edgible
Get started

Start free — no credit card

Your apps. Your AI.
Your hardware.

Big tech doesn't need a copy of your life. Run your own services on hardware you own — reachable from anywhere.

Host your own way

A mini-PC under the desk can host a public service. Edgible runs the gateway, the tunnel, and the certificates. You keep the machine and the data.

Private AI,
actually private.

Run open models on your own GPU and chat with them from anywhere. Prompts, context, and answers never leave hardware you own.

Get started free See how it works

No public IP · no port forwarding · no certificate renewals

Find out more

Why we built this

The internet forgot
who it belongs to.

  • Your photos sit on someone else's disk.
  • Your AI conversations train someone else's model.
  • Your rent goes up. Your access can vanish overnight.
  • Your data became the product.

It doesn't have to be this way. A machine you already own has more than enough capacity to run the services you use every day. Edgible makes it reachable from anywhere without handing the data to anyone.

Private AI

Your own AI,
on your own GPU.

Run open models on your own GPU and talk to them from anywhere — your phone, your laptop, your team. Every prompt and every answer stays on hardware you own.

Nobody else's terms
No per-token meter, no model deprecations, no policy change deciding what you're allowed to ask.
Nothing to leak
Conversations aren't logged in someone's cloud, and they never train someone else's model.
Locked to you
Require an API key on every request — checked on your device, before a byte reaches the model.
ai.yml
apiVersion: v3
kind: Application
metadata:
  name: private-ai
spec:
  placement:
    deviceSelector: { deviceName: gpu-box }
  workloads:
    - name: ollama
      type: pre-existing
      hostPort: 11434
  access:
    - name: chat
      type: https
      target: { workload: ollama }
      hostname: { generated: true }
      tls: { managedBy: edgible }
      policies:
        auth: { modes: [api-key] }
gpu-box — connected 
$ edgible stack deploy -f ai.yml
$ edgible stack status -f ai.yml
private-ai   ready   https://private-ai-x9k2f1.edgible.app

How it works

One tunnel out. Nothing in.

A visitor loads a URL. The request travels to your hardware through a single encrypted tunnel that your device opened itself. Nothing on your network is exposed.

How a request reaches your hardware A request travels from a visitor's browser over HTTPS to the Edgible gateway, then through a WireGuard tunnel — established outbound by your device — to Caddy and your service on your own machine, where TLS terminates. https://… A VISITOR any browser, anywhere hello-world-a1b2c3.edgible.app public internet · HTTPS EDGIBLE GATEWAY haproxy · :443 wireguard peer the only public endpoint — your device never accepts an inbound connection wireguard tunnel established outbound by your device · TCP/443 YOUR DEVICE wg0 caddy · tls · :443 your service · :8080 a mini-PC on a shelf, a Pi in a closet, a VM — anywhere Linux runs TLS terminates here, on your hardware, not at the gateway
Swipe to follow the request → One request, end to end. The gateway relays; it cannot read your traffic — the TLS session ends on your machine.

Why self-host

Any hardware. Any app. Your rules.

Host anywhere

A mini-PC, a Raspberry Pi, the workstation under your desk, or a rented VM. If it runs Linux and can make an outbound connection, it can host a workload.

Run what you already have

Docker Compose projects, systemd services, plain processes — or something that's already listening on a port. You don't rebuild your app to share it.

Your data stays home

Traffic is encrypted all the way to your machine, and only decrypted there. The gateway relays; it cannot read what passes through.

Nothing to change on your router

No port forwarding, no static IP, no dynamic DNS. Your device dials out over HTTPS, and Edgible handles hostnames and certificates, generated or on your own domain.

Security

No open ports, anywhere.

Most self-hosting guides start by opening a port, which leaves a permanent hole in your network for anyone scanning to find. Edgible works the other way round: your device makes the connection, and nothing connects to it.

Nothing listening
Your device makes one outbound connection over TCP/443 — the same thing a browser does. No port forwarding, no public IP, no inbound listener for anyone to find.
Encrypted on every hop
HTTPS from the visitor, a WireGuard tunnel from the gateway to your device. Every hop across the internet is encrypted.
Decrypted on your device
The TLS session ends on your hardware. The gateway forwards bytes it cannot read, so the request is decrypted only on your machine.
Policy per route
Every route carries its own policy: leave it public, or require an API key — checked on your device, before the request reaches your app.

Getting started

From a bare machine to a public URL in ten minutes.

my-first — connected 
$ curl -fsSL https://get.edgible.com/install.sh | bash
[edgible] Installed Edgible CLI
$ edgible auth login --user-email you@example.com
$ sudo edgible agent install \
    --device-type serving --device-name my-first
# no sudo? edgible agent install runs it under your account
$ sudo edgible agent start
$ edgible device health --name my-first
Health check OK
$ edgible stack deploy -f app.yml
$ edgible stack status -f app.yml
hello-world   ready   https://hello-world-a1b2c3.edgible.app
$ curl https://hello-world-a1b2c3.edgible.app/
# served from your machine, over the public internet

  1. Install the CLI

    One curl from get.edgible.com — no npm, no package manager. Then one more command registers the device and installs the agent as a systemd service. It connects out to the control plane — nothing listens for inbound traffic.

  2. Describe the application

    A short YAML file names the workload, the device it runs on, and how the public reaches it. Deploying the same file again reconciles what is running. Tearing it down removes it.

  3. Deploy and visit

    The agent reconciles, Edgible orders the certificate and wires the route, and the hostname goes live — typically 30–90 seconds for a first deploy.

Start with one
machine you own.

Edgible is free while it is in public beta, and there is no credit card to enter. Paid plans come after the beta.

Create an account See pricing