CodeVanzi/paasmcp

> Turn any Linux server or Homelab into a modern automated Cloud PaaS operated directly by AI Agents via MCP (Model Context Protocol) or Humans via a sleek Web Control Plane — with zero idle RAM overhead.
> 🇧🇷 Leia a Documentação Completa em Português aqui (docs/PT-BR.md)
## 💡 Why PaaSMCP?
Traditional self-hosted PaaS dashboards are great for manual clicking, but they:
1. Consume 300MB–1GB+ of RAM continuously just to run their control plane daemons and internal queues.
2. Require manual multi-step setup for SSH deploy keys, database bindings, and Cloudflare Tunnel / Zero Trust rules.
3. Were not designed from day one to be operated by AI Agents via MCP.
PaaSMCP takes a radically lightweight, Agent-First & Security-First approach:
0 MB Idle Daemon Overhead: Runs on-demand via MCP stdio or CLI, orchestrating native Docker Compose stacks directly on your host. (The optional web dashboard and GitHub webhook receiver are a small always-on service.)
Human-in-the-loop for risky actions: Agents run safe actions freely; destroying, purging, restoring, deleting secrets, public exposure, trusted apps and federation changes wait for a person to approve them in the dashboard or with paasmcp approve . Destroyed apps go to a 30-day trash. See Security model.
AES-256-GCM Encrypted Secrets & Backups Vault: Secrets (/opt/homelab/paasmcp/vault/ .enc.json) and database snapshots (/opt/homelab/paasmcp/backups/ .enc.bak) are encrypted at rest with a 0600 master key. Values are masked in MCP outputs (skldef) and can be ingested directly from files so sensitive keys never pass through LLM chat histories.
Instant Multi-Tenant Databases + Encrypted Snapshots: Provision isolated PostgreSQL 16 databases (db + user ) or Redis 7 logical instances in 1 second, automatically injecting DATABASEURL and REDISURL, with 1-click encrypted pgdump backup & zero-plaintext-disk restore.
Zero-Config Buildpacks + Multi-Service Docker Compose Pass-Through: Automatically builds repositories with a custom Dockerfile, sanitized multi-service docker-compose.yml (stripping unsafe privileged/host flags and injecting Vault secrets), or generates optimized multi-stage Dockerfiles for Node.js, Next.js, Vite/React/Astro SPAs, Python (FastAPI/Flask/Django), Go, C# / ASP.NET Core, and Static HTML. Other stacks (Rails, Laravel, Java…) build from your own Dockerfile; the dashboard has one-click presets for each of these.
Zero-Downtime Blue/Green Deploys: Each new version first runs as a candidate container on a free loopback port and must answer an HTTP healthcheck (healthcheckPath, default /, status :previous) before every deploy for instant 1-second rollback, and inspects containers for OOMKilled, crash-loops, and live CPU/RAM metrics (docker stats).
Two-Server Mirror: Pair a second server (paasmcp-join://, HMAC-SHA256 + SSH fingerprint), then paasmcp mirror offer/accept: each server keeps a live read-only copy of the other's Postgres (physical streaming over Tailscale, a replication slot keeps up to 10 GB of changes while the peer is away) and receives the other's backups in its Garage. paasmirror status shows streaming / caught up / seconds behind; promote is a manual failover with a strong confirmation that raises an epoch number, redeploys the peer's apps and points their DNS here. Automatic failover needs an arbiter (paasmcp arbiter install-service on a small third device, which can serve several clusters with arbiter add-key; forbidden without one; the dashboard's Arbiter tab shows its state (device, version, servers it hears, last watchdog contact, who serves whose data) and generates the install command with the key already in it; a PC that already runs PaaSMCP becomes an arbiter from its own dashboard and pairs with a 6-digit code (arbiter pair / arbiter pair-with), and the other server adopts the address through the control channel and paasmcp arbiter check / its "Test" button shows whether the arbiter answers and hears both servers): mirror watch heartbeats, takes over only when both it and the arbiter lost the peer and the copy stopped streaming, and fences a server whose data moved (its apps stop, deploys are refused). Guided failback: offer --from-copy-of, accept --rejoin (old data moved aside, never deleted), handback (waits for zero lag), promote. One server can also send copies to several others (star): on failure exactly one copy takes over and the others step aside until rebuilt (mirror retire for a manual failover). The full outage → failover → failback cycle runs in scripts/mirror-lab.sh and, with three servers and a real arbiter, in scripts/star-lab.sh (real Postgres containers).