Thanks to the sponsors:

☁️ Cosmos is the most secure and easy way to self-host a Home Server. It acts as a secure gateway to your application, as well as a server manager. It aims to solve the increasingly worrying problem of vulnerable self-hosted applications and personal servers.

Whether you have a server, a NAS, or a Raspberry Pi with applications such as Plex, HomeAssistant or even a blog, Cosmos is the perfect solution to run and secure them all. Simply install Cosmos on your server and connect to your applications through it to enjoy built-in security and robustness for all your services, right out of the box.

Cosmos is:

• App Store 📦📱 To easily install and manage your applications, with simple installers, automatic updates and security checks. This works alongside manual installation methods, such as importing docker-compose files, or the docker CLI
• Storage Manager 📂🔐 To easily manage your disks, including Parity Disks and MergerFS
• Network Storages 📡📂 Based on RClone, To easily manage your network storages, including accessing remote ones (ex. Dropbox) or share NFS / FTP / ... from the UI, protected by the smart shield
• Reverse-Proxy 🔄🔗 Targeting containers, other servers, or serving static folders / SPA with automatic HTTPS, and a nice UI
• Authentication Server 🔐👤 With strong security, multi-factor authentication and multiple strategies (OpenId, forward headers, HTML)
• Customizable Homepage 🏠🖼 To access all your applications from a single place, with a beautiful and customizable UI
• Container manager 🐋🔧 To easily manage your containers and their settings, keep them up to date as well as audit their security. Includes docker-compose support!
• VPN 🌐🔒 To securely access your applications from anywhere, without having to open ports on your router.
• Backups 📦🔒 To easily backup your applications, with incremental backups, encryption, and remote backups. Using Restic under the hood
• Monitoring 📈📊 Fully persisting and real-time monitoring with customizable alerts and notifications, so you can be notified of any issue.
• Identity Provider 👦👩 To easily manage your users, invite your friends and family to your applications without awkardly sharing credentials. Let them request a password change with an email rather than having you unlock their account manually!
• SmartShield technology 🧠🛡 Automatically secure your applications without manual adjustments (see below for more details). Includes anti-bot and anti-DDOS strategies. Now includes TCP protection (FTP, SSH, Games, ...)
• CRON 🕒🔧 To easily schedule tasks on the server or inside containers

It has been built to be:

• Easy to use 🚀👍 to install and use, with a simple web UI to manage your applications from any device
• Powerful 🧠🔥 Being easy does not mean being dumb: while Cosmos is easy to use, it is also powerful and flexible, you can even use it from the terminal if you want to!
• User-friendly 🧑‍🎨 For both new and experienced users: easily integrates into your existing home server, the already existing applications you have, and the new ones you want to install
• Secure 🔒🔑 Connect to all your applications with the same account, including strong security, multi-factor authentication and OpenId. Cosmos encrypt your data and protect your privacy. Security by design, and not as an afterthought
• Anti-Bot 🤖❌ Collection of tools to prevent bots from accessing your applications, such as common bot detection, IP based detection, and more
• Anti-DDOS 🔥⛔️ Additional protections such as variable timeouts/throttling, IP rate limiting and geo-blacklisting
• Modular 🧩📦 to easily add new features and integrations, but also run only the features you need (for example No docker, no Databases, or no HTTPS)

And a lot more planned features are coming!

What are the differences with other alternatives?

Cosmos has a few key differences with other alternatives such as YunoHost, Unraid, etc...

<table border="1" cellpadding="10" cellspacing="0" style="margin-left: auto; margin-right: auto;">
    <thead>
        <tr>
            <th>Feature</th>
            <th>Cosmos</th>
            <th>Unraid</th>
            <th>Yunohost</th>
            <th>CasaOS</th>
            <th>Cloudron</th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>Reverse Proxy</td>
            <td>✅</td>
            <td>❌</td>
            <td>✅</td>
            <td>❌</td>
            <td>~ *</td>
        </tr>
        <tr>
            <td>Container Management</td>
            <td>✅</td>
            <td>~ *</td>
            <td>❌</td>
            <td>~ *</td>
            <td>❌</td>
        </tr>
        <tr>
            <td>Automatic HTTPS</td>
            <td>✅</td>
            <td>❌</td>
            <td>❌</td>
            <td>❌</td>
            <td>✅</td>
        </tr>
        <tr>
            <td>Multi-users</td>
            <td>✅</td>
            <td>✅</td>
            <td>✅</td>
            <td>❌</td>
            <td>✅</td>
        </tr>
        <tr>
            <td>2FA</td>
            <td>✅</td>
            <td>❌</td>
            <td>❌</td>
            <td>❌</td>
            <td>✅</td>
        </tr>
        <tr>
            <td>OpenID/SSO</td>
            <td>✅</td>
            <td>❌</td>
            <td>❌</td>
            <td>❌</td>
            <td>~ *</td>
        </tr>
        <tr>
            <td>App Store</td>
            <td>✅</td>
            <td>✅</td>
            <td>✅</td>
            <td>✅</td>
            <td>✅</td>
        </tr>
        <tr>
            <td>Docker Compose support</td>
            <td>✅</td>
            <td>✅</td>
            <td>❌</td>
            <td>✅</td>
            <td>✅</td>
        </tr>
        <tr>
            <td>File manager</td>
            <td>❌</td>
            <td>✅</td>
            <td>❌</td>
            <td>✅</td>
            <td>❌</td>
        </tr>
        <tr>
            <td>Anti-bot / anti-DDOS</td>
            <td>✅</td>
            <td>❌</td>
            <td>❌</td>
            <td>❌</td>
            <td>❌</td>
        </tr>
        <tr>
            <td>VPN</td>
            <td>✅</td>
            <td>~ **</td>
            <td>❌</td>
            <td>❌</td>
            <td>❌</td>
        </tr>
        <tr>
            <td>Monitoring (w/ historical data & alerts)</td>
            <td>✅</td>
            <td>❌</td>
            <td>❌</td>
            <td>❌</td>
            <td>❌</td>
        </tr>
        <tr>
            <td>Hard VM Management</td>
            <td>❌</td>
            <td>✅</td>
            <td>❌</td>
            <td>❌</td>
            <td>❌</td>
        </tr>
    </tbody>
</table>

