zerosuiteinc/sh0 repository overview

⁠sh0 -- Self-Hosted Rust-based PaaS + BaaS. 103 AI tools. 5 DB engines. Auth, Realtime, Functions, Mail in a Single Binary

Deploy, database, auth, storage, email, functions -- your entire backend in one binary.

Single Rust binary (~25 MB). 103 AI tools. 170+ templates. 5 database engines. S3 storage. Email hosting. Auth service. Realtime WebSocket. Serverless functions. Auto-SSL. MCP server.

⁠Quick Start

docker run -d \
  --name sh0 \
  --restart unless-stopped \
  -p 9000:9000 \
  -p 80:80 \
  -p 443:443 \
  -v sh0-data:/var/lib/sh0 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  zerosuiteinc/sh0:1.6.0

Open http://your-server:9000 and login with [email protected] / sh0-change-me!

⁠Docker Compose

services:
  sh0:
    image: zerosuiteinc/sh0:1.6.0
    container_name: sh0
    restart: unless-stopped
    ports:
      - "9000:9000"
      - "80:80"
      - "443:443"
    volumes:
      - sh0-data:/var/lib/sh0
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - RUST_LOG=info
      # - SH0_PANEL_DOMAIN=panel.example.com
      # - SH0_BASE_DOMAIN=example.com

volumes:
  sh0-data:

⁠Why sh0?

⁠Complete Feature Inventory

⁠Deploy Platform (Free tier)

6 deployment methods:

• Git push -- Connect GitHub, GitLab, or Bitbucket with auto-deploy on push
• CLI push -- sh0 push detects stack, builds, and deploys in ~35 seconds
• 170+ templates -- One-click WordPress, PostgreSQL, Redis, Ghost, n8n, Ollama, and more
• Docker Compose -- Import and deploy existing compose files
• ZIP upload -- Upload compressed project archives
• Infrastructure as Code -- Declarative sh0.yaml configuration

20 auto-detected stacks: Node.js, Bun, Deno, Python, Django, FastAPI, Flask, PHP, Laravel, Go, Rust, Java, Spring Boot, Next.js, Nuxt, SvelteKit, Astro, Remix, static HTML, Ruby, .NET

Additional deploy features:

• Auto-SSL (Let's Encrypt via Caddy, zero config)
• Custom SSL certificates (CSR generation + PEM upload)
• Preview environments (auto-deploy PRs, auto-cleanup)
• Blue-green deploys (zero-downtime with automatic rollback)
• Deploy hooks (pre/post build, pre/post deploy)
• Horizontal scaling (1-10 replicas, round-robin/least-conn/random LB)
• Auto-scaling (CPU/memory thresholds)
• Web terminal (xterm.js shell into any container)
• File manager (browse, edit, create, delete files in containers)
• Code health scoring (34 rules across security, config, build, framework)

⁠Managed Services (Pro tier -- $19/mo)

⁠Infrastructure (Business tier -- $99/mo)

⁠AI Features (all tiers)

⁠Developer Tools

⁠170+ One-Click Templates

⁠CLI (30+ Commands)

sh0 push         Deploy local directory       sh0 scale      Scale replicas
sh0 deploy       Redeploy app                 sh0 logs -f    Stream logs
sh0 watch        Auto-deploy on changes       sh0 ssh        Shell into container
sh0 env          Manage env variables         sh0 cron       Manage cron jobs
sh0 preview      PR preview environments      sh0 export     Export to 7 platforms
sh0 templates    Browse 170+ templates        sh0 compose    Docker Compose deploy
sh0 check        Code health scan             sh0 domains    Manage domains
sh0 db           Database server management   sh0 storage    File storage management
sh0 mail         Email hosting management     sh0 auth       Auth server management
sh0 realtime     Realtime server management   sh0 fn         Function server management
sh0 uptime       Uptime check management      sh0 nodes      Multi-server management
sh0 login        Auth with remote server      sh0 whoami     Current user info

⁠Security

• AES-256-GCM encryption for all secrets, env vars, backup files, SSH keys
• Argon2id password hashing (OWASP-recommended)
• HTTP-only cookies with SameSite=Strict and CSRF protection
• API keys with SHA-256 hashing, constant-time comparison, scoped permissions (read/standard/admin)
• TOTP 2FA (RFC 6238) with 8 backup codes per user
• RBAC with 4 roles: Owner, Admin, Developer, Viewer
• Rate limiting on all sensitive endpoints
• Full audit log with user, action, IP, timestamp
• 8 security audits completed, 51+ issues found and fixed
• Container security: no-new-privileges, resource limits, non-root users
• Zero unwrap() in library code -- all errors handled via ? operator

⁠Architecture

+---------------------------------------------+
|  sh0 binary (~50 MB)                        |
|  +---------+  +---------+  +----------+     |
|  | Axum    |  | SQLite  |  | Svelte 5 |     |
|  | API     |  | DB      |  | Dashboard|     |
|  +---------+  +---------+  +----------+     |
|  +---------+  +---------+  +----------+     |
|  | Caddy   |  | Docker  |  | AI/MCP   |     |
|  | Proxy   |  | Engine  |  | Server   |     |
|  +---------+  +---------+  +----------+     |
+---------------------------------------------+

• Runtime: Tokio async + Axum 0.7 HTTP framework
• Database: SQLite with WAL mode (48+ migrations)
• Proxy: Caddy (managed child process, auto-SSL, Layer 4 TCP)
• Containers: Docker Engine API via Unix socket
• Dashboard: Svelte 5 SPA embedded into binary at compile time
• Languages: English, French, Spanish, Portuguese, Chinese
• API: 182 endpoints, OpenAPI 3.1 auto-generated spec

⁠Pricing

⁠Environment Variables

⁠Volumes

⁠Ports

⁠Alternative Install (native binary)

curl -fsSL https://get.sh0.dev | bash

Creates a systemd service automatically on Linux. Single binary, no Docker required for the platform itself.

⁠Links

Built by ZeroSuite, Inc.⁠ -- Delaware C-Corporation. Powered by Claude as AI CTO.