Self-hosted usually means a side job for an SRE.
Most self-hosted ZTNAs need a small Kubernetes to run, a YAML to fill in, and a person who's already comfortable in a Linux shell. Either you have that person — or you give up and go SaaS.
Case 06 · Self-Hosted Edge Nodes
Deploy your own gateways without terminal access.
Run as many self-hosted edge nodes as you need on your own hardware or cloud accounts. Our centralized Control Plane manages all your distributed gateways through a single interface.
1-Click
Cloud API Auto-Deploy
10k+
Concurrent connections per node
5
Cloud providers (Hetzner, Vultr, DO, Akamai, UpCloud)
01
The problem → L7 Admin Guard way
Zero-touch provisioning.
Provide your Hetzner or Vultr API key, and our Control Plane automatically provisions the server, deploys the 8MB gateway, issues certificates, and wires up the websocket connection. No SSH required.
02
Step by step
01
Add Cloud API Key
In the dashboard, enter a restricted API key for your favorite cloud provider (Hetzner, Vultr, DigitalOcean, etc.).
02
1-Click Deploy
Select your preferred region and instance size. The Control Plane spins up the server and deploys the gateway automatically in seconds.
03
Manage from one place
Routes, tokens, quotas, and updates are synced to all your gateways instantly over a secure websocket. You never have to manually edit a config file.
03
Common questions
- Does the 1-click deploy support AWS or GCP?
- We prioritize providers like Hetzner, Vultr, DigitalOcean, Akamai, and UpCloud because they offer inexpensive servers with generous traffic allowances. Since our gateways are extremely lightweight, they don't require expensive CPU, RAM, or disk space from AWS or GCP.
- Does the gateway store data on the server?
- The gateway uses an embedded BuntDB to cache routing rules. This allows it to survive server restarts even if the Control Plane is temporarily unreachable.
- What happens if it loses connection to the Control Plane?
- The gateway can operate completely autonomously offline using its BuntDB cache. Active sessions and new logins will continue to work normally until the TLS certificate expires.
Ship this in five minutes.
Live demo, no signup. Or grab the trial — every feature, fourteen days, no card.