Yundera is a managed self-hosting platform. You pick a hosting provider like Hetzner, Contabo, or Scaleway, and Yundera sets up and manages the entire server for you. Install apps with one click, get automatic domains and HTTPS, and pay one flat monthly price with no per-app or per-user fees.

Is Yundera real self-hosting?

Yes. Your data lives on your server at your chosen hosting provider. Yundera handles server management, domains, and reachability. Your app traffic goes directly to your server. Only behind CGNAT does traffic travel through an encrypted WireGuard tunnel.

How is Yundera different from Cloudron or YunoHost?

Cloudron and YunoHost are software you install on a server you provision and maintain yourself. Yundera manages the entire server for you — you just pick apps. No SSH, no Docker, no SSL renewals, no Linux administration required.

Is my traffic encrypted?

Yes. All traffic is encrypted with HTTPS (TLS). Use sslip.io for true end-to-end encryption, or nsl.sh subdomains for convenient encrypted-in-transit access.

Can I use my own domain?

Yes. Point any domain at your server using a Cloudflare CNAME record or a direct A record.

Where is my data stored?

All data stays on your server at your chosen hosting provider. Nothing is stored on Yundera servers.

What apps can I install?

Nextcloud, Immich, Jellyfin, Vaultwarden, n8n, Ghost, Docmost, Uptime Kuma, and 100+ more. All install with one click and get automatic domains and HTTPS.

Do I need technical knowledge?

No. Apps install with one click. Domains and HTTPS are automatic. Advanced users can SSH in and customize everything.

What if Yundera servers go down?

Your apps and data remain on your server. Local network access continues. Only nsl.sh domains would be temporarily unavailable.

Is NSL.SH open source?

Yes. NSL.SH is the open-source networking layer that provides automatic domains and HTTPS. Fully open source on GitHub at github.com/Yundera/mesh-router-root. Uses WireGuard.

How much does Yundera cost?

Starting from EUR 11.99/month depending on the hosting provider you choose. One flat price includes server management, all apps, all users. No per-app or per-user fees.

Which hosting providers does Yundera support?

Hetzner, Contabo, Scaleway, Vultr, and others. You pick the provider and plan. Yundera publishes benchmarks on 1,247 servers from 38 providers to help you choose.

How do I backup my data?

All data is under /DATA/. Use rsync to copy to USB or remote server. Automatic daily backups via cron.

Can I migrate from other platforms?

Yes. Export data from your current platform, install the same app on Yundera, copy data to /DATA/AppData/.

Is Yundera GDPR compliant?

All data stored on your server at your chosen provider. Yundera servers never store personal data. Aptero SAS is headquartered in Paris under EU law.

Glossary

Canonical definitions for terms used throughout this documentation.

Term	Definition
PCS	Personal Cloud Server — your machine running the Yundera software stack and your installed apps.
NSL.SH	The open-source mesh network that provides automatic domains, TLS, and reachability for Yundera PCS instances.
mesh-router	The component handling SSL termination and dynamic domain resolution on your PCS. Sets up WireGuard tunnels when direct connectivity is unavailable.
AppShield	An authentication sidecar container that provides SSO (Single Sign-On) across apps on your PCS. Formerly called `nginx-hash-lock`.
casa-img	Yundera's custom distribution based on CasaOS, providing the app runtime and dashboard.
Domain shape	`{subdomain}.{user-domain}.{server-domain}` — e.g., `immich.john.nsl.sh`.
sslip.io address	`{dashed-public-ip}.sslip.io` (e.g., `203-0-113-42.sslip.io`). Your PCS's direct address and the only path with strict end-to-end TLS.
Custom domain	Your own domain pointed at your PCS via Cloudflare CNAME or a direct A record. See Use Your Own Domain.
Control plane	Domain resolution and verification — always transits the NSL.SH backend. This is what gives you automatic domains and TLS.
Data plane	Your actual app traffic. Goes directly to your PCS when reachable, or through an encrypted WireGuard tunnel when behind CGNAT.
Provider / Requester	The two roles in a WireGuard tunnel between PCS instances.
CGNAT	Carrier-Grade NAT — when your ISP shares a single public IP among many customers, making direct inbound connections impossible without a tunnel.
App Store	The curated collection of Docker-based apps available for one-click install on your PCS. Source: Yundera/AppStore.
AppStoreLab	Staging repository for testing apps before they are promoted to the production App Store.