Eleven parts, one control plane for all your servers. Each runs on hardware you own, under the same permissions and the same audit trail.
Traffic moves to a new version only once it is healthy; the previous one stays ready for an instant rollback.
PersonalRun containers and whole Compose projects on any of your servers.
PersonalBuilds run on isolated build workers, then release like any other version.
BusinessGroup services into an app with its own environments, variables and members, and promote from one environment to the next.
Publish a site from your pipeline and serve it on your own domain.
PersonalPut a service on a domain; Opfield writes the proxy configuration on every ingress server.
Certificates are issued and renewed while running, for public domains and internal ones. Let’s Encrypt, renewed on your schedule.
Access lists in front of a service travel with its route. IP rules and basic auth; one list guards many routes.
Connect Cloudflare and records are created and kept in step with your routes.
Show a maintenance page on one route while you work behind it.
Managed on your servers, with health checks and private connections to your apps.
PersonalS3-compatible storage on your own servers.
PersonalDatabase backups on a schedule, with alerts to your team.
PersonalLook through tables and keys, and run queries, from the panel with the same permissions as everything else.
Run a service on several servers. If one goes down, a standby takes over and traffic follows on its own.
BusinessSites, services and databases keep serving while Opfield itself is down or updating.
Certificates and server identities renew themselves while running.
If a license lapses, nothing stops; only creating and changing paid resources pauses until renewal.
Services reach databases and each other on other servers through relays, without exposing a port.
Servers in different clouds, regions and offices work as one fleet. Servers only dial out, even from behind NAT.
Each server holds its own certificate, checked on every connection. Mutual TLS, with an identity per private link.
Health and load of the whole fleet in one list.
Search the logs of every service; keep structured logs for as long as you need.
BusinessAlert rules tell your team when something needs attention.
Publish a status page for your customers on your own domain.
Open a console on a server or inside a container from the browser, under the same permissions.
Per team or per person, down to one server, one service or one action.
Group resources into folders and give a team a folder instead of a list. Access granted on a folder covers everything in it.
People, tokens and AI agents in the same history of every change. Each entry shows who acted and what changed.
Export the trail for reviews and keep it as long as your policy says.
BusinessStream the audit trail to your SIEM as it happens.
EnterpriseSign in with your identity provider; people and groups arrive from it.
EnterpriseDescribe the outcome; the assistant shows the plan and waits for your approval before anything changes.
Connect Claude Code, Codex, Cursor or any MCP agent; your admin decides what it may touch. Each agent gets only the scopes you grant.
A model for the assistant and your agents without an AI account of your own; Free comes with every managed installation. With budgets per person.
Use Anthropic, OpenAI, Google, DeepSeek, Kimi or any OpenAI-compatible endpoint, including your own through Ollama. With fallback when one runs out.
The assistant works with secrets without showing them in chat or history. Revealing one takes its own permission.
Connect GitHub, GitLab or any pipeline and release from it.
Tell other systems when something changes in Opfield.
Everything in the panel is in the API, with tokens scoped to exact actions.
Export the configuration of your installation and bring it back.
Servers connect out to Opfield over encrypted channels; nothing waits for inbound connections. They reconnect on their own after a drop.
A server joins only with a one-time token tied to your Opfield certificate. After that, it uses a certificate of its own.
Two-factor codes or passkeys, required per team. One-time email codes work too.
Images you build are checked for known vulnerabilities before they ship.
BusinessIssue certificates for internal services from your own authority.
EnterpriseOpfield and your data stay on hardware you own.
Signed releases, verified before they run, installed on your schedule.
Read the code that runs your infrastructure.
We can run the control plane for you; your servers stay yours and join it.
Install Opfield on your own server in minutes, or talk to us about rolling it out across your teams.
Talk to us →