Your servers, run by an agent.
With a record that answers why.
Cloudfall is the operator's record for a small fleet run by an AI agent. It moves your applications and data onto one or two servers you own — hardened baseline, monitoring, health-gated deploys with rollback, a real DNS cutover — and an always-on operator runs them there. Every operation is verified, every decision leaves evidence: what the fleet looked like, what was proposed, who approved, what happened. Plain systemd and nginx. No Kubernetes.
$ uv run cloudfall import render render.yaml --application acme --server h1 $ uv run cloudfall migrate --build web=main --yes ✓ baseline converge every server to the managed baseline ✓ services converge every declared infrastructure service ✓ data:acme-db migrate external data with row-count verification ✓ build:web build a release artifact for web ✓ deploy:web deploy web behind its health gate ✓ domains-http render every declared domain route over HTTP ⏸ dns-verify paused: point acme.example.com at your server, then resume $ uv run cloudfall migrate --yes # resume after the DNS flip ✓ dns-verify public DNS points at the declared proxy servers ✓ domains-tls Let's Encrypt issued, HTTPS routes enabled ✓ inspect read-only server evidence collected ✓ audit compliant: config matches the observed servers ✓ verify-routes every declared route healthy over HTTPS
Proven live, not promised. The full journey ran on disposable
Hetzner servers: an application actually hosted on Render was cut over with its
data and a real TTL-lowered DNS flip on an owned domain, resuming to byte-identical
responses from the Cloudfall host, with a deliberately bad release rolled back
automatically along the way — the entire run driven by an AI agent through
cloudfall-mcp alone. The operator then remediated an induced failure
with a single approval, remediated the next identical failure autonomously under
declared policy in 2m06s, proved a real backup restorable in a timer-driven drill,
and delivered an alert to a second machine across the public network, receipts
throughout.
Read the proving-run reports
An operator that can't fake success
Agents can already run your servers. What they lack is a record: what they may do, whether it worked, and why they did it. Cloudfall is that record, and it happens to make leaving the cloud safe too.
A record that answers why
An agent's own log says a tool was called. Cloudfall's record says what the fleet looked like when it was, what was proposed, who approved, and what verify reported. After an incident, that is the page you open.
Verified, not just ran
Deployments produce receipts. Status is derived from validated
observations, and cloudfall audit reports drift between
your config and the observed servers with distinct exit codes.
Cloudfall never reports success it cannot prove.
Good-enough databases, with proof
Managed Postgres is mostly insurance. Cloudfall keeps the coverage and drops the premium: loopback PostgreSQL and Redis with receipted backups and timer-driven restore drills that prove a real backup restorable instead of assuming it.
Autonomy earned, never assumed
The always-on operator diagnoses from evidence and proposes fixes
you approve through the cloudfall-mcp confirmation
handshake. Autonomy is granted per operation class, licensed by
declared policy and earned receipt history; DNS cutover, data
deletion, and promotion always require your confirmation.
The bill buys computers, not margins
A steady cloud bill is mostly margin on commodity compute and managed databases. The same workload runs on one or two Hetzner-class servers for a tenth of the price, and the difference is runway, every year.
systemd, not containers
Applications run as native systemd services with artifact releases and symlink rollback on long-lived Debian servers. It is all plain systemd, nginx, and Postgres, so any Linux admin can take over without Cloudfall. No lock-in if you ever hire one.
From render.yaml to your own server
One resumable migration: it pauses where you must act and picks up exactly where it left off.
Import
cloudfall import render maps your Render blueprint onto
typed Cloudfall config with an explicit gap report. Nothing is
guessed silently.
Migrate
cloudfall migrate converges the baseline and services,
migrates your data with row-count verification, deploys behind
health gates, and pauses at DNS verification before issuing TLS.
Operate
Cut DNS and the bill starts buying computers. The always-on operator watches declared alerts and audited drift, remediates what its record proves reversible, and writes an audit entry for every decision; you approve only what can't be undone.
Pre-1.0, honestly labeled
Cloudfall is early. Here is exactly where it stands.
Implemented and proven live
- Hardened Debian baseline, nftables firewall, UTC time
- Loki / Grafana / Alloy logging with metrics and declared alert rules over mTLS
- Loopback PostgreSQL and Redis with timer-driven restore drills
- Health-gated deploys with automatic rollback of bad releases
- Let's Encrypt TLS and nginx routes from declared domains
- Render blueprint and live-API importers with guided data migration
- Resumable migrate with a real DNS cutover on an owned domain
cloudfall-mcpagent server with confirm-gated writes- sops/age secret references rendered to per-component env files
- Always-on operator: receipted proposals, policy-bounded autonomy
Not there yet
- Bare-metal RAID and storage provisioning
- Broader service catalog: MySQL, Elasticsearch, RabbitMQ, Node runtimes
- Enforced per-component resource limits for shared nodes
- Importers beyond Render
- Your existing Ansible inventory and playbooks as the config and the agent's tool list: design written, nothing built