Cloudgate features, from first deploy to production

Three ways in, three places to run, and what Cloudgate looks after once your app is live. Every Service sits in a Project and an Environment, and every Deployment is one attempt to build and release it.

How can I deploy with Cloudgate?

From the console, from your AI agent or from your terminal. All three reach the same Projects, under the same roles and grants.

The console
The web console for everything, including the get started steps that take someone new from sign-up to a live app: get a Server, press Deploy, open the address.
Your AI agent
Claude Code, Cursor or any MCP client, as an Agent with its own role, grant and keys. It deploys, opens previews and reads logs and health. How agents deploy over MCP.
Your terminal
The cloudgate CLI on npm: cloudgate deploy uploads the current folder, skipping .env and what .gitignore lists. Then status, logs and vars set. The Cloudgate CLI.
Git, images and uploads
Build from GitHub, GitLab, Bitbucket, Gitea or any git URL, with push-to-deploy through webhooks. Or run a Docker image, or uploaded files.
Project config with Plan and Apply
One cloudgate.yaml describes a Project's Services, kept in your repository or in Cloudgate. A change shows as a Plan of what it would create, change or destroy, and nothing happens until you Apply it.
Templates
Ready-made apps, from WordPress to n8n, each one a Project config. Browse the app templates.

Where do my apps run?

On a Server you own, on a Server you buy from us, or in your own AWS or Google Cloud account. Each Environment picks one, so staging and production can live in different places.

Your Server

Any Ubuntu machine Cloudgate reaches over SSH, or the machine Cloudgate itself runs on. A Setup run installs Docker Swarm and Traefik, and Domains get Let's Encrypt certificates.

Bought Server. On the Hosted instance, buy one in the console: pick a location on a world map and a size, add backups or extra storage from 10 GB to 10 TB. It is billed monthly in advance on the same invoice, at the price shown before you buy.

AWS

web, worker, web-private, cron
ECS (Fargate)
PostgreSQL, MySQL
RDS
Redis
ElastiCache
bucket, static sites
S3 and CloudFront
Compose stack
Its own Stack VM

Google Cloud

web
Cloud Run
worker
Cloud Run worker pool
Databases
Cloud SQL
Redis
Memorystore
bucket
Cloud Storage
Compose stack
Its own Stack VM

Cloud resources are made with OpenTofu in your own account. Cloudgate keeps the infrastructure state and shows drift, the changes someone made by hand in the cloud's console. Prefer to run Cloudgate itself on your own machine? Read about self-hosting Cloudgate.

What does Cloudgate look after once my app is live?

Builds, databases, domains, backups, monitoring and access, the same wherever the Service runs.

How does Cloudgate build my code?

With Nixpacks by default, which works out how to build most apps on its own. Pick another builder when your project needs it.

Builders
Nixpacks, Railpack, a Dockerfile, Heroku buildpacks, Paketo buildpacks, or a static site.
Ready-made images
Run a Docker image as it is, with no build at all.
Build logs
Every Deployment keeps its build log, readable in the console, from the CLI and by an Agent.
Builds in the cloud
On the Hosted instance, a Service in AWS or Google Cloud builds in that cloud's own build service, CodeBuild or Cloud Build.

What kinds of Service can I run?

Applications, databases, Compose stacks and AI models, each a Service in an Environment of a Project.

web
An Application with Domains that answers the internet.
worker
Always on, with no address: queues, bots and background jobs.
web-private
Answers HTTP only to the other Services in its Environment, never from outside.
cron
A fresh container per run, on a timetable you set.
bucket
Files behind an S3-compatible API. On a Server it is its own Garage container.
Compose stacks
A Docker Compose file deployed as it is. In a cloud it runs on its own Stack VM.
Sizes
From xsmall (0.25 CPU, 512 MB) doubling up to 2xlarge (8 CPU).
A shell when you need one
Open a shell into a running container from the console.

Which databases does Cloudgate run?

PostgreSQL, MySQL, MariaDB, MongoDB, Redis and libSQL, managed next to your apps, or a database you already have.

On a Server
Each database runs as its own Service, with its own volume, backups and logs.
In a cloud
On AWS, PostgreSQL and MySQL on RDS and Redis on ElastiCache. On Google Cloud, Cloud SQL and Memorystore for Redis.
Existing databases
Point Cloudgate at a database made outside it. It uses it as given and never changes it.
Wired into your apps
Link a database's address into an app with a wired variable, such as DATABASE_URL: pg-1.url, filled in at deploy and never saved.

Can I host my own AI models?

Yes. An AI model is a Service that serves one model with Ollama, vLLM or llama.cpp, on your own Server, optionally reserving whole GPUs.

