Levelrail by GLINR STUDIOS
Docs GitHub Install
Levelrail

Use cases

Compare

Migrate from

Star on GitHub Docs Install

Use case: Agencies

With Levelrail an agency can keep client apps on its own infrastructure, hand a contractor a token that reaches exactly one app, and keep a record of who deployed what. Start with the IAM policy guide to see how scoping works.

curl -fsSL https://levelrail.com/install.sh | sudo sh
Identity and access Source on GitHub
The Cloud node providers page listing Hetzner, DigitalOcean, AWS, Azure, Google Cloud and Custom data center, each marked Not connected with a Connect button. The Cloud node providers page listing Hetzner, DigitalOcean, AWS, Azure, Google Cloud and Custom data center, each marked Not connected with a Connect button.
Per-client nodes
  • app:name IAM policies scoped to one app or database
  • Deny an explicit Deny always wins, even over root
  • 5 clouds for per-client node provisioning
  • Beta multi-node, not yet proven across a real WAN Beta

How it works

One control plane, scoped per client

A contractor token is scoped to app:client-a, so it reaches that app and nothing else. An explicit Deny wins even over root, and the audit log records who did what.

What you get

Everything this use case leans on

  • Scoped IAM policies

    Write IAM policies scoped to app:name or database:name. An explicit Deny always wins, even over root.

    Docs Source

  • Queryable audit log

    Every sensitive request is logged with actor, ability, method, path and caller surface, and you can filter the log by any of them.

    Docs

  • Group client work

    Projects, organizations and environments group each client's work and share environment variables. See managing apps at scale.

    Docs

  • Client importer

    A read-only importer with a dry run brings a client over from Coolify, Dokploy or CapRover without touching the old server. The Coolify migration guide walks through it.

    Source

  • Per-client nodes

    When a client needs its own server, provision one on Hetzner, DigitalOcean, AWS, Azure or GCP from the same control plane.

    Docs Source

In the product

What it looks like

  • The Apps page listing five apps such as edge-cache and marketing-site with health status, domains, traffic and last deployed time. The Apps page listing five apps such as edge-cache and marketing-site with health status, domains, traffic and last deployed time.
    Client apps are listed in one place, each with its own domain and status. Read the docs
  • The Nodes page showing one online node named primary marked as this server and builds only, with a banner suggesting a second node to spread load. The Nodes page showing one online node named primary marked as this server and builds only, with a banner suggesting a second node to spread load.
    Nodes are the servers apps are placed on, and more can be added. Read the docs
  • Account settings showing active sessions and an API tokens table with abilities such as read, read:sensitive and write. Account settings showing active sessions and an API tokens table with abilities such as read, read:sensitive and write.
    Tokens carry explicit abilities, which is what a per-contractor token builds on. Read the docs

Get started

From zero to running

  1. Group by client

    Put each client under a project and tag its apps with an environment.

  2. Mint scoped tokens

    Create one token per contractor with a single ability, then add an Allow policy for that client's app only.

  3. Test the boundary

    Try the token against another client's app and confirm it is refused. Do this before you hand it over.

Go deeper

Read it, run it, or read the code

Source

glincker/levelrailApache 2.0, open source

Docs

Related use cases

Weighing it against something else? Compare Levelrail with the tools below, or migrate an existing setup.

Good to know

Scope and maturity, stated plainly so you can plan around them.

  • You get scoped access, audit logs and per-client nodes. Levelrail does not include billing, metering or a customer-facing subscription layer, so it is infrastructure you operate rather than a reselling platform.
  • Access is enforced through IAM policies and roles on users and tokens. Teams and per-project membership are not built yet, so model each client with policies.
  • Single-node hosting is the tested path. Multi-node is beta: enrollment, cordon and drain are verified locally, and the WireGuard mesh has not been proven across a real WAN. The multi-node guide lists what has been tested.

Maturity differs by feature. Feature status lists what is stable, beta or behind a flag, with the evidence for each.

FAQ

Questions

Can a client or contractor see only their own app?

Yes, give their user or token an IAM policy that allows only that app. Test it with a real token before you hand it over, and see internal tools for how roles and two-factor fit in.

Can I bill clients through Levelrail?

No, there is no billing or metering layer. You can scope what each client reaches, but invoicing happens outside the project. Compare it with other tools on the alternatives page.

Run it on a server you own

One command installs the control plane. Apache 2.0, no license key and no paid tier.

curl -fsSL https://levelrail.com/install.sh | sudo sh
Install guide Quickstart