Skip to content

What Edgible does, and where these guides prove it

Edgible publishes a service running on a machine you own at a public HTTPS hostname, using only an outbound connection on TCP 443. A service that does not speak HTTPS, such as a game server, is published the same way as a TCP or UDP app. The alternatives each cost something. Port-forwarding exposes the service, and anything it holds, to the open internet. A mesh VPN requires enrolling every device that will ever need access. A reverse proxy with certbot and dynamic DNS means you operate TLS and a domain yourself. With Edgible the machine makes the connection outward, and a hostname appears with a certificate already issued and an auth mode already applied.

The three differentiators

  1. The connection is outbound only. The serving agent holds an outbound 443 connection, so NAT is sufficient and no router configuration is required. Chapters that publish a port check, in their verify list, that the port is still bound to loopback and still not forwarded. Demonstrated in Start here, where the test is a phone with Wi‑Fi off loading the page over cellular.

  2. Auth is a property of the hostname. Each app carries an auth mode, chosen when you create it: org restricts access to your organisation behind a browser login, api-key accepts a bearer secret from machines that cannot log in, and None is open. Auth attaches to the app, not to a path inside it.

  3. One process can have several hostnames with different auth modes — split-surface publish. Because auth attaches to the hostname, the same running service can be published more than once with different protection. n8n's editor holds credentials and every workflow, so it stays org. Stripe and GitHub cannot complete a browser login, so they call a second hostname on None. One container on port 5678, two hostnames. Demonstrated in n8n editor through Edgible and Public webhook hostname.

Terms are defined once in the Glossary.

Feature, benefit, and where it is demonstrated

Where names the chapter that demonstrates the feature. How is the observable proof: what you watch happen.

Feature Benefit Where How
Public HTTPS with no inbound port No inbound port to attack Edgible on an Ubuntu VM Loads on a phone with Wi‑Fi off
Zero-DNS publish Hostname and cert without a DNS step Edgible on an Ubuntu VM, Publish the site, Edgible publishes Ollama URL works before any CNAME
A certificate per hostname, issued for you Never operate TLS n8n editor through Edgible Console shows the certificate issued
org auth Keep an interface private OpenClaw Control UI through Edgible Phone opens the UI; Gateway on loopback
None auth Accept webhook callers A webhook a stranger can hit An off-network GET returns JSON
api-key auth Secure Ollama Edgible publishes Ollama Bearer curl works; without it, 401
Split-surface publish Admin and public callers on one process Public webhook hostname, Publish Umami Editor asks for login; hooks does not
A static site published from your own disk No web host, no rented box Publish the site A phone on cellular loads files from your machine
API key create, list, revoke Cut off a caller Edgible publishes Ollama Secret prints once; revoked key fails
Device registration and health Confirm the machine is connected Edgible on an Ubuntu VM Health check OK in about 15 seconds
Publishes software you did not write Publish stock apps Edgible publishes Ollama Stock Ollama, unmodified, goes public
CLI, console and wizard parity Repeatable setup n8n editor through Edgible Same app from flags or prompts
Clean unpublish Reversible demo Tear down n8n, Tear down OpenClaw Hostnames dead; other apps still serving
TCP and UDP apps Publish what is not web Java players over TCP, Bedrock players over UDP mc-monitor answers on the public address over TCP and over UDP
Many apps on one machine, each with its own auth mode One machine, mixed estate n8n uses the published Ollama URL None, org and api-key at once

The set-piece demos

The whole small-site stack, on hardware you own. Website on Edgible publishes four hostnames off one machine: the site on None, the Umami tracking script on None, and the Umami and Uptime Kuma interfaces on org. It is the shortest demonstration that the access rule belongs to the hostname rather than to the service.

The back office workhorse, with its credentials staying in your building. n8n on Edgible covers the auth split end to end, including the WEBHOOK_URL setting that makes n8n print the public origin while traffic still reaches one process.

The agent everyone is currently trying, on hardware you control. OpenClaw on Edgible keeps the Gateway on loopback and lets the phone in through org. The agent edits a live public page in chapter 3, and chapter 4 installs a skill that lets it run the Edgible CLI.

Private AI, where the prompts and the weights stay home. In LLM on Edgible, Ollama and the model weights stay on one machine while n8n on a second and OpenClaw on a third call it over HTTPS with a bearer secret. No port-forward and no mesh VPN. This combination exercises private inference, machine authentication and remote self-hosted callers together.

Game night on a box you own, for the friends you invite. Game server on Edgible runs one Minecraft server and publishes it twice: Java Edition as a TCP app on 25565 and Bedrock Edition, through the Geyser plugin, as a UDP app on 29132. Friends on PC and on phone meet in one world. Neither app has an auth mode, so the game's own online mode and whitelist decide who plays.

A proven solution can be shared as a pattern, so someone else can reproduce it. Self Hosting is Social takes the website as the first card: a React site, a Strapi editor, analytics and a monitor, in two places, with the device name, the hostnames and the organization id left out. The second card is n8n: the editor on org and the hooks on None, one place. The third card is the assistant: Open WebUI on org and Ollama on api-key, one place. The card README is how the next person runs it.

What it replaces

Port-forwarding and the firewall rules around it. Dynamic DNS. Certbot and renewal cron. A hand-rolled nginx or Caddy reverse proxy. Mesh VPN enrolment for every client device. Ad-hoc tunnels that change URL on restart and cannot give one hostname a login and another none.

Known limits

  • TLS terminates on the serving device, so the gateway cannot inject HTTP headers. The original client IP therefore does not reach the app, which breaks visitor geolocation in analytics tools. What the country column will not tell you shows the empty country column and proves the cause. PROXY protocol between gateway and device would close this gap.
  • A TCP or UDP app has no auth mode, and its public port must be from 20000 to 29999, held by one app on its gateway at a time. When port 25565 is taken shows the error and the fix, and Why the port is 29132 the range.
  • WebSocket-heavy apps should be checked on first publish. n8n editor through Edgible describes what it means when the page shell loads but the canvas stays blank.

Start at Welcome for where to begin, or go straight to Start here.

Last updated