• denotes support limited to apps installed with the software itself

** Wireguard only. Does not support meshing or bypassing CGNAT

• Security: Cosmos has a unique strong focus on securing your application with exclusive features such as the smart-shield. It has 2FA, OpenID, anti-DDOS, and other security features built-in. It also has a strong focus on privacy, with the latest encryption methods and a strong focus on data protection. Unlike any other solutions, it assumes the software you run are not trustworthy, and protects you from them.
• Power-user friendly: Some of those alternatives can feel a bit "limiting" to someone who knows what they are doing. On the other hand, while Cosmos is designed to be easy to use, it is also powerful and flexible. It is designed to be used by both new and experienced users, and to integrate into your existing home server, the already existing applications you have, and the new ones you want to install. It can even be used from the terminal if you want to!
• Flexible: Unlike the alternatives, Cosmos is not exclusively focused around its app-store. Instead, it lets you freely install any application any way you want, and manage them from the UI, from Portainer, or from docker directly. Any of those applications will still be integrated into Cosmos and will also benefit from all the security features, Let's Encrypt, etc..
• Learning experience: If you are new to self-hosting, using a software that hides all the complexity from you can prevent you from learning how to properly manage your server. Cosmos is designed to be easy to use, but also to be a learning experience. It does not hide things away but instead guides you and incentivizes learning more about the tools you are using.
• No vendor-locking: Unlike solution that tightly couple their applications to the containers, Cosmos can manage apps created from anywhere all the same, and converting an existing container to a Cosmos app is as simple as adding a URL in the UI. You can also migrate out of Cosmos at any time, as it only uses vanilla docker containers.

You might also wonder about cloudflare proxy and cloudflare tunnel when it comes to security. But unlike popular beliefs those are not solutions on their own as:

• While they protect your remote access to your applications, they leave your origin server completely unprotected. A rogue device / application in your local network would have no troubles taking advantage of it
• Those options let Cloudflare see your entire network unencrypted. Yes, even if you use HTTPS: Cloudflare proxy de-encrypt your traffic, to re-encrypt it. Meaning that everything that goes through your traffic is plain readable text to Cloudflare. On the other hand, Cosmos is self-hosted so you stay in control of your data.

SDK and Terraform

A JavaScript/TypeScript SDK is available for programmatic access to the Cosmos API. See the JS SDK documentation for installation, usage, and examples.

The GO SDK can be found in the go-sdk folder and used with Go SDK documentation

Finally a Terraform provider is available to fully automate your setup: Terraform documentation

What is the SmartShield?

SmartShield is a modern API protection package designed to secure your API by implementing advanced rate-limiting and user restrictions. This helps efficiently allocate and protect your resources without manual adjustment of limits and policies.

Key Features:

• Dynamic Rate Limiting ✨ SmartShield calculates rate limits based on user behavior, providing a flexible approach to maintain API health without negatively impacting user experience.
• Adaptive Actions 📈 SmartShield automatically throttles users who exceed their rate limits, preventing them from consuming more resources than they are allowed without abruptly terminating their requests.
• User Bans & Strikes 🚫 Implement temporary or permanent bans and issue strikes automatically to prevent API abuse from malicious or resource-intensive users.
• Global Request Control 🌐 Monitor and limit with queues the total number of simultaneous requests on your server, ensuring optimal performance and stability.
• User-based Metrics 📊 SmartShield tracks user consumption in terms of requests, data usage, and simultaneous connections, allowing for detailed control.
• Privileged Access 🔑 Assign privileged access to specific user groups, granting them exemption f