The Gateway
Every call reaches the model through Cloudgate's Gateway, which speaks the OpenAI API, so any OpenAI client works by changing its base URL.
Spend per caller
The Gateway counts token spend per model and per calling Agent, so each app or agent that calls a model shows on its own line.
Nothing else gets in
An AI model has no Domain and no published port. A caller Agent's key is the only way to call it.
Deployed like any app
Start, stop and redeploy it from the console or by an Agent, as you would an Application.

How do domains, TLS and CDNs work?

Add a domain to a web Service and Cloudgate gets a Let's Encrypt certificate for it. Before that, a free sslip.io address works over plain http.

Certificates
TLS certificates issued and renewed for every Domain on a Server.
CDN providers
Put a Domain behind Cloudflare, Bunny, Fastly or ArvanCloud.
Static sites in AWS
Served from S3 and CloudFront.

How are backups taken?

Databases and volumes are backed up to S3-compatible destinations that you choose.

Your destination
Any S3-compatible storage. Its keys are stored encrypted, like every secret.
Server backups
A Bought Server can add optional server backups and extra storage, from 10 GB to 10 TB.

What are previews and rollbacks?

A preview is a copy of an Application built from a branch, with its own address. A rollback returns a Service to an earlier Deployment.

Pull request previews
One preview per pull request on GitHub.
Requested previews
A preview of any branch, asked for by a person or an Agent, that expires on its own.
Rollbacks
Go back to an earlier Deployment when a release breaks something.

What does Cloudgate monitor?

Servers, Services and the requests reaching them, with incidents opened when something crosses a line you set.

Server thresholds
CPU and memory thresholds per Server.
Uptime checks
Regular checks against your app, with an incident when it stops answering.
Error rate
Counted from Traefik's 5xx responses per Domain, with a threshold of your own.
Traces
Each Service gets its own trace store.
Logs
Build logs, runtime logs and access logs, in the console and from the CLI.
Incidents
Opened and closed by checks and thresholds, and readable by an Agent, which can never silence one.

Where can alerts go?

Send incidents and other notifications to the places your team already reads.

Chat
Slack, Discord, Microsoft Teams, Telegram, Mattermost and Lark.
Email and push
Email, Resend, ntfy, Gotify and Pushover.
Anything else
A custom webhook.

How are variables and secrets kept?

Environment variables live per Project, Environment and Service. Secrets are encrypted at rest and never shown back.

Wired variables
Link one Service's outputs into another, filled in at deploy and never saved.
Secrets stay secret
API responses say only whether a secret is set. Agents see stored secrets masked as ••••••.
From the CLI
cloudgate vars set KEY asks for the value without echoing it.

How do teams and access work?

An Organization has members with roles, and grants decide which Projects, Environments and Services each one reaches.

Roles and grants
A role says what a member may do. A grant says where, down to a single Service.
Agents
AI agents are members too, with a Reader, Operator or Caller role, a grant and their own keys.
Audit log
What people and agents did, including every agent call allowed or refused.
Personal keys
For scripts, CI and the CLI, acting as you.

Most of Cloudgate is in every plan. A few features for larger companies are in the Business plan, or an Enterprise license when you self-host.

Business plan
SSO for domains the Organization has proven with DNS, SCIM, custom roles, forward auth in front of your apps, and more Organizations on one plan.
Enterprise license (self-hosted)
The same, plus white-labelling, parallel builds and cloud runs, and more than one Organization.

Questions about Cloudgate's features

Is Cloudgate open source?

No. It is source-available under the Elastic License 2.0: free to use, self-host and modify, but you may not offer it to others as a hosted service. See self-hosting Cloudgate.

Can I deploy to AWS and Google Cloud as well as my own servers?

Yes. Connect a Cloud account and an Environment deploys there: on AWS to ECS (Fargate), RDS, ElastiCache, S3 and CloudFront; on Google Cloud to Cloud Run, Cloud SQL and Memorystore. Cloudgate makes them with OpenTofu and shows drift.

Which git providers does Cloudgate support?

GitHub, GitLab, Bitbucket, Gitea, or any git URL, with push-to-deploy through webhooks. A Service can also run a Docker image or uploaded files.

Does Cloudgate back up my databases?

Yes. Backups of databases and volumes go to an S3-compatible destination you choose.

Can an AI agent use Cloudgate?

Yes. An Agent connects over MCP with its own key, role and grant. It can deploy, open previews and read logs and health, and every call is in the audit log. See Cloudgate for AI agents.

Which features need a paid plan?

On the Hosted instance every plan includes deploys, databases, domains, backups, previews, monitoring and Agents. SSO, SCIM, custom roles and forward auth are in the Business plan. See Cloudgate pricing.

Put your next app online today

Every plan starts with a 30-day free trial. Bring a server, buy one from us, or connect AWS or Google Cloud.