edgible
Get started

Start free — no credit card

Your apps. Your AI.
Your hardware.

Big tech doesn't need a copy of your life. Run your own services on hardware you own — reachable from anywhere.

Host your own way

A mini-PC on a shelf can serve the world. Edgible handles the tunnel, the certificates, and the routing. You keep the machine, the data, and the say.

Private AI,
actually private.

Run open models on your own GPU and chat with them from anywhere. Prompts, context, and answers never leave hardware you own.

Get started free See how it works

No public IP · no port forwarding · no certificates to babysit

Find out more

Why we built this

The internet forgot
who it belongs to.

  • Your photos sit on someone else's disk.
  • Your AI conversations train someone else's model.
  • Your rent goes up. Your access can vanish overnight.
  • Your data became the product.

It doesn't have to be this way. The box on your shelf is more powerful than the servers the internet was built on. Edgible turns it into your own private cloud — reachable from anywhere, answering to no one but you.

Private AI

Your own AI.
Actually private.

Run open models on your own GPU and talk to them from anywhere — your phone, your laptop, your team. Every prompt and every answer stays on hardware you own.

Nobody else's terms
No per-token meter, no model deprecations, no policy change deciding what you're allowed to ask.
Nothing to leak
Conversations aren't logged in someone's cloud, and they never train someone else's model.
Locked to you
Require an API key on every request — checked on your device, before a byte reaches the model.
ai.yml
apiVersion: v3
kind: Application
metadata:
  name: private-ai
spec:
  placement:
    deviceSelector: { deviceName: gpu-box }
  workloads:
    - name: ollama
      type: pre-existing
      hostPort: 11434
  access:
    - name: chat
      type: https
      target: { workload: ollama }
      hostname: { generated: true }
      tls: { managedBy: edgible }
      policies:
        auth: { modes: [api-key] }
gpu-box — connected 
$ edgible stack deploy -f ai.yml
$ edgible stack status -f ai.yml
private-ai   ready   https://private-ai-x9k2f1.edgible.app

How it works

One tunnel out. Nothing in.

Visitors reach a URL. The URL reaches your hardware — through one encrypted tunnel your device opens itself. Nothing on your network is ever exposed.

How a request reaches your hardware A request travels from a visitor's browser over HTTPS to the Edgible gateway, then through a WireGuard tunnel — established outbound by your device — to Caddy and your service on your own machine, where TLS terminates. https://… A VISITOR any browser, anywhere hello-world-a1b2c3.edgible.app public internet · HTTPS EDGIBLE GATEWAY haproxy · :443 wireguard peer the only public endpoint — your device never accepts an inbound connection wireguard tunnel established outbound by your device · TCP/443 YOUR DEVICE wg0 caddy · tls · :443 your service · :8080 a mini-PC on a shelf, a Pi in a closet, a VM — anywhere Linux runs TLS terminates here — on your hardware, not in someone else's cloud
One request, end to end. The gateway relays; it cannot read your traffic — the TLS session ends on your machine.

Why self-host

Any hardware. Any app. Your rules.

Host anywhere

A mini-PC on a shelf, a Raspberry Pi in a closet, the workstation under your desk, or a VM in someone else's cloud — if it runs Linux and can reach the internet, it can serve the internet.

Run what you already have

Docker Compose projects, systemd services, plain processes — or something that's already listening on a port. You don't rebuild your app to share it.

Your data stays home

Traffic is encrypted all the way to your machine, and only decrypted there. The gateway relays; it cannot read what passes through.

No router surgery

No port forwarding, no static IP, no dynamic-DNS hacks. Your device dials out over HTTPS, and Edgible handles hostnames and certificates — generated or your own domain.

Security

Your home network stays invisible.

Most self-hosting guides start by opening a port — a permanent hole in your network, waiting to be scanned. Edgible starts from the opposite premise: your device reaches out, and nothing reaches in.

No doors to knock on
Your device makes one outbound connection over TCP/443 — the same thing a browser does. No port forwarding, no public IP, no inbound listener for anyone to find.
Sealed door to door
HTTPS from the visitor, a WireGuard tunnel from the gateway to your device. Every hop across the internet is encrypted.
Opened only at home
The TLS session ends on your hardware. The gateway forwards bytes it cannot read — your traffic crosses Edgible encrypted and is only opened on your machine.
You decide who gets in
Every route carries its own policy: leave it public, or require an API key — checked on your device, before the request reaches your app.

Getting started

From a box on a shelf to a URL in ten minutes.

my-first — connected 
$ curl -fsSL https://get.edgible.com/install.sh | bash
[edgible] Installed Edgible CLI
$ edgible auth login --user-email you@example.com
$ sudo edgible agent install --type systemd \
    --device-type serving --device-name my-first
$ sudo edgible agent start
$ edgible device health --name my-first
Health check OK
$ edgible stack deploy -f app.yml
$ edgible stack status -f app.yml
hello-world   ready   https://hello-world-a1b2c3.edgible.app
$ curl https://hello-world-a1b2c3.edgible.app/
# served from your machine, over the public internet

  1. Install the CLI

    One curl from get.edgible.com — no npm, no package manager. Then one more command registers the device and installs the agent as a systemd service. It connects out to the control plane — nothing listens for inbound traffic.

  2. Describe the application

    A short YAML file names the workload, the device it runs on, and how the world reaches it. Deploying the same file again reconciles; tearing it down leaves nothing behind.

  3. Deploy and visit

    The agent reconciles, Edgible orders the certificate and wires the route, and the hostname goes live — typically 30–90 seconds for a first deploy.

Take back your corner
of the internet.

Start free with up to three devices — no credit card. When you outgrow the closet, plans scale with you.

Create an account See pricing