Deploy a repository
Connect a Git repository, choose how it builds, and run your first deploy.
An app in VAC is one Git repository plus its build configuration, environment variables, and domains. Creating one and deploying it takes a minute.
Create an app
In the dashboard, click New app and provide:
| Field | Notes |
|---|---|
| Name | Human-readable. Required. |
| Slug | URL-safe identifier (a-z, 0-9, hyphens). Derived from the name if you leave it blank; must be unique. It becomes the app's subdomain and the prefix of its container aliases. |
| Git URL | HTTPS or SSH (see below). Required. |
| Branch | Defaults to main. |
| Compose file | Optional path; defaults to auto-detection. See Build settings. |
Repository access
VAC supports two authentication models:
Public HTTPS
Just paste the https://… URL. No credentials are stored — this works for any publicly
readable repository.
https://github.com/you/app.gitSSH with a deploy key
For private repositories, use an SSH URL. VAC generates a dedicated ED25519 deploy key per app and shows you the public half — add it to your repository's deploy keys (read-only is fine).
git@github.com:you/app.gitEach app gets its own keypair. The private key is encrypted with the master key and never leaves the box. You can rotate it any time (a fresh key is minted and the old one discarded) or delete it. Use Test connection to confirm VAC can reach the repo before deploying.
Private repositories over HTTPS with a username and token are not supported — use an SSH deploy key for private repos. Public HTTPS needs no credentials.
Run a deploy
Hit Deploy. VAC walks an ordered pipeline, streaming logs the whole way:
- Clone / pull the branch (or check out a pinned commit on a rollback).
- Resolve the build into a Compose file (detect or use your configured build kind).
- Preflight the Compose for unsafe or unroutable configuration.
- Render
.env— your secrets, decrypted into a Compose env file. - Build —
docker compose build. - Up —
docker compose up -d. - Detect services — record containers, ports, volumes.
- Sync routes to Caddy over
vac-edge. - Health-check — wait for Caddy to report the new upstreams healthy.
- Running — settle, or land in
error/degraded.
The deployment captures the commit SHA and message so you always know exactly what's live.
If any stage fails, the previously running version keeps serving. VAC records the failure as error (build/preflight failure) or degraded (came up but didn't pass health checks) — it never tears down a working stack.
Redeploy, rollback, cancel
- Redeploy — trigger a fresh deployment of the current branch any time (the Deploy button). Only one deployment per app runs at a time; a second request while one is active is rejected.
- Rollback — redeploy a previous successful deployment. VAC pins its commit SHA and checks it out, so you get exactly that version back.
- Cancel — stop an in-progress deployment.
Deploy on push
To deploy automatically on git push, configure the app's inbound webhook and a deploy
trigger (a branch or tag pattern). See Webhooks.
Multi-service apps
If your Compose file defines several services (web, worker, db…), VAC deploys them all.
Services that expose an HTTP port get routed and health-checked; the rest run as background
workers with no route. See Build settings for how
ports and routing are determined.