Pull request previews in your own cloud

Stagely runs each pull request's stagelet in your own cloud account. Your cloud credentials, secret values, built images and app traffic stay there.

Stagely gives each GitHub pull request a stagelet: a private, running copy of your app. The stagelet runs in your own cloud account on DigitalOcean, AWS, Google Cloud, Azure, Hetzner Cloud or Vultr. Stagely plans the deploys and decides who can open a stagelet. Your cloud account builds and runs everything, and keeps every cloud credential and secret value.

Is Stagely self-hosted?

In part. Stagely hosts the control plane at https://app.stagely.dev: the console, the API and the MCP endpoint. You do not run a control plane or its database. The rest runs in your account:

Part	Runs in	Does
Control plane	Stagely’s cloud	Plans each deploy, keeps the record of every deploy, and gives passes into stagelets
Customer agent (`stagely-agent`)	Your cloud, on the agent host	Holds your cloud credentials and secret values. Creates machines, runs builds on build workers, and runs stagelets.
Build workers	Your cloud	Get the commit’s full source, build the images and push them to your registry
Stagelet machines	Your cloud	Run one stagelet each
Stagelet gateway (`stagely-gateway`)	Your cloud, on the gateway host	Serves each stagelet’s private URL to people who have a pass. Holds no cloud credentials and no secret values.

What Stagely sees

Data	Does Stagely see it?
Cloud credentials	No. They stay on the agent host, and on your computer while setup runs.
Secret values	No. Stagely stores only each secret’s name and key.
Plain config values	Yes
Source code	Only what it needs to plan a deploy. It reads `.stagely.yml`, the Compose files and the files they reference, in memory. It keeps a bundle for resets with the resolved Compose model and the contents of `env_file` files. The full source stays in your cloud: the agent downloads it from GitHub and copies it to a build worker.
Built images	No. They stay in your registry.
Stagelet traffic	No. It goes from the gateway to the stagelet’s machine.

No inbound port from Stagely

The agent and the gateway each open one WebSocket connection to Stagely. Your cloud account needs no inbound port from Stagely.
The agent host accepts only SSH, and only from the address ranges that you gave setup.
The gateway host is the only part that is open to the whole internet, on ports 80 and 443.
Stagelet machines and build workers accept traffic only from the agent and the gateway.

A request without a pass from Stagely stops at the gateway:

$ curl -s -i https://f543a41f9949.stagelets.acme.dev/
HTTP/2 401
content-type: text/plain; charset=utf-8
x-content-type-options: nosniff
content-length: 35
date: Sun, 11 Oct 2026 12:13:27 GMT

open this stagelet through Stagely

A reviewer gets a pass from the console. The pass works once, for 30 seconds, and the gateway trades it for a session on that stagelet only. Security model describes every credential and how access ends.

Set up your account with one command

stagely setup <cloud> prepares an environment in your cloud account. It applies a Terraform module with OpenTofu or Terraform. The module creates a network, the agent host, the gateway host and their firewall rules. Then setup installs the agent and the gateway, and enrolls them with Stagely.

export DIGITALOCEAN_TOKEN=<token>
stagely login
stagely setup digitalocean \
  -environment production \
  -region fra1 \
  -stagelet-domain stagelets.example.com \
  -registry example-stagely \
  -operator-cidr 203.0.113.7/32 \
  -binaries bin/linux-amd64 \
  -acme-email ops@example.com

Each cloud has its own page, with the resources that setup creates, the credentials and the isolation rules: DigitalOcean, AWS, Google Cloud, Azure, Hetzner Cloud and Vultr.

Start

Follow the Quickstart to create the account and link GitHub.
Run setup for your cloud with Set up your cloud.
Read the Security model before you add real secrets.