Devion is a self-hosted platform for operating applications and Minecraft Java servers across organization-owned infrastructure. It combines project management, deployment desired state, role-based access control, audit-ready operations, domains, TLS routing, and a node-based workload control plane.
Devion's API is a control plane. It records intent and authorizes actions; node-local agents perform workload operations on their own hosts.
- Multi-organization projects, teams, members, and role-based access control
- Versioned container deployments with scheduling and durable agent commands
- Minecraft Java server management with console, live logs, persistent files, and per-server user/team roles
- Node enrollment, resource reporting, placement constraints, and reconciliation
- Domain routing and automated TLS through Traefik and Let's Encrypt
- Self-hosted PostgreSQL, RustFS, OCI registry, API, and dashboard services
Dashboard / API clients
|
v
Devion API control plane ---- PostgreSQL
|
| durable desired-state commands
v
Devion Agent (per node) ---- local Docker Engine
|
v
Applications and Minecraft servers
The API never directly starts application or game-server containers. The agent authenticates to the API, reports resources, polls commands, and is the only component that accesses the node's Docker socket.
Read the full design and node enrollment guide in docs/control-plane.md. For interactive CLI authentication, see docs/cli-device-authorization.md. Enterprise SSO configuration is documented in docs/generic-oauth-oidc.md. Password compromise protection is documented in docs/password-security.md. Browser account switching is documented in docs/multi-session.md.
- Linux host with Docker Engine and Docker Compose v2
- Git, curl, and OpenSSL
- Ports 80 and 443 available on the host
Install the current main branch:
curl -fsSL https://raw.githubusercontent.com/Devion-Systems/Devion/main/install.sh | sudo bashThe installer clones Devion to /opt/devion, generates local secrets, starts the platform services, applies migrations, and verifies the API health check. It displays the one-time company setup URL and installation token together with the dashboard URL based on the host's detected LAN IP. The setup creates the licensed company workspace and its first platform administrator; public registration is closed afterwards. A primary domain and encrypted LDAP connection settings are optional.
To install a fork instead:
curl -fsSL https://raw.githubusercontent.com/Devion-Systems/Devion/main/install.sh | \
sudo DEVION_REPOSITORY_URL=https://github.com/YOUR_ORG/Devion.git bashFor automatic HTTPS, point the relevant DNS A, AAAA, or CNAME record to the host before adding the domain in Devion. Optionally set an ACME contact email:
curl -fsSL https://raw.githubusercontent.com/Devion-Systems/Devion/main/install.sh | \
sudo DEVION_ACME_EMAIL=admin@example.com bashcd /opt/devion
docker compose --env-file deploy/docker/.env -f deploy/docker/docker-compose.yml ps
docker compose --env-file deploy/docker/.env -f deploy/docker/docker-compose.yml logs -f apiRe-running the installer performs an in-place update. It preserves data and secrets and keeps a timestamped backup of deploy/docker/.env.
The Devion host is an execution target by default: applications and Minecraft servers run there without any Node setup. The local agent is enrolled securely by the installer and becomes ready shortly after the first start.
Connect a Node only when you need additional hardware or capacity. Create a one-time registration token as an organization owner or admin:
Create a one-time node registration token as an organization owner or admin:
POST /organizations/{orgSlug}/nodes/registration-tokens
{ "expiresInSeconds": 3600 }
Use the returned token exactly once on the additional target host:
cd /opt/devion
docker compose --env-file deploy/docker/.env -f deploy/docker/docker-compose.yml run --build --rm --no-deps \
-e DEVION_AGENT_REGISTRATION_TOKEN='one-time-token' \
-e DEVION_AGENT_ENROLLMENT_ONLY=true \
agentAfter enrollment the agent stores its identity in its persistent volume; the registration token is no longer needed.
Minecraft Java servers are project-bound container workloads with a persistent /data volume. The dashboard provides:
- Start, stop, and deletion controls
- Live log output and a safe RCON-backed console
- A file browser/editor limited to the server's
/datavolume - Common version suggestions and support for a custom image-supported version
- Per-server grants for individuals and organization teams
Per-server roles are:
| Role | Permissions |
|---|---|
viewer |
View logs, file structure, and file contents |
operator |
Viewer permissions plus console, start/stop, and file edits |
admin |
Operator permissions plus management of server grants and deletion |
Organization owners and admins always retain full access.
- Bun
1.3.14 - Node.js
>=26 - Docker, for integration services and node-agent workload execution
bun install
bun run check-types
bun test
bun run --cwd apps/dashboard buildUseful commands:
# Start the API locally
bun run apps/api/src/index.ts
# Run the agent in development mode
bun run agent:dev
# Build or test the isolated builder service
bun run builder:build
bun run builder:testApply migrations before running an API version that uses the control plane or Minecraft RBAC:
bun run --cwd packages/db db:migrateThe current control-plane migration is 0012_control_plane; per-server Minecraft user/team access is added by 0013_game_server_rbac.
Container applications and Minecraft Java servers are supported through the agent runtime. MicroVM/Firecracker workloads and managed database provisioning intentionally return 501 until their node-agent, networking, ownership, and one-time secret-delivery protocols are defined.
Devion is licensed under the Apache License 2.0.