected — open for monorepos or custom builds
Auto-detected (Dockerfile → built-in Go/Python/Node/static). Override for monorepos or custom builds — leave blank to auto-detect. Applies to the generated recipe, not your own Dockerfile.
Environment & secrets env vars · runtime secrets · build secrets
Plain (non-secret) values injected at run time. For secret values use secrets below.
Injected as env vars at container start (values stay sealed — never shown or baked into the image).
Mounted only during the build (BuildKit --secret); never in the final image.
Advanced persistent volumes
Persistent storage, created automatically on the node — no setup. Persists across deploys; pins the app to one node (so volumed apps are replicas=1).

Databases

Postgres HA clusters — primary + synchronous standby + async replica, node-pinned volumes, Raft-coordinated failover.

new postgres HA cluster

Optional — POSTGRES_* are auto-generated.

postgres user, password, DATABASE_URL secret, and env are generated automatically. Members are placed on worker nodes.

Services

Docker-compose stacks pinned to a single node. Use apps + replicas when you need cross-node HA.

new service — docker compose stack

local
.env interpolation vars for your compose file (optional).

Runs a docker-compose stack pinned to ONE worker node (compose is single-host — no cross-node HA). Source: paste YAML, or point at a git repo (redeploy re-checks-out & pulls). To expose: set a domain + the host port your compose file publishes. Volumes: declare them in your compose (volumes:) — Docker creates them automatically and they persist across redeploys.

Routes

The edge load balancer. Each host fans out to healthy backend replicas; unhealthy ones are pulled from rotation.

Cluster

Nodes, roles, and the managed-DNS edge.

Platform

Edge (managed DNS)

Metrics

Live fleet, database, and per-node resource metrics — sampled in your browser this session. For history & alerting over time, scrape /metrics with Prometheus.

Fleet trends

this session · ~3s samples

Databases

Per-node resources

cpu · memory · disk · network

Prometheus /metrics

Secrets

Envelope-encrypted at rest in the keeper and replicated across brain nodes. Values are shown once, at create.

set secret

Settings

Source access, managed DNS, and self-update.

Git access · clone private app repos

Token to clone your private app repos. Sealed in the keeper; git-token is the cluster-wide default. Fine-grained PAT, Contents: read. No OAuth.

API access token

The token you sign in with. Rotating replicates a new one to every node in ~15s — no restart. The env SKIFF_TOKEN stays valid as break-glass. Previous token works 10 more min; new one is saved in this browser.

keeper is sealed — set SKIFF_ROOT_KEY to rotate the token

Cluster root key

Master key for all secrets. Rotating re-encrypts everything and rolls the new key to every node (quorum-safe restart).

keeper is sealed — set SKIFF_ROOT_KEY first
⚠ Restarts every node in sequence — test on staging first.

Self-update token · skiff's own releases

Token to see & download skiff's own releases (private repo). Set once — replicates to every node. Falls back to git-token. Without it the update button never appears.

keeper is sealed — set SKIFF_ROOT_KEY to store this

Dashboard domain

Serve this dashboard over HTTPS on your own domain (auto Let's Encrypt) instead of an IP.

Point this domain's DNS A record to your edge node's public IP, then save. The certificate is issued on first access. Leave blank to disable.
HTTPS ingress is off — the dashboard domain needs the node started with --tls to serve over HTTPS.

Managed DNS

Skiff auto-creates + maintains the A records for every app/service domain.

Cloudflare: leave zone blank to manage all your domains with one token. The token needs Zone → Zone → Read + Zone → DNS → Edit, Zone Resources = All zones. A 403 code 10000 in the status below means the token is missing one of those.

Config (incl. the token) is sealed in the keeper and replicated — it takes effect live, no restart. Set the provider to disabled to turn managed DNS off.

Reclaim disk space

Runs docker system prune -a on every node — removes stopped containers, unused networks, build cache, and all unused images incl. retired releases (the usual disk hog). Images a rollback needs are reloaded from skiff's own store, and volumes are never touched, so databases and app data (HA state) are safe. The next build re-warms its cache.

Credentials — copy now

These values are shown once. They live sealed in the keeper after this — the dashboard never shows them again.

logs

loading…

deploy error

extensions

Everything the postgres image ships. Enable installs it into this database (CREATE EXTENSION); disable drops it.

loading…

benchmark

Runs on the node itself: single- & multi-core CPU composite score (integer + floating-point + crypto), disk sequential write/read + durable fsync IOPS, and network throughput to a peer over the mesh. Takes a couple of seconds.

loading…

edit env

Environment variables for this resource. For secret values, use a secret instead.

make database public

Opens external access on the primary. You must ALSO allow the DB port in that node's firewall for it to be reachable. Anyone with the password can then connect — keep it published only while you need it.