Self-hosted PaaS for agencies: managing many client servers

• One control plane, many servers
• Client isolation
• Audit trail
• Handover
• Pricing shape
• Backups per client
• Templates
• Comparing options

Agencies have a deployment problem most product teams do not: dozens of small apps, each belonging to a different client, often on the client’s own server or cloud account. A self-hosted PaaS can turn that into one dashboard. It can also turn into a permissions mess. Here is what to check.

§One control plane, many servers

You want to connect each client’s server to a single control plane, rather than install a separate dashboard on every box. Check:

• How servers are attached (SSH key, agent, or both)
• Whether servers can sit in different providers and regions
• What happens to running apps if the control plane is down. They should keep serving.

§Client isolation

This is the part that matters most.

• Each client should be a separate project or workspace
• Developers should see only the clients they work on
• A client’s own developer may need access to their project and nothing else
• Secrets for one client must never be visible from another project

If a platform only has a single admin role, you will end up sharing credentials, which is exactly what you were trying to avoid.

§Audit trail

When a client asks “who changed the production database password in March”, you need an answer. Look for audit logs that record actor, project, action and time, and that cannot be edited by regular users.

§Handover

Clients leave. Make sure you can:

• Transfer a project, or export its configuration
• Remove the agency’s access from the client’s server cleanly
• Leave the client with documentation of what runs where

§Pricing shape

Per seat pricing punishes agencies with many developers touching many projects. Per server pricing punishes agencies with many small servers. Per project pricing, or self hosting for free, often fits better. Do the math with your real numbers.

§Backups per client

Each client’s databases should back up to storage the client controls, or at least to a separate bucket per client.

§Templates

Agencies rebuild the same stacks repeatedly: WordPress, a Next.js frontend with an API, a Laravel app. Templates or a marketplace save hours per project.

§Comparing options

Dokploy, Coolify and Peon all deploy Docker apps to your own servers. They differ in team model, audit logging and pricing. For the agency case, focus on isolation and audit features first, then on deployment features, which are similar across tools.

A feature by feature breakdown for one of these comparisons is on the Peon vs Dokploy page.

Disclosure: I work on Peon.