v2.16.0 · EdgeOps live

Route safely.
Recover quickly.

NPM Edge gives your self-hosted services a clean public front door: reverse proxy hosts, TLS termination, access policies, and one-click recovery for the configuration that keeps your network reachable.

Get started Docs

$ git clone https://github.com/innotelinc/npm.git && cd npm && cp .env.example .env && docker compose up -d --build

80 / 443public HTTP + HTTPS edge

Let's Encryptcertificate automation

MariaDBdurable NPM state

Backup UIsnapshot + restore

The edge layer you can own.

Keep routing and TLS simple, visible, and recoverable without handing your edge configuration to a hosted control plane.

🌐

Reverse proxy

Forward domains, redirections, streams and custom Nginx policies from one admin surface.

🔐

TLS termination

Use Let's Encrypt or custom certificates and attach them to the hosts that need them.

👥

Access lists

Apply optional HTTP authentication and allow/deny controls before traffic reaches an app.

💾

Recoverable state

Back up the database, NPM configuration and certificate material together.

⏱️

Scheduled backups

Run nightly snapshots with rolling retention, then download them for independent storage.

⚠️

Explicit restore

Validate an archive and confirm a destructive restore before replacing live edge state.

The EdgeOps layer of the stack.

NPM Edge owns routing and TLS at the boundary; Cerulean owns DNS and trust lifecycle, Authentik owns identity, Cerulean Vault owns secrets, and applications own their data.

🛡️

NPM Edge

Proxy hosts, TLS, access lists and generated Nginx configuration.

🗃️

MariaDB

NPM users, hosts, certificates, settings and audit metadata.

💾

backup-ui

Database + /data + Let's Encrypt snapshots and restores.

# deploy the complete edge component
$ cp .env.example .env
$ docker compose up -d --build
>> [npm] admin → host port 81
>> [backup-ui] recovery → host port 82
>> [edge] HTTP/S → ports 80 / 443

Local BIND when bundled.

Cerulean starts this complete NPM Edge component only when BIND_MODE=local and NPM_MODE=local. Remote-BIND deployments use an external NPM instance instead.

Public edgeports 80 + 443 · proxy hosts and TLSactive NPM adminport 81 · users, hosts, certificates, ACLslocal only Backup UIport 82 · snapshots and explicit restoreprotected DocumentationVitePress guides · setup and operationsopen

Roadmap.

A stable edge component today, with stronger platform integrations next.

v2.16.0"EdgeOps"

NPM, MariaDB, TLS, proxy hosts and backup-ui recovery companion.

done

Next"Integrations"

Documented Cerulean certificate workflows and Cerulean Vault secret rendering.

LTS"Hardened"

Operational hardening, backup restore drills and long-term support channel.

later

Route safely.Recover quickly.