Self-host Cerbos
Open source, policy-based authorization solution
Deploy Cerbos on your own instance with Freehold in one click. Freehold runs the container, issues the TLS certificate, keeps your data on a persistent volume, and gives Cerbos a free Tor .onion address — with no identity check to sign up and a hard cap on what it can cost you each month.
How Cerbos runs on Freehold
Cerbos runs in its own container with its own volumes on a private network — nothing else on Freehold can reach its data or its ports.
A valid HTTPS certificate and a free Tor v3 .onion address are provisioned at deploy time. You can also run Cerbos onion-only.
Turn on automatic image updates and the container is replaced on a new release; your volumes are never touched.
Download a ZIP of Cerbos's volume data from the dashboard whenever you want. No SSH.
Metered hourly with a hard monthly ceiling. Stop Cerbos and the charges stop.
Sign up with an email or GitHub. There is no identity check to run Cerbos, at any usage level.
Questions about self-hosting Cerbos
- Do I need to verify my identity to deploy Cerbos?
- No. Freehold asks for an email and a password, or a GitHub login. There is no ID upload, phone verification, or business check to deploy Cerbos — and none introduced later as your usage grows.
- Is my Cerbos instance private?
- Each Cerbos deployment is an isolated container with its own storage on a private network. It gets a free Tor .onion address alongside its normal URL, and you can run it onion-only so it is reachable exclusively over Tor.
- How much does running Cerbos on Freehold cost?
- You pay for the hours Cerbos is actually running, metered hourly, with a hard monthly ceiling on the app so the bill can't run away. Stop the app and billing for it stops. There is no flat subscription and no setup fee.