Kubernetes, operated by people and agents.
A project is a namespace, a domain and its own gateway. Build from git, deploy, clone the whole environment, and size it to what it actually uses — from the web app, from your terminal, or from an agent speaking MCP.
Running in production today: OVH · Kubernetes · OpnSense HAProxy
Six things to learn. That is the whole model.
Nothing is hidden behind a magic abstraction. Each primitive maps onto something that already exists in your cluster.
Project
Your unit of isolation: a namespace, a subdomain, and its own NGINX gateway. Variables, secrets, certificates and quota live here.
namespace + domain + gateway
Image
A registry entry and its versions. It comes from one of your builds, or from a public image such as postgres.
registry + versions
Build plan
How a repo becomes an image: git source, staged Dockerfile, build arguments, injected config files, automatic versioning.
git → image
Service
A running container: replicas, resource tier, volumes, sidecars and routes. Scaling to zero stops it without losing anything.
deployment + service + routes
Workflow
A pipeline of steps with dependencies. Six step types: BUILD, SERVICE_UPDATE, SERVICE_DEPLOY, WEBHOOK, COMMAND and CUSTOM.
steps + variables
Webhook
Registers itself with GitHub, GitLab, Gitea or Bitbucket, and turns a push, tag, PR or comment into variables for a workflow.
git event → workflow
Where a request actually goes
No shared ingress controller, no magic. HAProxy on OpnSense spreads traffic across the worker nodes, and every project owns the NGINX in front of its services.
-
01
Proxied (default)
HTTP arrives through the project gateway. Several services share one domain and one certificate, each on its own path. -
02
Public port
WebSocket, gRPC, MQTT or anything that is not HTTP: a dedicated NodePort and its own subdomain, bypassing NGINX. -
03
Internal only
Databases and caches: ClusterIP, reachable only from inside the project's namespace. -
TLS
Certificates
Instant wildcard on the default domain; Let's Encrypt for your own domains, renewed automatically before expiry.
From a push to production
The webhook registers itself, the build runs on the cluster, the deploy rolls. You can follow all of it live from your terminal.
Builds you do not repeat
Source is fetched by commit SHA, tag or branch, in that order. Automatic versioning per plan, build arguments, and config files injected at build time.
$ hf build logs 6a874f53 -f Step 2/4 · Building image… Step 4/4 · Pushing to registry
Deploys without a maintenance window
Rolling update by default, or Recreate when a service mounts a volume that cannot take two writers. Health checks, replicas and strategy stay yours.
$ hf scale api 3 $ hf logs api -f --grep error
Reserved against used
The platform keeps a usage history and tells you which service is oversized and which is starved, naming the tier change to make.
$ hf advice api downgrade large → medium worker upgrade micro → small
Built to be driven by something other than a mouse
One API serves the web app, the CLI and an agent. A Claude Code agent operates a whole project through 135 MCP tools: build, deploy, read logs, diagnose, pause.
The CLI
One line to install. Coloured tables to read, exact JSON for pipes, streaming logs, and an interactive session that completes your own service names.
$ curl -fsSL https://www.hasslefree.tech/cli/install.sh | bash $ hf login && hf project join shop $ hf ps -q | xargs -n1 hf service restart
Agents over MCP
Every project exposes its own MCP server behind a project API key. The agent sees that project and nothing else: its services, its builds, its logs.
- Build and deploy, waiting on the build
- Read logs and troubleshoot a failing service
- Spin up an ephemeral environment for a branch
- Pause a whole project, and resume it
Copies of the environment, not approximations
A clone brings the services, the variables, the routes and — if you ask for it — the data, restored from volume snapshots.
Ephemeral environments
One copy per branch, with its own domain and a TTL. It cleans itself up when it expires, and you can extend it while you still need it.
Project templates
Export a whole project to YAML and apply it elsewhere. Private values never travel in the file — the import asks you for them.
Pause
A paused project scales everything to zero and stops reserving CPU and memory. Volumes, routes, variables and configuration stay exactly as they were.
Isolation, per project
Encrypted secrets
Sensitive variables are encrypted per project with AES-256 and injected at deploy time. They are absent from API responses, and from any exported template.
Team access
Each project has an owner and collaborators with an admin, write or read role. Write covers deploying; read does not. Which clusters an account can use is decided by its tier.
Federated identity
Sign-in is authenticated against BitBot and verified through JWKS. Agents use tokens scoped to one project and one tool, never your session.
Tell us what you want to run
There is no self-service sign-up yet. Write to us with what you need to run, and we will set you up with a project on the cluster, over a short call.
- hello@hasslefree.tech
- Console
- robot.hasslefree.tech
- CLI
- curl -fsSL …/cli/install.sh | bash