---
title: "Pull request previews in your own cloud"
description: "Stagely runs each pull request's stagelet in your own cloud account. Your cloud credentials, secret values, built images and app traffic stay there."
url: https://stagely.dev/docs/guides/own-cloud
---

Stagely gives each GitHub pull request a stagelet: a private, running copy of your app. The stagelet runs in your own cloud account on DigitalOcean, AWS, Google Cloud, Azure, Hetzner Cloud or Vultr. Stagely plans the deploys and decides who can open a stagelet. Your cloud account builds and runs everything, and keeps every cloud credential and secret value.

## Is Stagely self-hosted?

In part. Stagely hosts the control plane at `https://app.stagely.dev`: the console, the API and the MCP endpoint. You do not run a control plane or its database. The rest runs in your account:

| Part                                 | Runs in                         | Does                                                                                                                |
| ------------------------------------ | ------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Control plane                        | Stagely's cloud                 | Plans each deploy, keeps the record of every deploy, and gives passes into stagelets                                |
| Customer agent (`stagely-agent`)     | Your cloud, on the agent host   | Holds your cloud credentials and secret values. Creates machines, runs builds on build workers, and runs stagelets. |
| Build workers                        | Your cloud                      | Get the commit's full source, build the images and push them to your registry                                       |
| Stagelet machines                    | Your cloud                      | Run one stagelet each                                                                                               |
| Stagelet gateway (`stagely-gateway`) | Your cloud, on the gateway host | Serves each stagelet's private URL to people who have a pass. Holds no cloud credentials and no secret values.      |

## What Stagely sees

| Data                | Does Stagely see it?                                                                                                                                                                                                                                                                                                                 |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Cloud credentials   | No. They stay on the agent host, and on your computer while setup runs.                                                                                                                                                                                                                                                              |
| Secret values       | No. Stagely stores only each secret's name and key.                                                                                                                                                                                                                                                                                  |
| Plain config values | Yes                                                                                                                                                                                                                                                                                                                                  |
| Source code         | Only what it needs to plan a deploy. It reads `.stagely.yml`, the Compose files and the files they reference, in memory. It keeps a bundle for resets with the resolved Compose model and the contents of `env_file` files. The full source stays in your cloud: the agent downloads it from GitHub and copies it to a build worker. |
| Built images        | No. They stay in your registry.                                                                                                                                                                                                                                                                                                      |
| Stagelet traffic    | No. It goes from the gateway to the stagelet's machine.                                                                                                                                                                                                                                                                              |

## No inbound port from Stagely

- The agent and the gateway each open one WebSocket connection to Stagely. Your cloud account needs no inbound port from Stagely.
- The agent host accepts only SSH, and only from the address ranges that you gave setup.
- The gateway host is the only part that is open to the whole internet, on ports 80 and 443.
- Stagelet machines and build workers accept traffic only from the agent and the gateway.

A request without a pass from Stagely stops at the gateway:

```text
$ curl -s -i https://f543a41f9949.stagelets.acme.dev/
HTTP/2 401
content-type: text/plain; charset=utf-8
x-content-type-options: nosniff
content-length: 35
date: Sun, 11 Oct 2026 12:13:27 GMT

open this stagelet through Stagely
```

A reviewer gets a pass from the console. The pass works once, for 30 seconds, and the gateway trades it for a session on that stagelet only. [Security model](https://stagely.dev/docs/security.md) describes every credential and how access ends.

## Set up your account with one command

`stagely setup <cloud>` prepares an environment in your cloud account. It applies a Terraform module with OpenTofu or Terraform. The module creates a network, the agent host, the gateway host and their firewall rules. Then setup installs the agent and the gateway, and enrolls them with Stagely.

```sh
export DIGITALOCEAN_TOKEN=<token>
stagely login
stagely setup digitalocean \
  -environment production \
  -region fra1 \
  -stagelet-domain stagelets.example.com \
  -registry example-stagely \
  -operator-cidr 203.0.113.7/32 \
  -binaries bin/linux-amd64 \
  -acme-email ops@example.com
```

Each cloud has its own page, with the resources that setup creates, the credentials and the isolation rules: [DigitalOcean](https://stagely.dev/docs/setup/cloud/digitalocean.md), [AWS](https://stagely.dev/docs/setup/cloud/aws.md), [Google Cloud](https://stagely.dev/docs/setup/cloud/google-cloud.md), [Azure](https://stagely.dev/docs/setup/cloud/azure.md), [Hetzner Cloud](https://stagely.dev/docs/setup/cloud/hetzner.md) and [Vultr](https://stagely.dev/docs/setup/cloud/vultr.md).

## Start

1. Follow the [Quickstart](https://stagely.dev/docs/setup.md) to create the account and link GitHub.
2. Run setup for your cloud with [Set up your cloud](https://stagely.dev/docs/setup/cloud.md).
3. Read the [Security model](https://stagely.dev/docs/security.md) before you add real secrets.