Put safer production boundaries around every workload.

Adios places managed gateways in front of public apps, keeps credentials outside source, supports runtime controls where available, and lets internal services remain non-routable.

Deploy with safer defaults Review the security model

adios.yaml · internal worker

name: billing-worker
region: de
replicas: 1
routable: false

build_cmd: go build -o worker ./cmd/worker
start_cmd: ./worker

runtime:
  name: go@1.25
  cpu: "0.5"
  memory_mb: 512
  disk_mb: 2048

secrets:
  QUEUE_URL: secret://QUEUE_URL

Example outcome

Run an internal billing worker without a public route.

Set routable: false, declare CPU and memory limits, and inject the queue URL from secret storage so the worker has only the access and resources it needs.

Reduce the public surface

Expose managed routes instead of opening application processes directly to the internet.

Reduce credential exposure

Resolve secret references only for the workload path that needs them.

Make workload boundaries explicit

Declare CPU, memory, disk, health, replica, and routing expectations with the runtime.

Why this matters

A raw server makes every production boundary your responsibility.

Public ports, TLS, credentials, resource limits, health checks, and routing decisions can become one-off configuration that is hard to review and easy to drift.

What changes with Adios

Reduce the public and operational surface of every workload

Put the gateway in front, keep credentials out of Git, use explicit resource settings, and make internal services non-routable when they do not need public traffic.

How it works

Reduce exposure before the workload starts.

Step 01
Deploy behind the Adios gateway.
Step 02
Use secret:// references for sensitive config.
Step 03
Run workloads with runtime boundaries and inspectable deploy state.

A real use case

Run an internal billing worker without a public route.

Set routable: false, declare CPU and memory limits, and inject the queue URL from secret storage so the worker has only the access and resources it needs.

Gateway-before-runtime traffic model

Non-routable internal services

Explicit CPU, memory, disk, replica, and health settings

Runtime controls where supported

Connected pathReady

01
Gateway
Managed public boundary
02
Release
Versioned deploy state
03
Runtime
Managed application process
04
Secrets
Resolved outside source

Start here

Make the workload boundaries explicit before production.

Put the gateway in front, keep secrets outside source, and declare the routing and resource settings the process should have.

Deploy with safer defaults

Keep building

The next pieces usually connected to this one.

View all features

Secrets & Environment Variables

Commit secret:// references so required credential names remain visible while their values are stored separately, then resolved for the runtime or workflow that needs them.

Explore →

Custom Domains & TLS

Declare custom hosts and whole-host redirects with the app. After DNS verification, Adios serves the TLS route and keeps the hostname attached to the promoted current release.

Explore →

Observability & Logs

Build logs, runtime logs, source artifacts, versions, replica health, routes, and workflow runs stay connected in the same deployment path.

Explore →