Architecture and roadmap
The device is where the truth lives.
Your hardware runs the software and keeps the data. Our servers are a remote control. They hold nothing you could keep at home.
Why this shape, and why now
Hardware got good enough a while ago. A Raspberry Pi 5, an old laptop with Linux or the Mac on your desk can run a password manager, a website and a local AI model at the same time. Certificates are free and a domain costs about €10 a year. What stayed hard is the part after the install: updates, domains, configuration and a way in from outside without opening up your router.
Obacht takes that part. Your apps run on your device, Obacht keeps an eye on them and stays out of the data. That's why the architecture below looks the way it does. The device holds everything that matters, our servers only coordinate, and every bundle sits on its own island.
All of it stands on open-source projects that rarely get much back. So from launch on, wherever a project can receive money, the template fee goes to that project.
Architecture
When you install an app through Obacht, its containers run on your device and the data they write stays there. Generated passwords and secrets, and the connections between services, are created on the device and never sent back to Obacht.
Obacht's backend knows what you asked for: which template, which domain, which version. From the device it gets status: whether an app runs, error messages, certificate dates. Container addresses and generated database passwords stay on the device.
Try it
What if our servers went away?
If Obacht's servers went offline tomorrow, every app on your device would keep running. You would lose the dashboard and the installer. The services themselves don't depend on us, and that is on purpose.
On your device
- Your apps keep running
- Your data stays where it is
- Keys and certificates stay on the device
At Obacht
- The dashboard in your browser
- Installing new apps
- Web addresses from outside, through our proxy
Everything works the way it should.
Where we are
Where we are and where we're going
Isolation first, then connections on your terms. There are no release dates. The phases run from what is built today to what is years away.
Now
Bundles ship
Multi-container apps, each bundle kept apart from the others. Signatures and pinned image digests for every template and every container. Every template says which hardware it needs. Secrets generated on the device and never sent anywhere.
This is the foundation. Every bundle is a signed unit that stands on its own. The catalogue grows from here.
Recently shipped
2026-10-08
11 new apps
2026-10-07
Shorter sign-up, and a model with Ollama
2026-09-26
A new web app, and a web address for every app
How a domain becomes a working app
What happens when you attach blog.example.com to a template on your device.
01
Add your domain
You enter the domain in the dashboard and point its DNS at the Obacht gateway.
02
Obacht checks DNS
Obacht checks that the DNS record points at the gateway. Your browser then tells the device, signed with your key.
03
A certificate for your device
The agent asks Let's Encrypt for a certificate. It is issued to your device. Obacht never holds it.
04
Your device serves it
Caddy, the web server on the device, starts serving the domain over HTTPS.
05
Visitors come through the tunnel
The gateway passes public traffic through the Obacht network, a WireGuard tunnel the device opened itself. No open ports on your router. Certificate and keys stay on your hardware.
Templates
A template describes one piece of software: Nextcloud, Ghost, Vaultwarden, Mealie, a static site. Every template is signed. Every container image in it is pinned to an exact digest. If an upstream image gets swapped, the signature check on the agent fails and nothing installs.
Templates also say what they need, like compatible hardware and minimum RAM. Obacht uses that to show which of your devices fit.
Three trust tiers
Official
Written, reviewed and maintained by the Obacht team.
Community
Written by outside authors and reviewed before they go into the public catalogue.
Unverified
Off by default. Shows up only if you switch the channel on yourself, and you get a clear warning at install.
Single, Bundle, System
Real software comes in different shapes. Obacht has three runtimes for them.
Single
One container that holds everything, like Vaultwarden or Memos. Small and quick to set up.
Bundle
Several containers that belong together, for apps that really need a database or a cache. Ghost with MySQL, HeyForm with MongoDB and Redis.
System
A service that runs outside Docker, directly on the host. On the Mac that's Ollama, so it can use Apple silicon directly. On the Pi it's the kiosk display and the camera stream.
Why every bundle is its own island
When a bundle needs a database, the database lives inside the bundle. Nothing is shared between apps. That costs a few hundred megabytes per bundle. In return a hole in one app can't reach another app's data. Uninstalling takes everything with it. Cloud platforms pool resources because their margins force them to. On hardware you own, keeping things apart is cheap and worth it.
Ghost
App
Own database
MySQL
Listmonk
App
Own database
Postgres
HeyForm
App
Own database
MongoDB
Get started
Runs on a Raspberry Pi, a Mac mini or any Linux machine.