App hosting
Deploy any Docker Compose app from a git repo. Webhook-driven auto-deploys, build logs, per-service scaling, and one-click rollbacks to previous builds.
What we run for you
Every service a client app needs, on one managed install.
Forge replaces a stack of per-project SaaS accounts with one server that already has the pieces wired together. Start with hosting and a database; turn on auth, email, AI, or automation when the brief grows — no new vendor, no new bill.
Hosting & delivery
Deploy, route, and recover.
The core loop: push code, get a live HTTPS site, roll back when you need to.
SSL & custom domains
Automatic HTTPS on clean subdomains or your client's own domain. Certificates issue and renew themselves; routing updates the moment an app deploys.
Preview environments
Every pull request gets its own ephemeral copy of the app at its own URL, redeployed on each push and torn down when the PR closes.
Monitoring & smoke tests
Health checks watch every service, scheduled smoke tests hit your real endpoints, and logs stream straight to the dashboard or CLI.
Data
Databases, cache, and storage — isolated per client.
Each project gets its own credentials and its own recovery path. No shared tables, no shared blast radius.
Managed Postgres
An isolated database per project with its own user and password, connection pooling via PgBouncer, and pgvector available for AI workloads.
Redis
Per-project Redis for caching, sessions, queues, and rate limiting — provisioned in seconds with scoped credentials.
S3-compatible storage
Buckets for uploads, assets, and media with S3-compatible access keys, so existing SDKs and libraries work unchanged.
Backups & restore
Scheduled database backups with restore to the same project or a fresh one. Recovery is a button, not an incident.
Identity & email
Logins and email without another vendor.
When a brief grows into user accounts, Forge provisions the identity stack next to the app.
Managed auth (Ory Kratos)
Registration, login, passwordless, password reset, and email verification flows per project — configured, hosted, and kept in sync with your app's origin.
OAuth2 & SSO (Ory Hydra)
Issue OAuth clients and tokens for APIs, machine-to-machine access, and single sign-on across a client's products.
Transactional email
Managed email delivery for identity flows and app sends, with per-project sender domains so mail comes from your client's brand, not ours.
Secrets vault
API keys and credentials are stored encrypted (AES-256-GCM) and injected into apps as environment variables — never committed, never in plain text.
AI services
Ship AI features without wiring five APIs.
The AI plumbing — keys, usage, embeddings, retrieval — lives on the server so every client app can use it.
LLM gateway
One endpoint that speaks OpenAI, Anthropic, and Gemini APIs. Upstream keys stay vaulted; each app gets its own scoped token with per-app usage tracking — or bring your own provider key.
Managed RAG
Drop PDFs in a bucket; Forge ingests, chunks, embeds, and indexes them. Apps query one endpoint and get ranked passages with page-level citations.
Private web search
A self-hosted metasearch endpoint apps can call for web results — no per-seat search API subscription, no query data sold on.
Vector database
pgvector ships in every managed Postgres, so embeddings and similarity search live next to your relational data.
Automation & integration
The unglamorous parts, handled.
Scheduled jobs, feature flags, and partner integrations — the things that otherwise become one-off scripts on a forgotten VM.
Cron jobs
Scheduled tasks run inside your app's own containers, declared in forge.yaml or the dashboard, with run history and manual triggers.
Feature flags
A managed flag service per project with an admin API and OpenFeature-compatible SDKs, so releases can be toggled without a redeploy.
Managed SFTP
A hardened, key-only SFTP endpoint for partners that still exchange files — banks, insurers, logistics. IP-restricted, chroot-jailed, wired into your app's storage.
Kubernetes clusters
Need real k8s for one workload? Forge provisions a single-node cluster on a host you point it at and hands your app the kubeconfig.
Control plane
One API. Four ways to run it.
Dashboard, CLI, REST API, and an embedded MCP server expose the same capabilities with the same auth — scripts, CI pipelines, and AI agents are first-class operators.
Infrastructure as one file
Declare an app's databases, auth, storage, email, flags, and cron in a forge.yaml next to your compose file. Every deploy reconciles reality to match it.
REST API & CLI
Every capability under /api/* with JWT or scoped API keys, and the pgforge CLI for scripted provisioning and log streaming.
MCP server
An embedded endpoint at /mcp lets approved AI tools — Claude, Cursor, and others — inspect and operate your infrastructure with the same auth.
High availability
Opt-in warm standby: a second node mirrors the whole stack over an encrypted mesh, with operator-confirmed or automatic failover when the primary dies.
Next step
Run it on our hardware, or yours.
Book a migration call and we'll map your clients onto a managed Forge server — or self-host the identical stack for free.
See how self-hosting works, or write to brian@beesworx.co.za.