Just shipped a clustered TLS certificate storage for Caddy in Uncloud 0.21 You can scale Caddy ingress across multiple machines, put it behind a load balancer and still get all your certificates automatically issued by Let's Encrypt. Caddy instances share ACME tokens through the cluster storage so any instance can answer a challenge. Once one gets a certificate, the others can use it too. Distributed locks coordinate issuance across machines. It's opt-in for now but planning to make it the default after thorough production testing. I bet this is the easiest way to run a highly available Caddy without using an external storage. This took me so much longer to implement than I anticipated but I can't get enough of this complex but beautiful world of leaderless distributed systems. As always my goal is to turn all that complexity into something simple to use. I'm glad we now have distributed locks we can use to coordinate concurrent operations in so many other places.

I'm starting to build the next chapter of Uncloud: Uncloud Hub 🌐 Uncloud made deploying on your own servers easy. But production only really starts when the deploy finishes. Hub is the missing dashboard and observability stack for your clusters so you can see what’s happening in production and know when something needs attention. Monitoring is the one piece of infra that has to be up exactly when something bad happens. That's why Hub is a managed service that stays up even when your servers go down. You can keep enjoying self-hosting but skip building and monitoring the monitoring. And when something does break, you can point your AI agent at the cluster and telemetry and let it troubleshoot the incident for you. This is how I plan to fund Uncloud's full-time development. I put up a page with an early access list if you want to help shape it 🙏🧵

Just shipped in Uncloud 0.20: secrets for your Compose services 🔐 Define a secret with x-command extension and then reference it as secret://name in env var. Uncloud resolves it at deploy time straight from 1Password, Bitwarden, AWS Secrets Manager, fnox, or any CLI you already use. Your prod secrets shouldn't live in your Compose file or in git.