Free plan

Push a repo.
Share it with a circle.

kitshn deploys your GitHub repos to Cloudflare and to your own machines. One map decides who can open each app: drag its card into a circle, and Cloudflare Access does the rest.

Install kitshn How it works See it live

On the pass

Live right now

Asking kitshn for the public apps…

Git

Deploys from git

A push to main deploys production. A pull request gets its own preview address, and the preview goes away when the pull request closes.

Who

One map for access

Circles hold people, email domains, devices and networks. A card inside a circle is shared with it. kitshn turns that into Cloudflare Access, so a check costs nothing.

Where

Cloudflare and your machines

Static sites and Worker apps run on Cloudflare. Compose apps run on your own machines through a tunnel, with no open ports.

Two circles on the kitshn map, Everyone and Her, with cards inside them — tick3d sits in Everyone, so it opens with no login.

The map

Circles say who

Each circle is a group: an email, a domain such as @qlik.com, a phone, a machine, an IP range, or everyone. Circles overlap freely. A card counts for every circle that it sits in.

A circle can ask for a passkey after the login. The Owner circle always does, and it holds the kitshn admin card.

Share

Drag to share, see it first

While you drag a card, every circle edge lights up and a label says what changes, such as + Her · view. The drop applies it. A toast offers Undo, and History keeps every change.

A card that enters a public circle asks first.

A card dragged from Everyone into the Her circle, with the labels “− Everyone” and “+ Her · view” — The preview before the drop.

Apps

Three kinds of apps

A recipe, kitshn.config.ts, names one kind. A repo can hold up to 10 apps.

Kind	Runs on	Good for
static	Workers static assets. Requests are free.	Sites, docs, a résumé, a trip plan
worker	A Cloudflare Worker with KV, Durable Objects and crons	Small APIs and apps with state
compose	Docker Compose on your machine, behind its tunnel	Anything in a container: bots, databases, big apps

Deploy

From a push to a live app

A push runs GitHub Actions. Actions sends the recipe and its OIDC token to the kitshn Worker. The app goes to Cloudflare or to a machine, and its card gets Access from its circles.

The repo needs no secret: GitHub signs each run with an OIDC token, and kitshn trusts only the GitHub accounts on its list. kitshn never runs the recipe. It reads it as data. Read how it works.

Details

Every card says who can open it

Select a card to see each circle that holds it, the members, the level and the address. Change the level for one circle, or set an end date: a share for a guest can end after a week.

The map works on a phone too. One finger pans, a long press opens the menu, and two fingers zoom.

The card panel of the riffle app: its address, deploys allowed, and who can open it

The kitshn offline page: “The kitchen is closed.” with the site, the reason and a Knock again button

Machines

Your machines, on the map

A small daemon joins each machine with one command. It runs the tunnel, deploys Compose apps in rootless Docker, and shares local dev servers as live sites.

When a machine is off, visitors get this page instead of an error. It costs a Worker request only while the site is down.

Start

Set it up in one command

You need a free Cloudflare account with a domain, and a GitHub account.

curl -fsSL https://kit.yarden-zamir.com/install | \
  CLOUDFLARE_API_TOKEN=... \
  KITSHN_HOST=kit.example.com \
  KITSHN_OWNER_EMAILS=you@example.com \
  KITSHN_DEPLOY_OWNERS=your-github-name sh

All install steps

Push a repo.Share it with a circle.